diff --git a/.github/scripts/ci_changes.py b/.github/scripts/ci_changes.py index 3ede1d963..94ab3eca5 100644 --- a/.github/scripts/ci_changes.py +++ b/.github/scripts/ci_changes.py @@ -76,6 +76,174 @@ ".github/workflows/release-candidate-cleanup.yml", } ) +REPO_ROOT = Path(__file__).resolve().parents[2] +STANDARD_JOURNEY_MANIFEST = ( + REPO_ROOT / "docs/site/src/data/standard-journeys.yaml" +) +AUTHORING_REFERENCE_MANIFEST = ( + REPO_ROOT / "docs/site/scripts/authoring-reference-sources.json" +) + + +def standard_journey_sources( + manifest_path: Path = STANDARD_JOURNEY_MANIFEST, +) -> frozenset[str]: + """Extract the exact canonical source paths from the journey manifest. + + The manifest owns this routing inventory. Keeping the deliberately small + parser here avoids adding a YAML dependency to the CI classifier. + """ + + sources: list[str] = [] + in_canonical_sources = False + for line in manifest_path.read_text(encoding="utf-8").splitlines(): + if line == " canonical_sources:": + in_canonical_sources = True + continue + if in_canonical_sources and line.startswith(" - "): + source = line.removeprefix(" - ").strip() + if ( + not source + or source[0] in {"'", '"', "{", "["} + or source.startswith(("/", "../")) + ): + raise ValueError( + "standard journey canonical_sources must contain " + f"unquoted repository-relative paths: {source!r}" + ) + sources.append(source) + continue + if in_canonical_sources and line and not line.startswith(" "): + in_canonical_sources = False + + if not sources: + raise ValueError( + f"no standard journey canonical_sources found in {manifest_path}" + ) + return frozenset(sources) + + +STANDARD_JOURNEY_SOURCES = standard_journey_sources() + + +def authoring_reference_contract_sources( + manifest_path: Path = AUTHORING_REFERENCE_MANIFEST, +) -> tuple[str, ...]: + """Derive repository inputs from the published reference source contract.""" + + manifest = json.loads(manifest_path.read_text(encoding="utf-8")) + schema_sources = manifest.get("schema_sources") + field_knowledge = manifest.get("field_knowledge") + human_intent = manifest.get("human_intent") + runtime_intent = manifest.get("runtime_intent") + if ( + not isinstance(schema_sources, list) + or not schema_sources + or not all(isinstance(source, str) and source for source in schema_sources) + or not isinstance(field_knowledge, str) + or not field_knowledge + or not isinstance(human_intent, str) + or not human_intent + or not isinstance(runtime_intent, list) + or not runtime_intent + or not all(isinstance(source, str) and source for source in runtime_intent) + ): + raise ValueError( + f"authoring-reference manifest has an invalid source contract: {manifest_path}" + ) + + sources = [ + ( + f"schemas/{source}" + if source.startswith("registry-") + else f"crates/registryctl/schemas/project-authoring/{source}" + ) + for source in schema_sources + ] + for source in (field_knowledge.split("#", 1)[0], human_intent): + sources.append( + source if source.startswith("crates/") else f"crates/registryctl/{source}" + ) + sources.extend(runtime_intent) + if any(source.startswith(("/", "../")) for source in sources): + raise ValueError( + "authoring-reference source contract must use repository-relative paths" + ) + if len(sources) != len(set(sources)): + raise ValueError("authoring-reference source contract paths must be unique") + return tuple(sources) + + +def validate_authoring_reference_routing( + contract_sources: tuple[str, ...], + inputs: tuple[tuple[str, str], ...], +) -> None: + """Fail when a source-contract input can change without rebuilding docs.""" + + missing = [ + source + for source in contract_sources + if not any(fnmatch.fnmatchcase(source, pattern) for pattern, _ in inputs) + ] + if missing: + raise ValueError( + "authoring-reference CI inputs do not route source-contract paths: " + f"{missing}" + ) + + +def authoring_reference_inputs( + manifest_path: Path = AUTHORING_REFERENCE_MANIFEST, +) -> tuple[tuple[str, str], ...]: + """Load the authoring-reference CI routing inventory from its owner.""" + + manifest = json.loads(manifest_path.read_text(encoding="utf-8")) + inputs = manifest.get("ci_inputs") + if not isinstance(inputs, list) or not inputs: + raise ValueError( + f"authoring-reference manifest has no ci_inputs: {manifest_path}" + ) + + parsed: list[tuple[str, str]] = [] + for index, entry in enumerate(inputs): + if not isinstance(entry, dict): + raise ValueError( + f"authoring-reference ci_inputs[{index}] must be an object" + ) + pattern = entry.get("pattern") + sample = entry.get("sample") + if ( + not isinstance(pattern, str) + or not pattern + or not isinstance(sample, str) + or not sample + or pattern.startswith(("/", "../")) + or sample.startswith(("/", "../")) + or not fnmatch.fnmatchcase(sample, pattern) + ): + raise ValueError( + "authoring-reference CI inputs must have matching " + f"repository-relative pattern/sample pairs: {entry!r}" + ) + parsed.append((pattern, sample)) + + patterns = [pattern for pattern, _ in parsed] + samples = [sample for _, sample in parsed] + if len(patterns) != len(set(patterns)) or len(samples) != len(set(samples)): + raise ValueError("authoring-reference CI patterns and samples must be unique") + result = tuple(parsed) + validate_authoring_reference_routing( + authoring_reference_contract_sources(manifest_path), + result, + ) + return result + + +AUTHORING_REFERENCE_CONTRACT_SOURCES = authoring_reference_contract_sources() +AUTHORING_REFERENCE_INPUTS = authoring_reference_inputs() +AUTHORING_REFERENCE_PATTERNS = tuple( + pattern for pattern, _ in AUTHORING_REFERENCE_INPUTS +) class Workspace: @@ -256,12 +424,42 @@ def classify( path, "crates/registry-relay/docs/*", "crates/registry-relay/openapi/*", + "crates/registry-relay/src/api/openapi.rs", + "crates/registryctl/assets/project-starters/*", + "crates/registry-notary-server/src/standalone/activation.rs", + "crates/registry-platform-ops/src/lib.rs", + "crates/registry-relay/src/consultation/*", + "crates/registryctl/schemas/project-reports/*", + "crates/registryctl/src/templates/*", + "crates/registryctl/tests/fixtures/project-authoring/*", + "crates/registryctl/tests/fixtures/project-reports/*", "docs/site/*", "products/manifest/docs/*", "products/notary/docs/*", "products/notary/openapi/*", + *AUTHORING_REFERENCE_PATTERNS, ) - or path == ".github/workflows/docs-pages.yml" + or path + in { + ".github/workflows/docs-pages.yml", + "crates/registry-relay/src/main.rs", + "crates/registry-relay/src/process_startup.rs", + "crates/registry-relay/src/server.rs", + "crates/registryctl/src/main.rs", + "crates/registryctl/src/project_authoring/capability_inventory.rs", + "crates/registryctl/src/project_authoring/diagnostic_reference.rs", + "crates/registryctl/src/project_authoring/diagnostics.rs", + "crates/registryctl/src/project_authoring/fixture_diagnostics.rs", + "crates/registryctl/src/project_authoring/fixture_coverage.rs", + "crates/registryctl/src/project_authoring/migration.rs", + "crates/registryctl/src/project_authoring/output.rs", + "crates/registryctl/src/project_authoring/preflight.rs", + "crates/registryctl/src/project_authoring/promotion.rs", + "crates/registryctl/src/project_authoring/report_contract.rs", + "crates/registryctl/src/project_authoring/semantic_comparison.rs", + "crates/registryctl/tests/fixtures/project-authoring-journeys.yaml", + } + or path in STANDARD_JOURNEY_SOURCES for path in paths ) docs_archives = any( @@ -310,8 +508,29 @@ def classify( or path.startswith("products/notary/") for path in paths ) + tutorial_source_under_test = any( + matches( + path, + "crates/registry-notary/src/*", + "crates/registry-notary-core/src/*", + "crates/registry-notary-server/src/*", + "crates/registryctl/src/templates/*", + ) + or path + in { + "crates/registry-relay/src/api/openapi.rs", + "crates/registry-relay/src/main.rs", + "crates/registry-relay/src/server.rs", + "crates/registryctl/src/main.rs", + "crates/registryctl/src/project_authoring/output.rs", + } + for path in paths + ) registryctl_tutorial = ( - complete or tutorial_infrastructure or bool(affected & TUTORIAL_PACKAGES) + complete + or tutorial_infrastructure + or tutorial_source_under_test + or bool(affected & TUTORIAL_PACKAGES) ) matrix = [] diff --git a/.github/scripts/test_ci_changes.py b/.github/scripts/test_ci_changes.py index 8831f1ced..11065cb2f 100644 --- a/.github/scripts/test_ci_changes.py +++ b/.github/scripts/test_ci_changes.py @@ -2,6 +2,7 @@ from __future__ import annotations +import fnmatch import json import re import subprocess @@ -9,7 +10,16 @@ import unittest from pathlib import Path -from ci_changes import RELEASE_SECURITY_WORKFLOWS, SHARDS, Workspace, classify +from ci_changes import ( + AUTHORING_REFERENCE_CONTRACT_SOURCES, + AUTHORING_REFERENCE_INPUTS, + RELEASE_SECURITY_WORKFLOWS, + SHARDS, + STANDARD_JOURNEY_SOURCES, + Workspace, + classify, + validate_authoring_reference_routing, +) from run_cargo_packages import command_args, package_args @@ -55,6 +65,7 @@ def test_reverse_dependencies_are_included(self) -> None: self.assertIn("registry-platform-crypto", outputs["rust_packages"]) self.assertIn("registry-relay", outputs["rust_packages"]) self.assertIn("registry-notary", outputs["rust_packages"]) + self.assertTrue(outputs["registryctl_tutorial"]) def test_ci_workflow_change_runs_the_complete_matrix(self) -> None: outputs = classify(self.workspace, (".github/workflows/ci.yml",)) @@ -115,6 +126,415 @@ def test_run_all_keeps_archive_sensitive_changed_paths(self) -> None: self.assertTrue(outputs["docs"]) self.assertTrue(outputs["docs_archives"]) + def test_authoring_reference_inputs_run_docs(self) -> None: + for _, path in AUTHORING_REFERENCE_INPUTS: + with self.subTest(path=path): + self.assertTrue(classify(self.workspace, (path,))["docs"]) + + def test_authoring_reference_source_contract_has_independent_ci_coverage(self) -> None: + self.assertEqual( + AUTHORING_REFERENCE_CONTRACT_SOURCES, + ( + "crates/registryctl/schemas/project-authoring/project.schema.json", + "crates/registryctl/schemas/project-authoring/environment.schema.json", + "crates/registryctl/schemas/project-authoring/integration.schema.json", + "crates/registryctl/schemas/project-authoring/fixture.schema.json", + "crates/registryctl/schemas/project-authoring/entity.schema.json", + "schemas/registry-relay.config.schema.json", + "schemas/registry-notary.config.schema.json", + "crates/registryctl/schemas/project-authoring/parity-coverage.json", + "crates/registryctl/schemas/project-authoring/documentation-intent.json", + "crates/registry-relay/config/documentation-intent.json", + "crates/registry-notary-core/config/documentation-intent.json", + ), + ) + validate_authoring_reference_routing( + AUTHORING_REFERENCE_CONTRACT_SOURCES, + AUTHORING_REFERENCE_INPUTS, + ) + without_project_authoring_schemas = tuple( + item + for item in AUTHORING_REFERENCE_INPUTS + if item[0] != "crates/registryctl/schemas/project-authoring/**" + ) + with self.assertRaisesRegex( + ValueError, + "do not route source-contract paths", + ): + validate_authoring_reference_routing( + AUTHORING_REFERENCE_CONTRACT_SOURCES, + without_project_authoring_schemas, + ) + + def test_docs_pages_watches_authoring_reference_inputs(self) -> None: + workflow = Path(".github/workflows/docs-pages.yml").read_text(encoding="utf-8") + for watched_path, _ in AUTHORING_REFERENCE_INPUTS: + with self.subTest(path=watched_path): + self.assertIn(f'"{watched_path}"', workflow) + + def test_public_project_authoring_modules_run_docs_and_are_watched(self) -> None: + project_authoring = Path("crates/registryctl/src/project_authoring.rs").read_text( + encoding="utf-8" + ) + public_modules = re.findall( + r"^pub use ([a-z][a-z0-9_]*)::\*;$", + project_authoring, + flags=re.MULTILINE, + ) + self.assertTrue(public_modules) + + workflow = Path(".github/workflows/docs-pages.yml").read_text(encoding="utf-8") + push_paths = re.findall( + r'^\s+- "([^"]+)"$', + workflow.split(" workflow_dispatch:", 1)[0], + flags=re.MULTILINE, + ) + for module in public_modules: + source = f"crates/registryctl/src/project_authoring/{module}.rs" + with self.subTest(source=source): + self.assertTrue(classify(self.workspace, (source,))["docs"]) + self.assertTrue( + any(fnmatch.fnmatchcase(source, pattern) for pattern in push_paths), + f"{source} is not watched by docs-pages.yml", + ) + self.assertFalse( + any( + fnmatch.fnmatchcase( + "crates/registryctl/src/project_authoring/project.rs", + pattern, + ) + for pattern in push_paths + ), + "implementation-only project.rs should not rebuild Pages", + ) + + def test_diagnostic_reference_inputs_run_docs_and_are_watched(self) -> None: + watched_paths = ( + "crates/registry-notary-server/src/standalone/activation.rs", + "crates/registry-platform-ops/src/lib.rs", + "crates/registry-relay/src/consultation/**", + "crates/registry-relay/src/process_startup.rs", + "crates/registryctl/schemas/project-reports/**", + "crates/registryctl/src/project_authoring/diagnostic_reference.rs", + "crates/registryctl/src/project_authoring/diagnostics.rs", + "crates/registryctl/src/project_authoring/fixture_diagnostics.rs", + "crates/registryctl/src/project_authoring/preflight.rs", + "crates/registryctl/tests/fixtures/project-reports/**", + ) + workflow = Path(".github/workflows/docs-pages.yml").read_text(encoding="utf-8") + for watched_path in watched_paths: + with self.subTest(path=watched_path): + classifier_path = watched_path.replace("**", "service.rs") + self.assertTrue(classify(self.workspace, (classifier_path,))["docs"]) + self.assertIn(f'"{watched_path}"', workflow) + + def test_first_country_docs_and_journey_routing_matrix(self) -> None: + cases = ( + ( + "crates/registryctl/assets/project-starters/bounded-http/registry-stack.yaml", + { + "docs": True, + "project_authoring": True, + "registryctl_tutorial": True, + }, + ), + ( + "crates/registryctl/tests/fixtures/project-authoring/opencrvs/registry-stack.yaml", + { + "docs": True, + "project_authoring": True, + "registryctl_tutorial": True, + }, + ), + ( + "crates/registryctl/tests/fixtures/project-authoring-journeys.yaml", + { + "docs": True, + "project_authoring": True, + "registryctl_tutorial": True, + }, + ), + ( + "crates/registryctl/src/templates/notary_addon/registry-stack.yaml", + { + "docs": True, + "project_authoring": True, + "registryctl_tutorial": True, + }, + ), + ( + "crates/registryctl/schemas/project-reports/registry.project.explanation.v1.schema.json", + { + "docs": True, + "project_authoring": True, + "registryctl_tutorial": True, + }, + ), + ( + "crates/registryctl/tests/fixtures/project-reports/registry.project.explanation.v1.json", + { + "docs": True, + "project_authoring": True, + "registryctl_tutorial": True, + }, + ), + ( + "crates/registryctl/src/project_authoring/report_contract.rs", + { + "docs": True, + "project_authoring": True, + "registryctl_tutorial": True, + }, + ), + ( + "crates/registryctl/src/project_authoring/output.rs", + { + "docs": True, + "project_authoring": True, + "registryctl_tutorial": True, + }, + ), + ( + "crates/registryctl/src/main.rs", + { + "docs": True, + "project_authoring": True, + "registryctl_tutorial": True, + }, + ), + ( + "crates/registry-relay/src/api/openapi.rs", + { + "docs": True, + "relay_contracts": True, + "registryctl_tutorial": True, + }, + ), + ( + "crates/registry-relay/src/server.rs", + { + "docs": True, + "relay_contracts": True, + "registryctl_tutorial": True, + }, + ), + ( + "crates/registry-relay/src/main.rs", + { + "docs": True, + "relay_contracts": True, + "registryctl_tutorial": True, + }, + ), + ( + "crates/registry-relay/src/config/loader.rs", + { + "docs": True, + "relay_contracts": True, + "registryctl_tutorial": True, + }, + ), + ( + "crates/registry-notary-server/src/standalone/activation.rs", + { + "docs": True, + "notary_contracts": True, + "registryctl_tutorial": True, + }, + ), + ( + "crates/registry-notary/src/config_loader.rs", + { + "docs": False, + "notary_contracts": True, + "registryctl_tutorial": True, + }, + ), + ( + "crates/registry-notary-core/src/config/root.rs", + { + "docs": True, + "notary_contracts": True, + "registryctl_tutorial": True, + }, + ), + ( + "crates/registry-notary-server/src/runtime/evaluation.rs", + { + "docs": False, + "notary_contracts": True, + "registryctl_tutorial": True, + }, + ), + ( + "crates/registry-platform-ops/src/lib.rs", + { + "docs": True, + "registryctl_tutorial": True, + }, + ), + ( + "crates/registry-relay/src/consultation/service.rs", + { + "docs": True, + "relay_contracts": True, + "registryctl_tutorial": True, + }, + ), + ( + "crates/registry-relay/src/process_startup.rs", + { + "docs": True, + "relay_contracts": True, + "registryctl_tutorial": True, + }, + ), + ( + "crates/registryctl/src/project_authoring/diagnostic_reference.rs", + { + "docs": True, + "project_authoring": True, + "registryctl_tutorial": True, + }, + ), + ( + "docs/site/src/data/standard-journeys.yaml", + { + "docs": True, + "rust": False, + "registryctl_tutorial": False, + }, + ), + ( + "docs/site/scripts/generate-standard-journeys.mjs", + { + "docs": True, + "rust": False, + "registryctl_tutorial": False, + }, + ), + ( + "docs/site/src/components/JourneyGateMatrix.astro", + { + "docs": True, + "rust": False, + "registryctl_tutorial": False, + }, + ), + ( + "docs/site/src/content/docs/journeys/verify-instance-openapi.mdx", + { + "docs": True, + "rust": False, + "registryctl_tutorial": False, + }, + ), + ( + "docs/site/src/content/docs/reference/diagnostics/operator.mdx", + { + "docs": True, + "rust": False, + "registryctl_tutorial": False, + }, + ), + ) + + for path, expected in cases: + with self.subTest(path=path): + outputs = classify(self.workspace, (path,)) + for output, value in expected.items(): + self.assertEqual(outputs[output], value, output) + + def test_tutorial_package_dependencies_route_the_source_journey(self) -> None: + cases = ( + ( + "crates/registry-relay/src/state_plane/runtime.rs", + { + "docs": False, + "relay_contracts": True, + "registryctl_tutorial": True, + }, + ), + ( + "crates/registry-platform-crypto/src/lib.rs", + {"docs": False, "registryctl_tutorial": True}, + ), + ( + "crates/registryctl/src/project_authoring/project.rs", + { + "docs": False, + "project_authoring": True, + "registryctl_tutorial": True, + }, + ), + ( + "README.md", + {"docs": False, "rust": False, "registryctl_tutorial": False}, + ), + ( + "crates/registry-notary-client/src/lib.rs", + { + "docs": False, + "notary_contracts": True, + "registryctl_tutorial": True, + }, + ), + ) + + for path, expected in cases: + with self.subTest(path=path): + outputs = classify(self.workspace, (path,)) + for output, value in expected.items(): + self.assertEqual(outputs[output], value, output) + + def test_docs_pages_watches_first_country_generation_inputs(self) -> None: + workflow = Path(".github/workflows/docs-pages.yml").read_text(encoding="utf-8") + watched_paths = ( + "crates/registryctl/assets/project-starters/**", + "crates/registryctl/src/main.rs", + "crates/registryctl/src/project_authoring/output.rs", + "crates/registryctl/src/project_authoring/report_contract.rs", + "crates/registryctl/src/templates/**", + "crates/registryctl/tests/fixtures/project-authoring-journeys.yaml", + "crates/registryctl/tests/fixtures/project-authoring/**", + "crates/registry-relay/src/api/openapi.rs", + "crates/registry-relay/src/main.rs", + "crates/registry-relay/src/server.rs", + ) + + for watched_path in watched_paths: + with self.subTest(path=watched_path): + self.assertIn(f'"{watched_path}"', workflow) + self.assertIn( + "node scripts/generate-standard-journeys.mjs --check", + workflow, + ) + + def test_docs_job_fetches_ignored_openapi_inputs_before_script_tests(self) -> None: + workflow = Path(".github/workflows/ci.yml").read_text(encoding="utf-8") + docs_job = workflow.split("\n docs:\n", 1)[1].split("\n docs-required:\n", 1)[0] + fetch = "run: node scripts/fetch-openapi.mjs" + test_scripts = "run: npm test" + + self.assertIn(fetch, docs_job) + self.assertLess(docs_job.index(fetch), docs_job.index(test_scripts)) + + def test_every_standard_journey_source_routes_to_docs_and_pages(self) -> None: + workflow = Path(".github/workflows/docs-pages.yml").read_text(encoding="utf-8") + push_paths = re.findall( + r'^\s+- "([^"]+)"$', + workflow.split(" workflow_dispatch:", 1)[0], + flags=re.MULTILINE, + ) + + for source in sorted(STANDARD_JOURNEY_SOURCES): + with self.subTest(source=source): + self.assertTrue(classify(self.workspace, (source,))["docs"]) + self.assertTrue( + any(fnmatch.fnmatchcase(source, pattern) for pattern in push_paths), + f"{source} is not watched by docs-pages.yml", + ) + def test_other_workflow_changes_do_not_select_the_full_matrix(self) -> None: for workflow in sorted(RELEASE_SECURITY_WORKFLOWS): with self.subTest(workflow=workflow): diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 9a4b00e09..52d006f5f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -539,6 +539,11 @@ jobs: working-directory: crates/registry-relay run: just exposure-check + - name: Verify disposable local OpenAPI opt-out + run: >- + cargo test --locked -p registry-relay --test api_docs + openapi_json_can_be_moved_to_public_router_for_local_testing -- --exact + rust-result: name: Rust workspace if: always() @@ -606,6 +611,9 @@ jobs: key: project-authoring-${{ matrix.arch }} save-if: ${{ github.ref == 'refs/heads/main' }} + - name: Build the Registryctl journey binary + run: cargo build --locked -p registryctl --bin registryctl + - name: Verify cross-machine project inputs run: >- cargo test --locked -p registryctl --test project_authoring @@ -618,6 +626,45 @@ jobs: cargo test --locked -p registryctl --test project_authoring project_authoring_rhai_commands_are_portable_offline -- --exact + - name: Verify every cataloged authoring journey + run: >- + cargo test --locked -p registryctl --test project_authoring + every_cataloged_supported_project_authoring_command_is_automated -- --exact + + - name: Setup Node + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e + with: + node-version: 22.12.0 + cache: npm + cache-dependency-path: docs/site/package-lock.json + + - name: Install docs shell dependency + if: runner.os == 'Linux' + run: | + sudo apt-get update + sudo apt-get install --yes zsh + + - name: Assert docs shell dependencies + shell: bash + run: | + set -euo pipefail + command -v sh + command -v bash + command -v zsh + + - name: Install docs dependencies + working-directory: docs/site + run: npm ci + + - name: Execute required standard journey commands from clean directories + working-directory: docs/site + env: + REGISTRYCTL_BIN: ${{ github.workspace }}/target/debug/registryctl + run: >- + node --test + --test-name-pattern="executes every required noninteractive sequence" + scripts/generate-standard-journeys.test.mjs + release-tool: name: Release tooling checks needs: changes @@ -699,25 +746,35 @@ jobs: - name: Test upgrade exercise validator run: python3 -m unittest release/scripts/test_validate_upgrade_exercise.py + - name: Test product-input lifecycle validator + run: python3 -m unittest release/scripts/test_validate_product_input_lifecycle.py + + - name: Test first-country acceptance validator + run: python3 -m unittest release/scripts/test_validate_first_country_acceptance.py + + - name: Validate first-country acceptance source packet + run: python3 release/scripts/validate-first-country-acceptance.py check-packet + - name: Test upgrade exercise asset preparation run: python3 -m unittest release/scripts/test_prepare_upgrade_exercise_assets.py - - name: Prepare committed upgrade candidate assets - id: upgrade-assets + - name: Prepare committed candidate assets + id: candidate-assets env: GH_TOKEN: ${{ github.token }} run: >- python3 release/scripts/prepare-upgrade-exercise-assets.py --discover release/exercises - --asset-root target/upgrade-exercise-assets + --product-input-records release/exercises/product-input-lifecycle + --asset-root target/candidate-release-assets --github-output "${GITHUB_OUTPUT}" - - name: Install cosign for committed upgrade evidence - if: steps.upgrade-assets.outputs.has_candidates == 'true' + - name: Install cosign for committed candidate evidence + if: steps.candidate-assets.outputs.has_candidates == 'true' uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3 - - name: Install SLSA verifier for committed upgrade evidence - if: steps.upgrade-assets.outputs.has_candidates == 'true' + - name: Install SLSA verifier for committed candidate evidence + if: steps.candidate-assets.outputs.has_candidates == 'true' env: SLSA_VERIFIER_SHA256: 946dbec729094195e88ef78e1734324a27869f03e2c6bd2f61cbc06bd5350339 SLSA_VERIFIER_VERSION: v2.7.1 @@ -733,8 +790,17 @@ jobs: chmod 0755 "${tools_dir}/slsa-verifier" echo "${tools_dir}" >> "${GITHUB_PATH}" + - name: Validate product-input lifecycle records + run: >- + python3 release/scripts/validate-product-input-lifecycle.py + --discover release/exercises + --candidate-asset-root target/candidate-release-assets + - name: Validate committed upgrade exercise records - run: python3 release/scripts/validate-upgrade-exercise.py --discover release/exercises --candidate-asset-root target/upgrade-exercise-assets + run: >- + python3 release/scripts/validate-upgrade-exercise.py + --discover release/exercises + --candidate-asset-root target/candidate-release-assets - name: Stable surface compatibility env: @@ -918,10 +984,27 @@ jobs: cache: npm cache-dependency-path: docs/site/package-lock.json + - name: Install docs shell dependency + run: | + sudo apt-get update + sudo apt-get install --yes zsh + + - name: Assert docs shell dependencies + shell: bash + run: | + set -euo pipefail + command -v sh + command -v bash + command -v zsh + - name: Install docs dependencies working-directory: docs/site run: npm ci + - name: Fetch pinned OpenAPI inputs + working-directory: docs/site + run: node scripts/fetch-openapi.mjs + - name: Test docs scripts working-directory: docs/site run: npm test diff --git a/.github/workflows/docs-pages.yml b/.github/workflows/docs-pages.yml index 1f31181c7..d7d823d47 100644 --- a/.github/workflows/docs-pages.yml +++ b/.github/workflows/docs-pages.yml @@ -7,11 +7,52 @@ on: paths: - ".github/workflows/docs-pages.yml" - "docs/site/**" + - "crates/registryctl/assets/project-starters/**" + - "crates/registryctl/schemas/project-authoring/**" + - "crates/registryctl/schemas/project-documentation/**" + - "crates/registryctl/schemas/project-reports/**" + - "crates/registryctl/src/lib.rs" + - "crates/registryctl/src/main.rs" + - "crates/registryctl/src/project_authoring/capability_inventory.rs" + - "crates/registryctl/src/project_authoring/diagnostic_reference.rs" + - "crates/registryctl/src/project_authoring/diagnostics.rs" + - "crates/registryctl/src/project_authoring/documentation.rs" + - "crates/registryctl/src/project_authoring/fixture_diagnostics.rs" + - "crates/registryctl/src/project_authoring/fixture_coverage.rs" + - "crates/registryctl/src/project_authoring/knowledge.rs" + - "crates/registryctl/src/project_authoring/migration.rs" + - "crates/registryctl/src/project_authoring/output.rs" + - "crates/registryctl/src/project_authoring/preflight.rs" + - "crates/registryctl/src/project_authoring/promotion.rs" + - "crates/registryctl/src/project_authoring/report_contract.rs" + - "crates/registryctl/src/project_authoring/semantic_comparison.rs" + - "crates/registryctl/src/sample.rs" + - "crates/registryctl/src/templates/**" + - "crates/registryctl/tests/fixtures/project-authoring-journeys.yaml" + - "crates/registryctl/tests/fixtures/project-authoring/**" + - "crates/registryctl/tests/fixtures/project-reports/**" + - "crates/registryctl/tests/init_output.rs" - "crates/registry-relay/docs/**" - "crates/registry-relay/openapi/**" + - "crates/registry-relay/config/documentation-intent.json" + - "crates/registry-relay/src/api/openapi.rs" + - "crates/registry-relay/src/consultation/**" + - "crates/registry-relay/src/config/**" + - "crates/registry-relay/src/main.rs" + - "crates/registry-relay/src/process_startup.rs" + - "crates/registry-relay/src/server.rs" + - "crates/registry-relay/tests/api_docs.rs" + - "crates/registry-notary-core/config/documentation-intent.json" + - "crates/registry-notary-core/src/config.rs" + - "crates/registry-notary-core/src/config/**" + - "crates/registry-notary-core/src/deployment.rs" + - "crates/registry-notary-server/src/standalone/activation.rs" + - "crates/registry-platform-ops/src/lib.rs" - "products/notary/docs/**" - "products/notary/openapi/**" - "products/manifest/docs/**" + - "schemas/registry-relay.config.schema.json" + - "schemas/registry-notary.config.schema.json" workflow_dispatch: permissions: @@ -45,6 +86,10 @@ jobs: working-directory: docs/site run: npm ci + - name: Check standard journey generation + working-directory: docs/site + run: node scripts/generate-standard-journeys.mjs --check + - name: Build latest docs working-directory: docs/site run: npm run build diff --git a/.gitleaks.toml b/.gitleaks.toml index 191f78afa..31c6096ba 100644 --- a/.gitleaks.toml +++ b/.gitleaks.toml @@ -39,6 +39,9 @@ regexes = [ '''let key = Pkcs1RsaPrivateKey''', '''chain_key_epoch_id:\s*[a-z0-9-]+-chain-1''', '''"dci_crvs_api":\s*"5e31d1e381d4bd8c7c74112d714fd49d263c6df7"''', + '''"key_path":\s*"oid4vci\.(?:enabled|nonce\.ttl_seconds|proof\.max_age_seconds)"''', + '''"AKIAABCDEFGHIJKLMNOP"''', + '''"eyJhbGciOiJSUzI1NiJ9\.eyJzdWIiOiJzdWJqZWN0In0\.abcdefghijklmnop"''', ] [[allowlists]] diff --git a/Cargo.lock b/Cargo.lock index dc8c86aa5..5eb266f52 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -5726,6 +5726,7 @@ name = "registryctl" version = "0.13.0" dependencies = [ "anyhow", + "async-trait", "base64", "cel", "clap", @@ -5745,8 +5746,10 @@ dependencies = [ "registry-platform-authcommon", "registry-platform-config", "registry-platform-crypto", + "registry-platform-ops", "registry-relay", "rustix", + "schemars 1.2.1", "serde", "serde_json", "serde_norway", diff --git a/crates/registry-config-report/schemas/registry.config.explanation.v1.schema.json b/crates/registry-config-report/schemas/registry.config.explanation.v1.schema.json index 7a09b44e4..1747c7b88 100644 --- a/crates/registry-config-report/schemas/registry.config.explanation.v1.schema.json +++ b/crates/registry-config-report/schemas/registry.config.explanation.v1.schema.json @@ -271,17 +271,13 @@ }, "profile": { "type": "object", - "required": ["id", "version", "contract_hash"], + "required": ["id", "contract_hash"], "additionalProperties": false, "properties": { "id": { "type": "string", "pattern": "^[a-z][a-z0-9._-]{0,95}$" }, - "version": { - "type": "string", - "pattern": "^[1-9][0-9]{0,9}$" - }, "contract_hash": { "$ref": "#/$defs/sha256_hash" } @@ -307,12 +303,13 @@ "inputs": { "type": "object", "minProperties": 1, - "maxProperties": 1, + "maxProperties": 16, "propertyNames": { "pattern": "^[a-z][a-z0-9_]{0,95}$" }, "additionalProperties": { - "const": "target.id" + "type": "string", + "pattern": "^(target\\.id|request\\.requester\\.id|request\\.(target|requester)\\.identifiers\\.[A-Za-z][A-Za-z0-9._-]{0,95}|request\\.target\\.attributes\\.[a-z][a-z0-9_]{0,63})$" } } } diff --git a/crates/registry-config-report/src/lib.rs b/crates/registry-config-report/src/lib.rs index 54205a8cc..fef01a4fd 100644 --- a/crates/registry-config-report/src/lib.rs +++ b/crates/registry-config-report/src/lib.rs @@ -4,6 +4,8 @@ //! crate owns only the report envelopes, schema assets, shared vocabulary, and //! redaction helpers used when those product-owned decisions are reported. +use std::collections::BTreeMap; + use serde::{Deserialize, Deserializer, Serialize}; use serde_json::Value; @@ -174,6 +176,7 @@ impl LiveApplyClass { } #[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] pub struct ConfigSourceRef { pub kind: ConfigSourceKind, #[serde(skip_serializing_if = "Option::is_none")] @@ -183,12 +186,14 @@ pub struct ConfigSourceRef { } #[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] pub struct DiagnosticSummary { pub error_count: u64, pub warning_count: u64, } #[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] pub struct ConfigDiagnostic { pub code: String, pub severity: DiagnosticSeverity, @@ -216,6 +221,7 @@ pub struct ConfigDiagnostic { /// [`RequiredEnvVar::public_safe_entries`], which omits sensitive entries /// entirely so names, presence, and counts are not disclosed. #[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] pub struct RequiredEnvVar { pub name: String, pub classification: ConfigValueClassification, @@ -260,6 +266,7 @@ impl RequiredEnvVar { } #[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] pub struct ConfigHashes { #[serde(skip_serializing_if = "Option::is_none")] pub internal_config_hash: Option, @@ -305,6 +312,7 @@ impl TrustedValueSource { } #[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] pub struct ContextConstraintLegalBasisReport { pub required: bool, pub approved_value_check: bool, @@ -313,6 +321,7 @@ pub struct ContextConstraintLegalBasisReport { } #[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] pub struct ContextConstraintConsentReport { pub required: bool, pub approved_value_check: bool, @@ -321,12 +330,14 @@ pub struct ContextConstraintConsentReport { } #[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] pub struct ContextConstraintJurisdictionReport { pub permitted_count: u64, pub trusted_value_source: TrustedValueSource, } #[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] pub struct ContextConstraintAssuranceReport { pub allowed_count: u64, pub minimum: Option, @@ -335,6 +346,7 @@ pub struct ContextConstraintAssuranceReport { } #[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] pub struct ContextConstraintSourceFreshnessReport { pub max_age_seconds: Option, pub observation_field: Option, @@ -343,6 +355,7 @@ pub struct ContextConstraintSourceFreshnessReport { } #[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] pub struct ContextConstraintsReportEntry { pub container_path: String, pub product: String, @@ -366,6 +379,7 @@ pub struct ContextConstraintsReportEntry { /// products emit explicit `null`s rather than omitting them when there is no /// cursor to observe. #[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] pub struct AuditShippingReport { pub sink_type: String, pub shipping_target_configured: bool, @@ -375,6 +389,7 @@ pub struct AuditShippingReport { } #[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] pub struct ConfigDiagnosticReport { pub schema_version: String, pub product: String, @@ -397,12 +412,14 @@ pub struct ConfigDiagnosticReport { } #[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] pub struct ConfigDefault { pub path: String, pub value: Value, } #[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] pub struct OptionalSection { pub path: String, #[serde(skip_serializing_if = "Option::is_none")] @@ -410,11 +427,86 @@ pub struct OptionalSection { } #[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] pub struct LiveApplyComponent { pub path: String, pub class: LiveApplyClass, } +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +#[non_exhaustive] +pub enum RelayConnectionCredentialMode { + ReloadableTokenFile, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +#[non_exhaustive] +pub enum RelayConnectionCredentialReload { + PerOperation, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +#[non_exhaustive] +pub enum RelayConnectionOfflineFileStatus { + Present, + Missing, + NotRegular, + Unreadable, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct RelayConnectionCredentialReport { + pub mode: RelayConnectionCredentialMode, + pub reload: RelayConnectionCredentialReload, + pub offline_file_status: RelayConnectionOfflineFileStatus, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +#[non_exhaustive] +pub enum RelayConnectionTransport { + Https, + LoopbackHttp, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct RelayConnectionNetworkReport { + pub transport: RelayConnectionTransport, + pub allowed_private_cidr_count: u64, + pub allow_insecure_localhost: bool, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct RelayConnectionReport { + pub credential: RelayConnectionCredentialReport, + pub network: RelayConnectionNetworkReport, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct RelayConsultationProfileReport { + pub id: String, + pub contract_hash: String, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct RelayConsultationReport { + pub container_path: String, + pub claim_id: String, + pub consultation: String, + pub profile: RelayConsultationProfileReport, + pub purpose: String, + pub required_scopes: Vec, + pub inputs: BTreeMap, +} + /// A configuration tree that is guaranteed to have passed through redaction. /// /// This newtype makes redaction unbypassable at the type level: the only way to @@ -469,6 +561,7 @@ impl RedactedConfig { } #[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] pub struct ConfigExplanation { pub schema_version: String, pub product: String, @@ -486,6 +579,10 @@ pub struct ConfigExplanation { pub live_apply: Vec, #[serde(default)] pub context_constraints: Vec, + #[serde(default, skip_serializing_if = "Option::is_none")] + pub relay_connection: Option, + #[serde(default, skip_serializing_if = "Vec::is_empty")] + pub relay_consultations: Vec, pub resolved_config: RedactedConfig, #[serde(skip_serializing_if = "config_hashes_option_is_empty")] pub hashes: Option, @@ -498,6 +595,7 @@ pub struct ConfigExplanation { /// wire format but does not claim that its `resolved_config` was produced by /// [`RedactedConfig::redacted`]. #[derive(Clone, Debug, Eq, PartialEq, Deserialize)] +#[serde(deny_unknown_fields)] pub struct ConfigExplanationDocument { pub schema_version: String, pub product: String, @@ -513,18 +611,24 @@ pub struct ConfigExplanationDocument { pub live_apply: Vec, #[serde(default)] pub context_constraints: Vec, + #[serde(default)] + pub relay_connection: Option, + #[serde(default)] + pub relay_consultations: Vec, pub resolved_config: Value, pub hashes: Option, pub generated_at: String, } #[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] pub struct RegistryctlProjectRef { pub path: String, pub profile: String, } #[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] pub struct RegistryctlProductReport { pub product: String, pub status: ReportStatus, @@ -532,6 +636,7 @@ pub struct RegistryctlProductReport { } #[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] pub struct RegistryctlValidationReport { pub schema_version: String, pub project: RegistryctlProjectRef, diff --git a/crates/registry-config-report/tests/report_contract.rs b/crates/registry-config-report/tests/report_contract.rs index cd6540cd0..8eb198910 100644 --- a/crates/registry-config-report/tests/report_contract.rs +++ b/crates/registry-config-report/tests/report_contract.rs @@ -58,6 +58,16 @@ where serde_json::from_str(fixture).expect("fixture decodes") } +fn assert_typed_invalid(document: Value) +where + T: DeserializeOwned, +{ + assert!( + serde_json::from_value::(document).is_err(), + "document with an unknown field should not deserialize" + ); +} + fn producer_explanation_from_document(document: ConfigExplanationDocument) -> ConfigExplanation { ConfigExplanation { schema_version: document.schema_version, @@ -69,6 +79,8 @@ fn producer_explanation_from_document(document: ConfigExplanationDocument) -> Co optional_sections_absent: document.optional_sections_absent, live_apply: document.live_apply, context_constraints: document.context_constraints, + relay_connection: document.relay_connection, + relay_consultations: document.relay_consultations, resolved_config: RedactedConfig::redacted(&document.resolved_config, |_, _| { ConfigValueClassification::Public }), @@ -77,6 +89,40 @@ fn producer_explanation_from_document(document: ConfigExplanationDocument) -> Co } } +fn explanation_fixture_with_relay_sections() -> Value { + let mut fixture = parse(CONFIG_EXPLANATION_FIXTURE_V1); + fixture["relay_connection"] = json!({ + "credential": { + "mode": "reloadable_token_file", + "reload": "per_operation", + "offline_file_status": "present" + }, + "network": { + "transport": "https", + "allowed_private_cidr_count": 2, + "allow_insecure_localhost": false + } + }); + fixture["relay_consultations"] = json!([ + { + "container_path": "notary.claims.birth_record_exists", + "claim_id": "birth_record_exists", + "consultation": "birth_record_exists", + "profile": { + "id": "opencrvs.birth_record_exists", + "contract_hash": format!("sha256:{}", "a".repeat(64)) + }, + "purpose": "birth_registration", + "required_scopes": ["records:read"], + "inputs": { + "person_id": "request.target.identifiers.national_id", + "subject_id": "target.id" + } + } + ]); + fixture +} + #[test] fn product_diagnostic_schema_validates_canonical_product_fixtures() { for fixture in [ @@ -249,6 +295,89 @@ fn serde_types_round_trip_canonical_fixtures() { round_trip::(REGISTRYCTL_VALIDATION_FIXTURE_V1); } +#[test] +fn explanation_typed_round_trip_preserves_committed_relay_sections() { + let fixture = explanation_fixture_with_relay_sections(); + assert_valid(CONFIG_EXPLANATION_SCHEMA_V1, &fixture); + + let decoded: ConfigExplanationDocument = + serde_json::from_value(fixture.clone()).expect("relay sections decode"); + let encoded = serde_json::to_value(producer_explanation_from_document(decoded.clone())) + .expect("relay sections re-encode"); + assert_eq!(encoded, fixture); + + let decoded_again: ConfigExplanationDocument = + serde_json::from_value(encoded).expect("re-encoded relay sections decode"); + assert_eq!(decoded_again, decoded); +} + +#[test] +fn explanation_schema_accepts_all_authorized_relay_consultation_input_paths() { + for input in [ + "target.id", + "request.requester.id", + "request.target.identifiers.national_id", + "request.target.attributes.person_sequence", + "request.requester.identifiers.national_id", + ] { + let mut fixture = explanation_fixture_with_relay_sections(); + fixture["relay_consultations"][0]["inputs"]["person_id"] = json!(input); + assert_valid(CONFIG_EXPLANATION_SCHEMA_V1, &fixture); + serde_json::from_value::(fixture) + .expect("authorized Relay consultation input decodes"); + } +} + +#[test] +fn explanation_schema_and_typed_contract_reject_unowned_relay_profile_version() { + let mut fixture = explanation_fixture_with_relay_sections(); + fixture["relay_consultations"][0]["profile"]["version"] = json!("1"); + + assert_invalid(CONFIG_EXPLANATION_SCHEMA_V1, &fixture); + assert_typed_invalid::(fixture); +} + +#[test] +fn diagnostic_report_typed_deserialization_rejects_unknown_root_and_nested_fields() { + let mut unknown_root = parse(RELAY_DIAGNOSTIC_OK_FIXTURE_V1); + unknown_root["future_field"] = json!(true); + assert_typed_invalid::(unknown_root); + + let mut unknown_nested = parse(RELAY_DIAGNOSTIC_OK_FIXTURE_V1); + unknown_nested["source"]["future_field"] = json!(true); + assert_typed_invalid::(unknown_nested); +} + +#[test] +fn explanation_typed_deserialization_rejects_unknown_root_and_nested_fields() { + let mut unknown_root = parse(CONFIG_EXPLANATION_FIXTURE_V1); + unknown_root["future_field"] = json!(true); + assert_typed_invalid::(unknown_root); + + let mut unknown_nested = parse(CONFIG_EXPLANATION_FIXTURE_V1); + unknown_nested["live_apply"][0]["future_field"] = json!(true); + assert_typed_invalid::(unknown_nested); + + let mut unknown_relay_connection = explanation_fixture_with_relay_sections(); + unknown_relay_connection["relay_connection"]["credential"]["future_field"] = json!(true); + assert_typed_invalid::(unknown_relay_connection); + + let mut unknown_relay_consultation = explanation_fixture_with_relay_sections(); + unknown_relay_consultation["relay_consultations"][0]["profile"]["future_field"] = json!(true); + assert_typed_invalid::(unknown_relay_consultation); +} + +#[test] +fn registryctl_report_typed_deserialization_rejects_unknown_root_and_nested_fields() { + let mut unknown_root = parse(REGISTRYCTL_VALIDATION_FIXTURE_V1); + unknown_root["future_field"] = json!(true); + assert_typed_invalid::(unknown_root); + + let mut unknown_nested = parse(REGISTRYCTL_VALIDATION_FIXTURE_V1); + unknown_nested["products"][0]["future_field"] = json!(true); + assert_typed_invalid::(unknown_nested); +} + #[test] fn diagnostic_report_round_trip_preserves_audit_shipping_section() { // The canonical fixtures all carry a populated audit_shipping section. diff --git a/crates/registry-notary-client/tests/standalone_e2e.rs b/crates/registry-notary-client/tests/standalone_e2e.rs index 0b44c1d5f..5fae656e9 100644 --- a/crates/registry-notary-client/tests/standalone_e2e.rs +++ b/crates/registry-notary-client/tests/standalone_e2e.rs @@ -81,6 +81,8 @@ deployment: multi_instance: false state: storage: in_memory +cel: + eval_timeout_ms: 5000 server: bind: 127.0.0.1:0 auth: diff --git a/crates/registry-notary-core/config/documentation-intent.json b/crates/registry-notary-core/config/documentation-intent.json new file mode 100644 index 000000000..1b378a054 --- /dev/null +++ b/crates/registry-notary-core/config/documentation-intent.json @@ -0,0 +1,7740 @@ +{ + "$schema": "https://id.registrystack.org/schemas/registryctl/project-documentation/registry.runtime.configuration_intent.v1.schema.json", + "format_version": "1.0", + "runtime_schema": "notary", + "schema_id": "https://id.registrystack.org/schemas/registry-notary/registry-notary.config.schema.json", + "schema_source": "registry-notary.config.schema.json", + "profiles": [ + { + "id": "notary_audit_internal", + "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ] + }, + { + "id": "notary_audit_secret_reference", + "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ] + }, + { + "id": "notary_audit_sensitive", + "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ] + }, + { + "id": "notary_auth_internal", + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ] + }, + { + "id": "notary_auth_oidc_scope_map_open_map", + "purpose": "Each reviewed key is an external token scope and each value is the bounded Notary scope mapping granted for that exact token scope.", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "bound_by_environment", + "sensitivity": "structural", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "open_map_semantics": "Each reviewed key is an external token scope and each value is the bounded Notary scope mapping granted for that exact token scope." + }, + { + "id": "notary_auth_secret_reference", + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ] + }, + { + "id": "notary_auth_sensitive", + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ] + }, + { + "id": "notary_cel_internal", + "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ] + }, + { + "id": "notary_config_trust_internal", + "purpose": "Controls Notary verification of signed configuration bundles, trust anchors, and rollback protection.", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ] + }, + { + "id": "notary_config_trust_sensitive", + "purpose": "Controls Notary verification of signed configuration bundles, trust anchors, and rollback protection.", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ] + }, + { + "id": "notary_credential_status_sensitive", + "purpose": "Controls Notary credential-status publication and retention behavior.", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ] + }, + { + "id": "notary_deployment_internal", + "purpose": "Declares Notary deployment posture and reviewed waiver metadata used by operator checks.", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ] + }, + { + "id": "notary_deployment_sensitive", + "purpose": "Declares Notary deployment posture and reviewed waiver metadata used by operator checks.", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ] + }, + { + "id": "notary_evidence_claims_evidence_mode_consultations_inputs_open_map", + "purpose": "Each reviewed key names a consultation input and each value binds it to an approved claim or variable source.", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "bound_by_environment", + "sensitivity": "structural", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "open_map_semantics": "Each reviewed key names a consultation input and each value binds it to an approved claim or variable source." + }, + { + "id": "notary_evidence_claims_evidence_mode_consultations_open_map", + "purpose": "Each reviewed key names a Relay consultation and each value defines the bounded consultation contract used to support this evidence claim.", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "bound_by_environment", + "sensitivity": "structural", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "open_map_semantics": "Each reviewed key names a Relay consultation and each value defines the bounded consultation contract used to support this evidence claim." + }, + { + "id": "notary_evidence_claims_evidence_mode_consultations_outputs_open_map", + "purpose": "Each reviewed key names a consultation output and each value defines its bounded evidence-result interpretation.", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "bound_by_environment", + "sensitivity": "structural", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "open_map_semantics": "Each reviewed key names a consultation output and each value defines its bounded evidence-result interpretation." + }, + { + "id": "notary_evidence_claims_rule_bindings_claims_open_map", + "purpose": "Each reviewed key names a CEL claim binding and each value selects the approved evidence claim exposed to that binding.", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "bound_by_environment", + "sensitivity": "structural", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "open_map_semantics": "Each reviewed key names a CEL claim binding and each value selects the approved evidence claim exposed to that binding." + }, + { + "id": "notary_evidence_credential_profiles_open_map", + "purpose": "Each reviewed key names a credential profile and each value defines its exact claims, format, and issuance contract.", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "arbitrary_map_keys_not_fixed_properties" + ], + "open_map_semantics": "Each reviewed key names a credential profile and each value defines its exact claims, format, and issuance contract." + }, + { + "id": "notary_evidence_internal", + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ] + }, + { + "id": "notary_evidence_secret_reference", + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ] + }, + { + "id": "notary_evidence_sensitive", + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ] + }, + { + "id": "notary_evidence_signing_keys_open_map", + "purpose": "Each reviewed key names a signing-key binding and each value references the operator-managed signing material and lifecycle metadata.", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "arbitrary_map_keys_not_fixed_properties" + ], + "open_map_semantics": "Each reviewed key names a signing-key binding and each value references the operator-managed signing material and lifecycle metadata." + }, + { + "id": "notary_evidence_variables_open_map", + "purpose": "Each reviewed key names a Notary evidence variable and each value defines its bounded source and evaluation contract.", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "bound_by_environment", + "sensitivity": "structural", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "open_map_semantics": "Each reviewed key names a Notary evidence variable and each value defines its bounded source and evaluation contract." + }, + { + "id": "notary_federation_internal", + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ] + }, + { + "id": "notary_federation_secret_reference", + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ] + }, + { + "id": "notary_federation_sensitive", + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ] + }, + { + "id": "notary_instance_internal", + "purpose": "Identifies the Notary instance and its deployment environment for operational correlation.", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ] + }, + { + "id": "notary_instance_sensitive", + "purpose": "Identifies the Notary instance and its deployment environment for operational correlation.", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ] + }, + { + "id": "notary_oid4vci_credential_configurations_open_map", + "purpose": "Each reviewed key names an OpenID4VCI credential configuration and each value defines the advertised and issued credential contract.", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "arbitrary_map_keys_not_fixed_properties" + ], + "open_map_semantics": "Each reviewed key names an OpenID4VCI credential configuration and each value defines the advertised and issued credential contract." + }, + { + "id": "notary_oid4vci_internal", + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ] + }, + { + "id": "notary_oid4vci_sensitive", + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ] + }, + { + "id": "notary_root_structural", + "purpose": "Defines the complete Notary runtime configuration boundary consumed when a Notary instance starts.", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "bound_by_environment", + "sensitivity": "structural", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ] + }, + { + "id": "notary_server_internal", + "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ] + }, + { + "id": "notary_server_sensitive", + "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ] + }, + { + "id": "notary_state_internal", + "purpose": "Controls Notary durable state storage, database trust, timeouts, connection limits, and sensitive-state protection.", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ] + }, + { + "id": "notary_state_secret_reference", + "purpose": "Controls Notary durable state storage, database trust, timeouts, connection limits, and sensitive-state protection.", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ] + }, + { + "id": "notary_state_sensitive", + "purpose": "Controls Notary durable state storage, database trust, timeouts, connection limits, and sensitive-state protection.", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ] + }, + { + "id": "notary_subject_access_sensitive", + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ] + } + ], + "assignments": [ + { + "schema": "notary", + "pointer": "", + "key_path": "", + "path_kind": "root", + "profile": "notary_root_structural", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/properties/audit", + "key_path": "audit", + "path_kind": "property", + "profile": "notary_audit_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuditConfig/properties/hash_secret_env", + "key_path": "audit.hash_secret_env", + "path_kind": "property", + "profile": "notary_audit_secret_reference", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuditConfig/properties/max_files", + "key_path": "audit.max_files", + "path_kind": "property", + "profile": "notary_audit_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuditConfig/properties/max_size_mb", + "key_path": "audit.max_size_mb", + "path_kind": "property", + "profile": "notary_audit_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuditConfig/properties/path", + "key_path": "audit.path", + "path_kind": "property", + "profile": "notary_audit_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuditConfig/properties/sink", + "key_path": "audit.sink", + "path_kind": "property", + "profile": "notary_audit_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuditConfig/properties/syslog_socket_path", + "key_path": "audit.syslog_socket_path", + "path_kind": "property", + "profile": "notary_audit_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/properties/auth", + "key_path": "auth", + "path_kind": "property", + "profile": "notary_auth_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthConfig/properties/access_token_signing", + "key_path": "auth.access_token_signing", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/AccessTokenSigningConfig/properties/access_token_ttl_seconds", + "key_path": "auth.access_token_signing.access_token_ttl_seconds", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/AccessTokenSigningConfig/properties/allowed_algorithms", + "key_path": "auth.access_token_signing.allowed_algorithms", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/AccessTokenSigningConfig/properties/allowed_algorithms/items", + "key_path": "auth.access_token_signing.allowed_algorithms[]", + "path_kind": "array_item", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/AccessTokenSigningConfig/properties/audiences", + "key_path": "auth.access_token_signing.audiences", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/AccessTokenSigningConfig/properties/audiences/items", + "key_path": "auth.access_token_signing.audiences[]", + "path_kind": "array_item", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/AccessTokenSigningConfig/properties/enabled", + "key_path": "auth.access_token_signing.enabled", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/AccessTokenSigningConfig/properties/issuer", + "key_path": "auth.access_token_signing.issuer", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/AccessTokenSigningConfig/properties/signing_key_id", + "key_path": "auth.access_token_signing.signing_key_id", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/AccessTokenSigningConfig/properties/token_typ", + "key_path": "auth.access_token_signing.token_typ", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/AccessTokenSigningConfig/properties/verification_key_ids", + "key_path": "auth.access_token_signing.verification_key_ids", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "schema_description", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/AccessTokenSigningConfig/properties/verification_key_ids/items", + "key_path": "auth.access_token_signing.verification_key_ids[]", + "path_kind": "array_item", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthConfig/properties/api_keys", + "key_path": "auth.api_keys", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthConfig/properties/api_keys/items", + "key_path": "auth.api_keys[]", + "path_kind": "array_item", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceCredentialConfig/properties/authorization_details", + "key_path": "auth.api_keys[].authorization_details", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "schema_description", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/access_mode", + "key_path": "auth.api_keys[].authorization_details.access_mode", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/actions", + "key_path": "auth.api_keys[].authorization_details.actions", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/actions/items", + "key_path": "auth.api_keys[].authorization_details.actions[]", + "path_kind": "array_item", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/assisted_access_context", + "key_path": "auth.api_keys[].authorization_details.assisted_access_context", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAssistedAccessContext/properties/channel", + "key_path": "auth.api_keys[].authorization_details.assisted_access_context.channel", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/assurance_level", + "key_path": "auth.api_keys[].authorization_details.assurance_level", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/claims", + "key_path": "auth.api_keys[].authorization_details.claims", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/claims/items", + "key_path": "auth.api_keys[].authorization_details.claims[]", + "path_kind": "array_item", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/ClaimRefObject/properties/id", + "key_path": "auth.api_keys[].authorization_details.claims[].id", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/ClaimRefObject/properties/version", + "key_path": "auth.api_keys[].authorization_details.claims[].version", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/consent_ref", + "key_path": "auth.api_keys[].authorization_details.consent_ref", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/disclosure", + "key_path": "auth.api_keys[].authorization_details.disclosure", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/format", + "key_path": "auth.api_keys[].authorization_details.format", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/jurisdiction", + "key_path": "auth.api_keys[].authorization_details.jurisdiction", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/legal_basis_ref", + "key_path": "auth.api_keys[].authorization_details.legal_basis_ref", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/locations", + "key_path": "auth.api_keys[].authorization_details.locations", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/locations/items", + "key_path": "auth.api_keys[].authorization_details.locations[]", + "path_kind": "array_item", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/purpose", + "key_path": "auth.api_keys[].authorization_details.purpose", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/relationship", + "key_path": "auth.api_keys[].authorization_details.relationship", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationRelationship/properties/proof_claim", + "key_path": "auth.api_keys[].authorization_details.relationship.proof_claim", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationRelationship/properties/relationship_type", + "key_path": "auth.api_keys[].authorization_details.relationship.relationship_type", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/schema_version", + "key_path": "auth.api_keys[].authorization_details.schema_version", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/subject", + "key_path": "auth.api_keys[].authorization_details.subject", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationSubject/properties/binding_claim", + "key_path": "auth.api_keys[].authorization_details.subject.binding_claim", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationSubject/properties/id_type", + "key_path": "auth.api_keys[].authorization_details.subject.id_type", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/target", + "key_path": "auth.api_keys[].authorization_details.target", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationTarget/properties/id", + "key_path": "auth.api_keys[].authorization_details.target.id", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationTarget/properties/id_type", + "key_path": "auth.api_keys[].authorization_details.target.id_type", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/type", + "key_path": "auth.api_keys[].authorization_details.type", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceCredentialConfig/properties/fingerprint", + "key_path": "auth.api_keys[].fingerprint", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/CredentialFingerprintRef/properties/name", + "key_path": "auth.api_keys[].fingerprint.name", + "path_kind": "property", + "profile": "notary_auth_secret_reference", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/CredentialFingerprintRef/properties/path", + "key_path": "auth.api_keys[].fingerprint.path", + "path_kind": "property", + "profile": "notary_auth_secret_reference", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/CredentialFingerprintRef/properties/provider", + "key_path": "auth.api_keys[].fingerprint.provider", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceCredentialConfig/properties/id", + "key_path": "auth.api_keys[].id", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceCredentialConfig/properties/scopes", + "key_path": "auth.api_keys[].scopes", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceCredentialConfig/properties/scopes/items", + "key_path": "auth.api_keys[].scopes[]", + "path_kind": "array_item", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthConfig/properties/bearer_tokens", + "key_path": "auth.bearer_tokens", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthConfig/properties/bearer_tokens/items", + "key_path": "auth.bearer_tokens[]", + "path_kind": "array_item", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceCredentialConfig/properties/authorization_details", + "key_path": "auth.bearer_tokens[].authorization_details", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "schema_description", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/access_mode", + "key_path": "auth.bearer_tokens[].authorization_details.access_mode", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/actions", + "key_path": "auth.bearer_tokens[].authorization_details.actions", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/actions/items", + "key_path": "auth.bearer_tokens[].authorization_details.actions[]", + "path_kind": "array_item", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/assisted_access_context", + "key_path": "auth.bearer_tokens[].authorization_details.assisted_access_context", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAssistedAccessContext/properties/channel", + "key_path": "auth.bearer_tokens[].authorization_details.assisted_access_context.channel", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/assurance_level", + "key_path": "auth.bearer_tokens[].authorization_details.assurance_level", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/claims", + "key_path": "auth.bearer_tokens[].authorization_details.claims", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/claims/items", + "key_path": "auth.bearer_tokens[].authorization_details.claims[]", + "path_kind": "array_item", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/ClaimRefObject/properties/id", + "key_path": "auth.bearer_tokens[].authorization_details.claims[].id", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/ClaimRefObject/properties/version", + "key_path": "auth.bearer_tokens[].authorization_details.claims[].version", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/consent_ref", + "key_path": "auth.bearer_tokens[].authorization_details.consent_ref", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/disclosure", + "key_path": "auth.bearer_tokens[].authorization_details.disclosure", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/format", + "key_path": "auth.bearer_tokens[].authorization_details.format", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/jurisdiction", + "key_path": "auth.bearer_tokens[].authorization_details.jurisdiction", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/legal_basis_ref", + "key_path": "auth.bearer_tokens[].authorization_details.legal_basis_ref", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/locations", + "key_path": "auth.bearer_tokens[].authorization_details.locations", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/locations/items", + "key_path": "auth.bearer_tokens[].authorization_details.locations[]", + "path_kind": "array_item", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/purpose", + "key_path": "auth.bearer_tokens[].authorization_details.purpose", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/relationship", + "key_path": "auth.bearer_tokens[].authorization_details.relationship", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationRelationship/properties/proof_claim", + "key_path": "auth.bearer_tokens[].authorization_details.relationship.proof_claim", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationRelationship/properties/relationship_type", + "key_path": "auth.bearer_tokens[].authorization_details.relationship.relationship_type", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/schema_version", + "key_path": "auth.bearer_tokens[].authorization_details.schema_version", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/subject", + "key_path": "auth.bearer_tokens[].authorization_details.subject", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationSubject/properties/binding_claim", + "key_path": "auth.bearer_tokens[].authorization_details.subject.binding_claim", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationSubject/properties/id_type", + "key_path": "auth.bearer_tokens[].authorization_details.subject.id_type", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/target", + "key_path": "auth.bearer_tokens[].authorization_details.target", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationTarget/properties/id", + "key_path": "auth.bearer_tokens[].authorization_details.target.id", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationTarget/properties/id_type", + "key_path": "auth.bearer_tokens[].authorization_details.target.id_type", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/type", + "key_path": "auth.bearer_tokens[].authorization_details.type", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceCredentialConfig/properties/fingerprint", + "key_path": "auth.bearer_tokens[].fingerprint", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/CredentialFingerprintRef/properties/name", + "key_path": "auth.bearer_tokens[].fingerprint.name", + "path_kind": "property", + "profile": "notary_auth_secret_reference", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/CredentialFingerprintRef/properties/path", + "key_path": "auth.bearer_tokens[].fingerprint.path", + "path_kind": "property", + "profile": "notary_auth_secret_reference", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/CredentialFingerprintRef/properties/provider", + "key_path": "auth.bearer_tokens[].fingerprint.provider", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceCredentialConfig/properties/id", + "key_path": "auth.bearer_tokens[].id", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceCredentialConfig/properties/scopes", + "key_path": "auth.bearer_tokens[].scopes", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceCredentialConfig/properties/scopes/items", + "key_path": "auth.bearer_tokens[].scopes[]", + "path_kind": "array_item", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthConfig/properties/oidc", + "key_path": "auth.oidc", + "path_kind": "property", + "profile": "notary_auth_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allow_insecure_localhost", + "key_path": "auth.oidc.allow_insecure_localhost", + "path_kind": "property", + "profile": "notary_auth_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_algorithms", + "key_path": "auth.oidc.allowed_algorithms", + "path_kind": "property", + "profile": "notary_auth_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_algorithms/items", + "key_path": "auth.oidc.allowed_algorithms[]", + "path_kind": "array_item", + "profile": "notary_auth_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_clients", + "key_path": "auth.oidc.allowed_clients", + "path_kind": "property", + "profile": "notary_auth_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_clients/items", + "key_path": "auth.oidc.allowed_clients[]", + "path_kind": "array_item", + "profile": "notary_auth_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_token_types", + "key_path": "auth.oidc.allowed_token_types", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_token_types/items", + "key_path": "auth.oidc.allowed_token_types[]", + "path_kind": "array_item", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/audiences", + "key_path": "auth.oidc.audiences", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/audiences/items", + "key_path": "auth.oidc.audiences[]", + "path_kind": "array_item", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/issuer", + "key_path": "auth.oidc.issuer", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/jwks_url", + "key_path": "auth.oidc.jwks_url", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/leeway", + "key_path": "auth.oidc.leeway", + "path_kind": "property", + "profile": "notary_auth_internal", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/principal_claim", + "key_path": "auth.oidc.principal_claim", + "path_kind": "property", + "profile": "notary_auth_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/scope_claim", + "key_path": "auth.oidc.scope_claim", + "path_kind": "property", + "profile": "notary_auth_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/scope_map", + "key_path": "auth.oidc.scope_map", + "path_kind": "property", + "profile": "notary_auth_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/scope_map/additionalProperties", + "key_path": "auth.oidc.scope_map.*", + "path_kind": "map_value", + "profile": "notary_auth_oidc_scope_map_open_map", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/scope_map/additionalProperties/items", + "key_path": "auth.oidc.scope_map.*[]", + "path_kind": "array_item", + "profile": "notary_auth_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/scope_separator", + "key_path": "auth.oidc.scope_separator", + "path_kind": "property", + "profile": "notary_auth_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/userinfo_endpoint", + "key_path": "auth.oidc.userinfo_endpoint", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/userinfo_issuers", + "key_path": "auth.oidc.userinfo_issuers", + "path_kind": "property", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/userinfo_issuers/items", + "key_path": "auth.oidc.userinfo_issuers[]", + "path_kind": "array_item", + "profile": "notary_auth_sensitive", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/properties/cel", + "key_path": "cel", + "path_kind": "property", + "profile": "notary_cel_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryCelConfig/properties/allow_regex", + "key_path": "cel.allow_regex", + "path_kind": "property", + "profile": "notary_cel_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryCelConfig/properties/eval_timeout_ms", + "key_path": "cel.eval_timeout_ms", + "path_kind": "property", + "profile": "notary_cel_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_binding_json_bytes", + "key_path": "cel.max_binding_json_bytes", + "path_kind": "property", + "profile": "notary_cel_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_expression_bytes", + "key_path": "cel.max_expression_bytes", + "path_kind": "property", + "profile": "notary_cel_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_list_items", + "key_path": "cel.max_list_items", + "path_kind": "property", + "profile": "notary_cel_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_object_depth", + "key_path": "cel.max_object_depth", + "path_kind": "property", + "profile": "notary_cel_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_object_keys", + "key_path": "cel.max_object_keys", + "path_kind": "property", + "profile": "notary_cel_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_result_json_bytes", + "key_path": "cel.max_result_json_bytes", + "path_kind": "property", + "profile": "notary_cel_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_string_bytes", + "key_path": "cel.max_string_bytes", + "path_kind": "property", + "profile": "notary_cel_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryCelConfig/properties/mode", + "key_path": "cel.mode", + "path_kind": "property", + "profile": "notary_cel_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryCelConfig/properties/worker_count", + "key_path": "cel.worker_count", + "path_kind": "property", + "profile": "notary_cel_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryCelConfig/properties/worker_memory_bytes", + "key_path": "cel.worker_memory_bytes", + "path_kind": "property", + "profile": "notary_cel_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryCelConfig/properties/worker_stderr_bytes", + "key_path": "cel.worker_stderr_bytes", + "path_kind": "property", + "profile": "notary_cel_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/properties/config_trust", + "key_path": "config_trust", + "path_kind": "property", + "profile": "notary_config_trust_internal", + "purpose_source": "schema_description", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/ConfigTrustConfig/properties/antirollback_state_path", + "key_path": "config_trust.antirollback_state_path", + "path_kind": "property", + "profile": "notary_config_trust_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/ConfigTrustConfig/properties/break_glass_override_path", + "key_path": "config_trust.break_glass_override_path", + "path_kind": "property", + "profile": "notary_config_trust_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/ConfigTrustConfig/properties/bundle_path", + "key_path": "config_trust.bundle_path", + "path_kind": "property", + "profile": "notary_config_trust_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/ConfigTrustConfig/properties/trust_anchor_path", + "key_path": "config_trust.trust_anchor_path", + "path_kind": "property", + "profile": "notary_config_trust_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/properties/credential_status", + "key_path": "credential_status", + "path_kind": "property", + "profile": "notary_credential_status_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/CredentialStatusConfig/properties/base_url", + "key_path": "credential_status.base_url", + "path_kind": "property", + "profile": "notary_credential_status_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/CredentialStatusConfig/properties/enabled", + "key_path": "credential_status.enabled", + "path_kind": "property", + "profile": "notary_credential_status_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/CredentialStatusConfig/properties/retention_seconds", + "key_path": "credential_status.retention_seconds", + "path_kind": "property", + "profile": "notary_credential_status_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/properties/deployment", + "key_path": "deployment", + "path_kind": "property", + "profile": "notary_deployment_internal", + "purpose_source": "schema_description", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/DeploymentConfig/properties/evidence", + "key_path": "deployment.evidence", + "path_kind": "property", + "profile": "notary_deployment_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_ack_cursor_path", + "key_path": "deployment.evidence.audit_ack_cursor_path", + "path_kind": "property", + "profile": "notary_deployment_sensitive", + "purpose_source": "schema_description", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_ack_max_age_secs", + "key_path": "deployment.evidence.audit_ack_max_age_secs", + "path_kind": "property", + "profile": "notary_deployment_internal", + "purpose_source": "schema_description", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_offhost_shipping", + "key_path": "deployment.evidence.audit_offhost_shipping", + "path_kind": "property", + "profile": "notary_deployment_internal", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/DeploymentEvidenceConfig/properties/signer_custody_approved", + "key_path": "deployment.evidence.signer_custody_approved", + "path_kind": "property", + "profile": "notary_deployment_internal", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/DeploymentConfig/properties/multi_instance", + "key_path": "deployment.multi_instance", + "path_kind": "property", + "profile": "notary_deployment_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/DeploymentConfig/properties/profile", + "key_path": "deployment.profile", + "path_kind": "property", + "profile": "notary_deployment_internal", + "purpose_source": "schema_description", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/DeploymentConfig/properties/waivers", + "key_path": "deployment.waivers", + "path_kind": "property", + "profile": "notary_deployment_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/DeploymentConfig/properties/waivers/items", + "key_path": "deployment.waivers[]", + "path_kind": "array_item", + "profile": "notary_deployment_internal", + "purpose_source": "schema_description", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/DeploymentWaiverConfig/properties/expires", + "key_path": "deployment.waivers[].expires", + "path_kind": "property", + "profile": "notary_deployment_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/DeploymentWaiverConfig/properties/finding", + "key_path": "deployment.waivers[].finding", + "path_kind": "property", + "profile": "notary_deployment_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/DeploymentWaiverConfig/properties/reference", + "key_path": "deployment.waivers[].reference", + "path_kind": "property", + "profile": "notary_deployment_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/DeploymentWaiverConfig/properties/summary", + "key_path": "deployment.waivers[].summary", + "path_kind": "property", + "profile": "notary_deployment_internal", + "purpose_source": "schema_description", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/properties/evidence", + "key_path": "evidence", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/allowed_purposes", + "key_path": "evidence.allowed_purposes", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/allowed_purposes/items", + "key_path": "evidence.allowed_purposes[]", + "path_kind": "array_item", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/api_base_url", + "key_path": "evidence.api_base_url", + "path_kind": "property", + "profile": "notary_evidence_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/api_version", + "key_path": "evidence.api_version", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/claims", + "key_path": "evidence.claims", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/claims_url", + "key_path": "evidence.claims_url", + "path_kind": "property", + "profile": "notary_evidence_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/claims/items", + "key_path": "evidence.claims[]", + "path_kind": "array_item", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/cccev", + "key_path": "evidence.claims[].cccev", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/CccevConfig/properties/evidence_type", + "key_path": "evidence.claims[].cccev.evidence_type", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/CccevConfig/properties/evidence_type_iri", + "key_path": "evidence.claims[].cccev.evidence_type_iri", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/CccevConfig/properties/requirement_type", + "key_path": "evidence.claims[].cccev.requirement_type", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/credential_profiles", + "key_path": "evidence.claims[].credential_profiles", + "path_kind": "property", + "profile": "notary_evidence_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/credential_profiles/items", + "key_path": "evidence.claims[].credential_profiles[]", + "path_kind": "array_item", + "profile": "notary_evidence_sensitive", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/depends_on", + "key_path": "evidence.claims[].depends_on", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/depends_on/items", + "key_path": "evidence.claims[].depends_on[]", + "path_kind": "array_item", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/disclosure", + "key_path": "evidence.claims[].disclosure", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/DisclosureConfig/properties/allowed", + "key_path": "evidence.claims[].disclosure.allowed", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/DisclosureConfig/properties/allowed/items", + "key_path": "evidence.claims[].disclosure.allowed[]", + "path_kind": "array_item", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/DisclosureConfig/properties/default", + "key_path": "evidence.claims[].disclosure.default", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/DisclosureConfig/properties/downgrade", + "key_path": "evidence.claims[].disclosure.downgrade", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/evidence_mode", + "key_path": "evidence.claims[].evidence_mode", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SealedClaimEvidenceMode/oneOf/0/properties/consultations", + "key_path": "evidence.claims[].evidence_mode.consultations", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SealedClaimEvidenceMode/oneOf/0/properties/consultations/additionalProperties", + "key_path": "evidence.claims[].evidence_mode.consultations.*", + "path_kind": "map_value", + "profile": "notary_evidence_claims_evidence_mode_consultations_open_map", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RelayConsultationConfig/properties/inputs", + "key_path": "evidence.claims[].evidence_mode.consultations.*.inputs", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RelayConsultationConfig/properties/inputs/additionalProperties", + "key_path": "evidence.claims[].evidence_mode.consultations.*.inputs.*", + "path_kind": "map_value", + "profile": "notary_evidence_claims_evidence_mode_consultations_inputs_open_map", + "purpose_source": "schema_description", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RelayConsultationConfig/properties/outputs", + "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RelayConsultationConfig/properties/outputs/additionalProperties", + "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*", + "path_kind": "map_value", + "profile": "notary_evidence_claims_evidence_mode_consultations_outputs_open_map", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RelayOutputContract/oneOf/2/properties/max_bytes", + "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.max_bytes", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RelayOutputContract/oneOf/1/properties/maximum", + "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.maximum", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RelayOutputContract/oneOf/1/properties/minimum", + "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.minimum", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RelayOutputContract/oneOf/0/properties/nullable", + "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.nullable", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RelayOutputContract/oneOf/0/properties/type", + "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.type", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RelayConsultationConfig/properties/profile", + "key_path": "evidence.claims[].evidence_mode.consultations.*.profile", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RelayConsultationProfileRef/properties/contract_hash", + "key_path": "evidence.claims[].evidence_mode.consultations.*.profile.contract_hash", + "path_kind": "property", + "profile": "notary_evidence_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RelayConsultationProfileRef/properties/id", + "key_path": "evidence.claims[].evidence_mode.consultations.*.profile.id", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SealedClaimEvidenceMode/oneOf/0/properties/type", + "key_path": "evidence.claims[].evidence_mode.type", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/formats", + "key_path": "evidence.claims[].formats", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/formats/items", + "key_path": "evidence.claims[].formats[]", + "path_kind": "array_item", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/id", + "key_path": "evidence.claims[].id", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/inputs", + "key_path": "evidence.claims[].inputs", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/inputs/items", + "key_path": "evidence.claims[].inputs[]", + "path_kind": "array_item", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/ClaimInputConfig/properties/name", + "key_path": "evidence.claims[].inputs[].name", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/ClaimInputConfig/properties/type", + "key_path": "evidence.claims[].inputs[].type", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/oots", + "key_path": "evidence.claims[].oots", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/OotsConfig/properties/authentication_level_of_assurance", + "key_path": "evidence.claims[].oots.authentication_level_of_assurance", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/OotsConfig/properties/enabled", + "key_path": "evidence.claims[].oots.enabled", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/OotsConfig/properties/evidence_type_classification", + "key_path": "evidence.claims[].oots.evidence_type_classification", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/OotsConfig/properties/evidence_type_list", + "key_path": "evidence.claims[].oots.evidence_type_list", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/OotsConfig/properties/languages", + "key_path": "evidence.claims[].oots.languages", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/OotsConfig/properties/languages/items", + "key_path": "evidence.claims[].oots.languages[]", + "path_kind": "array_item", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/OotsConfig/properties/reference_framework", + "key_path": "evidence.claims[].oots.reference_framework", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/OotsConfig/properties/requirement", + "key_path": "evidence.claims[].oots.requirement", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/operations", + "key_path": "evidence.claims[].operations", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/ClaimOperationsConfig/properties/batch_evaluate", + "key_path": "evidence.claims[].operations.batch_evaluate", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/BatchOperationConfig/properties/enabled", + "key_path": "evidence.claims[].operations.batch_evaluate.enabled", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/BatchOperationConfig/properties/max_subjects", + "key_path": "evidence.claims[].operations.batch_evaluate.max_subjects", + "path_kind": "property", + "profile": "notary_evidence_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/ClaimOperationsConfig/properties/evaluate", + "key_path": "evidence.claims[].operations.evaluate", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/OperationConfig/properties/enabled", + "key_path": "evidence.claims[].operations.evaluate.enabled", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/purpose", + "key_path": "evidence.claims[].purpose", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/required_scopes", + "key_path": "evidence.claims[].required_scopes", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/required_scopes/items", + "key_path": "evidence.claims[].required_scopes[]", + "path_kind": "array_item", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/rule", + "key_path": "evidence.claims[].rule", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RuleConfig/oneOf/2/properties/bindings", + "key_path": "evidence.claims[].rule.bindings", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/CelBindingsConfig/properties/claims", + "key_path": "evidence.claims[].rule.bindings.claims", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/CelBindingsConfig/properties/claims/additionalProperties", + "key_path": "evidence.claims[].rule.bindings.claims.*", + "path_kind": "map_value", + "profile": "notary_evidence_claims_rule_bindings_claims_open_map", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/ClaimBindingConfig/properties/binding_type", + "key_path": "evidence.claims[].rule.bindings.claims.*.binding_type", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/ClaimBindingConfig/properties/claim", + "key_path": "evidence.claims[].rule.bindings.claims.*.claim", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/CelBindingsConfig/properties/vars", + "key_path": "evidence.claims[].rule.bindings.vars", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RuleConfig/oneOf/0/properties/consultation", + "key_path": "evidence.claims[].rule.consultation", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RuleConfig/oneOf/2/properties/expression", + "key_path": "evidence.claims[].rule.expression", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RuleConfig/oneOf/0/properties/output", + "key_path": "evidence.claims[].rule.output", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RuleConfig/oneOf/0/properties/type", + "key_path": "evidence.claims[].rule.type", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/semantics", + "key_path": "evidence.claims[].semantics", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/ClaimSemanticConfig/properties/concept", + "key_path": "evidence.claims[].semantics.concept", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/ClaimSemanticConfig/properties/derived_from", + "key_path": "evidence.claims[].semantics.derived_from", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/ClaimSemanticConfig/properties/derived_from/items", + "key_path": "evidence.claims[].semantics.derived_from[]", + "path_kind": "array_item", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/ClaimSemanticConfig/properties/predicate", + "key_path": "evidence.claims[].semantics.predicate", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/ClaimSemanticConfig/properties/property", + "key_path": "evidence.claims[].semantics.property", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/ClaimSemanticConfig/properties/value_mapping", + "key_path": "evidence.claims[].semantics.value_mapping", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/ClaimSemanticConfig/properties/vocabulary", + "key_path": "evidence.claims[].semantics.vocabulary", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/subject_type", + "key_path": "evidence.claims[].subject_type", + "path_kind": "property", + "profile": "notary_evidence_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/title", + "key_path": "evidence.claims[].title", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/value", + "key_path": "evidence.claims[].value", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/ClaimValueConfig/properties/nullable", + "key_path": "evidence.claims[].value.nullable", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/ClaimValueConfig/properties/type", + "key_path": "evidence.claims[].value.type", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/ClaimValueConfig/properties/unit", + "key_path": "evidence.claims[].value.unit", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/version", + "key_path": "evidence.claims[].version", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/concurrency", + "key_path": "evidence.concurrency", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/ConcurrencyConfig/properties/subjects", + "key_path": "evidence.concurrency.subjects", + "path_kind": "property", + "profile": "notary_evidence_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/credential_profiles", + "key_path": "evidence.credential_profiles", + "path_kind": "property", + "profile": "notary_evidence_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/credential_profiles/additionalProperties", + "key_path": "evidence.credential_profiles.*", + "path_kind": "map_value", + "profile": "notary_evidence_credential_profiles_open_map", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/CredentialProfileConfig/properties/allowed_claims", + "key_path": "evidence.credential_profiles.*.allowed_claims", + "path_kind": "property", + "profile": "notary_evidence_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/CredentialProfileConfig/properties/allowed_claims/items", + "key_path": "evidence.credential_profiles.*.allowed_claims[]", + "path_kind": "array_item", + "profile": "notary_evidence_sensitive", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/CredentialProfileConfig/properties/disclosure", + "key_path": "evidence.credential_profiles.*.disclosure", + "path_kind": "property", + "profile": "notary_evidence_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/CredentialDisclosureConfig/properties/allowed", + "key_path": "evidence.credential_profiles.*.disclosure.allowed", + "path_kind": "property", + "profile": "notary_evidence_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/CredentialDisclosureConfig/properties/allowed/items", + "key_path": "evidence.credential_profiles.*.disclosure.allowed[]", + "path_kind": "array_item", + "profile": "notary_evidence_sensitive", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/CredentialProfileConfig/properties/format", + "key_path": "evidence.credential_profiles.*.format", + "path_kind": "property", + "profile": "notary_evidence_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/CredentialProfileConfig/properties/holder_binding", + "key_path": "evidence.credential_profiles.*.holder_binding", + "path_kind": "property", + "profile": "notary_evidence_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/HolderBindingConfig/properties/allowed_did_methods", + "key_path": "evidence.credential_profiles.*.holder_binding.allowed_did_methods", + "path_kind": "property", + "profile": "notary_evidence_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/HolderBindingConfig/properties/allowed_did_methods/items", + "key_path": "evidence.credential_profiles.*.holder_binding.allowed_did_methods[]", + "path_kind": "array_item", + "profile": "notary_evidence_sensitive", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/HolderBindingConfig/properties/mode", + "key_path": "evidence.credential_profiles.*.holder_binding.mode", + "path_kind": "property", + "profile": "notary_evidence_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/HolderBindingConfig/properties/proof_of_possession", + "key_path": "evidence.credential_profiles.*.holder_binding.proof_of_possession", + "path_kind": "property", + "profile": "notary_evidence_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/CredentialProfileConfig/properties/issuer", + "key_path": "evidence.credential_profiles.*.issuer", + "path_kind": "property", + "profile": "notary_evidence_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/CredentialProfileConfig/properties/signing_key", + "key_path": "evidence.credential_profiles.*.signing_key", + "path_kind": "property", + "profile": "notary_evidence_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/CredentialProfileConfig/properties/validity_seconds", + "key_path": "evidence.credential_profiles.*.validity_seconds", + "path_kind": "property", + "profile": "notary_evidence_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/CredentialProfileConfig/properties/vct", + "key_path": "evidence.credential_profiles.*.vct", + "path_kind": "property", + "profile": "notary_evidence_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/enabled", + "key_path": "evidence.enabled", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/formats_url", + "key_path": "evidence.formats_url", + "path_kind": "property", + "profile": "notary_evidence_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/inline_batch_limit", + "key_path": "evidence.inline_batch_limit", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/machine_quota", + "key_path": "evidence.machine_quota", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/MachineQuotaConfig/properties/enabled", + "key_path": "evidence.machine_quota.enabled", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/MachineQuotaConfig/properties/subjects_per_minute", + "key_path": "evidence.machine_quota.subjects_per_minute", + "path_kind": "property", + "profile": "notary_evidence_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/max_credential_validity_seconds", + "key_path": "evidence.max_credential_validity_seconds", + "path_kind": "property", + "profile": "notary_evidence_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/relay", + "key_path": "evidence.relay", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "schema_description", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RelayConnectionConfig/properties/allow_insecure_localhost", + "key_path": "evidence.relay.allow_insecure_localhost", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RelayConnectionConfig/properties/allowed_private_cidrs", + "key_path": "evidence.relay.allowed_private_cidrs", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RelayConnectionConfig/properties/allowed_private_cidrs/items", + "key_path": "evidence.relay.allowed_private_cidrs[]", + "path_kind": "array_item", + "profile": "notary_evidence_internal", + "purpose_source": "schema_description", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RelayConnectionConfig/properties/base_url", + "key_path": "evidence.relay.base_url", + "path_kind": "property", + "profile": "notary_evidence_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RelayConnectionConfig/properties/max_in_flight", + "key_path": "evidence.relay.max_in_flight", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RelayConnectionConfig/properties/token_file", + "key_path": "evidence.relay.token_file", + "path_kind": "property", + "profile": "notary_evidence_secret_reference", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RelayConnectionConfig/properties/workload_client_id", + "key_path": "evidence.relay.workload_client_id", + "path_kind": "property", + "profile": "notary_evidence_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/service_id", + "key_path": "evidence.service_id", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/signing_keys", + "key_path": "evidence.signing_keys", + "path_kind": "property", + "profile": "notary_evidence_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/signing_keys/additionalProperties", + "key_path": "evidence.signing_keys.*", + "path_kind": "map_value", + "profile": "notary_evidence_signing_keys_open_map", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SigningKeyConfig/properties/alg", + "key_path": "evidence.signing_keys.*.alg", + "path_kind": "property", + "profile": "notary_evidence_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SigningKeyConfig/properties/key_id_hex", + "key_path": "evidence.signing_keys.*.key_id_hex", + "path_kind": "property", + "profile": "notary_evidence_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SigningKeyConfig/properties/key_label", + "key_path": "evidence.signing_keys.*.key_label", + "path_kind": "property", + "profile": "notary_evidence_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SigningKeyConfig/properties/kid", + "key_path": "evidence.signing_keys.*.kid", + "path_kind": "property", + "profile": "notary_evidence_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SigningKeyConfig/properties/module_path", + "key_path": "evidence.signing_keys.*.module_path", + "path_kind": "property", + "profile": "notary_evidence_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SigningKeyConfig/properties/password_env", + "key_path": "evidence.signing_keys.*.password_env", + "path_kind": "property", + "profile": "notary_evidence_secret_reference", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SigningKeyConfig/properties/path", + "key_path": "evidence.signing_keys.*.path", + "path_kind": "property", + "profile": "notary_evidence_secret_reference", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SigningKeyConfig/properties/pin_env", + "key_path": "evidence.signing_keys.*.pin_env", + "path_kind": "property", + "profile": "notary_evidence_secret_reference", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SigningKeyConfig/properties/private_jwk_env", + "key_path": "evidence.signing_keys.*.private_jwk_env", + "path_kind": "property", + "profile": "notary_evidence_secret_reference", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SigningKeyConfig/properties/provider", + "key_path": "evidence.signing_keys.*.provider", + "path_kind": "property", + "profile": "notary_evidence_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SigningKeyConfig/properties/public_jwk_env", + "key_path": "evidence.signing_keys.*.public_jwk_env", + "path_kind": "property", + "profile": "notary_evidence_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SigningKeyConfig/properties/publish_until_unix_seconds", + "key_path": "evidence.signing_keys.*.publish_until_unix_seconds", + "path_kind": "property", + "profile": "notary_evidence_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SigningKeyConfig/properties/status", + "key_path": "evidence.signing_keys.*.status", + "path_kind": "property", + "profile": "notary_evidence_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SigningKeyConfig/properties/token_label", + "key_path": "evidence.signing_keys.*.token_label", + "path_kind": "property", + "profile": "notary_evidence_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/variables", + "key_path": "evidence.variables", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/variables/additionalProperties", + "key_path": "evidence.variables.*", + "path_kind": "map_value", + "profile": "notary_evidence_variables_open_map", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RequestVariableConfig/properties/from", + "key_path": "evidence.variables.*.from", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RequestVariableConfig/properties/type", + "key_path": "evidence.variables.*.type", + "path_kind": "property", + "profile": "notary_evidence_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/properties/federation", + "key_path": "federation", + "path_kind": "property", + "profile": "notary_federation_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/clock_leeway_seconds", + "key_path": "federation.clock_leeway_seconds", + "path_kind": "property", + "profile": "notary_federation_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/emergency_denylist", + "key_path": "federation.emergency_denylist", + "path_kind": "property", + "profile": "notary_federation_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/FederationEmergencyDenylistConfig/properties/kids", + "key_path": "federation.emergency_denylist.kids", + "path_kind": "property", + "profile": "notary_federation_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/FederationEmergencyDenylistConfig/properties/kids/items", + "key_path": "federation.emergency_denylist.kids[]", + "path_kind": "array_item", + "profile": "notary_federation_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/FederationEmergencyDenylistConfig/properties/node_ids", + "key_path": "federation.emergency_denylist.node_ids", + "path_kind": "property", + "profile": "notary_federation_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/FederationEmergencyDenylistConfig/properties/node_ids/items", + "key_path": "federation.emergency_denylist.node_ids[]", + "path_kind": "array_item", + "profile": "notary_federation_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/enabled", + "key_path": "federation.enabled", + "path_kind": "property", + "profile": "notary_federation_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/evaluation_profiles", + "key_path": "federation.evaluation_profiles", + "path_kind": "property", + "profile": "notary_federation_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/evaluation_profiles/items", + "key_path": "federation.evaluation_profiles[]", + "path_kind": "array_item", + "profile": "notary_federation_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/FederationEvaluationProfileConfig/properties/assurance_level", + "key_path": "federation.evaluation_profiles[].assurance_level", + "path_kind": "property", + "profile": "notary_federation_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/FederationEvaluationProfileConfig/properties/claim_id", + "key_path": "federation.evaluation_profiles[].claim_id", + "path_kind": "property", + "profile": "notary_federation_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/FederationEvaluationProfileConfig/properties/consent_ref", + "key_path": "federation.evaluation_profiles[].consent_ref", + "path_kind": "property", + "profile": "notary_federation_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/FederationEvaluationProfileConfig/properties/disclosure", + "key_path": "federation.evaluation_profiles[].disclosure", + "path_kind": "property", + "profile": "notary_federation_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/FederationEvaluationProfileConfig/properties/id", + "key_path": "federation.evaluation_profiles[].id", + "path_kind": "property", + "profile": "notary_federation_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/FederationEvaluationProfileConfig/properties/jurisdiction", + "key_path": "federation.evaluation_profiles[].jurisdiction", + "path_kind": "property", + "profile": "notary_federation_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/FederationEvaluationProfileConfig/properties/legal_basis_ref", + "key_path": "federation.evaluation_profiles[].legal_basis_ref", + "path_kind": "property", + "profile": "notary_federation_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/FederationEvaluationProfileConfig/properties/max_claim_result_age_seconds", + "key_path": "federation.evaluation_profiles[].max_claim_result_age_seconds", + "path_kind": "property", + "profile": "notary_federation_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/FederationEvaluationProfileConfig/properties/ruleset", + "key_path": "federation.evaluation_profiles[].ruleset", + "path_kind": "property", + "profile": "notary_federation_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/FederationEvaluationProfileConfig/properties/subject_id_type", + "key_path": "federation.evaluation_profiles[].subject_id_type", + "path_kind": "property", + "profile": "notary_federation_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/federation_api", + "key_path": "federation.federation_api", + "path_kind": "property", + "profile": "notary_federation_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/inbound_body_limit_bytes", + "key_path": "federation.inbound_body_limit_bytes", + "path_kind": "property", + "profile": "notary_federation_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/issuer", + "key_path": "federation.issuer", + "path_kind": "property", + "profile": "notary_federation_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/jwks_uri", + "key_path": "federation.jwks_uri", + "path_kind": "property", + "profile": "notary_federation_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/max_request_lifetime_seconds", + "key_path": "federation.max_request_lifetime_seconds", + "path_kind": "property", + "profile": "notary_federation_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/node_id", + "key_path": "federation.node_id", + "path_kind": "property", + "profile": "notary_federation_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/pairwise_subject_hash", + "key_path": "federation.pairwise_subject_hash", + "path_kind": "property", + "profile": "notary_federation_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/FederationPairwiseSubjectHashConfig/properties/secret_env", + "key_path": "federation.pairwise_subject_hash.secret_env", + "path_kind": "property", + "profile": "notary_federation_secret_reference", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/peers", + "key_path": "federation.peers", + "path_kind": "property", + "profile": "notary_federation_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/peers/items", + "key_path": "federation.peers[]", + "path_kind": "array_item", + "profile": "notary_federation_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/FederationPeerConfig/properties/allow_insecure_localhost", + "key_path": "federation.peers[].allow_insecure_localhost", + "path_kind": "property", + "profile": "notary_federation_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/FederationPeerConfig/properties/allow_insecure_private_network", + "key_path": "federation.peers[].allow_insecure_private_network", + "path_kind": "property", + "profile": "notary_federation_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/FederationPeerConfig/properties/allowed_profiles", + "key_path": "federation.peers[].allowed_profiles", + "path_kind": "property", + "profile": "notary_federation_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/FederationPeerConfig/properties/allowed_profiles/items", + "key_path": "federation.peers[].allowed_profiles[]", + "path_kind": "array_item", + "profile": "notary_federation_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/FederationPeerConfig/properties/allowed_protocol_versions", + "key_path": "federation.peers[].allowed_protocol_versions", + "path_kind": "property", + "profile": "notary_federation_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/FederationPeerConfig/properties/allowed_protocol_versions/items", + "key_path": "federation.peers[].allowed_protocol_versions[]", + "path_kind": "array_item", + "profile": "notary_federation_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/FederationPeerConfig/properties/allowed_purposes", + "key_path": "federation.peers[].allowed_purposes", + "path_kind": "property", + "profile": "notary_federation_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/FederationPeerConfig/properties/allowed_purposes/items", + "key_path": "federation.peers[].allowed_purposes[]", + "path_kind": "array_item", + "profile": "notary_federation_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/FederationPeerConfig/properties/evaluation_scopes", + "key_path": "federation.peers[].evaluation_scopes", + "path_kind": "property", + "profile": "notary_federation_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/FederationPeerConfig/properties/evaluation_scopes/items", + "key_path": "federation.peers[].evaluation_scopes[]", + "path_kind": "array_item", + "profile": "notary_federation_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/FederationPeerConfig/properties/issuer", + "key_path": "federation.peers[].issuer", + "path_kind": "property", + "profile": "notary_federation_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/FederationPeerConfig/properties/jwks_uri", + "key_path": "federation.peers[].jwks_uri", + "path_kind": "property", + "profile": "notary_federation_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/FederationPeerConfig/properties/node_id", + "key_path": "federation.peers[].node_id", + "path_kind": "property", + "profile": "notary_federation_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/response_shaping", + "key_path": "federation.response_shaping", + "path_kind": "property", + "profile": "notary_federation_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/FederationResponseShapingConfig/properties/minimum_denial_latency_ms", + "key_path": "federation.response_shaping.minimum_denial_latency_ms", + "path_kind": "property", + "profile": "notary_federation_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/signing", + "key_path": "federation.signing", + "path_kind": "property", + "profile": "notary_federation_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/FederationSigningConfig/properties/signing_key", + "key_path": "federation.signing.signing_key", + "path_kind": "property", + "profile": "notary_federation_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/supported_protocol_versions", + "key_path": "federation.supported_protocol_versions", + "path_kind": "property", + "profile": "notary_federation_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/supported_protocol_versions/items", + "key_path": "federation.supported_protocol_versions[]", + "path_kind": "array_item", + "profile": "notary_federation_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/properties/instance", + "key_path": "instance", + "path_kind": "property", + "profile": "notary_instance_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/NotaryInstanceConfig/properties/environment", + "key_path": "instance.environment", + "path_kind": "property", + "profile": "notary_instance_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/NotaryInstanceConfig/properties/id", + "key_path": "instance.id", + "path_kind": "property", + "profile": "notary_instance_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/NotaryInstanceConfig/properties/jurisdiction", + "key_path": "instance.jurisdiction", + "path_kind": "property", + "profile": "notary_instance_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/NotaryInstanceConfig/properties/owner", + "key_path": "instance.owner", + "path_kind": "property", + "profile": "notary_instance_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/NotaryInstanceConfig/properties/public_base_url", + "key_path": "instance.public_base_url", + "path_kind": "property", + "profile": "notary_instance_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/properties/oid4vci", + "key_path": "oid4vci", + "path_kind": "property", + "profile": "notary_oid4vci_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig/properties/accepted_token_audiences", + "key_path": "oid4vci.accepted_token_audiences", + "path_kind": "property", + "profile": "notary_oid4vci_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig/properties/accepted_token_audiences/items", + "key_path": "oid4vci.accepted_token_audiences[]", + "path_kind": "array_item", + "profile": "notary_oid4vci_sensitive", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig/properties/authorization", + "key_path": "oid4vci.authorization", + "path_kind": "property", + "profile": "notary_oid4vci_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig/properties/authorization_servers", + "key_path": "oid4vci.authorization_servers", + "path_kind": "property", + "profile": "notary_oid4vci_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig/properties/authorization_servers/items", + "key_path": "oid4vci.authorization_servers[]", + "path_kind": "array_item", + "profile": "notary_oid4vci_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciAuthorizationConfig/properties/require_pkce_method", + "key_path": "oid4vci.authorization.require_pkce_method", + "path_kind": "property", + "profile": "notary_oid4vci_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig/properties/credential_configurations", + "key_path": "oid4vci.credential_configurations", + "path_kind": "property", + "profile": "notary_oid4vci_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig/properties/credential_configurations/additionalProperties", + "key_path": "oid4vci.credential_configurations.*", + "path_kind": "map_value", + "profile": "notary_oid4vci_credential_configurations_open_map", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/claim_id", + "key_path": "oid4vci.credential_configurations.*.claim_id", + "path_kind": "property", + "profile": "notary_oid4vci_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/claims", + "key_path": "oid4vci.credential_configurations.*.claims", + "path_kind": "property", + "profile": "notary_oid4vci_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/claims/items", + "key_path": "oid4vci.credential_configurations.*.claims[]", + "path_kind": "array_item", + "profile": "notary_oid4vci_sensitive", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialClaimConfig/properties/display_name", + "key_path": "oid4vci.credential_configurations.*.claims[].display_name", + "path_kind": "property", + "profile": "notary_oid4vci_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialClaimConfig/properties/id", + "key_path": "oid4vci.credential_configurations.*.claims[].id", + "path_kind": "property", + "profile": "notary_oid4vci_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialClaimConfig/properties/output_path", + "key_path": "oid4vci.credential_configurations.*.claims[].output_path", + "path_kind": "property", + "profile": "notary_oid4vci_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialClaimConfig/properties/output_path/items", + "key_path": "oid4vci.credential_configurations.*.claims[].output_path[]", + "path_kind": "array_item", + "profile": "notary_oid4vci_sensitive", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialClaimConfig/properties/sd", + "key_path": "oid4vci.credential_configurations.*.claims[].sd", + "path_kind": "property", + "profile": "notary_oid4vci_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/credential_profile", + "key_path": "oid4vci.credential_configurations.*.credential_profile", + "path_kind": "property", + "profile": "notary_oid4vci_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/cryptographic_binding_methods_supported", + "key_path": "oid4vci.credential_configurations.*.cryptographic_binding_methods_supported", + "path_kind": "property", + "profile": "notary_oid4vci_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/cryptographic_binding_methods_supported/items", + "key_path": "oid4vci.credential_configurations.*.cryptographic_binding_methods_supported[]", + "path_kind": "array_item", + "profile": "notary_oid4vci_sensitive", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/display", + "key_path": "oid4vci.credential_configurations.*.display", + "path_kind": "property", + "profile": "notary_oid4vci_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/display_name", + "key_path": "oid4vci.credential_configurations.*.display_name", + "path_kind": "property", + "profile": "notary_oid4vci_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/background_color", + "key_path": "oid4vci.credential_configurations.*.display.background_color", + "path_kind": "property", + "profile": "notary_oid4vci_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/background_image", + "key_path": "oid4vci.credential_configurations.*.display.background_image", + "path_kind": "property", + "profile": "notary_oid4vci_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/alt_text", + "key_path": "oid4vci.credential_configurations.*.display.background_image.alt_text", + "path_kind": "property", + "profile": "notary_oid4vci_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/uri", + "key_path": "oid4vci.credential_configurations.*.display.background_image.uri", + "path_kind": "property", + "profile": "notary_oid4vci_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/url", + "key_path": "oid4vci.credential_configurations.*.display.background_image.url", + "path_kind": "property", + "profile": "notary_oid4vci_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/description", + "key_path": "oid4vci.credential_configurations.*.display.description", + "path_kind": "property", + "profile": "notary_oid4vci_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/locale", + "key_path": "oid4vci.credential_configurations.*.display.locale", + "path_kind": "property", + "profile": "notary_oid4vci_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/logo", + "key_path": "oid4vci.credential_configurations.*.display.logo", + "path_kind": "property", + "profile": "notary_oid4vci_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/alt_text", + "key_path": "oid4vci.credential_configurations.*.display.logo.alt_text", + "path_kind": "property", + "profile": "notary_oid4vci_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/uri", + "key_path": "oid4vci.credential_configurations.*.display.logo.uri", + "path_kind": "property", + "profile": "notary_oid4vci_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/url", + "key_path": "oid4vci.credential_configurations.*.display.logo.url", + "path_kind": "property", + "profile": "notary_oid4vci_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/secondary_image", + "key_path": "oid4vci.credential_configurations.*.display.secondary_image", + "path_kind": "property", + "profile": "notary_oid4vci_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/alt_text", + "key_path": "oid4vci.credential_configurations.*.display.secondary_image.alt_text", + "path_kind": "property", + "profile": "notary_oid4vci_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/uri", + "key_path": "oid4vci.credential_configurations.*.display.secondary_image.uri", + "path_kind": "property", + "profile": "notary_oid4vci_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/url", + "key_path": "oid4vci.credential_configurations.*.display.secondary_image.url", + "path_kind": "property", + "profile": "notary_oid4vci_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/text_color", + "key_path": "oid4vci.credential_configurations.*.display.text_color", + "path_kind": "property", + "profile": "notary_oid4vci_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/format", + "key_path": "oid4vci.credential_configurations.*.format", + "path_kind": "property", + "profile": "notary_oid4vci_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/proof_signing_alg_values_supported", + "key_path": "oid4vci.credential_configurations.*.proof_signing_alg_values_supported", + "path_kind": "property", + "profile": "notary_oid4vci_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/proof_signing_alg_values_supported/items", + "key_path": "oid4vci.credential_configurations.*.proof_signing_alg_values_supported[]", + "path_kind": "array_item", + "profile": "notary_oid4vci_sensitive", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/scope", + "key_path": "oid4vci.credential_configurations.*.scope", + "path_kind": "property", + "profile": "notary_oid4vci_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/vct", + "key_path": "oid4vci.credential_configurations.*.vct", + "path_kind": "property", + "profile": "notary_oid4vci_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig/properties/credential_endpoint", + "key_path": "oid4vci.credential_endpoint", + "path_kind": "property", + "profile": "notary_oid4vci_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig/properties/credential_issuer", + "key_path": "oid4vci.credential_issuer", + "path_kind": "property", + "profile": "notary_oid4vci_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig/properties/display", + "key_path": "oid4vci.display", + "path_kind": "property", + "profile": "notary_oid4vci_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig/properties/display/items", + "key_path": "oid4vci.display[]", + "path_kind": "array_item", + "profile": "notary_oid4vci_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciIssuerDisplayConfig/properties/locale", + "key_path": "oid4vci.display[].locale", + "path_kind": "property", + "profile": "notary_oid4vci_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciIssuerDisplayConfig/properties/logo", + "key_path": "oid4vci.display[].logo", + "path_kind": "property", + "profile": "notary_oid4vci_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/alt_text", + "key_path": "oid4vci.display[].logo.alt_text", + "path_kind": "property", + "profile": "notary_oid4vci_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/uri", + "key_path": "oid4vci.display[].logo.uri", + "path_kind": "property", + "profile": "notary_oid4vci_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/url", + "key_path": "oid4vci.display[].logo.url", + "path_kind": "property", + "profile": "notary_oid4vci_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciIssuerDisplayConfig/properties/name", + "key_path": "oid4vci.display[].name", + "path_kind": "property", + "profile": "notary_oid4vci_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig/properties/enabled", + "key_path": "oid4vci.enabled", + "path_kind": "property", + "profile": "notary_oid4vci_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig/properties/nonce", + "key_path": "oid4vci.nonce", + "path_kind": "property", + "profile": "notary_oid4vci_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig/properties/nonce_endpoint", + "key_path": "oid4vci.nonce_endpoint", + "path_kind": "property", + "profile": "notary_oid4vci_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciNonceConfig/properties/enabled", + "key_path": "oid4vci.nonce.enabled", + "path_kind": "property", + "profile": "notary_oid4vci_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciNonceConfig/properties/ttl_seconds", + "key_path": "oid4vci.nonce.ttl_seconds", + "path_kind": "property", + "profile": "notary_oid4vci_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig/properties/offer_endpoint", + "key_path": "oid4vci.offer_endpoint", + "path_kind": "property", + "profile": "notary_oid4vci_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig/properties/pre_authorized_code", + "key_path": "oid4vci.pre_authorized_code", + "path_kind": "property", + "profile": "notary_oid4vci_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciPreAuthorizedCodeConfig/properties/enabled", + "key_path": "oid4vci.pre_authorized_code.enabled", + "path_kind": "property", + "profile": "notary_oid4vci_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciPreAuthorizedCodeConfig/properties/esignet", + "key_path": "oid4vci.pre_authorized_code.esignet", + "path_kind": "property", + "profile": "notary_oid4vci_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/allow_insecure_localhost", + "key_path": "oid4vci.pre_authorized_code.esignet.allow_insecure_localhost", + "path_kind": "property", + "profile": "notary_oid4vci_internal", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/authorize_url", + "key_path": "oid4vci.pre_authorized_code.esignet.authorize_url", + "path_kind": "property", + "profile": "notary_oid4vci_sensitive", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/client_id", + "key_path": "oid4vci.pre_authorized_code.esignet.client_id", + "path_kind": "property", + "profile": "notary_oid4vci_sensitive", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/client_signing_key_id", + "key_path": "oid4vci.pre_authorized_code.esignet.client_signing_key_id", + "path_kind": "property", + "profile": "notary_oid4vci_sensitive", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/issuer", + "key_path": "oid4vci.pre_authorized_code.esignet.issuer", + "path_kind": "property", + "profile": "notary_oid4vci_sensitive", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/jwks_uri", + "key_path": "oid4vci.pre_authorized_code.esignet.jwks_uri", + "path_kind": "property", + "profile": "notary_oid4vci_internal", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/login_state_ttl_seconds", + "key_path": "oid4vci.pre_authorized_code.esignet.login_state_ttl_seconds", + "path_kind": "property", + "profile": "notary_oid4vci_internal", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/redirect_uri", + "key_path": "oid4vci.pre_authorized_code.esignet.redirect_uri", + "path_kind": "property", + "profile": "notary_oid4vci_internal", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/scopes", + "key_path": "oid4vci.pre_authorized_code.esignet.scopes", + "path_kind": "property", + "profile": "notary_oid4vci_internal", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/scopes/items", + "key_path": "oid4vci.pre_authorized_code.esignet.scopes[]", + "path_kind": "array_item", + "profile": "notary_oid4vci_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/token_url", + "key_path": "oid4vci.pre_authorized_code.esignet.token_url", + "path_kind": "property", + "profile": "notary_oid4vci_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/userinfo_url", + "key_path": "oid4vci.pre_authorized_code.esignet.userinfo_url", + "path_kind": "property", + "profile": "notary_oid4vci_sensitive", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciPreAuthorizedCodeConfig/properties/pre_authorized_code_ttl_seconds", + "key_path": "oid4vci.pre_authorized_code.pre_authorized_code_ttl_seconds", + "path_kind": "property", + "profile": "notary_oid4vci_internal", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciPreAuthorizedCodeConfig/properties/tx_code", + "key_path": "oid4vci.pre_authorized_code.tx_code", + "path_kind": "property", + "profile": "notary_oid4vci_internal", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciTxCodeConfig/properties/input_mode", + "key_path": "oid4vci.pre_authorized_code.tx_code.input_mode", + "path_kind": "property", + "profile": "notary_oid4vci_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciTxCodeConfig/properties/length", + "key_path": "oid4vci.pre_authorized_code.tx_code.length", + "path_kind": "property", + "profile": "notary_oid4vci_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciTxCodeConfig/properties/required", + "key_path": "oid4vci.pre_authorized_code.tx_code.required", + "path_kind": "property", + "profile": "notary_oid4vci_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig/properties/proof", + "key_path": "oid4vci.proof", + "path_kind": "property", + "profile": "notary_oid4vci_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciProofConfig/properties/max_age_seconds", + "key_path": "oid4vci.proof.max_age_seconds", + "path_kind": "property", + "profile": "notary_oid4vci_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciProofConfig/properties/max_clock_skew_seconds", + "key_path": "oid4vci.proof.max_clock_skew_seconds", + "path_kind": "property", + "profile": "notary_oid4vci_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/properties/server", + "key_path": "server", + "path_kind": "property", + "profile": "notary_server_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryHttpConfig/properties/admin_listener", + "key_path": "server.admin_listener", + "path_kind": "property", + "profile": "notary_server_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryAdminListenerConfig/properties/bind", + "key_path": "server.admin_listener.bind", + "path_kind": "property", + "profile": "notary_server_internal", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryAdminListenerConfig/properties/mode", + "key_path": "server.admin_listener.mode", + "path_kind": "property", + "profile": "notary_server_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryHttpConfig/properties/bind", + "key_path": "server.bind", + "path_kind": "property", + "profile": "notary_server_internal", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryHttpConfig/properties/cors", + "key_path": "server.cors", + "path_kind": "property", + "profile": "notary_server_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryCorsConfig/properties/allowed_origins", + "key_path": "server.cors.allowed_origins", + "path_kind": "property", + "profile": "notary_server_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryCorsConfig/properties/allowed_origins/items", + "key_path": "server.cors.allowed_origins[]", + "path_kind": "array_item", + "profile": "notary_server_sensitive", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryHttpConfig/properties/http1_header_read_timeout", + "key_path": "server.http1_header_read_timeout", + "path_kind": "property", + "profile": "notary_server_internal", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryHttpConfig/properties/max_connections", + "key_path": "server.max_connections", + "path_kind": "property", + "profile": "notary_server_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryHttpConfig/properties/openapi_requires_auth", + "key_path": "server.openapi_requires_auth", + "path_kind": "property", + "profile": "notary_server_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryHttpConfig/properties/request_body_timeout", + "key_path": "server.request_body_timeout", + "path_kind": "property", + "profile": "notary_server_internal", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryHttpConfig/properties/request_timeout", + "key_path": "server.request_timeout", + "path_kind": "property", + "profile": "notary_server_internal", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryHttpConfig/properties/trusted_proxy_ips", + "key_path": "server.trusted_proxy_ips", + "path_kind": "property", + "profile": "notary_server_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryHttpConfig/properties/trusted_proxy_ips/items", + "key_path": "server.trusted_proxy_ips[]", + "path_kind": "array_item", + "profile": "notary_server_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/properties/state", + "key_path": "state", + "path_kind": "property", + "profile": "notary_state_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/StateConfig/properties/postgresql", + "key_path": "state.postgresql", + "path_kind": "property", + "profile": "notary_state_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/StatePostgresqlConfig/properties/connect_timeout_ms", + "key_path": "state.postgresql.connect_timeout_ms", + "path_kind": "property", + "profile": "notary_state_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/StatePostgresqlConfig/properties/max_connections", + "key_path": "state.postgresql.max_connections", + "path_kind": "property", + "profile": "notary_state_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/StatePostgresqlConfig/properties/operation_timeout_ms", + "key_path": "state.postgresql.operation_timeout_ms", + "path_kind": "property", + "profile": "notary_state_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/StatePostgresqlConfig/properties/root_certificate_path", + "key_path": "state.postgresql.root_certificate_path", + "path_kind": "property", + "profile": "notary_state_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/StatePostgresqlConfig/properties/sensitive_state_key_env", + "key_path": "state.postgresql.sensitive_state_key_env", + "path_kind": "property", + "profile": "notary_state_secret_reference", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/StatePostgresqlConfig/properties/url_env", + "key_path": "state.postgresql.url_env", + "path_kind": "property", + "profile": "notary_state_secret_reference", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/StateConfig/properties/storage", + "key_path": "state.storage", + "path_kind": "property", + "profile": "notary_state_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/properties/subject_access", + "key_path": "subject_access", + "path_kind": "property", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/allowed_claims", + "key_path": "subject_access.allowed_claims", + "path_kind": "property", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/allowed_claims/items", + "key_path": "subject_access.allowed_claims[]", + "path_kind": "array_item", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/allowed_disclosures", + "key_path": "subject_access.allowed_disclosures", + "path_kind": "property", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/allowed_disclosures/items", + "key_path": "subject_access.allowed_disclosures[]", + "path_kind": "array_item", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/allowed_formats", + "key_path": "subject_access.allowed_formats", + "path_kind": "property", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/allowed_formats/items", + "key_path": "subject_access.allowed_formats[]", + "path_kind": "array_item", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/allowed_operations", + "key_path": "subject_access.allowed_operations", + "path_kind": "property", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessOperationsConfig/properties/batch_evaluate", + "key_path": "subject_access.allowed_operations.batch_evaluate", + "path_kind": "property", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessOperationsConfig/properties/evaluate", + "key_path": "subject_access.allowed_operations.evaluate", + "path_kind": "property", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessOperationsConfig/properties/issue_credential", + "key_path": "subject_access.allowed_operations.issue_credential", + "path_kind": "property", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessOperationsConfig/properties/render", + "key_path": "subject_access.allowed_operations.render", + "path_kind": "property", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/allowed_purposes", + "key_path": "subject_access.allowed_purposes", + "path_kind": "property", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/allowed_purposes/items", + "key_path": "subject_access.allowed_purposes[]", + "path_kind": "array_item", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/allowed_wallet_origins", + "key_path": "subject_access.allowed_wallet_origins", + "path_kind": "property", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/allowed_wallet_origins/items", + "key_path": "subject_access.allowed_wallet_origins[]", + "path_kind": "array_item", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/citizen_clients", + "key_path": "subject_access.citizen_clients", + "path_kind": "property", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessCitizenClientsConfig/properties/allowed_audiences", + "key_path": "subject_access.citizen_clients.allowed_audiences", + "path_kind": "property", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessCitizenClientsConfig/properties/allowed_audiences/items", + "key_path": "subject_access.citizen_clients.allowed_audiences[]", + "path_kind": "array_item", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessCitizenClientsConfig/properties/allowed_client_ids", + "key_path": "subject_access.citizen_clients.allowed_client_ids", + "path_kind": "property", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessCitizenClientsConfig/properties/allowed_client_ids/items", + "key_path": "subject_access.citizen_clients.allowed_client_ids[]", + "path_kind": "array_item", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/credential_profiles", + "key_path": "subject_access.credential_profiles", + "path_kind": "property", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/credential_profiles/items", + "key_path": "subject_access.credential_profiles[]", + "path_kind": "array_item", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/delegation", + "key_path": "subject_access.delegation", + "path_kind": "property", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessDelegationConfig/properties/allowed_relationships", + "key_path": "subject_access.delegation.allowed_relationships", + "path_kind": "property", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessDelegationConfig/properties/allowed_relationships/items", + "key_path": "subject_access.delegation.allowed_relationships[]", + "path_kind": "array_item", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/allowed_claims", + "key_path": "subject_access.delegation.allowed_relationships[].allowed_claims", + "path_kind": "property", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/allowed_claims/items", + "key_path": "subject_access.delegation.allowed_relationships[].allowed_claims[]", + "path_kind": "array_item", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/allowed_disclosures", + "key_path": "subject_access.delegation.allowed_relationships[].allowed_disclosures", + "path_kind": "property", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/allowed_disclosures/items", + "key_path": "subject_access.delegation.allowed_relationships[].allowed_disclosures[]", + "path_kind": "array_item", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/allowed_formats", + "key_path": "subject_access.delegation.allowed_relationships[].allowed_formats", + "path_kind": "property", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/allowed_formats/items", + "key_path": "subject_access.delegation.allowed_relationships[].allowed_formats[]", + "path_kind": "array_item", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/allowed_purposes", + "key_path": "subject_access.delegation.allowed_relationships[].allowed_purposes", + "path_kind": "property", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/allowed_purposes/items", + "key_path": "subject_access.delegation.allowed_relationships[].allowed_purposes[]", + "path_kind": "array_item", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/credential_profiles", + "key_path": "subject_access.delegation.allowed_relationships[].credential_profiles", + "path_kind": "property", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/credential_profiles/items", + "key_path": "subject_access.delegation.allowed_relationships[].credential_profiles[]", + "path_kind": "array_item", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/proof_claim", + "key_path": "subject_access.delegation.allowed_relationships[].proof_claim", + "path_kind": "property", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/relationship_type", + "key_path": "subject_access.delegation.allowed_relationships[].relationship_type", + "path_kind": "property", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/target_id_type", + "key_path": "subject_access.delegation.allowed_relationships[].target_id_type", + "path_kind": "property", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessDelegationConfig/properties/enabled", + "key_path": "subject_access.delegation.enabled", + "path_kind": "property", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/enabled", + "key_path": "subject_access.enabled", + "path_kind": "property", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/rate_limits", + "key_path": "subject_access.rate_limits", + "path_kind": "property", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessRateLimitsConfig/properties/credential_issuance_per_principal_per_hour", + "key_path": "subject_access.rate_limits.credential_issuance_per_principal_per_hour", + "path_kind": "property", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessRateLimitsConfig/properties/invalid_token_per_client_address_per_minute", + "key_path": "subject_access.rate_limits.invalid_token_per_client_address_per_minute", + "path_kind": "property", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessRateLimitsConfig/properties/per_holder_per_hour", + "key_path": "subject_access.rate_limits.per_holder_per_hour", + "path_kind": "property", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessRateLimitsConfig/properties/per_principal_per_minute", + "key_path": "subject_access.rate_limits.per_principal_per_minute", + "path_kind": "property", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessRateLimitsConfig/properties/subject_mismatch_per_principal_per_hour", + "key_path": "subject_access.rate_limits.subject_mismatch_per_principal_per_hour", + "path_kind": "property", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessRateLimitsConfig/properties/tx_code_attempts_per_code_per_minute", + "key_path": "subject_access.rate_limits.tx_code_attempts_per_code_per_minute", + "path_kind": "property", + "profile": "notary_subject_access_sensitive", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/required_scopes", + "key_path": "subject_access.required_scopes", + "path_kind": "property", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/required_scopes/items", + "key_path": "subject_access.required_scopes[]", + "path_kind": "array_item", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/scope_policy", + "key_path": "subject_access.scope_policy", + "path_kind": "property", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/subject_binding", + "key_path": "subject_access.subject_binding", + "path_kind": "property", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessSubjectBindingConfig/properties/allow_sub_as_civil_id", + "key_path": "subject_access.subject_binding.allow_sub_as_civil_id", + "path_kind": "property", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessSubjectBindingConfig/properties/claim_source", + "key_path": "subject_access.subject_binding.claim_source", + "path_kind": "property", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessSubjectBindingConfig/properties/id_type", + "key_path": "subject_access.subject_binding.id_type", + "path_kind": "property", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessSubjectBindingConfig/properties/normalize", + "key_path": "subject_access.subject_binding.normalize", + "path_kind": "property", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessSubjectBindingConfig/properties/request_field", + "key_path": "subject_access.subject_binding.request_field", + "path_kind": "property", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessSubjectBindingConfig/properties/token_claim", + "key_path": "subject_access.subject_binding.token_claim", + "path_kind": "property", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/token_policy", + "key_path": "subject_access.token_policy", + "path_kind": "property", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessTokenPolicyConfig/properties/assurance_claim_source", + "key_path": "subject_access.token_policy.assurance_claim_source", + "path_kind": "property", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessTokenPolicyConfig/properties/max_access_token_lifetime_seconds", + "key_path": "subject_access.token_policy.max_access_token_lifetime_seconds", + "path_kind": "property", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessTokenPolicyConfig/properties/max_auth_age_seconds", + "key_path": "subject_access.token_policy.max_auth_age_seconds", + "path_kind": "property", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessTokenPolicyConfig/properties/max_clock_leeway_seconds", + "key_path": "subject_access.token_policy.max_clock_leeway_seconds", + "path_kind": "property", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessTokenPolicyConfig/properties/max_credential_validity_seconds", + "key_path": "subject_access.token_policy.max_credential_validity_seconds", + "path_kind": "property", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessTokenPolicyConfig/properties/max_evaluation_age_seconds", + "key_path": "subject_access.token_policy.max_evaluation_age_seconds", + "path_kind": "property", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessTokenPolicyConfig/properties/required_acr_values", + "key_path": "subject_access.token_policy.required_acr_values", + "path_kind": "property", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "notary", + "pointer": "/$defs/SubjectAccessTokenPolicyConfig/properties/required_acr_values/items", + "key_path": "subject_access.token_policy.required_acr_values[]", + "path_kind": "array_item", + "profile": "notary_subject_access_sensitive", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + } + ], + "overrides": [ + { + "schema": "notary", + "pointer": "/$defs/AccessTokenSigningConfig/properties/verification_key_ids", + "key_path": "auth.access_token_signing.verification_key_ids", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceCredentialConfig/properties/authorization_details", + "key_path": "auth.api_keys[].authorization_details", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/access_mode", + "key_path": "auth.api_keys[].authorization_details.access_mode", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/actions", + "key_path": "auth.api_keys[].authorization_details.actions", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/assisted_access_context", + "key_path": "auth.api_keys[].authorization_details.assisted_access_context", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/assurance_level", + "key_path": "auth.api_keys[].authorization_details.assurance_level", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/claims", + "key_path": "auth.api_keys[].authorization_details.claims", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/consent_ref", + "key_path": "auth.api_keys[].authorization_details.consent_ref", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/disclosure", + "key_path": "auth.api_keys[].authorization_details.disclosure", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/format", + "key_path": "auth.api_keys[].authorization_details.format", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/jurisdiction", + "key_path": "auth.api_keys[].authorization_details.jurisdiction", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/legal_basis_ref", + "key_path": "auth.api_keys[].authorization_details.legal_basis_ref", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/locations", + "key_path": "auth.api_keys[].authorization_details.locations", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/purpose", + "key_path": "auth.api_keys[].authorization_details.purpose", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/relationship", + "key_path": "auth.api_keys[].authorization_details.relationship", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/subject", + "key_path": "auth.api_keys[].authorization_details.subject", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/target", + "key_path": "auth.api_keys[].authorization_details.target", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/CredentialFingerprintRef/properties/name", + "key_path": "auth.api_keys[].fingerprint.name", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/CredentialFingerprintRef/properties/path", + "key_path": "auth.api_keys[].fingerprint.path", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceCredentialConfig/properties/authorization_details", + "key_path": "auth.bearer_tokens[].authorization_details", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/access_mode", + "key_path": "auth.bearer_tokens[].authorization_details.access_mode", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/actions", + "key_path": "auth.bearer_tokens[].authorization_details.actions", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/assisted_access_context", + "key_path": "auth.bearer_tokens[].authorization_details.assisted_access_context", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/assurance_level", + "key_path": "auth.bearer_tokens[].authorization_details.assurance_level", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/claims", + "key_path": "auth.bearer_tokens[].authorization_details.claims", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/consent_ref", + "key_path": "auth.bearer_tokens[].authorization_details.consent_ref", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/disclosure", + "key_path": "auth.bearer_tokens[].authorization_details.disclosure", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/format", + "key_path": "auth.bearer_tokens[].authorization_details.format", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/jurisdiction", + "key_path": "auth.bearer_tokens[].authorization_details.jurisdiction", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/legal_basis_ref", + "key_path": "auth.bearer_tokens[].authorization_details.legal_basis_ref", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/locations", + "key_path": "auth.bearer_tokens[].authorization_details.locations", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/purpose", + "key_path": "auth.bearer_tokens[].authorization_details.purpose", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/relationship", + "key_path": "auth.bearer_tokens[].authorization_details.relationship", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/subject", + "key_path": "auth.bearer_tokens[].authorization_details.subject", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/target", + "key_path": "auth.bearer_tokens[].authorization_details.target", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/CredentialFingerprintRef/properties/name", + "key_path": "auth.bearer_tokens[].fingerprint.name", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/CredentialFingerprintRef/properties/path", + "key_path": "auth.bearer_tokens[].fingerprint.path", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/properties/cel", + "key_path": "cel", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + { + "schema": "notary", + "pointer": "/properties/config_trust", + "key_path": "config_trust", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/ConfigTrustConfig/properties/break_glass_override_path", + "key_path": "config_trust.break_glass_override_path", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/properties/credential_status", + "key_path": "credential_status", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + { + "schema": "notary", + "pointer": "/properties/deployment", + "key_path": "deployment", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + { + "schema": "notary", + "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_ack_cursor_path", + "key_path": "deployment.evidence.audit_ack_cursor_path", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_ack_max_age_secs", + "key_path": "deployment.evidence.audit_ack_max_age_secs", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/DeploymentConfig/properties/profile", + "key_path": "deployment.profile", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/DeploymentConfig/properties/waivers", + "key_path": "deployment.waivers", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + { + "schema": "notary", + "pointer": "/$defs/DeploymentWaiverConfig/properties/summary", + "key_path": "deployment.waivers[].summary", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference." + }, + { + "schema": "notary", + "pointer": "/$defs/CccevConfig/properties/evidence_type", + "key_path": "evidence.claims[].cccev.evidence_type", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/CccevConfig/properties/evidence_type_iri", + "key_path": "evidence.claims[].cccev.evidence_type_iri", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/semantics", + "key_path": "evidence.claims[].semantics", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/ClaimSemanticConfig/properties/concept", + "key_path": "evidence.claims[].semantics.concept", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/ClaimSemanticConfig/properties/derived_from", + "key_path": "evidence.claims[].semantics.derived_from", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + { + "schema": "notary", + "pointer": "/$defs/ClaimSemanticConfig/properties/predicate", + "key_path": "evidence.claims[].semantics.predicate", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/ClaimSemanticConfig/properties/property", + "key_path": "evidence.claims[].semantics.property", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/ClaimSemanticConfig/properties/value_mapping", + "key_path": "evidence.claims[].semantics.value_mapping", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/ClaimSemanticConfig/properties/vocabulary", + "key_path": "evidence.claims[].semantics.vocabulary", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/ClaimValueConfig/properties/nullable", + "key_path": "evidence.claims[].value.nullable", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference." + }, + { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/relay", + "key_path": "evidence.relay", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/SigningKeyConfig/properties/publish_until_unix_seconds", + "key_path": "evidence.signing_keys.*.publish_until_unix_seconds", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/properties/federation", + "key_path": "federation", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + { + "schema": "notary", + "pointer": "/$defs/FederationEvaluationProfileConfig/properties/assurance_level", + "key_path": "federation.evaluation_profiles[].assurance_level", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/FederationEvaluationProfileConfig/properties/consent_ref", + "key_path": "federation.evaluation_profiles[].consent_ref", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/FederationEvaluationProfileConfig/properties/disclosure", + "key_path": "federation.evaluation_profiles[].disclosure", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/FederationEvaluationProfileConfig/properties/jurisdiction", + "key_path": "federation.evaluation_profiles[].jurisdiction", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/FederationEvaluationProfileConfig/properties/legal_basis_ref", + "key_path": "federation.evaluation_profiles[].legal_basis_ref", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/FederationEvaluationProfileConfig/properties/max_claim_result_age_seconds", + "key_path": "federation.evaluation_profiles[].max_claim_result_age_seconds", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/properties/instance", + "key_path": "instance", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + { + "schema": "notary", + "pointer": "/$defs/NotaryInstanceConfig/properties/jurisdiction", + "key_path": "instance.jurisdiction", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/NotaryInstanceConfig/properties/owner", + "key_path": "instance.owner", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/NotaryInstanceConfig/properties/public_base_url", + "key_path": "instance.public_base_url", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/properties/oid4vci", + "key_path": "oid4vci", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/claim_id", + "key_path": "oid4vci.credential_configurations.*.claim_id", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/claims", + "key_path": "oid4vci.credential_configurations.*.claims", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/background_color", + "key_path": "oid4vci.credential_configurations.*.display.background_color", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/background_image", + "key_path": "oid4vci.credential_configurations.*.display.background_image", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/alt_text", + "key_path": "oid4vci.credential_configurations.*.display.background_image.alt_text", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/uri", + "key_path": "oid4vci.credential_configurations.*.display.background_image.uri", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/url", + "key_path": "oid4vci.credential_configurations.*.display.background_image.url", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/description", + "key_path": "oid4vci.credential_configurations.*.display.description", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/locale", + "key_path": "oid4vci.credential_configurations.*.display.locale", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/logo", + "key_path": "oid4vci.credential_configurations.*.display.logo", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/alt_text", + "key_path": "oid4vci.credential_configurations.*.display.logo.alt_text", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/uri", + "key_path": "oid4vci.credential_configurations.*.display.logo.uri", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/url", + "key_path": "oid4vci.credential_configurations.*.display.logo.url", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/secondary_image", + "key_path": "oid4vci.credential_configurations.*.display.secondary_image", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/alt_text", + "key_path": "oid4vci.credential_configurations.*.display.secondary_image.alt_text", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/uri", + "key_path": "oid4vci.credential_configurations.*.display.secondary_image.uri", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/url", + "key_path": "oid4vci.credential_configurations.*.display.secondary_image.url", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/text_color", + "key_path": "oid4vci.credential_configurations.*.display.text_color", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciIssuerDisplayConfig/properties/locale", + "key_path": "oid4vci.display[].locale", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciIssuerDisplayConfig/properties/logo", + "key_path": "oid4vci.display[].logo", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/alt_text", + "key_path": "oid4vci.display[].logo.alt_text", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/uri", + "key_path": "oid4vci.display[].logo.uri", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/url", + "key_path": "oid4vci.display[].logo.url", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryHttpConfig/properties/admin_listener", + "key_path": "server.admin_listener", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryAdminListenerConfig/properties/mode", + "key_path": "server.admin_listener.mode", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference." + }, + { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryHttpConfig/properties/openapi_requires_auth", + "key_path": "server.openapi_requires_auth", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference." + }, + { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryHttpConfig/properties/trusted_proxy_ips", + "key_path": "server.trusted_proxy_ips", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + { + "schema": "notary", + "pointer": "/properties/state", + "key_path": "state", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + { + "schema": "notary", + "pointer": "/$defs/StateConfig/properties/postgresql", + "key_path": "state.postgresql", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + { + "schema": "notary", + "pointer": "/$defs/StatePostgresqlConfig/properties/root_certificate_path", + "key_path": "state.postgresql.root_certificate_path", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "notary", + "pointer": "/properties/subject_access", + "key_path": "subject_access", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + } + ] +} diff --git a/crates/registry-notary-core/src/config/tests/root.rs b/crates/registry-notary-core/src/config/tests/root.rs index 1c0939604..7585fd532 100644 --- a/crates/registry-notary-core/src/config/tests/root.rs +++ b/crates/registry-notary-core/src/config/tests/root.rs @@ -1130,6 +1130,12 @@ pub(super) fn server_limits_default_to_relay_parity_values() { assert_eq!(config.server.max_connections, 1024); } +#[test] +pub(super) fn cel_evaluation_timeout_keeps_the_fail_closed_product_default() { + let config = minimal_config(); + assert_eq!(config.cel.eval_timeout_ms, 2_000); +} + #[test] pub(super) fn server_limits_must_be_nonzero() { let mut config = minimal_config(); diff --git a/crates/registry-notary-server/src/lib.rs b/crates/registry-notary-server/src/lib.rs index 8ec86d8d4..b27ad4572 100644 --- a/crates/registry-notary-server/src/lib.rs +++ b/crates/registry-notary-server/src/lib.rs @@ -50,8 +50,10 @@ pub use standalone::{ compile_notary_runtime, compile_notary_runtime_with_provenance, notary_admin_router_from_runtime, notary_public_router_from_runtime, notary_routers_from_runtime, notary_shared_router_from_runtime, standalone_router, - verify_relay_from_config, EvidenceIssuerRegistry, NotaryRouters, NotaryRuntimeSnapshot, - StandaloneServerError, + verify_relay_from_config, EvidenceIssuerRegistry, NotaryActivationCode, + NotaryActivationCodeDefinition, NotaryActivationCodeLifecycle, NotaryActivationFailure, + NotaryRouters, NotaryRuntimeSnapshot, StandaloneServerError, + NOTARY_ACTIVATION_CODE_DEFINITIONS, }; pub use subject_access_rate_limit::{ SubjectAccessRateLimitBucket, SubjectAccessRateLimitError, SubjectAccessRateLimitKeys, diff --git a/crates/registry-notary-server/src/standalone.rs b/crates/registry-notary-server/src/standalone.rs index 27f83a9a8..f9e7f7dbc 100644 --- a/crates/registry-notary-server/src/standalone.rs +++ b/crates/registry-notary-server/src/standalone.rs @@ -7,8 +7,10 @@ pub use runtime::{ compile_notary_runtime, compile_notary_runtime_with_provenance, find_credential, notary_admin_router_from_runtime, notary_public_router_from_runtime, notary_routers_from_runtime, notary_shared_router_from_runtime, standalone_router, - verify_relay_from_config, EvidenceIssuerRegistry, NotaryRouters, NotaryRuntimeSnapshot, - ResolvedCredential, StandaloneServerError, + verify_relay_from_config, EvidenceIssuerRegistry, NotaryActivationCode, + NotaryActivationCodeDefinition, NotaryActivationCodeLifecycle, NotaryActivationFailure, + NotaryRouters, NotaryRuntimeSnapshot, ResolvedCredential, StandaloneServerError, + NOTARY_ACTIVATION_CODE_DEFINITIONS, }; #[cfg(feature = "registry-notary-cel")] diff --git a/crates/registry-notary-server/src/standalone/activation.rs b/crates/registry-notary-server/src/standalone/activation.rs new file mode 100644 index 000000000..92b47cb06 --- /dev/null +++ b/crates/registry-notary-server/src/standalone/activation.rs @@ -0,0 +1,912 @@ +// SPDX-License-Identifier: Apache-2.0 +//! Stable, value-free Registry Notary runtime activation codes. + +use std::fmt; + +use super::assembly::StandaloneServerError; +use crate::state_plane::{NotaryPostgresStatePlaneReadiness, SensitiveStateError}; + +const VALUE_FREE_EVIDENCE_POLICY: &str = "Emit only this code and static definition. Do not emit inner errors, paths, URLs, hashes, credentials, identifiers, parser text, or country values."; +const ACTIVATION_EVIDENCE_LIMITATION: &str = "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values."; + +#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Hash)] +#[repr(u8)] +enum NotaryActivationCodeKind { + ConfigurationInvalid, + DeploymentGateFailed, + RelayActivationFailed, + RelayConfigurationInvalid, + RelayCredentialUnavailable, + RelayCredentialsRejected, + RelayProfileMismatch, + RelayProfileNotFound, + RelayUnavailable, + RuntimeActivationFailed, + RuntimeActivationRequired, + PostgresqlDatabaseReadOnly, + PostgresqlDatabaseUnavailable, + PostgresqlDatabaseUnsupported, + PostgresqlDurabilityUnsafe, + PostgresqlRoleIncompatible, + PostgresqlSchemaIncompatible, +} + +/// Closed, product-owned code for a Registry Notary runtime activation failure. +/// +/// The representation is private so callers cannot invent codes. Use the +/// named constants or [`Self::ALL`] when building operator references. +#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Hash)] +pub struct NotaryActivationCode(NotaryActivationCodeKind); + +impl NotaryActivationCode { + pub const CONFIGURATION_INVALID: Self = Self(NotaryActivationCodeKind::ConfigurationInvalid); + pub const DEPLOYMENT_GATE_FAILED: Self = Self(NotaryActivationCodeKind::DeploymentGateFailed); + pub const RELAY_ACTIVATION_FAILED: Self = Self(NotaryActivationCodeKind::RelayActivationFailed); + pub const RELAY_CONFIGURATION_INVALID: Self = + Self(NotaryActivationCodeKind::RelayConfigurationInvalid); + pub const RELAY_CREDENTIAL_UNAVAILABLE: Self = + Self(NotaryActivationCodeKind::RelayCredentialUnavailable); + pub const RELAY_CREDENTIALS_REJECTED: Self = + Self(NotaryActivationCodeKind::RelayCredentialsRejected); + pub const RELAY_PROFILE_MISMATCH: Self = Self(NotaryActivationCodeKind::RelayProfileMismatch); + pub const RELAY_PROFILE_NOT_FOUND: Self = Self(NotaryActivationCodeKind::RelayProfileNotFound); + pub const RELAY_UNAVAILABLE: Self = Self(NotaryActivationCodeKind::RelayUnavailable); + pub const RUNTIME_ACTIVATION_FAILED: Self = + Self(NotaryActivationCodeKind::RuntimeActivationFailed); + pub const RUNTIME_ACTIVATION_REQUIRED: Self = + Self(NotaryActivationCodeKind::RuntimeActivationRequired); + pub const POSTGRESQL_DATABASE_READ_ONLY: Self = + Self(NotaryActivationCodeKind::PostgresqlDatabaseReadOnly); + pub const POSTGRESQL_DATABASE_UNAVAILABLE: Self = + Self(NotaryActivationCodeKind::PostgresqlDatabaseUnavailable); + pub const POSTGRESQL_DATABASE_UNSUPPORTED: Self = + Self(NotaryActivationCodeKind::PostgresqlDatabaseUnsupported); + pub const POSTGRESQL_DURABILITY_UNSAFE: Self = + Self(NotaryActivationCodeKind::PostgresqlDurabilityUnsafe); + pub const POSTGRESQL_ROLE_INCOMPATIBLE: Self = + Self(NotaryActivationCodeKind::PostgresqlRoleIncompatible); + pub const POSTGRESQL_SCHEMA_INCOMPATIBLE: Self = + Self(NotaryActivationCodeKind::PostgresqlSchemaIncompatible); + + /// Every published code in stable lexical order. + pub const ALL: &'static [Self] = &[ + Self::CONFIGURATION_INVALID, + Self::DEPLOYMENT_GATE_FAILED, + Self::RELAY_ACTIVATION_FAILED, + Self::RELAY_CONFIGURATION_INVALID, + Self::RELAY_CREDENTIAL_UNAVAILABLE, + Self::RELAY_CREDENTIALS_REJECTED, + Self::RELAY_PROFILE_MISMATCH, + Self::RELAY_PROFILE_NOT_FOUND, + Self::RELAY_UNAVAILABLE, + Self::RUNTIME_ACTIVATION_FAILED, + Self::RUNTIME_ACTIVATION_REQUIRED, + Self::POSTGRESQL_DATABASE_READ_ONLY, + Self::POSTGRESQL_DATABASE_UNAVAILABLE, + Self::POSTGRESQL_DATABASE_UNSUPPORTED, + Self::POSTGRESQL_DURABILITY_UNSAFE, + Self::POSTGRESQL_ROLE_INCOMPATIBLE, + Self::POSTGRESQL_SCHEMA_INCOMPATIBLE, + ]; + + #[must_use] + pub const fn as_str(self) -> &'static str { + match self.0 { + NotaryActivationCodeKind::ConfigurationInvalid => "notary.configuration.invalid", + NotaryActivationCodeKind::DeploymentGateFailed => "notary.deployment.gate_failed", + NotaryActivationCodeKind::RelayActivationFailed => "notary.relay.activation_failed", + NotaryActivationCodeKind::RelayConfigurationInvalid => { + "notary.relay.configuration_invalid" + } + NotaryActivationCodeKind::RelayCredentialUnavailable => { + "notary.relay.credential_unavailable" + } + NotaryActivationCodeKind::RelayCredentialsRejected => { + "notary.relay.credentials_rejected" + } + NotaryActivationCodeKind::RelayProfileMismatch => "notary.relay.profile_mismatch", + NotaryActivationCodeKind::RelayProfileNotFound => "notary.relay.profile_not_found", + NotaryActivationCodeKind::RelayUnavailable => "notary.relay.unavailable", + NotaryActivationCodeKind::RuntimeActivationFailed => "notary.runtime.activation_failed", + NotaryActivationCodeKind::RuntimeActivationRequired => { + "notary.runtime.activation_required" + } + NotaryActivationCodeKind::PostgresqlDatabaseReadOnly => { + "notary.state.postgresql.database_read_only" + } + NotaryActivationCodeKind::PostgresqlDatabaseUnavailable => { + "notary.state.postgresql.database_unavailable" + } + NotaryActivationCodeKind::PostgresqlDatabaseUnsupported => { + "notary.state.postgresql.database_unsupported" + } + NotaryActivationCodeKind::PostgresqlDurabilityUnsafe => { + "notary.state.postgresql.durability_unsafe" + } + NotaryActivationCodeKind::PostgresqlRoleIncompatible => { + "notary.state.postgresql.role_incompatible" + } + NotaryActivationCodeKind::PostgresqlSchemaIncompatible => { + "notary.state.postgresql.schema_incompatible" + } + } + } + + /// Static value-free operator guidance for this code. + #[must_use] + pub fn definition(self) -> &'static NotaryActivationCodeDefinition { + &NOTARY_ACTIVATION_CODE_DEFINITIONS[self.0 as usize] + } +} + +impl fmt::Display for NotaryActivationCode { + fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result { + formatter.write_str(self.as_str()) + } +} + +/// Publication state for a product-owned activation code definition. +#[derive(Clone, Copy, Debug, PartialEq, Eq)] +pub enum NotaryActivationCodeLifecycle { + /// The catalog contract has not shipped in a tagged release. + Unreleased, + /// The catalog contract shipped in the named release. + Released { introduced_version: &'static str }, +} + +impl NotaryActivationCodeLifecycle { + #[must_use] + pub const fn as_str(self) -> &'static str { + match self { + Self::Unreleased => "unreleased", + Self::Released { .. } => "released", + } + } + + #[must_use] + pub const fn introduced_version(self) -> Option<&'static str> { + match self { + Self::Unreleased => None, + Self::Released { introduced_version } => Some(introduced_version), + } + } +} + +/// Static, value-free meaning and recovery guidance for an activation code. +#[derive(Clone, Copy, Debug, PartialEq, Eq)] +pub struct NotaryActivationCodeDefinition { + pub code: NotaryActivationCode, + pub lifecycle: NotaryActivationCodeLifecycle, + pub phase: &'static str, + pub meaning: &'static str, + pub rule: &'static str, + pub remediation: &'static str, + pub evidence_scope: &'static str, + pub evidence_policy: &'static str, + pub evidence_limitation: &'static str, + pub docs_slug: &'static str, +} + +/// Product-owned source for generated operator references. +pub static NOTARY_ACTIVATION_CODE_DEFINITIONS: [NotaryActivationCodeDefinition; 17] = [ + NotaryActivationCodeDefinition { + code: NotaryActivationCode::CONFIGURATION_INVALID, + lifecycle: NotaryActivationCodeLifecycle::Unreleased, + phase: "configuration_activation", + meaning: "Registry Notary runtime configuration is invalid", + rule: "Runtime activation requires valid product configuration, supported features, and resolvable secret and provider bindings", + remediation: "run registry-notary doctor, correct the reviewed configuration or binding, and retry activation", + evidence_scope: "Notary configuration, provider bindings, and compiled feature support", + evidence_policy: VALUE_FREE_EVIDENCE_POLICY, + evidence_limitation: ACTIVATION_EVIDENCE_LIMITATION, + docs_slug: "configuration-invalid", + }, + NotaryActivationCodeDefinition { + code: NotaryActivationCode::DEPLOYMENT_GATE_FAILED, + lifecycle: NotaryActivationCodeLifecycle::Unreleased, + phase: "deployment_activation", + meaning: "Registry Notary deployment gates refused startup", + rule: "Every startup-failing deployment gate must pass before activation", + remediation: "run registry-notary doctor for the selected deployment profile and resolve its startup-failing findings", + evidence_scope: "selected deployment profile and startup-failing gate results", + evidence_policy: VALUE_FREE_EVIDENCE_POLICY, + evidence_limitation: ACTIVATION_EVIDENCE_LIMITATION, + docs_slug: "deployment-gate-failed", + }, + NotaryActivationCodeDefinition { + code: NotaryActivationCode::RELAY_ACTIVATION_FAILED, + lifecycle: NotaryActivationCodeLifecycle::Unreleased, + phase: "relay_activation", + meaning: "Relay consultation activation failed", + rule: "Registry-backed claims require the reviewed Relay consultation client to activate before Notary serves", + remediation: "check the Notary configuration and startup environment", + evidence_scope: "Notary Relay consultation client activation lifecycle", + evidence_policy: VALUE_FREE_EVIDENCE_POLICY, + evidence_limitation: ACTIVATION_EVIDENCE_LIMITATION, + docs_slug: "relay-activation-failed", + }, + NotaryActivationCodeDefinition { + code: NotaryActivationCode::RELAY_CONFIGURATION_INVALID, + lifecycle: NotaryActivationCodeLifecycle::Unreleased, + phase: "relay_activation", + meaning: "Relay consultation configuration is invalid", + rule: "The Relay destination, activation plan, and activation lifecycle must form one valid reviewed configuration", + remediation: "check the evidence.relay connection and Registry-backed consultation configuration", + evidence_scope: "Relay destination, activation plan, and consultation configuration", + evidence_policy: VALUE_FREE_EVIDENCE_POLICY, + evidence_limitation: ACTIVATION_EVIDENCE_LIMITATION, + docs_slug: "relay-configuration-invalid", + }, + NotaryActivationCodeDefinition { + code: NotaryActivationCode::RELAY_CREDENTIAL_UNAVAILABLE, + lifecycle: NotaryActivationCodeLifecycle::Unreleased, + phase: "relay_activation", + meaning: "Relay workload credential is unavailable", + rule: "A current non-empty workload credential must be available before a live Relay consultation", + remediation: "mount a current readable workload JWT at evidence.relay.token_file", + evidence_scope: "configured Relay workload credential availability", + evidence_policy: VALUE_FREE_EVIDENCE_POLICY, + evidence_limitation: ACTIVATION_EVIDENCE_LIMITATION, + docs_slug: "relay-credential-unavailable", + }, + NotaryActivationCodeDefinition { + code: NotaryActivationCode::RELAY_CREDENTIALS_REJECTED, + lifecycle: NotaryActivationCodeLifecycle::Unreleased, + phase: "relay_activation", + meaning: "Relay rejected the configured workload credential", + rule: "Relay must accept the configured Notary workload binding, scope, and validity window", + remediation: "rotate the workload JWT and verify that Relay recognizes its workload binding, required scope, and validity window", + evidence_scope: "Relay workload binding, scope, and validity acceptance", + evidence_policy: VALUE_FREE_EVIDENCE_POLICY, + evidence_limitation: ACTIVATION_EVIDENCE_LIMITATION, + docs_slug: "relay-credentials-rejected", + }, + NotaryActivationCodeDefinition { + code: NotaryActivationCode::RELAY_PROFILE_MISMATCH, + lifecycle: NotaryActivationCodeLifecycle::Unreleased, + phase: "relay_activation", + meaning: "Relay consultation profile does not match the configured contract pin", + rule: "The active Relay profile must match the reviewed Notary consultation contract pin", + remediation: "reconcile the Notary profile id and contract hash with the reviewed Relay consultation contract", + evidence_scope: "reviewed Notary profile pin and active Relay consultation contract", + evidence_policy: VALUE_FREE_EVIDENCE_POLICY, + evidence_limitation: ACTIVATION_EVIDENCE_LIMITATION, + docs_slug: "relay-profile-mismatch", + }, + NotaryActivationCodeDefinition { + code: NotaryActivationCode::RELAY_PROFILE_NOT_FOUND, + lifecycle: NotaryActivationCodeLifecycle::Unreleased, + phase: "relay_activation", + meaning: "Relay consultation profile was not found", + rule: "Every Registry-backed Notary consultation must resolve to an active Relay profile", + remediation: "deploy the configured Relay profile id, then retry the live check", + evidence_scope: "configured consultation profile resolution in Relay", + evidence_policy: VALUE_FREE_EVIDENCE_POLICY, + evidence_limitation: ACTIVATION_EVIDENCE_LIMITATION, + docs_slug: "relay-profile-not-found", + }, + NotaryActivationCodeDefinition { + code: NotaryActivationCode::RELAY_UNAVAILABLE, + lifecycle: NotaryActivationCodeLifecycle::Unreleased, + phase: "relay_activation", + meaning: "Relay consultation service is unavailable", + rule: "The reviewed Relay destination must be reachable through the configured transport policy", + remediation: "check Relay reachability, TLS, destination policy, and service health", + evidence_scope: "reviewed Relay destination, transport policy, and service availability", + evidence_policy: VALUE_FREE_EVIDENCE_POLICY, + evidence_limitation: ACTIVATION_EVIDENCE_LIMITATION, + docs_slug: "relay-unavailable", + }, + NotaryActivationCodeDefinition { + code: NotaryActivationCode::RUNTIME_ACTIVATION_FAILED, + lifecycle: NotaryActivationCodeLifecycle::Unreleased, + phase: "runtime_activation", + meaning: "Registry Notary runtime activation failed", + rule: "Audit, state, sensitive-state, and other runtime dependencies must activate successfully before listeners serve", + remediation: "restore the governed runtime dependency or integrity condition, then retry activation", + evidence_scope: "governed audit, state, sensitive-state, and runtime dependencies", + evidence_policy: VALUE_FREE_EVIDENCE_POLICY, + evidence_limitation: ACTIVATION_EVIDENCE_LIMITATION, + docs_slug: "runtime-activation-failed", + }, + NotaryActivationCodeDefinition { + code: NotaryActivationCode::RUNTIME_ACTIVATION_REQUIRED, + lifecycle: NotaryActivationCodeLifecycle::Unreleased, + phase: "runtime_activation", + meaning: "Registry Notary runtime activation is required before serving", + rule: "Routers may be built only after the governed audit and state activation lifecycle completes", + remediation: "run the compiled Registry Notary runtime activation step before building or serving routers", + evidence_scope: "router assembly and governed audit and state activation lifecycle", + evidence_policy: VALUE_FREE_EVIDENCE_POLICY, + evidence_limitation: ACTIVATION_EVIDENCE_LIMITATION, + docs_slug: "runtime-activation-required", + }, + NotaryActivationCodeDefinition { + code: NotaryActivationCode::POSTGRESQL_DATABASE_READ_ONLY, + lifecycle: NotaryActivationCodeLifecycle::Unreleased, + phase: "runtime_activation", + meaning: "Registry Notary PostgreSQL state database is read-only or recovering", + rule: "Serving requires a writable PostgreSQL primary for correctness-state transactions", + remediation: "restore a writable PostgreSQL primary, run registry-notary state doctor, and retry activation", + evidence_scope: "PostgreSQL writeability and recovery posture", + evidence_policy: VALUE_FREE_EVIDENCE_POLICY, + evidence_limitation: ACTIVATION_EVIDENCE_LIMITATION, + docs_slug: "postgresql-database-read-only", + }, + NotaryActivationCodeDefinition { + code: NotaryActivationCode::POSTGRESQL_DATABASE_UNAVAILABLE, + lifecycle: NotaryActivationCodeLifecycle::Unreleased, + phase: "runtime_activation", + meaning: "Registry Notary PostgreSQL state database is unavailable", + rule: "Serving requires a reachable PostgreSQL service with an accepted TLS trust chain", + remediation: "check PostgreSQL reachability, TLS trust, and service health, then run registry-notary state doctor", + evidence_scope: "PostgreSQL transport, TLS trust, and service availability", + evidence_policy: VALUE_FREE_EVIDENCE_POLICY, + evidence_limitation: ACTIVATION_EVIDENCE_LIMITATION, + docs_slug: "postgresql-database-unavailable", + }, + NotaryActivationCodeDefinition { + code: NotaryActivationCode::POSTGRESQL_DATABASE_UNSUPPORTED, + lifecycle: NotaryActivationCodeLifecycle::Unreleased, + phase: "runtime_activation", + meaning: "Registry Notary PostgreSQL server major is unsupported", + rule: "Serving requires a PostgreSQL major covered by the Registry Notary compatibility contract", + remediation: "move the state database to a supported PostgreSQL major, run registry-notary state doctor, and retry activation", + evidence_scope: "PostgreSQL server-major compatibility", + evidence_policy: VALUE_FREE_EVIDENCE_POLICY, + evidence_limitation: ACTIVATION_EVIDENCE_LIMITATION, + docs_slug: "postgresql-database-unsupported", + }, + NotaryActivationCodeDefinition { + code: NotaryActivationCode::POSTGRESQL_DURABILITY_UNSAFE, + lifecycle: NotaryActivationCodeLifecycle::Unreleased, + phase: "runtime_activation", + meaning: "Registry Notary PostgreSQL durability settings are unsafe", + rule: "Serving requires the documented PostgreSQL durability settings for correctness state", + remediation: "restore the required PostgreSQL durability settings, run registry-notary state doctor, and retry activation", + evidence_scope: "PostgreSQL durability posture", + evidence_policy: VALUE_FREE_EVIDENCE_POLICY, + evidence_limitation: ACTIVATION_EVIDENCE_LIMITATION, + docs_slug: "postgresql-durability-unsafe", + }, + NotaryActivationCodeDefinition { + code: NotaryActivationCode::POSTGRESQL_ROLE_INCOMPATIBLE, + lifecycle: NotaryActivationCodeLifecycle::Unreleased, + phase: "runtime_activation", + meaning: "Registry Notary PostgreSQL runtime role contract is incompatible", + rule: "Serving requires the documented restricted runtime role and its attested schema binding", + remediation: "restore the documented runtime grants and role binding, run registry-notary state doctor, and retry activation", + evidence_scope: "PostgreSQL runtime-role attributes, grants, and schema binding", + evidence_policy: VALUE_FREE_EVIDENCE_POLICY, + evidence_limitation: ACTIVATION_EVIDENCE_LIMITATION, + docs_slug: "postgresql-role-incompatible", + }, + NotaryActivationCodeDefinition { + code: NotaryActivationCode::POSTGRESQL_SCHEMA_INCOMPATIBLE, + lifecycle: NotaryActivationCodeLifecycle::Unreleased, + phase: "runtime_activation", + meaning: "Registry Notary PostgreSQL state schema contract is incompatible", + rule: "Serving requires the exact product-owned schema, catalog, fingerprint, and privilege contract", + remediation: "restore or install the matching Registry Notary state schema, run registry-notary state doctor, and retry activation", + evidence_scope: "PostgreSQL state schema, catalog, fingerprint, and privilege contract", + evidence_policy: VALUE_FREE_EVIDENCE_POLICY, + evidence_limitation: ACTIVATION_EVIDENCE_LIMITATION, + docs_slug: "postgresql-schema-incompatible", + }, +]; + +impl NotaryPostgresStatePlaneReadiness { + /// Map a value-free PostgreSQL readiness classification to its public + /// activation code and static operator guidance. + #[must_use] + pub const fn activation_code(self) -> NotaryActivationCode { + match self { + Self::ConfigurationInvalid => NotaryActivationCode::CONFIGURATION_INVALID, + Self::DatabaseUnavailable | Self::Shutdown => { + NotaryActivationCode::POSTGRESQL_DATABASE_UNAVAILABLE + } + Self::UnsupportedServerMajor => NotaryActivationCode::POSTGRESQL_DATABASE_UNSUPPORTED, + Self::DatabaseNotWritable => NotaryActivationCode::POSTGRESQL_DATABASE_READ_ONLY, + Self::UnsafeDurability => NotaryActivationCode::POSTGRESQL_DURABILITY_UNSAFE, + Self::SchemaIncompatible => NotaryActivationCode::POSTGRESQL_SCHEMA_INCOMPATIBLE, + Self::RoleIncompatible => NotaryActivationCode::POSTGRESQL_ROLE_INCOMPATIBLE, + Self::Ready => NotaryActivationCode::RUNTIME_ACTIVATION_FAILED, + } + } +} + +/// Redacted process-boundary error that deliberately retains no inner error. +#[derive(Clone, Copy, PartialEq, Eq)] +pub struct NotaryActivationFailure { + code: NotaryActivationCode, +} + +impl NotaryActivationFailure { + #[must_use] + pub const fn code(self) -> NotaryActivationCode { + self.code + } + + #[must_use] + pub fn definition(self) -> &'static NotaryActivationCodeDefinition { + self.code.definition() + } +} + +impl fmt::Debug for NotaryActivationFailure { + fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result { + formatter + .debug_struct("NotaryActivationFailure") + .field("code", &self.code.as_str()) + .finish() + } +} + +impl fmt::Display for NotaryActivationFailure { + fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result { + let definition = self.definition(); + write!( + formatter, + "{}: {}; next action: {}", + definition.code, definition.meaning, definition.remediation + ) + } +} + +impl std::error::Error for NotaryActivationFailure {} + +impl From for NotaryActivationFailure { + fn from(code: NotaryActivationCode) -> Self { + Self { code } + } +} + +impl From for NotaryActivationFailure { + fn from(error: StandaloneServerError) -> Self { + error.activation_code().into() + } +} + +impl StandaloneServerError { + /// Map every internal startup failure to a closed, value-free public code. + #[must_use] + pub const fn activation_code(&self) -> NotaryActivationCode { + match self { + Self::Config(_) + | Self::MissingCredentialEnv(_) + | Self::InvalidCredentialHash(_, _) + | Self::InvalidSigningKey { .. } + | Self::SigningKeyProviderUnavailable { .. } + | Self::MissingFederationSecretEnv(_) + | Self::MissingAuditPath + | Self::MissingAuditHashSecretEnv + | Self::Cors(_) + | Self::InvalidAuditSink(_) + | Self::InvalidAuditConfig(_) + | Self::InvalidOidcConfig(_) + | Self::InvalidFederationConfig(_) => NotaryActivationCode::CONFIGURATION_INVALID, + Self::InvalidRelayDestination + | Self::InvalidRelayActivationPlan + | Self::RelayAlreadyActivated + | Self::RelayNotActivated => NotaryActivationCode::RELAY_CONFIGURATION_INVALID, + Self::RelayActivation => NotaryActivationCode::RELAY_ACTIVATION_FAILED, + Self::RelayCredentialUnavailable => NotaryActivationCode::RELAY_CREDENTIAL_UNAVAILABLE, + Self::RelayCredentialsRejected => NotaryActivationCode::RELAY_CREDENTIALS_REJECTED, + Self::RelayProfileNotFound => NotaryActivationCode::RELAY_PROFILE_NOT_FOUND, + Self::RelayProfileMismatch => NotaryActivationCode::RELAY_PROFILE_MISMATCH, + Self::RelayUnavailable => NotaryActivationCode::RELAY_UNAVAILABLE, + Self::AuditChainVerificationRequired | Self::PostgresqlStateActivationRequired => { + NotaryActivationCode::RUNTIME_ACTIVATION_REQUIRED + } + Self::StatePlane(error) => { + NotaryPostgresStatePlaneReadiness::from_error(*error).activation_code() + } + Self::SensitiveState(SensitiveStateError::StatePlane(error)) => { + NotaryPostgresStatePlaneReadiness::from_error(*error).activation_code() + } + Self::Audit(_) | Self::SensitiveState(_) => { + NotaryActivationCode::RUNTIME_ACTIVATION_FAILED + } + #[cfg(feature = "registry-notary-cel")] + Self::InvalidCelConfig(_) => NotaryActivationCode::CONFIGURATION_INVALID, + Self::DeploymentGateStartupFailure { .. } => { + NotaryActivationCode::DEPLOYMENT_GATE_FAILED + } + } + } +} + +#[cfg(test)] +mod tests { + use super::*; + + use std::collections::BTreeSet; + + use registry_notary_core::EvidenceConfigError; + use registry_platform_audit::AuditError; + use registry_platform_authcommon::FingerprintFormatError; + use registry_platform_httpsec::CorsValidationError; + + use crate::state_plane::{NotaryPostgresStatePlaneError, SensitiveStateError}; + + const SENTINEL: &str = "SENTINEL_PATH_URL_HASH_CREDENTIAL_IDENTIFIER_COUNTRY_PARSER_VALUE"; + + fn representative_errors() -> Vec<(StandaloneServerError, NotaryActivationCode)> { + let errors = vec![ + ( + StandaloneServerError::Config(EvidenceConfigError::InvalidAuthConfig { + reason: SENTINEL.to_string(), + }), + NotaryActivationCode::CONFIGURATION_INVALID, + ), + ( + StandaloneServerError::MissingCredentialEnv(SENTINEL.to_string()), + NotaryActivationCode::CONFIGURATION_INVALID, + ), + ( + StandaloneServerError::InvalidCredentialHash( + SENTINEL.to_string(), + FingerprintFormatError::InvalidHex, + ), + NotaryActivationCode::CONFIGURATION_INVALID, + ), + ( + StandaloneServerError::InvalidRelayDestination, + NotaryActivationCode::RELAY_CONFIGURATION_INVALID, + ), + ( + StandaloneServerError::InvalidRelayActivationPlan, + NotaryActivationCode::RELAY_CONFIGURATION_INVALID, + ), + ( + StandaloneServerError::RelayActivation, + NotaryActivationCode::RELAY_ACTIVATION_FAILED, + ), + ( + StandaloneServerError::RelayAlreadyActivated, + NotaryActivationCode::RELAY_CONFIGURATION_INVALID, + ), + ( + StandaloneServerError::RelayNotActivated, + NotaryActivationCode::RELAY_CONFIGURATION_INVALID, + ), + ( + StandaloneServerError::AuditChainVerificationRequired, + NotaryActivationCode::RUNTIME_ACTIVATION_REQUIRED, + ), + ( + StandaloneServerError::PostgresqlStateActivationRequired, + NotaryActivationCode::RUNTIME_ACTIVATION_REQUIRED, + ), + ( + StandaloneServerError::RelayCredentialUnavailable, + NotaryActivationCode::RELAY_CREDENTIAL_UNAVAILABLE, + ), + ( + StandaloneServerError::RelayCredentialsRejected, + NotaryActivationCode::RELAY_CREDENTIALS_REJECTED, + ), + ( + StandaloneServerError::RelayProfileNotFound, + NotaryActivationCode::RELAY_PROFILE_NOT_FOUND, + ), + ( + StandaloneServerError::RelayProfileMismatch, + NotaryActivationCode::RELAY_PROFILE_MISMATCH, + ), + ( + StandaloneServerError::RelayUnavailable, + NotaryActivationCode::RELAY_UNAVAILABLE, + ), + ( + StandaloneServerError::InvalidSigningKey { + key: SENTINEL.to_string(), + reason: SENTINEL.to_string(), + }, + NotaryActivationCode::CONFIGURATION_INVALID, + ), + ( + StandaloneServerError::SigningKeyProviderUnavailable { + provider: SENTINEL.to_string(), + }, + NotaryActivationCode::CONFIGURATION_INVALID, + ), + ( + StandaloneServerError::MissingFederationSecretEnv(SENTINEL.to_string()), + NotaryActivationCode::CONFIGURATION_INVALID, + ), + ( + StandaloneServerError::MissingAuditPath, + NotaryActivationCode::CONFIGURATION_INVALID, + ), + ( + StandaloneServerError::MissingAuditHashSecretEnv, + NotaryActivationCode::CONFIGURATION_INVALID, + ), + ( + StandaloneServerError::Audit(AuditError::EnvVarUnavailable { + name: SENTINEL.to_string(), + }), + NotaryActivationCode::RUNTIME_ACTIVATION_FAILED, + ), + ( + StandaloneServerError::Cors(CorsValidationError::MalformedOrigin( + SENTINEL.to_string(), + )), + NotaryActivationCode::CONFIGURATION_INVALID, + ), + ( + StandaloneServerError::InvalidAuditSink(SENTINEL.to_string()), + NotaryActivationCode::CONFIGURATION_INVALID, + ), + ( + StandaloneServerError::InvalidAuditConfig(SENTINEL.to_string()), + NotaryActivationCode::CONFIGURATION_INVALID, + ), + ( + StandaloneServerError::InvalidOidcConfig(SENTINEL.to_string()), + NotaryActivationCode::CONFIGURATION_INVALID, + ), + ( + StandaloneServerError::InvalidFederationConfig(SENTINEL.to_string()), + NotaryActivationCode::CONFIGURATION_INVALID, + ), + ( + StandaloneServerError::StatePlane( + NotaryPostgresStatePlaneError::DatabaseUrlUnavailable, + ), + NotaryActivationCode::POSTGRESQL_DATABASE_UNAVAILABLE, + ), + ( + StandaloneServerError::SensitiveState( + SensitiveStateError::KeyEnvironmentUnavailable, + ), + NotaryActivationCode::RUNTIME_ACTIVATION_FAILED, + ), + ( + StandaloneServerError::DeploymentGateStartupFailure { + profile: SENTINEL.to_string(), + findings: SENTINEL.to_string(), + }, + NotaryActivationCode::DEPLOYMENT_GATE_FAILED, + ), + ]; + #[cfg(feature = "registry-notary-cel")] + let errors = { + let mut errors = errors; + errors.push(( + StandaloneServerError::InvalidCelConfig(SENTINEL.to_string()), + NotaryActivationCode::CONFIGURATION_INVALID, + )); + errors + }; + errors + } + + #[test] + fn activation_codes_are_unique_ordered_and_definition_complete() { + assert_eq!( + NotaryActivationCode::ALL.len(), + NOTARY_ACTIVATION_CODE_DEFINITIONS.len() + ); + let mut docs_slugs = BTreeSet::new(); + for pair in NotaryActivationCode::ALL.windows(2) { + assert!( + pair[0].as_str() < pair[1].as_str(), + "activation codes must remain unique and lexically ordered" + ); + } + for (index, code) in NotaryActivationCode::ALL.iter().copied().enumerate() { + let definition = code.definition(); + assert_eq!(definition, &NOTARY_ACTIVATION_CODE_DEFINITIONS[index]); + assert_eq!(definition.code, code); + assert_eq!( + definition.lifecycle, + NotaryActivationCodeLifecycle::Unreleased + ); + assert_eq!(definition.lifecycle.as_str(), "unreleased"); + assert_eq!(definition.lifecycle.introduced_version(), None); + assert!(matches!( + definition.phase, + "configuration_activation" + | "deployment_activation" + | "relay_activation" + | "runtime_activation" + )); + assert!(!definition.meaning.is_empty()); + assert!(!definition.rule.is_empty()); + assert!(!definition.remediation.is_empty()); + assert!(!definition.evidence_scope.is_empty()); + assert_eq!(definition.evidence_policy, VALUE_FREE_EVIDENCE_POLICY); + assert_eq!( + definition.evidence_limitation, + ACTIVATION_EVIDENCE_LIMITATION + ); + assert!( + !definition.docs_slug.is_empty() + && !definition.docs_slug.starts_with('-') + && !definition.docs_slug.ends_with('-') + && definition + .docs_slug + .bytes() + .all(|byte| byte.is_ascii_lowercase() + || byte.is_ascii_digit() + || byte == b'-'), + "documentation slugs must be stable lowercase anchor components" + ); + assert!( + docs_slugs.insert(definition.docs_slug), + "documentation slugs must be unique" + ); + for value in [ + definition.phase, + definition.meaning, + definition.rule, + definition.remediation, + definition.evidence_scope, + definition.evidence_policy, + definition.evidence_limitation, + definition.docs_slug, + ] { + assert!( + !value.contains(SENTINEL), + "static activation metadata must not carry runtime values" + ); + } + } + } + + #[test] + fn every_standalone_error_maps_to_a_published_value_free_code() { + let cases = representative_errors(); + #[cfg(not(feature = "registry-notary-cel"))] + assert_eq!(cases.len(), 29); + #[cfg(feature = "registry-notary-cel")] + assert_eq!(cases.len(), 30); + + for (error, expected) in cases { + assert_eq!(error.activation_code(), expected); + assert!(NotaryActivationCode::ALL.contains(&expected)); + let failure = NotaryActivationFailure::from(error); + assert_eq!(failure.code(), expected); + let display = failure.to_string(); + let debug = format!("{failure:?}"); + assert!(display.contains(expected.as_str())); + assert!(!display.contains(SENTINEL)); + assert!(!debug.contains(SENTINEL)); + } + } + + #[test] + fn postgresql_failures_keep_cause_specific_public_classification() { + let cases = [ + ( + NotaryPostgresStatePlaneError::DatabaseUnavailable, + NotaryActivationCode::POSTGRESQL_DATABASE_UNAVAILABLE, + ), + ( + NotaryPostgresStatePlaneError::DatabaseNotWritable, + NotaryActivationCode::POSTGRESQL_DATABASE_READ_ONLY, + ), + ( + NotaryPostgresStatePlaneError::UnsupportedServerMajor, + NotaryActivationCode::POSTGRESQL_DATABASE_UNSUPPORTED, + ), + ( + NotaryPostgresStatePlaneError::UnsafeDurability, + NotaryActivationCode::POSTGRESQL_DURABILITY_UNSAFE, + ), + ( + NotaryPostgresStatePlaneError::SchemaIncompatible, + NotaryActivationCode::POSTGRESQL_SCHEMA_INCOMPATIBLE, + ), + ( + NotaryPostgresStatePlaneError::RoleIncompatible, + NotaryActivationCode::POSTGRESQL_ROLE_INCOMPATIBLE, + ), + ]; + + for (error, expected) in cases { + let direct = StandaloneServerError::StatePlane(error); + let sensitive = + StandaloneServerError::SensitiveState(SensitiveStateError::StatePlane(error)); + assert_eq!(direct.activation_code(), expected); + assert_eq!(sensitive.activation_code(), expected); + + let failure = NotaryActivationFailure::from(direct); + let rendered = format!("{failure:?} {failure}"); + assert!(rendered.contains(expected.as_str())); + assert!(!rendered.contains(SENTINEL)); + assert!(!rendered.contains("postgresql://")); + } + } + + #[test] + fn postgresql_public_diagnostics_have_static_meaning_and_remediation() { + let codes = [ + NotaryActivationCode::POSTGRESQL_DATABASE_READ_ONLY, + NotaryActivationCode::POSTGRESQL_DATABASE_UNAVAILABLE, + NotaryActivationCode::POSTGRESQL_DATABASE_UNSUPPORTED, + NotaryActivationCode::POSTGRESQL_DURABILITY_UNSAFE, + NotaryActivationCode::POSTGRESQL_ROLE_INCOMPATIBLE, + NotaryActivationCode::POSTGRESQL_SCHEMA_INCOMPATIBLE, + ]; + + for code in codes { + let definition = code.definition(); + let failure = NotaryActivationFailure::from(code); + let display = failure.to_string(); + assert!(display.contains(code.as_str())); + assert!(display.contains(definition.meaning)); + assert!(display.contains(definition.remediation)); + for forbidden in [SENTINEL, "postgresql://", "/run/", "registry_notary_"] { + assert!( + !display.contains(forbidden), + "public PostgreSQL diagnostic exposed forbidden value {forbidden:?}: {display}" + ); + } + } + } + + #[test] + fn established_doctor_code_strings_remain_exact() { + assert_eq!( + NotaryActivationCode::RELAY_CREDENTIAL_UNAVAILABLE.as_str(), + "notary.relay.credential_unavailable" + ); + assert_eq!( + NotaryActivationCode::RELAY_CREDENTIALS_REJECTED.as_str(), + "notary.relay.credentials_rejected" + ); + assert_eq!( + NotaryActivationCode::RELAY_PROFILE_NOT_FOUND.as_str(), + "notary.relay.profile_not_found" + ); + assert_eq!( + NotaryActivationCode::RELAY_PROFILE_MISMATCH.as_str(), + "notary.relay.profile_mismatch" + ); + assert_eq!( + NotaryActivationCode::RELAY_UNAVAILABLE.as_str(), + "notary.relay.unavailable" + ); + assert_eq!( + NotaryActivationCode::RELAY_CONFIGURATION_INVALID.as_str(), + "notary.relay.configuration_invalid" + ); + assert_eq!( + NotaryActivationCode::RELAY_ACTIVATION_FAILED.as_str(), + "notary.relay.activation_failed" + ); + assert_eq!( + NotaryActivationCode::POSTGRESQL_DATABASE_READ_ONLY.as_str(), + "notary.state.postgresql.database_read_only" + ); + assert_eq!( + NotaryActivationCode::POSTGRESQL_DATABASE_UNAVAILABLE.as_str(), + "notary.state.postgresql.database_unavailable" + ); + assert_eq!( + NotaryActivationCode::POSTGRESQL_DATABASE_UNSUPPORTED.as_str(), + "notary.state.postgresql.database_unsupported" + ); + assert_eq!( + NotaryActivationCode::POSTGRESQL_ROLE_INCOMPATIBLE.as_str(), + "notary.state.postgresql.role_incompatible" + ); + assert_eq!( + NotaryActivationCode::POSTGRESQL_SCHEMA_INCOMPATIBLE.as_str(), + "notary.state.postgresql.schema_incompatible" + ); + } + + #[cfg(feature = "registry-notary-cel")] + #[test] + fn cel_startup_errors_use_the_value_free_configuration_code() { + let failure = NotaryActivationFailure::from(StandaloneServerError::InvalidCelConfig( + SENTINEL.to_string(), + )); + assert_eq!(failure.code(), NotaryActivationCode::CONFIGURATION_INVALID); + assert!(!failure.to_string().contains(SENTINEL)); + } +} diff --git a/crates/registry-notary-server/src/standalone/assembly.rs b/crates/registry-notary-server/src/standalone/assembly.rs index fcbd73c64..319892bd9 100644 --- a/crates/registry-notary-server/src/standalone/assembly.rs +++ b/crates/registry-notary-server/src/standalone/assembly.rs @@ -73,12 +73,10 @@ impl NotaryRuntimeSnapshot { ) { tracing::error!( code = crate::AUDIT_CHAIN_INCONSISTENT_CODE, - error = %error, "audit chain failed eager integrity verification" ); } else { tracing::warn!( - error = %error, "audit chain eager verification encountered a retryable operational failure" ); } diff --git a/crates/registry-notary-server/src/standalone/offline_fixture.rs b/crates/registry-notary-server/src/standalone/offline_fixture.rs index a949da64a..49ccec21e 100644 --- a/crates/registry-notary-server/src/standalone/offline_fixture.rs +++ b/crates/registry-notary-server/src/standalone/offline_fixture.rs @@ -2,8 +2,7 @@ //! Product-owned Notary evidence path for environment-free authoring fixtures. use std::collections::{BTreeMap, BTreeSet}; -use std::sync::atomic::{AtomicU64, Ordering}; -use std::sync::Arc; +use std::sync::{Arc, Mutex}; use base64::engine::general_purpose::URL_SAFE_NO_PAD; use base64::Engine as _; @@ -262,6 +261,7 @@ pub struct OfflineNotaryEvidence { product_error_code: Option<&'static str>, relay_calls: u64, consultation_count: usize, + relay_profile_ids: Vec, } impl OfflineNotaryEvidence { @@ -289,6 +289,14 @@ impl OfflineNotaryEvidence { pub const fn consultation_count(&self) -> usize { self.consultation_count } + + /// Compiled Relay profile identities selected by the production request + /// planner. These are value-free configuration identities, not request + /// values or runtime consultation ULIDs. + #[must_use] + pub fn relay_profile_ids(&self) -> &[String] { + &self.relay_profile_ids + } } impl std::fmt::Debug for OfflineNotaryEvidence { @@ -307,6 +315,7 @@ impl std::fmt::Debug for OfflineNotaryEvidence { .field("product_error_code", &self.product_error_code) .field("relay_calls", &self.relay_calls) .field("consultation_count", &self.consultation_count) + .field("relay_profile_ids", &self.relay_profile_ids) .finish() } } @@ -387,7 +396,6 @@ impl OfflineNotaryHarness { } pub async fn evaluate(&self, offline: OfflineNotaryRequest) -> OfflineNotaryEvidence { - let relay_before = self.relay.calls.load(Ordering::SeqCst); let scopes = match offline.authentication { OfflineAuthentication::Valid => required_scopes(&self.evidence, &offline.request), OfflineAuthentication::InsufficientScope => { @@ -399,7 +407,7 @@ impl OfflineNotaryHarness { }; let scopes = match scopes { Ok(scopes) => scopes, - Err(error) => return self.evidence_from_error(error, relay_before, 0), + Err(error) => return self.evidence_from_error(error, &[]), }; let fingerprint = fingerprint_api_key(self.api_key.as_str()); let credential = ResolvedCredential { @@ -429,7 +437,7 @@ impl OfflineNotaryHarness { ); let principal = match principal { Ok(principal) => principal, - Err(error) => return self.evidence_from_error(error, relay_before, 0), + Err(error) => return self.evidence_from_error(error, &[]), }; let (result, audit) = self .runtime @@ -447,33 +455,26 @@ impl OfflineNotaryHarness { claims: claims.into_iter().map(OfflineClaimView::from).collect(), error_class: None, product_error_code: None, - relay_calls: self - .relay - .calls - .load(Ordering::SeqCst) - .saturating_sub(relay_before), + relay_calls: u64::try_from(consultation_ids.len()).unwrap_or(u64::MAX), consultation_count: consultation_ids.len(), + relay_profile_ids: self.relay.take_profile_ids_for(&consultation_ids), }, - Err(error) => self.evidence_from_error(error, relay_before, consultation_ids.len()), + Err(error) => self.evidence_from_error(error, &consultation_ids), } } fn evidence_from_error( &self, error: EvidenceError, - relay_before: u64, - consultation_count: usize, + consultation_ids: &[String], ) -> OfflineNotaryEvidence { OfflineNotaryEvidence { claims: Vec::new(), error_class: Some(error_class(&error)), product_error_code: Some(error.code()), - relay_calls: self - .relay - .calls - .load(Ordering::SeqCst) - .saturating_sub(relay_before), - consultation_count, + relay_calls: u64::try_from(consultation_ids.len()).unwrap_or(u64::MAX), + consultation_count: consultation_ids.len(), + relay_profile_ids: self.relay.take_profile_ids_for(consultation_ids), } } } @@ -557,7 +558,7 @@ struct OfflineRelayEntry { struct OfflineActivatedRelay { entries: BTreeMap, - calls: AtomicU64, + profile_by_consultation_id: Mutex>, } impl OfflineActivatedRelay { @@ -607,10 +608,23 @@ impl OfflineActivatedRelay { } Ok(Self { entries, - calls: AtomicU64::new(0), + profile_by_consultation_id: Mutex::new(BTreeMap::new()), }) } + fn take_profile_ids_for(&self, consultation_ids: &[String]) -> Vec { + let mut profile_by_consultation_id = self + .profile_by_consultation_id + .lock() + .unwrap_or_else(std::sync::PoisonError::into_inner); + consultation_ids + .iter() + .filter_map(|id| profile_by_consultation_id.remove(id)) + .collect::>() + .into_iter() + .collect() + } + fn entry_for( &self, key: &ConsultationGroupKeyV1, @@ -639,7 +653,7 @@ impl std::fmt::Debug for OfflineActivatedRelay { formatter .debug_struct("OfflineActivatedRelay") .field("entries", &"[REDACTED]") - .field("calls", &self.calls.load(Ordering::Relaxed)) + .field("profile_by_consultation_id", &"[REDACTED]") .finish() } } @@ -663,7 +677,6 @@ impl ActivatedRelayConsultations for OfflineActivatedRelay { key: &ConsultationGroupKeyV1, ) -> Result { let entry = self.entry_for(key)?; - self.calls.fetch_add(1, Ordering::SeqCst); let (outcome, match_data) = match entry.outcome { OfflineRelayOutcome::Match => ( RuntimeRelayOutcome::Match, @@ -674,12 +687,18 @@ impl ActivatedRelayConsultations for OfflineActivatedRelay { OfflineRelayOutcome::NoMatch => (RuntimeRelayOutcome::NoMatch, None), OfflineRelayOutcome::Ambiguous => (RuntimeRelayOutcome::Ambiguous, None), }; - RuntimeRelayConsultationResult::new( - ulid::Ulid::new(), + let consultation_id = ulid::Ulid::new(); + let result = RuntimeRelayConsultationResult::new( + consultation_id, outcome, match_data, OffsetDateTime::now_utc(), - ) + )?; + self.profile_by_consultation_id + .lock() + .unwrap_or_else(std::sync::PoisonError::into_inner) + .insert(consultation_id.to_string(), key.profile_id().to_owned()); + Ok(result) } } diff --git a/crates/registry-notary-server/src/standalone/runtime.rs b/crates/registry-notary-server/src/standalone/runtime.rs index 96bdfac99..a517b7d97 100644 --- a/crates/registry-notary-server/src/standalone/runtime.rs +++ b/crates/registry-notary-server/src/standalone/runtime.rs @@ -77,6 +77,8 @@ use crate::{ RegistryNotaryApiState, SubjectAccessRateLimitKeys, SubjectAccessRateLimiter, }; +#[path = "activation.rs"] +mod activation; #[path = "assembly.rs"] mod assembly; #[path = "auth/mod.rs"] @@ -97,6 +99,7 @@ mod relay; #[path = "transport/mod.rs"] mod transport; +pub use activation::*; pub use assembly::*; use auth::*; pub use auth::{find_credential, ResolvedCredential}; diff --git a/crates/registry-notary-server/src/state_plane/runtime.rs b/crates/registry-notary-server/src/state_plane/runtime.rs index d7039adf5..ff90c4e2c 100644 --- a/crates/registry-notary-server/src/state_plane/runtime.rs +++ b/crates/registry-notary-server/src/state_plane/runtime.rs @@ -7,10 +7,12 @@ use std::{ collections::HashMap, - env, fmt, + env, + error::Error as StdError, + fmt, fs::File, future::Future, - io::Read, + io::{self, Read}, path::{Path, PathBuf}, sync::{ atomic::{AtomicBool, AtomicU64, Ordering}, @@ -32,6 +34,7 @@ use tokio::task::{AbortHandle, JoinHandle}; use tokio::time::MissedTickBehavior; use tokio_postgres::{ config::{SslMode, TargetSessionAttrs}, + error::SqlState, Client, Config as TokioPostgresConfig, }; use zeroize::Zeroizing; @@ -54,6 +57,10 @@ const RETENTION_CATCH_UP_INITIAL_BACKOFF: Duration = Duration::from_millis(10); const RETENTION_CATCH_UP_MAX_BACKOFF: Duration = Duration::from_millis(100); const RETENTION_PRUNE_QUERY: &str = "SELECT deleted_count, batch_saturated FROM registry_notary_api.retention_prune_v1($1)"; +// tokio-postgres uses this closed driver-owned cause when +// `target_session_attrs=read-write` reaches a read-only server. Match it only +// to classify the posture. Never expose the cause or any driver error text. +const TARGET_SESSION_READ_ONLY_CAUSE: &str = "database does not allow writes"; type ConnectionDriver = JoinHandle>; type CredentialGeneration = [u8; 32]; @@ -302,7 +309,7 @@ impl NotaryPostgresOperatorConnection { ) .await .map_err(|_| NotaryPostgresStatePlaneError::DatabaseUnavailable)? - .map_err(|_| NotaryPostgresStatePlaneError::DatabaseUnavailable)?; + .map_err(map_connection_error)?; Ok(Self { client, driver: Some(tokio::spawn(connection)), @@ -683,7 +690,7 @@ impl PhysicalPostgresSession { ) .await .map_err(|_| NotaryPostgresStatePlaneError::DatabaseUnavailable)? - .map_err(|_| NotaryPostgresStatePlaneError::DatabaseUnavailable)?; + .map_err(map_connection_error)?; Ok(()) } @@ -770,7 +777,7 @@ impl ConnectionFactory { tokio::time::timeout(self.connect_timeout, postgres_config.connect(connector)) .await .map_err(|_| NotaryPostgresStatePlaneError::DatabaseUnavailable)? - .map_err(|_| NotaryPostgresStatePlaneError::DatabaseUnavailable)?; + .map_err(map_connection_error)?; drop(postgres_config); let driver = tokio::spawn(connection); @@ -972,6 +979,32 @@ fn map_pool_error( } } +fn map_connection_error(error: tokio_postgres::Error) -> NotaryPostgresStatePlaneError { + classify_connection_failure(error.code(), StdError::source(&error)) +} + +fn classify_connection_failure( + sqlstate: Option<&SqlState>, + cause: Option<&(dyn StdError + 'static)>, +) -> NotaryPostgresStatePlaneError { + if sqlstate == Some(&SqlState::READ_ONLY_SQL_TRANSACTION) + || is_target_session_read_only_cause(cause) + { + NotaryPostgresStatePlaneError::DatabaseNotWritable + } else { + NotaryPostgresStatePlaneError::DatabaseUnavailable + } +} + +fn is_target_session_read_only_cause(cause: Option<&(dyn StdError + 'static)>) -> bool { + cause + .and_then(|cause| cause.downcast_ref::()) + .is_some_and(|cause| { + cause.kind() == io::ErrorKind::PermissionDenied + && cause.to_string() == TARGET_SESSION_READ_ONLY_CAUSE + }) +} + const fn map_attestation_error(error: StatePlaneMigrationError) -> NotaryPostgresStatePlaneError { match error { StatePlaneMigrationError::UnsupportedServerMajor => { @@ -1079,6 +1112,36 @@ mod tests { ); } + #[test] + fn connection_failures_preserve_only_the_safe_read_only_classification() { + assert_eq!( + classify_connection_failure(Some(&SqlState::READ_ONLY_SQL_TRANSACTION), None), + NotaryPostgresStatePlaneError::DatabaseNotWritable + ); + + let target_session_cause = io::Error::new( + io::ErrorKind::PermissionDenied, + TARGET_SESSION_READ_ONLY_CAUSE, + ); + assert_eq!( + classify_connection_failure(None, Some(&target_session_cause)), + NotaryPostgresStatePlaneError::DatabaseNotWritable + ); + + let unrelated = io::Error::new( + io::ErrorKind::PermissionDenied, + "SENTINEL_DATABASE_PATH_OR_DRIVER_VALUE", + ); + let classified = classify_connection_failure(None, Some(&unrelated)); + assert_eq!( + classified, + NotaryPostgresStatePlaneError::DatabaseUnavailable + ); + let rendered = format!("{classified:?} {classified}"); + assert!(!rendered.contains("SENTINEL")); + assert!(!rendered.contains("driver")); + } + #[test] fn runtime_configuration_debug_redacts_environment_and_path() { let rendered = format!("{:?}", config()); diff --git a/crates/registry-notary/src/boot.rs b/crates/registry-notary/src/boot.rs index a07e42c1c..353f8fb27 100644 --- a/crates/registry-notary/src/boot.rs +++ b/crates/registry-notary/src/boot.rs @@ -1,11 +1,23 @@ use crate::*; +pub(crate) fn value_free_configuration_failure( + _: E, +) -> registry_notary_server::NotaryActivationFailure { + registry_notary_server::NotaryActivationCode::CONFIGURATION_INVALID.into() +} + +fn value_free_runtime_activation_failure( + _: E, +) -> registry_notary_server::NotaryActivationFailure { + registry_notary_server::NotaryActivationCode::RUNTIME_ACTIVATION_FAILED.into() +} + pub(crate) async fn run_server( config_path: &Path, bind_override: Option, initialize_state: bool, ) -> Result<(), Box> { - init_tracing()?; + init_tracing().map_err(value_free_configuration_failure)?; let loaded = load_server_config(config_path, initialize_state)?; let mut config = loaded.config; @@ -18,9 +30,11 @@ pub(crate) async fn run_server( config, loaded.config_source, loaded.config_provenance.clone(), - )? + ) + .map_err(registry_notary_server::NotaryActivationFailure::from)? .activate() - .await?; + .await + .map_err(registry_notary_server::NotaryActivationFailure::from)?; match admin_mode { RegistryNotaryAdminListenerMode::Dedicated => { let public_listener = tokio::net::TcpListener::bind(bind).await?; @@ -28,8 +42,10 @@ pub(crate) async fn run_server( let admin_listener = tokio::net::TcpListener::bind(admin_bind).await?; let admin_addr: SocketAddr = admin_listener.local_addr()?; emit_and_persist_boot_acceptance(&runtime, loaded.pending_bundle_acceptance.as_ref()) - .await?; - let routers = notary_routers_from_runtime(runtime)?; + .await + .map_err(value_free_runtime_activation_failure)?; + let routers = notary_routers_from_runtime(runtime) + .map_err(registry_notary_server::NotaryActivationFailure::from)?; tracing::info!( %public_addr, %admin_addr, @@ -66,8 +82,10 @@ pub(crate) async fn run_server( let listener = tokio::net::TcpListener::bind(bind).await?; let local_addr: SocketAddr = listener.local_addr()?; emit_and_persist_boot_acceptance(&runtime, loaded.pending_bundle_acceptance.as_ref()) - .await?; - let app = notary_shared_router_from_runtime(runtime)? + .await + .map_err(value_free_runtime_activation_failure)?; + let app = notary_shared_router_from_runtime(runtime) + .map_err(registry_notary_server::NotaryActivationFailure::from)? .layer(TraceLayer::new_for_http().make_span_with(http_trace_span)); tracing::info!( %local_addr, @@ -81,8 +99,10 @@ pub(crate) async fn run_server( let listener = tokio::net::TcpListener::bind(bind).await?; let local_addr: SocketAddr = listener.local_addr()?; emit_and_persist_boot_acceptance(&runtime, loaded.pending_bundle_acceptance.as_ref()) - .await?; - let app = notary_routers_from_runtime(runtime)? + .await + .map_err(value_free_runtime_activation_failure)?; + let app = notary_routers_from_runtime(runtime) + .map_err(registry_notary_server::NotaryActivationFailure::from)? .public .layer(TraceLayer::new_for_http().make_span_with(http_trace_span)); tracing::info!( diff --git a/crates/registry-notary/src/boot/tests.rs b/crates/registry-notary/src/boot/tests.rs index 862f7b88b..15296eeca 100644 --- a/crates/registry-notary/src/boot/tests.rs +++ b/crates/registry-notary/src/boot/tests.rs @@ -2,6 +2,63 @@ use super::*; use crate::test_support::*; +use registry_notary_server::{NotaryActivationCode, NotaryActivationFailure}; +use registry_platform_ops::{BundleVerificationCode, BundleVerificationFailure}; + +fn assert_value_free_activation_failure( + error: &(dyn std::error::Error + 'static), + expected_code: NotaryActivationCode, + forbidden_values: &[&str], +) { + let failure = error + .downcast_ref::() + .expect("runtime activation errors use the redacted process boundary"); + assert_eq!(failure.code(), expected_code); + assert!( + std::error::Error::source(failure).is_none(), + "the public failure must not retain an inner error" + ); + let rendered = failure.to_string(); + assert!(rendered.contains(expected_code.as_str())); + for forbidden in forbidden_values { + assert!( + !rendered.contains(forbidden), + "activation boundary exposed forbidden value {forbidden:?}: {rendered}" + ); + } +} + +#[test] +fn top_level_server_error_renderer_drops_unknown_error_values() { + const SENTINEL: &str = "SENTINEL_PRIVATE_USERNAME_COUNTRY_SECRET_PATH_AND_DIGEST"; + let unknown = std::io::Error::other(SENTINEL); + + let rendered = crate::top_level_error_message(&unknown, true); + + assert!(rendered.contains(NotaryActivationCode::RUNTIME_ACTIVATION_FAILED.as_str())); + assert!(!rendered.contains(SENTINEL)); +} + +#[test] +fn top_level_server_error_renderer_preserves_safe_activation_code() { + let failure = NotaryActivationFailure::from(NotaryActivationCode::CONFIGURATION_INVALID); + + let rendered = crate::top_level_error_message(&failure, true); + + assert!(rendered.contains(NotaryActivationCode::CONFIGURATION_INVALID.as_str())); + assert!(!rendered.contains("SENTINEL")); +} + +#[test] +fn top_level_server_error_renderer_preserves_safe_bundle_verification_code() { + let failure = BundleVerificationFailure::from(BundleVerificationCode::REJECTED_SIGNATURE); + + let rendered = crate::top_level_error_message(&failure, true); + + assert_eq!(rendered, failure.to_string()); + assert!(rendered.contains(BundleVerificationCode::REJECTED_SIGNATURE.as_str())); + assert!(!rendered.contains("SENTINEL")); +} #[test] fn boot_bundle_acceptance_audit_failure_aborts_before_antirollback_persist() { @@ -46,6 +103,32 @@ fn boot_bundle_acceptance_audit_failure_aborts_before_antirollback_persist() { ); } +#[tokio::test] +async fn boot_configuration_boundary_redacts_paths_and_parser_values() { + let tmp = tempfile::tempdir().expect("tempdir"); + let config_path = tmp.path().join("SENTINEL_PRIVATE_CONFIG_PATH.yaml"); + fs::write( + &config_path, + "SENTINEL_COUNTRY_IDENTIFIER: [invalid parser value", + ) + .expect("invalid startup config writes"); + + let error = run_server(&config_path, None, false) + .await + .expect_err("invalid startup config fails closed"); + + assert_value_free_activation_failure( + error.as_ref(), + NotaryActivationCode::CONFIGURATION_INVALID, + &[ + "SENTINEL_PRIVATE_CONFIG_PATH", + "SENTINEL_COUNTRY_IDENTIFIER", + "invalid parser value", + config_path.to_str().expect("config path is UTF-8"), + ], + ); +} + #[tokio::test] #[allow(clippy::await_holding_lock)] async fn governed_boot_integrity_failure_persists_nothing_and_serves_nothing() { @@ -109,11 +192,14 @@ async fn governed_boot_integrity_failure_persists_nothing_and_serves_nothing() { let error = run_server(&config_path, None, true) .await .expect_err("governed boot audit failure aborts startup"); - assert!( - error - .to_string() - .contains("audit chain verification failed"), - "unexpected error: {error}" + assert_value_free_activation_failure( + error.as_ref(), + NotaryActivationCode::RUNTIME_ACTIVATION_FAILED, + &[ + "audit chain verification failed", + audit_path.to_str().expect("audit path is UTF-8"), + "governed.boot.tampered", + ], ); let key = registry_platform_ops::AntiRollbackKey { product: "registry-notary".to_string(), @@ -229,11 +315,14 @@ async fn run_server_compiles_runtime_before_binding_listener() { .expect_err("invalid runtime config fails before serving"); let message = error.to_string(); - assert!( - message.contains("TEST_DOCTOR_OAUTH_CLIENT_ID") - || message.contains("TEST_DOCTOR_OAUTH_CLIENT_SECRET") - || message.contains("audit.hash_secret_env"), - "unexpected error: {message}" + assert_value_free_activation_failure( + error.as_ref(), + NotaryActivationCode::CONFIGURATION_INVALID, + &[ + "TEST_DOCTOR_OAUTH_CLIENT_ID", + "TEST_DOCTOR_OAUTH_CLIENT_SECRET", + "audit.hash_secret_env", + ], ); assert!( !message.contains("Address already in use"), @@ -301,10 +390,14 @@ evidence: .expect_err("missing signing key env fails before serving"); let message = error.to_string(); - assert!( - message.contains("signing key 'issuer' is invalid") - && message.contains("private_jwk_env is missing or empty"), - "unexpected error: {message}" + assert_value_free_activation_failure( + error.as_ref(), + NotaryActivationCode::CONFIGURATION_INVALID, + &[ + "signing key 'issuer'", + "private_jwk_env", + "TEST_STARTUP_ISSUER_JWK", + ], ); assert!( !message.contains("Address already in use"), diff --git a/crates/registry-notary/src/commands/config_bundle.rs b/crates/registry-notary/src/commands/config_bundle.rs index 87cf78856..3c4045874 100644 --- a/crates/registry-notary/src/commands/config_bundle.rs +++ b/crates/registry-notary/src/commands/config_bundle.rs @@ -1,4 +1,8 @@ use crate::*; +use registry_platform_ops::{ + bundle_verify_rejection_code, ApplyReportResult, BundleVerificationCode, + BundleVerificationFailure, +}; pub(crate) async fn config_verify_bundle( args: ConfigVerifyBundleArgs, @@ -6,17 +10,8 @@ pub(crate) async fn config_verify_bundle( let verified = match verify_config_bundle(&args.bundle_dir, &args.anchor_path) { Ok(verified) => verified, Err(error) => { - let result = bundle_verify_rejection_result(&error); - print_config_verify_bundle_report(config_verify_bundle_report( - result, - "unknown", - None, - None, - None, - None, - Some((result, error.to_string())), - ))?; - return Err(Box::new(error)); + let code = bundle_verify_rejection_code(&error); + return reject_config_verify_bundle(code); } }; let key = antirollback_key_from_verified_bundle(&verified); @@ -27,52 +22,31 @@ pub(crate) async fn config_verify_bundle( &verified.manifest.config_hash, &verified.manifest_hash, ) { - print_config_verify_bundle_report(config_verify_bundle_report( - "rejected_rollback", - &verified.manifest.stream_id, - Some(verified.manifest.bundle_id.clone()), - Some(verified.manifest.sequence), - verified.manifest.previous_config_hash.clone(), - Some(verified.manifest.config_hash.clone()), - Some(("rejected_rollback", error.to_string())), - ))?; - return Err(Box::new(error)); + let code = error.bundle_rejection_code(); + return reject_config_verify_bundle(code); } - let config_text = std::str::from_utf8(&verified.config_bytes)?; + let config_text = match std::str::from_utf8(&verified.config_bytes) { + Ok(config_text) => config_text, + Err(_) => { + return reject_config_verify_bundle(BundleVerificationCode::REJECTED_VALIDATION); + } + }; let parsed = match parse_config_document(config_text).and_then(|parsed| { validate_signed_bundle_config_document(&parsed)?; Ok(parsed) }) { Ok(parsed) => parsed, - Err(error) => { - print_config_verify_bundle_report(config_verify_bundle_report( - "rejected_validation", - &verified.manifest.stream_id, - Some(verified.manifest.bundle_id.clone()), - Some(verified.manifest.sequence), - verified.manifest.previous_config_hash.clone(), - Some(verified.manifest.config_hash.clone()), - Some(("rejected_validation", error.to_string())), - ))?; - return Err(error); + Err(_) => { + return reject_config_verify_bundle(BundleVerificationCode::REJECTED_VALIDATION); } }; - if let Err(error) = - compile_notary_runtime_with_provenance(parsed.config, ConfigSource::SignedBundleFile, None) + if compile_notary_runtime_with_provenance(parsed.config, ConfigSource::SignedBundleFile, None) + .is_err() { - print_config_verify_bundle_report(config_verify_bundle_report( - "rejected_validation", - &verified.manifest.stream_id, - Some(verified.manifest.bundle_id.clone()), - Some(verified.manifest.sequence), - verified.manifest.previous_config_hash.clone(), - Some(verified.manifest.config_hash.clone()), - Some(("rejected_validation", error.to_string())), - ))?; - return Err(Box::new(error)); + return reject_config_verify_bundle(BundleVerificationCode::REJECTED_VALIDATION); } print_config_verify_bundle_report(config_verify_bundle_report( - "verified", + ApplyReportResult::Verified, &verified.manifest.stream_id, Some(verified.manifest.bundle_id), Some(verified.manifest.sequence), @@ -83,6 +57,21 @@ pub(crate) async fn config_verify_bundle( Ok(()) } +fn reject_config_verify_bundle( + code: BundleVerificationCode, +) -> Result<(), Box> { + print_config_verify_bundle_report(config_verify_bundle_report( + ApplyReportResult::from(code), + "unknown", + None, + None, + None, + None, + Some(code), + ))?; + Err(Box::new(BundleVerificationFailure::from(code))) +} + pub(crate) fn print_config_verify_bundle_report( report: Value, ) -> Result<(), Box> { @@ -91,16 +80,28 @@ pub(crate) fn print_config_verify_bundle_report( } pub(crate) fn config_verify_bundle_report( - result: &'static str, + result: ApplyReportResult, stream_id: &str, bundle_id: Option, bundle_sequence: Option, previous_config_hash: Option, config_hash: Option, - error: Option<(&'static str, String)>, + error: Option, ) -> Value { + let rejected = error.is_some(); + let stream_id = if rejected { "unknown" } else { stream_id }; + let bundle_id = if rejected { None } else { bundle_id }; + let bundle_sequence = if rejected { None } else { bundle_sequence }; + let previous_config_hash = if rejected { None } else { previous_config_hash }; + let config_hash = if rejected { None } else { config_hash }; let errors = error - .map(|(code, message)| vec![json!({ "code": code, "message": message })]) + .map(|code| { + let definition = code.definition(); + vec![json!({ + "code": code.as_str(), + "message": definition.safe_report_message, + })] + }) .unwrap_or_default(); json!({ "schema": "registry.platform.config_apply_report.v1", @@ -112,7 +113,7 @@ pub(crate) fn config_verify_bundle_report( "bundle_sequence": bundle_sequence, "previous_config_hash": previous_config_hash, "config_hash": config_hash, - "result": result, + "result": result.as_str(), "restart_required": false, "change_classes": [], "affected_components": [], diff --git a/crates/registry-notary/src/commands/state.rs b/crates/registry-notary/src/commands/state.rs index aafa49481..9eed6cfdd 100644 --- a/crates/registry-notary/src/commands/state.rs +++ b/crates/registry-notary/src/commands/state.rs @@ -78,11 +78,9 @@ fn state_doctor_completion( fn state_doctor_error( readiness: registry_notary_server::state_plane::NotaryPostgresStatePlaneReadiness, ) -> Box { - format!( - "registry-notary PostgreSQL state is not ready: {}", - readiness.doctor_component_code() - ) - .into() + Box::new(registry_notary_server::NotaryActivationFailure::from( + readiness.activation_code(), + )) } #[cfg(test)] diff --git a/crates/registry-notary/src/commands/state/tests.rs b/crates/registry-notary/src/commands/state/tests.rs index dbf540ba0..96e1ad653 100644 --- a/crates/registry-notary/src/commands/state/tests.rs +++ b/crates/registry-notary/src/commands/state/tests.rs @@ -65,23 +65,51 @@ fn state_command_output_reports_attested_versions_without_claiming_every_install } #[test] -fn state_doctor_failures_use_only_closed_value_free_component_codes() { +fn state_doctor_failures_use_cause_specific_value_free_operator_diagnostics() { use registry_notary_server::state_plane::NotaryPostgresStatePlaneReadiness as Readiness; let cases = [ - (Readiness::ConfigurationInvalid, "configuration_invalid"), - (Readiness::DatabaseUnavailable, "database_unavailable"), - (Readiness::UnsupportedServerMajor, "database_unavailable"), - (Readiness::DatabaseNotWritable, "database_unavailable"), - (Readiness::UnsafeDurability, "database_unavailable"), - (Readiness::SchemaIncompatible, "schema_incompatible"), - (Readiness::RoleIncompatible, "role_incompatible"), - (Readiness::Shutdown, "database_unavailable"), + ( + Readiness::ConfigurationInvalid, + NotaryActivationCode::CONFIGURATION_INVALID, + ), + ( + Readiness::DatabaseUnavailable, + NotaryActivationCode::POSTGRESQL_DATABASE_UNAVAILABLE, + ), + ( + Readiness::UnsupportedServerMajor, + NotaryActivationCode::POSTGRESQL_DATABASE_UNSUPPORTED, + ), + ( + Readiness::DatabaseNotWritable, + NotaryActivationCode::POSTGRESQL_DATABASE_READ_ONLY, + ), + ( + Readiness::UnsafeDurability, + NotaryActivationCode::POSTGRESQL_DURABILITY_UNSAFE, + ), + ( + Readiness::SchemaIncompatible, + NotaryActivationCode::POSTGRESQL_SCHEMA_INCOMPATIBLE, + ), + ( + Readiness::RoleIncompatible, + NotaryActivationCode::POSTGRESQL_ROLE_INCOMPATIBLE, + ), + ( + Readiness::Shutdown, + NotaryActivationCode::POSTGRESQL_DATABASE_UNAVAILABLE, + ), ]; - for (readiness, expected) in cases { + for (readiness, code) in cases { + let definition = code.definition(); assert_eq!( state_doctor_error(readiness).to_string(), - format!("registry-notary PostgreSQL state is not ready: {expected}") + format!( + "{}: {}; next action: {}", + code, definition.meaning, definition.remediation + ) ); } } diff --git a/crates/registry-notary/src/config_loader.rs b/crates/registry-notary/src/config_loader.rs index e9d06ba8e..1af223d63 100644 --- a/crates/registry-notary/src/config_loader.rs +++ b/crates/registry-notary/src/config_loader.rs @@ -1,5 +1,7 @@ use crate::*; +use registry_notary_server::{NotaryActivationCode, NotaryActivationFailure}; + #[derive(Debug)] pub(crate) struct LoadedServerConfig { pub(crate) config: StandaloneRegistryNotaryConfig, @@ -74,10 +76,31 @@ pub(crate) fn load_server_config( config_path: &Path, initialize_state: bool, ) -> Result> { - let raw = fs::read_to_string(config_path)?; - let bootstrap = parse_config_document(&raw)?; + let raw = fs::read_to_string(config_path).map_err(|_| { + log_safe_configuration_rejection( + NotaryActivationCode::CONFIGURATION_INVALID.as_str(), + "rejected_validation", + None, + ); + configuration_failure() + })?; + let bootstrap = parse_config_document(&raw).map_err(|_| { + log_safe_configuration_rejection( + NotaryActivationCode::CONFIGURATION_INVALID.as_str(), + "rejected_validation", + None, + ); + configuration_failure() + })?; let Some(config_trust) = bootstrap.config.config_trust.as_ref() else { - validate_config_document(&bootstrap)?; + validate_config_document(&bootstrap).map_err(|_| { + log_safe_configuration_rejection( + NotaryActivationCode::CONFIGURATION_INVALID.as_str(), + "rejected_validation", + None, + ); + configuration_failure() + })?; return Ok(LoadedServerConfig { config: bootstrap.config, config_source: ConfigSource::LocalFile, @@ -96,8 +119,8 @@ pub(crate) fn load_server_config( )? { return Ok(loaded); } - log_bundle_verification_error(&error); - return Err(Box::::from(error)); + let code = log_bundle_verification_error(&error); + return Err(bundle_verification_failure(code)); } }; match load_verified_bundle_server_config(config_trust, initialize_state, verified) { @@ -131,35 +154,29 @@ pub(crate) fn load_verified_bundle_server_config( initialize_state, }) .map_err(map_config_boot_error)?; - let config_text = std::str::from_utf8(&verified.config_bytes).map_err(|error| { - tracing::error!( - code = "config.bundle_rejected", - result = "rejected_validation", - error = %error, - "signed config bundle primary config is not UTF-8" + let config_text = std::str::from_utf8(&verified.config_bytes).map_err(|_| { + log_safe_bundle_rejection( + "config.bundle_rejected", + BundleVerificationCode::REJECTED_VALIDATION, + None, ); - eprintln!("config.bundle_rejected result=rejected_validation error={error}"); - Box::::from(error) + bundle_verification_failure(BundleVerificationCode::REJECTED_VALIDATION) })?; - let parsed = parse_config_document(config_text).map_err(|error| { - tracing::error!( - code = "config.bundle_rejected", - result = "rejected_validation", - error = %error, - "signed config bundle primary config failed to parse" + let parsed = parse_config_document(config_text).map_err(|_| { + log_safe_bundle_rejection( + "config.bundle_rejected", + BundleVerificationCode::REJECTED_VALIDATION, + None, ); - eprintln!("config.bundle_rejected result=rejected_validation error={error}"); - error + bundle_verification_failure(BundleVerificationCode::REJECTED_VALIDATION) })?; - validate_signed_bundle_config_document(&parsed).map_err(|error| { - tracing::error!( - code = "config.bundle_rejected", - result = "rejected_validation", - error = %error, - "signed config bundle primary config failed product validation" + validate_signed_bundle_config_document(&parsed).map_err(|_| { + log_safe_bundle_rejection( + "config.bundle_rejected", + BundleVerificationCode::REJECTED_VALIDATION, + None, ); - eprintln!("config.bundle_rejected result=rejected_validation error={error}"); - error + bundle_verification_failure(BundleVerificationCode::REJECTED_VALIDATION) })?; let provenance = ConfigProvenance { source: ConfigSource::SignedBundleFile, @@ -220,35 +237,29 @@ pub(crate) fn load_unsigned_pin_server_config( config_trust: &ConfigTrustConfig, selection: UnsignedConfigSelection, ) -> Result> { - let config_text = std::str::from_utf8(&selection.config_bytes).map_err(|error| { - tracing::error!( - code = "config.bundle_rejected", - result = "rejected_validation", - error = %error, - "unsigned break-glass config is not UTF-8" + let config_text = std::str::from_utf8(&selection.config_bytes).map_err(|_| { + log_safe_bundle_rejection( + "config.bundle_rejected", + BundleVerificationCode::REJECTED_VALIDATION, + None, ); - eprintln!("config.bundle_rejected result=rejected_validation error={error}"); - Box::::from(error) + bundle_verification_failure(BundleVerificationCode::REJECTED_VALIDATION) })?; - let parsed = parse_config_document(config_text).map_err(|error| { - tracing::error!( - code = "config.bundle_rejected", - result = "rejected_validation", - error = %error, - "unsigned break-glass config failed to parse" + let parsed = parse_config_document(config_text).map_err(|_| { + log_safe_bundle_rejection( + "config.bundle_rejected", + BundleVerificationCode::REJECTED_VALIDATION, + None, ); - eprintln!("config.bundle_rejected result=rejected_validation error={error}"); - error + bundle_verification_failure(BundleVerificationCode::REJECTED_VALIDATION) })?; - validate_config_document(&parsed).map_err(|error| { - tracing::error!( - code = "config.bundle_rejected", - result = "rejected_validation", - error = %error, - "unsigned break-glass config failed product validation" + validate_config_document(&parsed).map_err(|_| { + log_safe_bundle_rejection( + "config.bundle_rejected", + BundleVerificationCode::REJECTED_VALIDATION, + None, ); - eprintln!("config.bundle_rejected result=rejected_validation error={error}"); - error + bundle_verification_failure(BundleVerificationCode::REJECTED_VALIDATION) })?; let override_pin = Some(selection.pin.clone()); Ok(LoadedServerConfig { @@ -289,36 +300,103 @@ pub(crate) fn load_unsigned_pin_server_config( }) } -pub(crate) fn log_bundle_verification_error(error: &ConfigBundleError) { - let result = bundle_verify_rejection_result(error); - tracing::error!( - code = "config.bundle_rejected", - result, - error = %error, - "signed config bundle verification failed" - ); - eprintln!("config.bundle_rejected result={result} error={error}"); +pub(crate) fn log_bundle_verification_error(error: &ConfigBundleError) -> BundleVerificationCode { + let code = bundle_verify_rejection_code(error); + log_safe_bundle_rejection("config.bundle_rejected", code, None); + code } pub(crate) fn map_config_boot_error(error: ConfigBootError) -> Box { + let code = error.bundle_rejection_code(); if let Some(reason) = error.break_glass_invalid_reason() { - tracing::error!( - code = "config.break_glass_invalid", - error = %error, - reason, - "config break-glass override rejected" - ); - eprintln!("config.break_glass_invalid error={error}"); + log_safe_bundle_rejection("config.break_glass_invalid", code, Some(reason)); } - let result = error.bundle_rejection_result(); - tracing::error!( - code = "config.bundle_rejected", + log_safe_bundle_rejection("config.bundle_rejected", code, None); + bundle_verification_failure(code) +} + +fn configuration_failure() -> Box { + Box::new(NotaryActivationFailure::from( + NotaryActivationCode::CONFIGURATION_INVALID, + )) +} + +fn bundle_verification_failure(code: BundleVerificationCode) -> Box { + Box::new(BundleVerificationFailure::from(code)) +} + +#[derive(Clone, Copy, Debug, PartialEq, Eq)] +struct SafeStartupRejection { + classification_code: &'static str, + result: &'static str, + reason: &'static str, + activation_code: &'static str, + safe_meaning: &'static str, + safe_remediation: &'static str, +} + +fn safe_configuration_rejection( + classification_code: &'static str, + result: &'static str, + reason: Option<&'static str>, +) -> SafeStartupRejection { + let definition = NotaryActivationCode::CONFIGURATION_INVALID.definition(); + SafeStartupRejection { + classification_code, result, - error = %error, - "config bundle boot state rejected startup" + reason: reason.unwrap_or("none"), + activation_code: definition.code.as_str(), + safe_meaning: definition.meaning, + safe_remediation: definition.remediation, + } +} + +fn safe_bundle_rejection( + classification_code: &'static str, + code: BundleVerificationCode, + reason: Option<&'static str>, +) -> SafeStartupRejection { + let definition = code.definition(); + SafeStartupRejection { + classification_code, + result: code.as_str(), + reason: reason.unwrap_or("none"), + activation_code: NotaryActivationCode::CONFIGURATION_INVALID.as_str(), + safe_meaning: definition.safe_meaning, + safe_remediation: definition.safe_remediation, + } +} + +fn log_safe_configuration_rejection( + classification_code: &'static str, + result: &'static str, + reason: Option<&'static str>, +) { + log_safe_startup_rejection(safe_configuration_rejection( + classification_code, + result, + reason, + )); +} + +fn log_safe_bundle_rejection( + classification_code: &'static str, + code: BundleVerificationCode, + reason: Option<&'static str>, +) { + log_safe_startup_rejection(safe_bundle_rejection(classification_code, code, reason)); +} + +fn log_safe_startup_rejection(rejection: SafeStartupRejection) { + tracing::error!( + code = rejection.classification_code, + result = rejection.result, + reason = rejection.reason, + activation_code = rejection.activation_code, + safe_meaning = rejection.safe_meaning, + safe_remediation = rejection.safe_remediation, + "registry notary startup configuration rejected" ); - eprintln!("config.bundle_rejected result={result} error={error}"); - Box::new(error) } #[derive(Debug)] diff --git a/crates/registry-notary/src/config_loader/tests.rs b/crates/registry-notary/src/config_loader/tests.rs index 81048910d..29d07e216 100644 --- a/crates/registry-notary/src/config_loader/tests.rs +++ b/crates/registry-notary/src/config_loader/tests.rs @@ -3,6 +3,122 @@ use super::*; use crate::test_support::*; +const PATH_SENTINEL: &str = "/private/SENTINEL_COUNTRY_CONFIG_PATH"; +const HASH_SENTINEL: &str = + "sha256:SENTINEL_EXPECTED_COUNTRY_DIGEST_11111111111111111111111111111111"; +const OTHER_HASH_SENTINEL: &str = + "sha256:SENTINEL_ACTUAL_COUNTRY_DIGEST_2222222222222222222222222222222222"; +const PARSER_SENTINEL: &str = "SENTINEL_PRIVATE_PARSER_TEXT"; +const SECRET_SENTINEL: &str = "SENTINEL_PRIVATE_SECRET"; +const COUNTRY_SENTINEL: &str = "SENTINEL_PRIVATE_COUNTRY_VALUE"; + +fn config_bundle_error_cases() -> Vec<(ConfigBundleError, BundleVerificationCode)> { + vec![ + ( + ConfigBundleError::Io(PATH_SENTINEL.to_string()), + BundleVerificationCode::REJECTED_VALIDATION, + ), + ( + ConfigBundleError::Json(PARSER_SENTINEL.to_string()), + BundleVerificationCode::REJECTED_VALIDATION, + ), + ( + ConfigBundleError::InvalidManifest(COUNTRY_SENTINEL), + BundleVerificationCode::REJECTED_VALIDATION, + ), + ( + ConfigBundleError::InvalidTrustAnchor(SECRET_SENTINEL), + BundleVerificationCode::REJECTED_SIGNATURE, + ), + ( + ConfigBundleError::InvalidPermissions(PATH_SENTINEL), + BundleVerificationCode::REJECTED_SIGNATURE, + ), + ( + ConfigBundleError::InvalidBreakGlass(SECRET_SENTINEL), + BundleVerificationCode::REJECTED_VALIDATION, + ), + ( + ConfigBundleError::InvalidSignatureEnvelope(SECRET_SENTINEL), + BundleVerificationCode::REJECTED_SIGNATURE, + ), + ( + ConfigBundleError::BindingMismatch(COUNTRY_SENTINEL), + BundleVerificationCode::REJECTED_BINDING, + ), + ( + ConfigBundleError::SignatureRejected, + BundleVerificationCode::REJECTED_SIGNATURE, + ), + ( + ConfigBundleError::FileClosure(PATH_SENTINEL.to_string()), + BundleVerificationCode::REJECTED_SIGNATURE, + ), + ( + ConfigBundleError::HashMismatch { + path: PATH_SENTINEL.to_string(), + expected: HASH_SENTINEL.to_string(), + actual: OTHER_HASH_SENTINEL.to_string(), + }, + BundleVerificationCode::REJECTED_SIGNATURE, + ), + ] +} + +fn config_boot_error_cases() -> Vec<(ConfigBootError, BundleVerificationCode)> { + vec![ + ( + ConfigBootError::Store(registry_platform_ops::AntiRollbackStoreError::InvalidState( + SECRET_SENTINEL.to_string(), + )), + BundleVerificationCode::REJECTED_ROLLBACK, + ), + ( + ConfigBootError::Bundle(ConfigBundleError::BindingMismatch(COUNTRY_SENTINEL)), + BundleVerificationCode::REJECTED_BINDING, + ), + ( + ConfigBootError::NonMonotonicSequence, + BundleVerificationCode::REJECTED_ROLLBACK, + ), + ( + ConfigBootError::OverrideHashMismatch, + BundleVerificationCode::REJECTED_ROLLBACK, + ), + ( + ConfigBootError::MissingUnsignedConfigPath, + BundleVerificationCode::REJECTED_ROLLBACK, + ), + ( + ConfigBootError::UnsignedConfigHashMismatch { + expected: HASH_SENTINEL.to_string(), + actual: OTHER_HASH_SENTINEL.to_string(), + }, + BundleVerificationCode::REJECTED_ROLLBACK, + ), + ( + ConfigBootError::MissingSignedBundleId, + BundleVerificationCode::REJECTED_VALIDATION, + ), + ( + ConfigBootError::MissingSignedBundleManifestHash, + BundleVerificationCode::REJECTED_VALIDATION, + ), + ( + ConfigBootError::MissingSignedBundleSequence, + BundleVerificationCode::REJECTED_VALIDATION, + ), + ( + ConfigBootError::MissingOverridePin, + BundleVerificationCode::REJECTED_VALIDATION, + ), + ( + ConfigBootError::InvalidOverridePath, + BundleVerificationCode::REJECTED_VALIDATION, + ), + ] +} + #[test] fn config_env_expansion_replaces_required_and_default_values() { let _guard = ENV_LOCK.lock().expect("env lock"); @@ -38,6 +154,170 @@ fn config_env_expansion_rejects_invalid_variable_names() { assert!(err.to_string().contains("invalid env var name")); } +#[test] +fn bundle_startup_rejections_use_every_exact_static_catalog_definition() { + for code in BundleVerificationCode::ALL { + let definition = code.definition(); + let rejection = safe_bundle_rejection("config.bundle_rejected", *code, None); + + assert_eq!(rejection.classification_code, "config.bundle_rejected"); + assert_eq!(rejection.result, code.as_str()); + assert_eq!(rejection.reason, "none"); + assert_eq!( + rejection.activation_code, + NotaryActivationCode::CONFIGURATION_INVALID.as_str() + ); + assert_eq!(rejection.safe_meaning, definition.safe_meaning); + assert_eq!(rejection.safe_remediation, definition.safe_remediation); + } +} + +#[test] +fn typed_bundle_failures_map_to_exact_value_free_startup_definitions() { + let forbidden = [ + PATH_SENTINEL, + HASH_SENTINEL, + OTHER_HASH_SENTINEL, + PARSER_SENTINEL, + SECRET_SENTINEL, + COUNTRY_SENTINEL, + ]; + + for (error, expected) in config_bundle_error_cases() { + let code = bundle_verify_rejection_code(&error); + assert_eq!(code, expected); + let rejection = safe_bundle_rejection("config.bundle_rejected", code, None); + assert_eq!(rejection.result, expected.as_str()); + assert_eq!(rejection.safe_meaning, expected.definition().safe_meaning); + assert_eq!( + rejection.safe_remediation, + expected.definition().safe_remediation + ); + let rendered = format!("{rejection:?}"); + for sentinel in forbidden { + assert!( + !rendered.contains(sentinel), + "safe startup rejection exposed {sentinel:?}: {rendered}" + ); + } + } +} + +#[test] +fn typed_boot_failures_preserve_binding_rollback_and_validation_definitions() { + for (error, expected) in config_boot_error_cases() { + let code = error.bundle_rejection_code(); + assert_eq!(code, expected); + let rejection = safe_bundle_rejection("config.bundle_rejected", code, None); + assert_eq!(rejection.result, expected.as_str()); + assert_eq!(rejection.safe_meaning, expected.definition().safe_meaning); + assert_eq!( + rejection.safe_remediation, + expected.definition().safe_remediation + ); + } +} + +#[test] +fn local_configuration_rejection_uses_notary_configuration_definition() { + let definition = NotaryActivationCode::CONFIGURATION_INVALID.definition(); + let rejection = safe_configuration_rejection( + NotaryActivationCode::CONFIGURATION_INVALID.as_str(), + BundleVerificationCode::REJECTED_VALIDATION.as_str(), + None, + ); + + assert_eq!(rejection.activation_code, definition.code.as_str()); + assert_eq!(rejection.safe_meaning, definition.meaning); + assert_eq!(rejection.safe_remediation, definition.remediation); +} + +#[test] +fn config_boot_error_mapping_preserves_static_bundle_code_and_drops_hash_values() { + let error = map_config_boot_error(ConfigBootError::UnsignedConfigHashMismatch { + expected: HASH_SENTINEL.to_string(), + actual: OTHER_HASH_SENTINEL.to_string(), + }); + let failure = error + .downcast_ref::() + .expect("config boot errors retain only the typed bundle rejection"); + + assert_eq!(failure.code(), BundleVerificationCode::REJECTED_ROLLBACK); + assert!(std::error::Error::source(failure).is_none()); + let rendered = format!("{failure} {failure:?}"); + assert!(rendered.contains(BundleVerificationCode::REJECTED_ROLLBACK.as_str())); + assert!(!rendered.contains(HASH_SENTINEL)); + assert!(!rendered.contains(OTHER_HASH_SENTINEL)); +} + +#[test] +fn verified_bundle_parse_failure_returns_static_validation_failure() { + let tmp = tempfile::tempdir().expect("tempdir"); + let fixture = write_signed_notary_bundle(&tmp); + let mut verified = + verify_config_bundle(&fixture.bundle_dir, &fixture.anchor_path).expect("bundle verifies"); + verified.config_bytes = b"SENTINEL_PRIVATE_COUNTRY_VALUE: [invalid parser text".to_vec(); + let bootstrap = + parse_config_document(¬ary_bootstrap_config(&fixture)).expect("bootstrap config parses"); + let config_trust = bootstrap + .config + .config_trust + .expect("bootstrap config has trust settings"); + + let error = load_verified_bundle_server_config(&config_trust, true, verified) + .expect_err("verified bundle parser failure rejects startup"); + let failure = error + .downcast_ref::() + .expect("verified bundle parser failures retain a validation category"); + + assert_eq!(failure.code(), BundleVerificationCode::REJECTED_VALIDATION); + let rendered = format!("{failure} {failure:?}"); + assert!(!rendered.contains("SENTINEL_PRIVATE_COUNTRY_VALUE")); + assert!(!rendered.contains("invalid parser text")); +} + +#[test] +fn verified_bundle_product_validation_failure_returns_static_validation_failure() { + let tmp = tempfile::tempdir().expect("tempdir"); + let governed_invalid = + notary_bundle_runtime_config().replace("mode: dedicated", "mode: shared_with_public"); + let fixture = write_signed_notary_bundle_with_config(&tmp, governed_invalid); + let verified = + verify_config_bundle(&fixture.bundle_dir, &fixture.anchor_path).expect("bundle verifies"); + let bootstrap = + parse_config_document(¬ary_bootstrap_config(&fixture)).expect("bootstrap config parses"); + let config_trust = bootstrap + .config + .config_trust + .expect("bootstrap config has trust settings"); + + let error = load_verified_bundle_server_config(&config_trust, true, verified) + .expect_err("verified bundle product validation failure rejects startup"); + let failure = error + .downcast_ref::() + .expect("verified bundle validation failures retain a validation category"); + + assert_eq!(failure.code(), BundleVerificationCode::REJECTED_VALIDATION); +} + +#[test] +fn missing_startup_config_path_returns_value_free_failure() { + let tmp = tempfile::tempdir().expect("tempdir"); + let sentinel = "SENTINEL_PRIVATE_COUNTRY_CONFIG_PATH"; + let config_path = tmp.path().join(sentinel).join("notary.yaml"); + + let error = load_server_config(&config_path, false) + .expect_err("missing startup config must fail closed"); + let failure = error + .downcast_ref::() + .expect("missing startup config uses the redacted activation boundary"); + + assert_eq!(failure.code(), NotaryActivationCode::CONFIGURATION_INVALID); + let rendered = format!("{failure} {failure:?}"); + assert!(!rendered.contains(sentinel)); + assert!(!rendered.contains(config_path.to_string_lossy().as_ref())); +} + #[test] fn signed_bundle_server_config_loads_with_pending_acceptance() { let tmp = tempfile::tempdir().expect("tempdir"); diff --git a/crates/registry-notary/src/doctor.rs b/crates/registry-notary/src/doctor.rs index 79e94a5c4..5c7020b03 100644 --- a/crates/registry-notary/src/doctor.rs +++ b/crates/registry-notary/src/doctor.rs @@ -1,5 +1,7 @@ use crate::*; +use registry_notary_server::NotaryActivationCode; + #[cfg(unix)] use std::os::unix::fs::PermissionsExt as _; @@ -109,6 +111,47 @@ impl Diagnostic { } } +struct DoctorDiagnosticView<'a> { + severity: &'static str, + code: &'a str, + label: &'a str, + action: Option<&'a str>, +} + +fn doctor_diagnostic_view(diagnostic: &Diagnostic) -> DoctorDiagnosticView<'_> { + let (severity, code) = if let (Some(severity), Some(code)) = ( + diagnostic.report_severity, + diagnostic.report_code.as_deref(), + ) { + (shared_severity(severity), code) + } else if diagnostic.warning { + ("warning", "warning") + } else if diagnostic.ok { + ("info", "ok") + } else { + ("error", "failed") + }; + if let Some(definition) = NotaryActivationCode::ALL + .iter() + .copied() + .find(|activation_code| activation_code.as_str() == code) + .map(NotaryActivationCode::definition) + { + return DoctorDiagnosticView { + severity, + code: definition.code.as_str(), + label: definition.meaning, + action: Some(definition.remediation), + }; + } + DoctorDiagnosticView { + severity, + code, + label: &diagnostic.label, + action: diagnostic.action.as_deref(), + } +} + #[derive(Debug)] pub(crate) struct DoctorOptions { pub(crate) live: bool, @@ -146,19 +189,12 @@ pub(crate) async fn doctor( raw } Err(err) => { - diagnostics.push(Diagnostic::fail( + diagnostics.push(Diagnostic::fail_with_code( format!("config file read failed: {err}"), "check --config points to a readable YAML file", + NotaryActivationCode::CONFIGURATION_INVALID.as_str(), )); - render_doctor_output( - &diagnostics, - options.format, - None, - config_path, - None, - None, - env_report, - )?; + render_doctor_output(&diagnostics, options.format, None, None, env_report)?; return Ok(false); } }; @@ -170,9 +206,10 @@ pub(crate) async fn doctor( Some(config) } Err(err) => { - diagnostics.push(Diagnostic::fail( + diagnostics.push(Diagnostic::fail_with_code( format!("config YAML parse or validation failed: {err}"), "fix the YAML syntax and field names", + NotaryActivationCode::CONFIGURATION_INVALID.as_str(), )); None } @@ -215,8 +252,6 @@ pub(crate) async fn doctor( &diagnostics, options.format, expanded_config.as_ref(), - config_path, - Some(&raw), config.as_ref(), env_report, )?; @@ -343,9 +378,10 @@ pub(crate) fn pkcs11_preflight_diagnostic( Ok(_) => Some(Diagnostic::ok( "PKCS#11 signing providers loaded and self-tested", )), - Err(err) => Some(Diagnostic::fail( + Err(err) => Some(Diagnostic::fail_with_code( format!("PKCS#11 signing preflight failed: {err}"), "check module_path, token_label, pin_env, key_label, key_id_hex, public_jwk_env, and whether this binary was built with pkcs11", + NotaryActivationCode::CONFIGURATION_INVALID.as_str(), )), } } @@ -359,8 +395,9 @@ pub(crate) fn print_diagnostics(diagnostics: &[Diagnostic]) { } else { "FAIL" }; - println!("{status} {}", diag.label); - if let Some(action) = &diag.action { + let view = doctor_diagnostic_view(diag); + println!("{status} {} [{}]", view.label, view.code); + if let Some(action) = view.action { println!(" Next action: {action}"); } } @@ -370,8 +407,6 @@ pub(crate) fn render_doctor_output( diagnostics: &[Diagnostic], format: DoctorOutputFormat, expanded_config: Option<&Value>, - config_path: &Path, - raw_config: Option<&str>, config: Option<&StandaloneRegistryNotaryConfig>, env_report: &EnvFileReport, ) -> Result<(), Box> { @@ -385,13 +420,7 @@ pub(crate) fn render_doctor_output( DoctorOutputFormat::Json => { println!( "{}", - serde_json::to_string_pretty(&doctor_json_report( - diagnostics, - config_path, - raw_config, - config, - env_report, - ))? + serde_json::to_string_pretty(&doctor_json_report(diagnostics, config, env_report))? ); } } @@ -400,8 +429,6 @@ pub(crate) fn render_doctor_output( pub(crate) fn doctor_json_report( diagnostics: &[Diagnostic], - config_path: &Path, - raw_config: Option<&str>, config: Option<&StandaloneRegistryNotaryConfig>, env_report: &EnvFileReport, ) -> Value { @@ -423,7 +450,6 @@ pub(crate) fn doctor_json_report( "config_schema_version": NOTARY_CONFIG_SCHEMA_VERSION, "source": { "kind": "local_file", - "path": path_for_json(config_path), }, "status": if error_count > 0 { ReportStatus::Error.as_str() @@ -447,11 +473,6 @@ pub(crate) fn doctor_json_report( if let Some(config) = config { report["audit_shipping"] = notary_audit_shipping(config); } - if let Some(raw) = raw_config { - report["hashes"] = json!({ - "internal_config_hash": sha256_hash(raw), - }); - } report } @@ -499,26 +520,15 @@ pub(crate) fn notary_audit_shipping(config: &StandaloneRegistryNotaryConfig) -> } pub(crate) fn doctor_json_diagnostic(diagnostic: &Diagnostic) -> Value { - let (severity, code) = if let (Some(severity), Some(code)) = ( - diagnostic.report_severity, - diagnostic.report_code.as_deref(), - ) { - (shared_severity(severity), code) - } else if diagnostic.warning { - ("warning", "warning") - } else if diagnostic.ok { - ("info", "ok") + let view = doctor_diagnostic_view(diagnostic); + let message = if let Some(action) = view.action { + format!("{} Next action: {action}", view.label) } else { - ("error", "failed") - }; - let message = if let Some(action) = &diagnostic.action { - format!("{} Next action: {action}", diagnostic.label) - } else { - diagnostic.label.clone() + view.label.to_string() }; let value = json!({ - "severity": severity, - "code": code, + "severity": view.severity, + "code": view.code, "message": message, }); value @@ -675,7 +685,7 @@ fn relay_token_file_diagnostic(config: &StandaloneRegistryNotaryConfig) -> Diagn return Diagnostic::fail_with_code( "Relay connection is not configured for Registry-backed claims", "configure evidence.relay before serving Registry-backed claims", - "notary.relay.configuration_invalid", + NotaryActivationCode::RELAY_CONFIGURATION_INVALID.as_str(), ); }; match fs::metadata(&relay.token_file) { @@ -693,12 +703,12 @@ fn relay_token_file_diagnostic(config: &StandaloneRegistryNotaryConfig) -> Diagn Ok(_) => Diagnostic::fail_with_code( "Relay workload token file is not a non-empty regular file", "mount a non-empty workload JWT at the configured evidence.relay.token_file path", - "notary.relay.credential_unavailable", + NotaryActivationCode::RELAY_CREDENTIAL_UNAVAILABLE.as_str(), ), Err(_) => Diagnostic::fail_with_code( "Relay workload token file is unavailable", "mount a readable workload JWT at the configured evidence.relay.token_file path", - "notary.relay.credential_unavailable", + NotaryActivationCode::RELAY_CREDENTIAL_UNAVAILABLE.as_str(), ), } } @@ -754,9 +764,10 @@ pub(crate) fn check_local_jwk_env( .and_then(|jwk| LocalJwkSigner::new(jwk).map_err(|err| err.to_string())); match result { Ok(_) => Diagnostic::ok(format!("{env} is a usable local JWK for {key_id}")), - Err(err) => Diagnostic::fail( + Err(err) => Diagnostic::fail_with_code( format!("{env} is not a usable local JWK for {key_id}: {err}"), "generate a local demo key with `registry-notary demo-issuer-key`", + NotaryActivationCode::CONFIGURATION_INVALID.as_str(), ), } } @@ -784,9 +795,10 @@ pub(crate) fn check_public_jwk_env( }); match result { Ok(_) => Diagnostic::ok(format!("{env} is a usable public JWK for {key_id}")), - Err(err) => Diagnostic::fail( + Err(err) => Diagnostic::fail_with_code( format!("{env} is not a usable public JWK for {key_id}: {err}"), "set it to a public JWK with the configured kid", + NotaryActivationCode::CONFIGURATION_INVALID.as_str(), ), } } @@ -878,7 +890,7 @@ pub(crate) async fn live_diagnostics(config: &StandaloneRegistryNotaryConfig) -> Ok(false) => Diagnostic::fail_with_code( "Relay activation plan did not include Registry-backed claims", "check the Registry-backed claim and evidence.relay configuration", - "notary.relay.configuration_invalid", + NotaryActivationCode::RELAY_CONFIGURATION_INVALID.as_str(), ), Err(error) => relay_live_failure_diagnostic(&error), }); @@ -892,47 +904,12 @@ pub(crate) async fn live_diagnostics(config: &StandaloneRegistryNotaryConfig) -> } fn relay_live_failure_diagnostic(error: &StandaloneServerError) -> Diagnostic { - match error { - StandaloneServerError::RelayCredentialUnavailable => Diagnostic::fail_with_code( - "Relay workload credential is unavailable", - "mount a current readable workload JWT at evidence.relay.token_file", - "notary.relay.credential_unavailable", - ), - StandaloneServerError::RelayCredentialsRejected => Diagnostic::fail_with_code( - "Relay rejected the configured workload credential", - "rotate the workload JWT and verify that Relay recognizes its workload binding, required scope, and validity window", - "notary.relay.credentials_rejected", - ), - StandaloneServerError::RelayProfileNotFound => Diagnostic::fail_with_code( - "Relay consultation profile was not found", - "deploy the configured Relay profile id, then retry the live check", - "notary.relay.profile_not_found", - ), - StandaloneServerError::RelayProfileMismatch => Diagnostic::fail_with_code( - "Relay consultation profile does not match the configured contract pin", - "reconcile the Notary profile id and contract hash with the reviewed Relay consultation contract", - "notary.relay.profile_mismatch", - ), - StandaloneServerError::RelayUnavailable => Diagnostic::fail_with_code( - "Relay consultation service is unavailable", - "check Relay reachability, TLS, destination policy, and service health", - "notary.relay.unavailable", - ), - StandaloneServerError::InvalidRelayDestination - | StandaloneServerError::InvalidRelayActivationPlan - | StandaloneServerError::RelayActivation - | StandaloneServerError::RelayAlreadyActivated - | StandaloneServerError::RelayNotActivated => Diagnostic::fail_with_code( - "Relay consultation configuration is invalid", - "check the evidence.relay connection and Registry-backed consultation configuration", - "notary.relay.configuration_invalid", - ), - _ => Diagnostic::fail_with_code( - "Relay consultation activation failed", - "check the Notary configuration and startup environment", - "notary.relay.activation_failed", - ), - } + let definition = error.activation_code().definition(); + Diagnostic::fail_with_code( + definition.meaning, + definition.remediation, + definition.code.as_str(), + ) } #[cfg(test)] diff --git a/crates/registry-notary/src/doctor/tests.rs b/crates/registry-notary/src/doctor/tests.rs index 1a34ed0dd..5828bdfae 100644 --- a/crates/registry-notary/src/doctor/tests.rs +++ b/crates/registry-notary/src/doctor/tests.rs @@ -211,6 +211,10 @@ fn relay_live_failures_have_stable_safe_categories() { StandaloneServerError::InvalidRelayActivationPlan, "notary.relay.configuration_invalid", ), + ( + StandaloneServerError::RelayActivation, + "notary.relay.activation_failed", + ), ]; for (error, expected_code) in cases { diff --git a/crates/registry-notary/src/explain_config/tests.rs b/crates/registry-notary/src/explain_config/tests.rs index 47d83f0cf..dac98992d 100644 --- a/crates/registry-notary/src/explain_config/tests.rs +++ b/crates/registry-notary/src/explain_config/tests.rs @@ -40,7 +40,8 @@ evidence: id: example.person-status.exact contract_hash: {CONTRACT_HASH} inputs: - tracked_entity: target.id + tracked_entity: request.target.identifiers.national_id + subject_id: target.id outputs: status: type: string @@ -135,6 +136,35 @@ fn relay_configuration_reports_reloadable_credential_and_safe_network_posture() assert_eq!(relay_live_apply["class"], "restart_required"); } +#[test] +fn relay_backed_explanation_satisfies_shared_schema_and_typed_contract() { + let (_token_directory, _token_file, config) = relay_config(); + let explanation = config_explanation_json( + Path::new("/etc/registry-notary/config.yaml"), + "redacted test config", + &config, + &EnvFileReport::default(), + ); + + let schema: Value = serde_json::from_str(registry_config_report::CONFIG_EXPLANATION_SCHEMA_V1) + .expect("explanation schema parses"); + let validator = jsonschema::JSONSchema::compile(&schema).expect("explanation schema compiles"); + if let Err(errors) = validator.validate(&explanation) { + let messages = errors.map(|error| error.to_string()).collect::>(); + panic!("Relay-backed explanation should validate: {messages:?}"); + } + + let typed: registry_config_report::ConfigExplanationDocument = + serde_json::from_value(explanation).expect("Relay-backed explanation decodes strictly"); + assert_eq!( + typed.relay_consultations[0] + .inputs + .get("tracked_entity") + .map(String::as_str), + Some("request.target.identifiers.national_id") + ); +} + #[test] fn relay_consultation_report_exposes_only_pinned_operator_contract() { let (_token_directory, _token_file, config) = relay_config(); @@ -153,7 +183,8 @@ fn relay_consultation_report_exposes_only_pinned_operator_contract() { "purpose": "benefit-verification", "required_scopes": ["registry:evidence"], "inputs": { - "tracked_entity": "target.id", + "tracked_entity": "request.target.identifiers.national_id", + "subject_id": "target.id", }, })] ); diff --git a/crates/registry-notary/src/logging.rs b/crates/registry-notary/src/logging.rs index 3cb3bf74a..6b6f54be8 100644 --- a/crates/registry-notary/src/logging.rs +++ b/crates/registry-notary/src/logging.rs @@ -31,6 +31,7 @@ pub(crate) fn log_env_filter() -> EnvFilter { pub(crate) fn init_tracing() -> Result<(), Box> { let result = match log_format_from_env()? { LogFormat::Text => tracing_subscriber::fmt() + .with_ansi(false) .with_env_filter(log_env_filter()) .try_init(), LogFormat::Json => tracing_subscriber::fmt() diff --git a/crates/registry-notary/src/main.rs b/crates/registry-notary/src/main.rs index 196de46bd..00059f5cc 100644 --- a/crates/registry-notary/src/main.rs +++ b/crates/registry-notary/src/main.rs @@ -47,7 +47,7 @@ use registry_notary_core::{ use registry_notary_server::{ compile_notary_runtime_with_provenance, notary_routers_from_runtime, notary_shared_router_from_runtime, openapi_document, verify_relay_from_config, - EvidenceIssuerRegistry, StandaloneServerError, + EvidenceIssuerRegistry, NotaryActivationCode, NotaryActivationFailure, StandaloneServerError, }; use registry_platform_config::{ expand_config_env_vars, reject_deprecated_config_fields, verify_config_bundle, @@ -55,12 +55,13 @@ use registry_platform_config::{ }; use registry_platform_crypto::{LocalJwkSigner, PrivateJwk, PublicJwk}; use registry_platform_ops::{ - antirollback_key_from_verified_bundle, audit_shipping_target, bundle_verify_rejection_result, + antirollback_key_from_verified_bundle, audit_shipping_target, bundle_verify_rejection_code, evaluate_ack_health, load_unsigned_break_glass_or_pin, persist_bundle_acceptance as persist_config_bundle_acceptance, posture_safe_runtime_config_hash, resolve_bundle_state_action, verify_bundle_state_read_only, - AuditSinkKind, BundleStateAction, BundleStateRequest, ConfigBootError, ConfigOverrideMode, - ConfigProvenance, ConfigSource, PendingBundleAcceptance, UnsignedConfigSelection, + AuditSinkKind, BundleStateAction, BundleStateRequest, BundleVerificationCode, + BundleVerificationFailure, ConfigBootError, ConfigOverrideMode, ConfigProvenance, ConfigSource, + PendingBundleAcceptance, UnsignedConfigSelection, }; use serde_json::{json, Value}; use serve::{serve_listener, ServeLimits}; @@ -249,20 +250,55 @@ struct ConfigVerifyBundleArgs { #[tokio::main] async fn main() -> ExitCode { - match run(Args::parse()).await { + let args = Args::parse(); + let server_startup = args.command.is_none(); + match run(args).await { Ok(code) => code, Err(err) => { - eprintln!("ERROR {err}"); + eprintln!( + "ERROR {}", + top_level_error_message(err.as_ref(), server_startup) + ); ExitCode::FAILURE } } } +// Process diagnostics and governed audit records have different publication +// boundaries. Diagnostics must be value-free. A configured stdout audit sink is +// protected operator evidence, so accepted bundle identities, signer ids, and +// integrity hashes intentionally remain in `config.bundle_accepted` records. +fn top_level_error_message( + error: &(dyn std::error::Error + 'static), + server_startup: bool, +) -> String { + if !server_startup { + return error.to_string(); + } + if let Some(failure) = error.downcast_ref::() { + return failure.to_string(); + } + error + .downcast_ref::() + .copied() + .unwrap_or_else(|| NotaryActivationCode::RUNTIME_ACTIVATION_FAILED.into()) + .to_string() +} + async fn run(args: Args) -> Result> { - let env_report = load_env_file_arg(args.env_file.as_deref(), args.env_file_override)?; + let server_startup = args.command.is_none(); + let doctor_command = matches!(&args.command, Some(Command::Doctor { .. })); + let env_report = match load_env_file_arg(args.env_file.as_deref(), args.env_file_override) { + Ok(report) => report, + Err(error) if server_startup || doctor_command => { + return Err(Box::new(value_free_configuration_failure(error))); + } + Err(error) => return Err(error), + }; match args.command { None => { - let config_path = required_config_path(args.config.as_deref())?; + let config_path = required_config_path(args.config.as_deref()) + .map_err(value_free_configuration_failure)?; run_server(config_path, args.bind, args.initialize_state).await?; Ok(ExitCode::SUCCESS) } @@ -365,3 +401,69 @@ async fn run(args: Args) -> Result> { #[cfg(test)] mod test_support; + +#[cfg(test)] +mod operator_boundary_tests { + use super::*; + + #[test] + fn accepted_bundle_audit_keeps_governed_identity_at_the_protected_boundary() { + const CONFIG_HASH: &str = + "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd"; + const PREVIOUS_HASH: &str = + "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"; + let acceptance = PendingBundleAcceptance { + state_path: PathBuf::from( + "/Users/SENTINEL_USER/SENTINEL_COUNTRY/SENTINEL_SECRET_STATE.json", + ), + key: registry_platform_ops::AntiRollbackKey { + product: "registry-notary".to_string(), + instance_id: "SENTINEL_PARSER_INSTANCE".to_string(), + environment: "SENTINEL_COUNTRY".to_string(), + stream_id: "governed-stream".to_string(), + }, + source: ConfigSource::SignedBundleFile, + bundle_id: Some("governed-bundle-42".to_string()), + bundle_manifest_hash: Some( + "sha256:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee" + .to_string(), + ), + sequence: Some(42), + config_hash: CONFIG_HASH.to_string(), + previous_config_hash: Some(PREVIOUS_HASH.to_string()), + previous_hash_matched: Some(true), + signer_kids: vec!["governed-signer-kid".to_string()], + break_glass: false, + state_action: BundleStateAction::Accept, + override_pin: None, + override_path: None, + }; + + let rendered = + serde_json::to_string(&bundle_acceptance_audit(&acceptance)).expect("audit serializes"); + + for governed_value in [ + "governed-bundle-42", + "governed-signer-kid", + CONFIG_HASH, + PREVIOUS_HASH, + ] { + assert!( + rendered.contains(governed_value), + "accepted audit lost governed identity evidence {governed_value:?}: {rendered}" + ); + } + for raw_value in [ + "SENTINEL_USER", + "SENTINEL_COUNTRY", + "SENTINEL_SECRET", + "SENTINEL_PARSER", + acceptance.state_path.to_str().expect("test path is UTF-8"), + ] { + assert!( + !rendered.contains(raw_value), + "accepted audit crossed its protected boundary with raw value {raw_value:?}: {rendered}" + ); + } + } +} diff --git a/crates/registry-notary/tests/config_schema.rs b/crates/registry-notary/tests/config_schema.rs index 220bbedd3..fe29d2891 100644 --- a/crates/registry-notary/tests/config_schema.rs +++ b/crates/registry-notary/tests/config_schema.rs @@ -19,6 +19,7 @@ use serde_json::{json, Value}; const SCHEMA_ARTIFACT: &str = "schemas/registry-notary.config.schema.json"; const CONFIG_REFERENCE: &str = "products/notary/docs/operator-config-reference.md"; +const DOCUMENTATION_INTENT: &str = "crates/registry-notary-core/config/documentation-intent.json"; const KEY_PATHS_START: &str = "{/* registry-notary-config-key-paths:start */}"; const KEY_PATHS_END: &str = "{/* registry-notary-config-key-paths:end */}"; @@ -267,6 +268,27 @@ fn schema_command_is_exactly_the_committed_artifact() { ); } +#[test] +fn schema_command_does_not_read_config_environment_or_secret_values() { + let marker = "NOTARY_SCHEMA_MUST_NOT_READ_OR_EMIT_THIS_SECRET_VALUE"; + let temp = tempfile::tempdir().expect("temporary working directory"); + let output = Command::new(env!("CARGO_BIN_EXE_registry-notary")) + .arg("schema") + .current_dir(temp.path()) + .env( + "REGISTRY_NOTARY_CONFIG", + temp.path().join("missing-config.yaml"), + ) + .env("REGISTRY_NOTARY_SCHEMA_SECRET_SENTINEL", marker) + .output() + .expect("schema command runs without runtime inputs"); + + assert!(output.status.success()); + assert!(output.stderr.is_empty()); + assert_eq!(output.stdout, document_json().as_bytes()); + assert!(!String::from_utf8(output.stdout).unwrap().contains(marker)); +} + #[test] fn maintained_runtime_config_fixtures_validate_and_deserialize() { let schema = document(); @@ -728,3 +750,41 @@ fn schema_and_configuration_reference_have_exact_bidirectional_key_path_parity() schema_paths.iter().cloned().collect::>().join("\n") ); } + +#[test] +fn product_owned_documentation_intent_has_exact_runtime_key_inventory() { + let schema = document(); + let mut schema_paths = BTreeSet::new(); + collect_key_paths(&schema, &schema, "", &mut schema_paths, &mut HashSet::new()); + let intent: Value = serde_json::from_slice( + &fs::read(stack_root().join(DOCUMENTATION_INTENT)) + .expect("Notary documentation intent exists"), + ) + .expect("Notary documentation intent parses"); + assert_eq!(intent["runtime_schema"], "notary"); + assert_eq!(intent["schema_id"], CONFIG_SCHEMA_ID); + let assignments = intent["assignments"] + .as_array() + .expect("Notary intent assignments are an array"); + assert_eq!(assignments.len(), 529); + let assigned_paths = assignments + .iter() + .map(|assignment| { + assert_eq!(assignment["schema"], "notary"); + assert_eq!(assignment["schema_facts_reviewed"], true); + assignment["key_path"] + .as_str() + .expect("assignment key_path is a string") + .to_owned() + }) + .filter(|path| !path.is_empty()) + .collect::>(); + assert_eq!(assigned_paths, schema_paths); + assert_eq!( + assignments + .iter() + .filter(|assignment| assignment["path_kind"] == "map_value") + .count(), + 9 + ); +} diff --git a/crates/registry-notary/tests/config_verify_bundle_cli.rs b/crates/registry-notary/tests/config_verify_bundle_cli.rs index da78ecea4..ee30245e8 100644 --- a/crates/registry-notary/tests/config_verify_bundle_cli.rs +++ b/crates/registry-notary/tests/config_verify_bundle_cli.rs @@ -12,7 +12,7 @@ use registry_platform_config::{ use registry_platform_crypto::{canonicalize_json, sign, PrivateJwk}; use registry_platform_ops::{ AntiRollbackKey, AntiRollbackRecord, ConfigOverrideMode, ConfigOverridePin, - FileAntiRollbackStore, + FileAntiRollbackStore, BUNDLE_VERIFICATION_CODE_DEFINITIONS, }; use serde_json::Value; use tempfile::TempDir; @@ -22,6 +22,19 @@ const TEST_TOKEN_HASH: &str = "sha256:31f2999a69fa6301763a9f61eea44388a13318ce8b80a16a115a9efdb62b883b"; const TEST_AUDIT_HASH_SECRET: &str = "registry-notary-cli-audit-secret-32-bytes"; const ZERO_HASH: &str = "sha256:0000000000000000000000000000000000000000000000000000000000000000"; +const USER_SENTINEL: &str = "redaction-user@example.test"; +const COUNTRY_SENTINEL: &str = "REDACTION_COUNTRY_VALUE"; +const STREAM_ID: &str = "notary-test-stream"; +const BUNDLE_ID: &str = "notary-test-bundle"; +const ERROR_MESSAGE_SENTINELS: &[&str] = &[ + USER_SENTINEL, + COUNTRY_SENTINEL, + TEST_AUDIT_HASH_SECRET, + "REDACTION_SECRET_VALUE", + "REDACTION_PARSER_STRING", + "REDACTION_LOCAL_PATH", + "/Users/", +]; struct BundleFixture { bundle_dir: PathBuf, @@ -29,6 +42,7 @@ struct BundleFixture { state_path: PathBuf, config_path: PathBuf, config_hash: String, + signer_kid: String, } #[test] @@ -48,10 +62,16 @@ fn config_verify_bundle_cli_reports_verified_signed_bundle() { let report = stdout_json(&output); assert_eq!(report["result"], "verified"); assert_eq!(report["component"], "registry-notary"); - assert_eq!(report["stream_id"], "notary-test-stream"); - assert_eq!(report["bundle_id"], "notary-test-bundle"); + assert_eq!(report["stream_id"], STREAM_ID); + assert_eq!(report["bundle_id"], BUNDLE_ID); assert_eq!(report["bundle_sequence"], 1); + assert_eq!(report["previous_config_hash"], ZERO_HASH); assert_eq!(report["config_hash"], fixture.config_hash); + assert_eq!(report["errors"], serde_json::json!([])); + assert_eq!( + String::from_utf8(output.stderr).expect("stderr is UTF-8"), + "" + ); } #[test] @@ -67,6 +87,7 @@ fn config_verify_bundle_cli_reports_rejected_rollback() { let report = stdout_json(&output); assert_eq!(report["result"], "rejected_rollback"); assert_eq!(report["errors"][0]["code"], "rejected_rollback"); + assert_rejected_output_boundary(&output, &report, "rejected_rollback", &fixture, &[]); } #[test] @@ -80,7 +101,7 @@ fn config_verify_bundle_cli_rejects_expired_override_pin() { product: "registry-notary".to_string(), instance_id: "notary-cli".to_string(), environment: "development".to_string(), - stream_id: "notary-test-stream".to_string(), + stream_id: STREAM_ID.to_string(), }, last_sequence: 2, last_config_hash: @@ -96,8 +117,10 @@ fn config_verify_bundle_cli_rejects_expired_override_pin() { config_path: None, expires_at: Some("2026-07-07T10:00:00Z".to_string()), used_at: "2026-07-07T09:00:00Z".to_string(), - operator: "jeremi".to_string(), - reason: "expired rollback".to_string(), + operator: USER_SENTINEL.to_string(), + reason: format!( + "{COUNTRY_SENTINEL} REDACTION_SECRET_VALUE REDACTION_PARSER_STRING REDACTION_LOCAL_PATH" + ), }), break_glass: Default::default(), local_approvals: Default::default(), @@ -114,6 +137,7 @@ fn config_verify_bundle_cli_rejects_expired_override_pin() { let report = stdout_json(&output); assert_eq!(report["result"], "rejected_rollback"); assert_eq!(report["errors"][0]["code"], "rejected_rollback"); + assert_rejected_output_boundary(&output, &report, "rejected_rollback", &fixture, &[]); } #[test] @@ -129,13 +153,16 @@ fn config_verify_bundle_cli_reports_rejected_binding() { let report = stdout_json(&output); assert_eq!(report["result"], "rejected_binding"); assert_eq!(report["errors"][0]["code"], "rejected_binding"); + assert_rejected_output_boundary(&output, &report, "rejected_binding", &fixture, &[]); } #[test] fn config_verify_bundle_cli_reports_rejected_signature_for_hash_mismatch() { let temp = TempDir::new().expect("tempdir"); let fixture = write_bundle_fixture(&temp, "registry-notary", 0); - std::fs::write(&fixture.config_path, b"changed config bytes").expect("config changes"); + let changed = b"changed config bytes"; + let actual_hash = sha256_uri(changed); + std::fs::write(&fixture.config_path, changed).expect("config changes"); let output = verify_bundle_command(&fixture) .output() @@ -145,6 +172,123 @@ fn config_verify_bundle_cli_reports_rejected_signature_for_hash_mismatch() { let report = stdout_json(&output); assert_eq!(report["result"], "rejected_signature"); assert_eq!(report["errors"][0]["code"], "rejected_signature"); + assert_rejected_output_boundary( + &output, + &report, + "rejected_signature", + &fixture, + &[ + "config/notary.yaml", + fixture.config_hash.as_str(), + actual_hash.as_str(), + fixture.config_path.to_str().expect("path is UTF-8"), + ], + ); +} + +#[test] +fn config_verify_bundle_cli_malformed_anchor_has_value_free_stdout_and_stderr() { + let temp = TempDir::new().expect("tempdir"); + let mut fixture = write_bundle_fixture(&temp, "registry-notary", 0); + let private_dir = temp + .path() + .join(format!("REDACTION_LOCAL_PATH-{USER_SENTINEL}")); + std::fs::create_dir_all(&private_dir).expect("private anchor dir"); + fixture.anchor_path = private_dir.join(format!("{COUNTRY_SENTINEL}-anchor.json")); + std::fs::write( + &fixture.anchor_path, + "{\"secret\":\"REDACTION_SECRET_VALUE\",\"parser\":[\"REDACTION_PARSER_STRING\"", + ) + .expect("malformed anchor writes"); + + let output = verify_bundle_command(&fixture) + .output() + .expect("command runs"); + + assert!(!output.status.success()); + let report = stdout_json(&output); + assert_rejected_output_boundary( + &output, + &report, + "rejected_validation", + &fixture, + &[fixture.anchor_path.to_str().expect("path is UTF-8")], + ); +} + +#[test] +fn config_verify_bundle_cli_file_closure_has_value_free_stdout_and_stderr() { + let temp = TempDir::new().expect("tempdir"); + let fixture = write_bundle_fixture(&temp, "registry-notary", 0); + let unexpected_path = fixture + .bundle_dir + .join("config") + .join(format!("{COUNTRY_SENTINEL}-REDACTION_SECRET_VALUE.yaml")); + std::fs::write( + &unexpected_path, + format!("{USER_SENTINEL} REDACTION_PARSER_STRING"), + ) + .expect("unexpected bundle file writes"); + + let output = verify_bundle_command(&fixture) + .output() + .expect("command runs"); + + assert!(!output.status.success()); + let report = stdout_json(&output); + assert_rejected_output_boundary( + &output, + &report, + "rejected_signature", + &fixture, + &[unexpected_path.to_str().expect("path is UTF-8")], + ); +} + +#[test] +fn config_verify_bundle_cli_config_parser_failure_has_value_free_stdout_and_stderr() { + let temp = TempDir::new().expect("tempdir"); + let malformed_config = format!( + "country: {COUNTRY_SENTINEL}\nsecret: [REDACTION_SECRET_VALUE\nparser: REDACTION_PARSER_STRING\nuser: {USER_SENTINEL}\n" + ); + let fixture = + write_bundle_fixture_with_config(&temp, "registry-notary", 0, malformed_config.clone()); + + let output = verify_bundle_command(&fixture) + .output() + .expect("command runs"); + + assert!(!output.status.success()); + let report = stdout_json(&output); + assert_rejected_output_boundary( + &output, + &report, + "rejected_validation", + &fixture, + &[malformed_config.as_str()], + ); +} + +#[test] +fn config_verify_bundle_cli_non_utf8_config_has_value_free_stdout_and_stderr() { + let temp = TempDir::new().expect("tempdir"); + let mut fixture = write_bundle_fixture(&temp, "registry-notary", 0); + let invalid_utf8 = b"\xffREDACTION_SECRET_VALUE REDACTION_PARSER_STRING"; + resign_config_bytes(&mut fixture, invalid_utf8); + + let output = verify_bundle_command(&fixture) + .output() + .expect("command runs"); + + assert!(!output.status.success()); + let report = stdout_json(&output); + assert_rejected_output_boundary( + &output, + &report, + "rejected_validation", + &fixture, + &["REDACTION_SECRET_VALUE", "REDACTION_PARSER_STRING"], + ); } #[test] @@ -205,6 +349,7 @@ fn config_verify_bundle_cli_shared_parity_matrix() { assert_eq!(report["component"], "registry-notary", "{name}"); } else { assert_eq!(report["errors"][0]["code"], expected, "{name}"); + assert_rejected_output_boundary(&output, &report, expected, &fixture, &[]); } } } @@ -223,10 +368,13 @@ fn config_verify_bundle_cli_runs_deployment_gates() { let report = stdout_json(&output); assert_eq!(report["result"], "rejected_validation"); assert_eq!(report["errors"][0]["code"], "rejected_validation"); - assert!(report["errors"][0]["message"] - .as_str() - .expect("error message") - .contains("notary.audit.sink_missing")); + assert_rejected_output_boundary( + &output, + &report, + "rejected_validation", + &fixture, + &["notary.audit.sink_missing"], + ); } #[test] @@ -246,10 +394,85 @@ fn config_verify_bundle_cli_rejects_governed_shared_admin_listener() { let report = stdout_json(&output); assert_eq!(report["result"], "rejected_validation"); assert_eq!(report["errors"][0]["code"], "rejected_validation"); - assert!(report["errors"][0]["message"] - .as_str() - .expect("error message") - .contains("server.admin_listener.mode = dedicated")); + assert_rejected_output_boundary( + &output, + &report, + "rejected_validation", + &fixture, + &["server.admin_listener.mode = dedicated"], + ); +} + +fn bundle_code_definition( + expected_code: &str, +) -> &'static registry_platform_ops::BundleVerificationCodeDefinition { + BUNDLE_VERIFICATION_CODE_DEFINITIONS + .iter() + .find(|definition| definition.code.as_str() == expected_code) + .expect("published code has a catalog definition") +} + +fn assert_rejected_output_boundary( + output: &std::process::Output, + report: &Value, + expected_code: &str, + fixture: &BundleFixture, + extra_sentinels: &[&str], +) { + assert_eq!(report["result"], expected_code); + assert_eq!(report["errors"][0]["code"], expected_code); + let definition = bundle_code_definition(expected_code); + assert_eq!( + report["errors"][0]["message"], definition.safe_report_message, + "public message must be the reviewed static catalog meaning and remediation" + ); + assert_eq!(report["stream_id"], "unknown"); + for field in [ + "bundle_id", + "bundle_sequence", + "previous_config_hash", + "config_hash", + ] { + assert_eq!( + report[field], + Value::Null, + "rejected report must not publish manifest-derived {field}" + ); + } + let stderr = String::from_utf8(output.stderr.clone()).expect("stderr is UTF-8"); + assert_eq!( + stderr, + format!( + "ERROR {expected_code}: {}\n", + definition.safe_report_message + ), + "child stderr must contain only the stable catalog failure" + ); + let full_output = format!( + "{}\n{}", + String::from_utf8_lossy(&output.stdout), + String::from_utf8_lossy(&output.stderr) + ); + for sentinel in ERROR_MESSAGE_SENTINELS + .iter() + .copied() + .chain([ + STREAM_ID, + BUNDLE_ID, + ZERO_HASH, + fixture.config_hash.as_str(), + fixture.signer_kid.as_str(), + fixture.config_path.to_str().expect("path is UTF-8"), + fixture.bundle_dir.to_str().expect("path is UTF-8"), + fixture.state_path.to_str().expect("path is UTF-8"), + ]) + .chain(extra_sentinels.iter().copied()) + { + assert!( + !full_output.contains(sentinel), + "rejected command leaked sentinel {sentinel:?}: {full_output}" + ); + } } fn verify_bundle_command(fixture: &BundleFixture) -> Command { @@ -298,9 +521,9 @@ fn write_bundle_fixture_with_config( schema: "registry.platform.config_bundle.v1".to_string(), product: manifest_product.to_string(), environment: "development".to_string(), - stream_id: "notary-test-stream".to_string(), + stream_id: STREAM_ID.to_string(), instance_id: None, - bundle_id: "notary-test-bundle".to_string(), + bundle_id: BUNDLE_ID.to_string(), sequence: 1, previous_config_hash: Some(ZERO_HASH.to_string()), config_hash: config_hash.clone(), @@ -316,10 +539,10 @@ fn write_bundle_fixture_with_config( schema: "registry.platform.config_trust_anchor.v1".to_string(), product: "registry-notary".to_string(), environment: "development".to_string(), - stream_id: "notary-test-stream".to_string(), + stream_id: STREAM_ID.to_string(), instance_id: "notary-cli".to_string(), signers: vec![ConfigTrustAnchorSigner { - kid, + kid: kid.clone(), jwk: public, enabled: true, }], @@ -338,7 +561,7 @@ fn write_bundle_fixture_with_config( product: "registry-notary".to_string(), instance_id: "notary-cli".to_string(), environment: "development".to_string(), - stream_id: "notary-test-stream".to_string(), + stream_id: STREAM_ID.to_string(), }, last_sequence, last_config_hash: if last_sequence == 0 { @@ -362,9 +585,29 @@ fn write_bundle_fixture_with_config( state_path, config_path, config_hash, + signer_kid: kid, } } +fn resign_config_bytes(fixture: &mut BundleFixture, config_bytes: &[u8]) { + std::fs::write(&fixture.config_path, config_bytes).expect("config bytes write"); + let config_hash = sha256_uri(config_bytes); + let manifest_path = fixture.bundle_dir.join("manifest.json"); + let mut manifest: ConfigBundleManifest = + serde_json::from_slice(&std::fs::read(&manifest_path).expect("manifest reads")) + .expect("manifest parses"); + manifest.config_hash = config_hash.clone(); + manifest.files[0].sha256 = config_hash.clone(); + let private = PrivateJwk::parse(PRIVATE_JWK).expect("private JWK parses"); + write_manifest_and_signature( + &fixture.bundle_dir, + &manifest, + &private, + &fixture.signer_kid, + ); + fixture.config_hash = config_hash; +} + fn write_manifest_and_signature( bundle_dir: &std::path::Path, manifest: &ConfigBundleManifest, diff --git a/crates/registry-notary/tests/doctor_cli.rs b/crates/registry-notary/tests/doctor_cli.rs index ebe77f0aa..54d3a08dd 100644 --- a/crates/registry-notary/tests/doctor_cli.rs +++ b/crates/registry-notary/tests/doctor_cli.rs @@ -5,6 +5,7 @@ use std::path::{Path, PathBuf}; use std::process::Command; use registry_config_report::{CONFIG_EXPLANATION_SCHEMA_V1, PRODUCT_DIAGNOSTIC_REPORT_SCHEMA_V1}; +use registry_notary_server::NotaryActivationCode; use serde_json::{json, Value}; use tempfile::TempDir; @@ -12,6 +13,13 @@ const TEST_API_HASH: &str = "sha256:31f2999a69fa6301763a9f61eea44388a13318ce8b80a16a115a9efdb62b883b"; const TEST_AUDIT_SECRET: &str = "doctor-audit-secret-32-bytes-minimum"; const TEST_ISSUER_JWK: &str = r#"{"kty":"OKP","crv":"Ed25519","d":"2oPoxdKuO7Kpd-3JLfNW_4xwpFxItbS-fxe03ZybYEw","x":"1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc","alg":"EdDSA"}"#; +const DOCTOR_PATH_SENTINEL: &str = "REDACTION_DOCTOR_LOCAL_PATH"; +const DOCTOR_HASH_SENTINEL: &str = + "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"; +const DOCTOR_PARSER_SENTINEL: &str = "REDACTION_DOCTOR_PARSER_STRING"; +const DOCTOR_COUNTRY_SENTINEL: &str = "REDACTION_DOCTOR_COUNTRY_VALUE"; +const DOCTOR_SECRET_SENTINEL: &str = "REDACTION_DOCTOR_SECRET_VALUE"; +const DOCTOR_USER_SENTINEL: &str = "redaction-doctor-user@example.test"; #[derive(Default)] struct TestConfigOptions<'a> { @@ -220,8 +228,18 @@ REGISTRY_NOTARY_POSTGRES_URL='postgresql://registry_notary_runtime:test@127.0.0. } fn write_invalid_config(tmp: &TempDir) -> PathBuf { - let path = tmp.path().join("invalid.yaml"); - std::fs::write(&path, "auth:\n mode: definitely-not-valid\n").expect("config writes"); + let private_dir = tmp + .path() + .join(format!("{DOCTOR_PATH_SENTINEL}-{DOCTOR_USER_SENTINEL}")); + std::fs::create_dir_all(&private_dir).expect("private config dir"); + let path = private_dir.join(format!("{DOCTOR_COUNTRY_SENTINEL}.yaml")); + std::fs::write( + &path, + format!( + "country: {DOCTOR_COUNTRY_SENTINEL}\nhash: {DOCTOR_HASH_SENTINEL}\nsecret: [{DOCTOR_SECRET_SENTINEL}\nparser: {DOCTOR_PARSER_SENTINEL}\n" + ), + ) + .expect("config writes"); path } @@ -286,6 +304,37 @@ fn diagnostic_with_code<'a>(report: &'a Value, code: &str) -> Option<&'a Value> .find(|diagnostic| diagnostic["code"] == code) } +fn safe_configuration_message() -> String { + let definition = NotaryActivationCode::CONFIGURATION_INVALID.definition(); + format!( + "{} Next action: {}", + definition.meaning, definition.remediation + ) +} + +fn assert_safe_configuration_diagnostic(report: &Value) -> &Value { + let diagnostic = + diagnostic_with_code(report, NotaryActivationCode::CONFIGURATION_INVALID.as_str()) + .expect("stable configuration diagnostic"); + assert_eq!(diagnostic["severity"], "error"); + assert_eq!(diagnostic["message"], safe_configuration_message()); + diagnostic +} + +fn assert_output_excludes(output: &std::process::Output, sentinels: &[&str]) { + let combined = format!( + "{}\n{}", + String::from_utf8_lossy(&output.stdout), + String::from_utf8_lossy(&output.stderr) + ); + for sentinel in sentinels { + assert!( + !combined.contains(sentinel), + "doctor output leaked sentinel {sentinel:?}: {combined}" + ); + } +} + fn assert_no_documentation_key(diagnostic: &Value) { assert!( diagnostic.get("documentation_key").is_none(), @@ -664,12 +713,7 @@ fn doctor_json_rejects_multi_instance_in_memory_state_before_profile_override() assert_product_diagnostic_report(&report); assert_eq!(report["status"], "error"); - let diagnostic = diagnostic_with_code(&report, "failed").expect("invalid state diagnostic"); - assert_eq!(diagnostic["severity"], "error"); - assert!(diagnostic["message"] - .as_str() - .expect("diagnostic message") - .contains("state.storage = in_memory requires deployment.multi_instance = false")); + assert_safe_configuration_diagnostic(&report); } #[test] @@ -989,6 +1033,11 @@ fn doctor_json_reports_success_as_single_redacted_document() { assert_product_diagnostic_report(&report); assert_eq!(report["status"], "ok"); + assert_eq!(report["source"], json!({ "kind": "local_file" })); + assert!( + report.get("hashes").is_none(), + "doctor must not publish raw internal config hashes" + ); assert!(report["diagnostics"] .as_array() .expect("diagnostics array") @@ -1007,6 +1056,7 @@ fn doctor_json_reports_success_as_single_redacted_document() { assert!(!stdout.contains(TEST_ISSUER_JWK)); assert!(!stdout.contains(TEST_AUDIT_SECRET)); assert!(!stdout.contains(TEST_API_HASH)); + assert!(!stdout.contains(config.to_string_lossy().as_ref())); } #[test] @@ -1058,28 +1108,123 @@ fn doctor_json_reports_config_parse_failure_without_text_preamble() { !output.status.success(), "doctor should fail for invalid config" ); - let stdout = String::from_utf8(output.stdout).expect("stdout is utf8"); - let report: Value = serde_json::from_str(&stdout).expect("failure emits JSON"); + let report: Value = serde_json::from_slice(&output.stdout).expect("failure emits JSON"); assert_product_diagnostic_report(&report); assert_eq!(report["status"], "error"); + assert_eq!(report["source"], json!({ "kind": "local_file" })); + assert!(report.get("hashes").is_none()); + assert_safe_configuration_diagnostic(&report); + assert_eq!( + String::from_utf8(output.stderr.clone()).expect("stderr is utf8"), + "" + ); + assert_output_excludes( + &output, + &[ + config.to_str().expect("config path is UTF-8"), + DOCTOR_PATH_SENTINEL, + DOCTOR_HASH_SENTINEL, + DOCTOR_PARSER_SENTINEL, + DOCTOR_COUNTRY_SENTINEL, + DOCTOR_SECRET_SENTINEL, + DOCTOR_USER_SENTINEL, + ], + ); +} - assert!(report["diagnostics"] - .as_array() - .expect("diagnostics array") - .iter() - .any(|diagnostic| diagnostic["severity"] == "error" - && diagnostic["message"] - .as_str() - .expect("message") - .contains("config YAML parse or validation failed") - && diagnostic["message"] - .as_str() - .expect("message") - .contains("fix the YAML syntax and field names"))); +#[test] +fn doctor_text_reports_config_parse_failure_with_static_code_and_guidance() { + let tmp = TempDir::new().expect("tempdir"); + let config = write_invalid_config(&tmp); + + let output = doctor_command(&config, None).output().expect("doctor runs"); + + assert!(!output.status.success()); + let definition = NotaryActivationCode::CONFIGURATION_INVALID.definition(); + let stdout = String::from_utf8(output.stdout.clone()).expect("stdout is UTF-8"); + assert!(stdout.contains(&format!( + "FAIL {} [{}]", + definition.meaning, + definition.code.as_str() + ))); + assert!(stdout.contains(&format!("Next action: {}", definition.remediation))); assert_eq!( - String::from_utf8(output.stderr).expect("stderr is utf8"), + String::from_utf8(output.stderr.clone()).expect("stderr is UTF-8"), "" ); + assert_output_excludes( + &output, + &[ + config.to_str().expect("config path is UTF-8"), + DOCTOR_PATH_SENTINEL, + DOCTOR_HASH_SENTINEL, + DOCTOR_PARSER_SENTINEL, + DOCTOR_COUNTRY_SENTINEL, + DOCTOR_SECRET_SENTINEL, + DOCTOR_USER_SENTINEL, + ], + ); +} + +#[test] +fn doctor_json_missing_source_reports_classification_without_local_path() { + let tmp = TempDir::new().expect("tempdir"); + let missing = tmp.path().join(format!( + "{DOCTOR_PATH_SENTINEL}-{DOCTOR_SECRET_SENTINEL}.yaml" + )); + + let output = doctor_command(&missing, None) + .args(["--format", "json"]) + .output() + .expect("doctor runs"); + + assert!(!output.status.success()); + let report: Value = serde_json::from_slice(&output.stdout).expect("failure emits JSON"); + assert_product_diagnostic_report(&report); + assert_eq!(report["source"], json!({ "kind": "local_file" })); + assert!(report.get("hashes").is_none()); + assert_safe_configuration_diagnostic(&report); + assert_output_excludes( + &output, + &[ + missing.to_str().expect("missing path is UTF-8"), + DOCTOR_PATH_SENTINEL, + DOCTOR_SECRET_SENTINEL, + ], + ); +} + +#[test] +fn doctor_missing_env_file_has_value_free_stderr() { + let tmp = TempDir::new().expect("tempdir"); + let config = write_config(&tmp); + let missing_env = tmp.path().join(format!( + "{DOCTOR_PATH_SENTINEL}-{DOCTOR_COUNTRY_SENTINEL}-{DOCTOR_SECRET_SENTINEL}.env" + )); + + let output = doctor_command(&config, Some(&missing_env)) + .args(["--format", "json"]) + .output() + .expect("doctor runs"); + + assert!(!output.status.success()); + assert!(output.stdout.is_empty()); + let failure = registry_notary_server::NotaryActivationFailure::from( + NotaryActivationCode::CONFIGURATION_INVALID, + ); + assert_eq!( + String::from_utf8(output.stderr.clone()).expect("stderr is UTF-8"), + format!("ERROR {failure}\n") + ); + assert_output_excludes( + &output, + &[ + missing_env.to_str().expect("env path is UTF-8"), + DOCTOR_PATH_SENTINEL, + DOCTOR_COUNTRY_SENTINEL, + DOCTOR_SECRET_SENTINEL, + ], + ); } #[test] @@ -1095,16 +1240,8 @@ fn doctor_json_reports_empty_claim_formats_with_remediation() { assert!(!output.status.success(), "doctor must reject empty formats"); let report: Value = serde_json::from_slice(&output.stdout).expect("doctor emits JSON"); assert_product_diagnostic_report(&report); - let diagnostic = diagnostic_with_code(&report, "failed").expect("failure diagnostic"); - let message = diagnostic["message"].as_str().expect("message string"); - assert!( - message.contains("empty-format"), - "claim id is reported: {message}" - ); - assert!( - message.contains("omit formats"), - "remediation is reported: {message}" - ); + assert_safe_configuration_diagnostic(&report); + assert_output_excludes(&output, &["empty-format", "omit formats"]); } #[test] @@ -1123,15 +1260,14 @@ fn doctor_json_reports_sd_jwt_claim_format_with_remediation() { ); let report: Value = serde_json::from_slice(&output.stdout).expect("doctor emits JSON"); assert_product_diagnostic_report(&report); - let diagnostic = diagnostic_with_code(&report, "failed").expect("failure diagnostic"); - let message = diagnostic["message"].as_str().expect("message string"); - assert!( - message.contains("sd-jwt-format"), - "claim id is reported: {message}" - ); - assert!( - message.contains("application/dc+sd-jwt") && message.contains("credential_profiles"), - "offending format and remediation are reported: {message}" + assert_safe_configuration_diagnostic(&report); + assert_output_excludes( + &output, + &[ + "sd-jwt-format", + "application/dc+sd-jwt", + "credential_profiles", + ], ); } @@ -1158,16 +1294,8 @@ fn doctor_json_reports_unknown_claim_format_with_remediation() { ); let report: Value = serde_json::from_slice(&output.stdout).expect("doctor emits JSON"); assert_product_diagnostic_report(&report); - let diagnostic = diagnostic_with_code(&report, "failed").expect("failure diagnostic"); - let message = diagnostic["message"].as_str().expect("message string"); - assert!( - message.contains("unknown-format"), - "claim id is reported: {message}" - ); - assert!( - message.contains("application/example+json") && message.contains("supported formats"), - "offending format and remediation are reported: {message}" - ); + assert_safe_configuration_diagnostic(&report); + assert_output_excludes(&output, &["unknown-format", "application/example+json"]); } #[test] @@ -1190,15 +1318,12 @@ fn doctor_json_reports_missing_canonical_claim_format_with_remediation() { ); let report: Value = serde_json::from_slice(&output.stdout).expect("doctor emits JSON"); assert_product_diagnostic_report(&report); - let diagnostic = diagnostic_with_code(&report, "failed").expect("failure diagnostic"); - let message = diagnostic["message"].as_str().expect("message string"); - assert!( - message.contains("missing-canonical"), - "claim id is reported: {message}" - ); - assert!( - message.contains("application/vnd.registry-notary.claim-result+json") - && message.contains("add it"), - "canonical format and remediation are reported: {message}" + assert_safe_configuration_diagnostic(&report); + assert_output_excludes( + &output, + &[ + "missing-canonical", + "application/vnd.registry-notary.claim-result+json", + ], ); } diff --git a/crates/registry-notary/tests/startup_redaction.rs b/crates/registry-notary/tests/startup_redaction.rs new file mode 100644 index 000000000..89f6f2757 --- /dev/null +++ b/crates/registry-notary/tests/startup_redaction.rs @@ -0,0 +1,309 @@ +// SPDX-License-Identifier: Apache-2.0 + +use std::path::{Path, PathBuf}; +use std::process::{Command, Output}; + +use registry_notary_server::NotaryActivationCode; +use registry_platform_ops::{BundleVerificationCode, BundleVerificationFailure}; + +const SENTINEL_COUNTRY: &str = "SENTINEL_COUNTRY_FARAJALAND"; +const SENTINEL_USERNAME: &str = "SENTINEL_USERNAME_ALICE"; +const SENTINEL_SECRET: &str = "SENTINEL_SECRET_DO_NOT_PRINT"; +const SENTINEL_DIGEST: &str = "sha256:SENTINEL_PRIVATE_DIGEST"; + +fn registry_notary_command() -> Command { + registry_notary_command_with_log("info") +} + +fn registry_notary_command_with_log(rust_log: &str) -> Command { + registry_notary_command_with_log_format(rust_log, "text") +} + +fn registry_notary_command_with_log_format(rust_log: &str, log_format: &str) -> Command { + let mut command = Command::new(env!("CARGO_BIN_EXE_registry-notary")); + command + .env_remove("REGISTRY_NOTARY_CONFIG") + .env_remove("REGISTRY_NOTARY_ENV_FILE") + .env("REGISTRY_NOTARY_LOG_FORMAT", log_format) + .env("RUST_LOG", rust_log); + command +} + +fn run_server(config_path: &Path) -> Output { + registry_notary_command() + .arg("--config") + .arg(config_path) + .output() + .expect("registry-notary starts") +} + +fn combined_output(output: &Output) -> String { + format!( + "{}\n{}", + String::from_utf8_lossy(&output.stdout), + String::from_utf8_lossy(&output.stderr) + ) +} + +fn assert_safe_configuration_failure(output: &Output, forbidden: &[&str]) { + assert!(!output.status.success(), "invalid startup must fail closed"); + let combined = combined_output(output); + assert!( + combined.contains("notary.configuration.invalid"), + "startup output must expose the stable safe activation code: {combined}" + ); + for value in forbidden { + assert!( + !combined.contains(value), + "startup output exposed forbidden value {value:?}: {combined}" + ); + } +} + +struct MissingBundleFixture { + config_path: PathBuf, + trust_path: PathBuf, + bundle_path: PathBuf, + state_path: PathBuf, + override_path: PathBuf, +} + +fn write_missing_bundle_fixture(tmp: &tempfile::TempDir) -> MissingBundleFixture { + let config_path = tmp.path().join("bootstrap.yaml"); + let trust_path = tmp.path().join(format!("{SENTINEL_USERNAME}-anchor.json")); + let bundle_path = tmp.path().join(format!("{SENTINEL_COUNTRY}-bundle")); + let state_path = tmp.path().join(format!("{SENTINEL_DIGEST}-state.json")); + let override_path = tmp.path().join(format!("{SENTINEL_SECRET}-override.json")); + std::fs::write( + &config_path, + format!( + r#" +deployment: + profile: local +state: + storage: in_memory +server: + bind: 127.0.0.1:0 +auth: + api_keys: + - id: local + fingerprint: + provider: env + name: STARTUP_REDACTION_API_HASH + scopes: [registry_notary:credential_issue] +audit: + sink: stdout +evidence: + enabled: true + signing_keys: + issuer: + provider: local_jwk_env + private_jwk_env: STARTUP_REDACTION_ISSUER_JWK + alg: EdDSA + kid: did:web:issuer.example#key-1 + status: active +config_trust: + trust_anchor_path: {} + bundle_path: {} + antirollback_state_path: {} + break_glass_override_path: {} +"#, + trust_path.display(), + bundle_path.display(), + state_path.display(), + override_path.display(), + ), + ) + .expect("bootstrap config writes"); + MissingBundleFixture { + config_path, + trust_path, + bundle_path, + state_path, + override_path, + } +} + +#[test] +fn rust_log_off_emits_one_static_local_configuration_failure_line() { + let tmp = tempfile::tempdir().expect("tempdir"); + let config_path = tmp.path().join(format!( + "{SENTINEL_USERNAME}-{SENTINEL_COUNTRY}-{SENTINEL_SECRET}.yaml" + )); + + let output = registry_notary_command_with_log("off") + .arg("--config") + .arg(&config_path) + .output() + .expect("registry-notary starts"); + + assert!(!output.status.success(), "missing config must fail closed"); + assert!( + output.stdout.is_empty(), + "startup failure must not emit stdout with tracing disabled: {}", + String::from_utf8_lossy(&output.stdout) + ); + let definition = NotaryActivationCode::CONFIGURATION_INVALID.definition(); + let expected = format!( + "ERROR {}: {}; next action: {}\n", + definition.code, definition.meaning, definition.remediation + ); + let stderr = String::from_utf8_lossy(&output.stderr); + assert_eq!(stderr, expected); + assert_eq!( + stderr.lines().count(), + 1, + "startup must render exactly one terminal failure line" + ); + for forbidden in [ + SENTINEL_COUNTRY, + SENTINEL_USERNAME, + SENTINEL_SECRET, + config_path.to_string_lossy().as_ref(), + ] { + assert!( + !stderr.contains(forbidden), + "terminal failure line exposed forbidden value {forbidden:?}: {stderr}" + ); + } +} + +#[test] +fn rust_log_off_emits_one_exact_static_bundle_rejection_line() { + let tmp = tempfile::tempdir().expect("tempdir"); + let fixture = write_missing_bundle_fixture(&tmp); + + let output = registry_notary_command_with_log("off") + .arg("--config") + .arg(&fixture.config_path) + .output() + .expect("registry-notary starts"); + + assert!(!output.status.success(), "missing bundle must fail closed"); + assert!( + output.stdout.is_empty(), + "bundle startup failure must not emit stdout with tracing disabled: {}", + String::from_utf8_lossy(&output.stdout) + ); + let failure = BundleVerificationFailure::from(BundleVerificationCode::REJECTED_VALIDATION); + let stderr = String::from_utf8_lossy(&output.stderr); + assert_eq!(stderr, format!("ERROR {failure}\n")); + assert_eq!( + stderr.lines().count(), + 1, + "bundle startup must render exactly one terminal failure line" + ); + for forbidden in [ + SENTINEL_COUNTRY, + SENTINEL_USERNAME, + SENTINEL_SECRET, + SENTINEL_DIGEST, + fixture.trust_path.to_string_lossy().as_ref(), + fixture.bundle_path.to_string_lossy().as_ref(), + fixture.state_path.to_string_lossy().as_ref(), + fixture.override_path.to_string_lossy().as_ref(), + ] { + assert!( + !stderr.contains(forbidden), + "terminal bundle rejection exposed forbidden value {forbidden:?}: {stderr}" + ); + } +} + +#[test] +fn malformed_local_config_does_not_expose_parser_input_or_path() { + let tmp = tempfile::tempdir().expect("tempdir"); + let private_dir = tmp + .path() + .join(format!("{SENTINEL_USERNAME}-{SENTINEL_COUNTRY}")); + std::fs::create_dir_all(&private_dir).expect("private config dir"); + let config_path = private_dir.join(format!("{SENTINEL_SECRET}.yaml")); + std::fs::write( + &config_path, + format!("country: {SENTINEL_COUNTRY}\nsecret: [{SENTINEL_SECRET}\n"), + ) + .expect("malformed config writes"); + + let output = run_server(&config_path); + + assert_safe_configuration_failure( + &output, + &[ + SENTINEL_COUNTRY, + SENTINEL_USERNAME, + SENTINEL_SECRET, + config_path.to_string_lossy().as_ref(), + ], + ); +} + +#[test] +fn missing_env_file_does_not_expose_startup_path() { + let tmp = tempfile::tempdir().expect("tempdir"); + let env_path = tmp.path().join(format!( + "{SENTINEL_USERNAME}-{SENTINEL_COUNTRY}-{SENTINEL_SECRET}.env" + )); + + let output = registry_notary_command() + .arg("--env-file") + .arg(&env_path) + .output() + .expect("registry-notary starts"); + + assert_safe_configuration_failure( + &output, + &[ + SENTINEL_COUNTRY, + SENTINEL_USERNAME, + SENTINEL_SECRET, + env_path.to_string_lossy().as_ref(), + ], + ); +} + +#[test] +fn signed_bundle_boot_failure_does_not_expose_governed_paths_or_values() { + let tmp = tempfile::tempdir().expect("tempdir"); + let fixture = write_missing_bundle_fixture(&tmp); + + for log_format in ["text", "json"] { + let output = registry_notary_command_with_log_format("info", log_format) + .arg("--config") + .arg(&fixture.config_path) + .output() + .expect("registry-notary starts"); + + assert_safe_configuration_failure( + &output, + &[ + SENTINEL_COUNTRY, + SENTINEL_USERNAME, + SENTINEL_SECRET, + SENTINEL_DIGEST, + fixture.trust_path.to_string_lossy().as_ref(), + fixture.bundle_path.to_string_lossy().as_ref(), + fixture.state_path.to_string_lossy().as_ref(), + fixture.override_path.to_string_lossy().as_ref(), + ], + ); + let combined = combined_output(&output); + let code = BundleVerificationCode::REJECTED_VALIDATION; + let definition = code.definition(); + assert!( + combined.contains(code.as_str()), + "{log_format} startup log omitted the stable rejection code: {combined}" + ); + assert!( + combined.contains(definition.safe_meaning), + "{log_format} startup log omitted the static safe meaning: {combined}" + ); + assert!( + combined.contains(definition.safe_remediation), + "{log_format} startup log omitted the static safe remediation: {combined}" + ); + assert!( + !combined.as_bytes().contains(&0x1b), + "{log_format} startup log contained ANSI escape bytes: {combined:?}" + ); + } +} diff --git a/crates/registry-notary/tests/state_cli.rs b/crates/registry-notary/tests/state_cli.rs index 9fd269b90..873d379e0 100644 --- a/crates/registry-notary/tests/state_cli.rs +++ b/crates/registry-notary/tests/state_cli.rs @@ -23,7 +23,7 @@ fn state_doctor_configuration_failure_is_stable_and_value_free() { let stderr = String::from_utf8(output.stderr).expect("stderr is UTF-8"); assert_eq!( stderr, - "ERROR registry-notary PostgreSQL state is not ready: configuration_invalid\n" + "ERROR notary.configuration.invalid: Registry Notary runtime configuration is invalid; next action: run registry-notary doctor, correct the reviewed configuration or binding, and retry activation\n" ); assert!(!stderr.contains(sentinel)); assert!(!stderr.contains(&config_path.display().to_string())); diff --git a/crates/registry-platform-ops/src/lib.rs b/crates/registry-platform-ops/src/lib.rs index 18b71756b..ee5e7f7ee 100644 --- a/crates/registry-platform-ops/src/lib.rs +++ b/crates/registry-platform-ops/src/lib.rs @@ -845,6 +845,267 @@ impl ConfigProvenance { } } +/// Stable, value-free category for a rejected bundle verification or +/// acceptance decision. +/// +/// The representation is private so callers cannot construct unreviewed +/// categories. [`Self::ALL`] is the complete public catalog. Source error +/// payloads, including paths, hashes, parser messages, and supplied values, +/// are deliberately excluded from this type and its definitions. +#[derive(Clone, Copy, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)] +pub struct BundleVerificationCode(BundleVerificationCodeValue); + +#[derive(Clone, Copy, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)] +enum BundleVerificationCodeValue { + Binding, + Rollback, + Signature, + Validation, +} + +impl BundleVerificationCode { + pub const REJECTED_BINDING: Self = Self(BundleVerificationCodeValue::Binding); + pub const REJECTED_ROLLBACK: Self = Self(BundleVerificationCodeValue::Rollback); + pub const REJECTED_SIGNATURE: Self = Self(BundleVerificationCodeValue::Signature); + pub const REJECTED_VALIDATION: Self = Self(BundleVerificationCodeValue::Validation); + + /// Every published bundle-verification rejection code in stable order. + pub const ALL: &'static [Self] = &[ + Self::REJECTED_BINDING, + Self::REJECTED_ROLLBACK, + Self::REJECTED_SIGNATURE, + Self::REJECTED_VALIDATION, + ]; + + #[must_use] + pub const fn as_str(self) -> &'static str { + match self.0 { + BundleVerificationCodeValue::Binding => "rejected_binding", + BundleVerificationCodeValue::Rollback => "rejected_rollback", + BundleVerificationCodeValue::Signature => "rejected_signature", + BundleVerificationCodeValue::Validation => "rejected_validation", + } + } + + /// Return the reviewed static public metadata for this code. + #[must_use] + pub fn definition(self) -> &'static BundleVerificationCodeDefinition { + let index = match self.0 { + BundleVerificationCodeValue::Binding => 0, + BundleVerificationCodeValue::Rollback => 1, + BundleVerificationCodeValue::Signature => 2, + BundleVerificationCodeValue::Validation => 3, + }; + &BUNDLE_VERIFICATION_CODE_DEFINITIONS[index] + } +} + +impl Display for BundleVerificationCode { + fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { + f.write_str(self.as_str()) + } +} + +impl Serialize for BundleVerificationCode { + fn serialize(&self, serializer: S) -> Result + where + S: serde::Serializer, + { + serializer.serialize_str(self.as_str()) + } +} + +/// Restriction applied to evidence published for a bundle-verification code. +#[derive(Clone, Copy, Debug, Eq, PartialEq, Serialize)] +#[serde(rename_all = "snake_case")] +#[non_exhaustive] +pub enum BundleVerificationEvidencePolicy { + /// Publish the stable code and reviewed static catalog text only. + NoRuntimeValues, +} + +impl BundleVerificationEvidencePolicy { + #[must_use] + pub const fn as_str(self) -> &'static str { + match self { + Self::NoRuntimeValues => "no_runtime_values", + } + } +} + +/// Publication lifecycle of a bundle-verification code. +#[derive(Clone, Copy, Debug, Eq, PartialEq, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum BundleVerificationCodeLifecycle { + /// The code is implemented but has not appeared in a released version. + Unreleased, + /// The code is part of the active released public contract. + Active, + /// The released code remains recognized while consumers migrate. + Deprecated, +} + +/// Reviewed, value-free public metadata for one bundle-verification code. +#[derive(Clone, Copy, Debug, Eq, PartialEq, Serialize)] +pub struct BundleVerificationCodeDefinition { + pub code: BundleVerificationCode, + pub phase: &'static str, + pub safe_meaning: &'static str, + pub rule: &'static str, + pub safe_remediation: &'static str, + pub safe_report_message: &'static str, + pub evidence_scope: &'static str, + pub evidence_policy: BundleVerificationEvidencePolicy, + pub evidence_limitation: &'static str, + pub docs_slug: &'static str, + pub lifecycle: BundleVerificationCodeLifecycle, + pub introduced_in: Option<&'static str>, +} + +impl BundleVerificationCodeDefinition { + /// Check the lifecycle/version relationship required by generated + /// references and release gates. + #[must_use] + pub fn lifecycle_metadata_is_valid(&self) -> bool { + match self.lifecycle { + BundleVerificationCodeLifecycle::Unreleased => self.introduced_in.is_none(), + BundleVerificationCodeLifecycle::Active + | BundleVerificationCodeLifecycle::Deprecated => { + self.introduced_in.is_some_and(is_numeric_release_version) + } + } + } +} + +fn is_numeric_release_version(version: &str) -> bool { + let mut parts = version.split('.'); + (0..3).all(|_| { + parts + .next() + .is_some_and(|part| !part.is_empty() && part.bytes().all(|byte| byte.is_ascii_digit())) + }) && parts.next().is_none() +} + +/// Canonical product-owned definitions consumed by reports and generated +/// references. Entries are ordered by their stable code string. +pub const BUNDLE_VERIFICATION_CODE_DEFINITIONS: &[BundleVerificationCodeDefinition] = &[ + BundleVerificationCodeDefinition { + code: BundleVerificationCode::REJECTED_BINDING, + phase: "bundle_verification", + safe_meaning: "The bundle binding does not match the intended runtime target.", + rule: "registry.platform.bundle_verification.binding_matches_target", + safe_remediation: "Use a bundle issued for the intended runtime binding.", + safe_report_message: "The bundle binding does not match the intended runtime target. Use a bundle issued for the intended runtime binding.", + evidence_scope: "signed bundle and configured runtime binding", + evidence_policy: BundleVerificationEvidencePolicy::NoRuntimeValues, + evidence_limitation: + "The category does not disclose received or configured binding values.", + docs_slug: "rejected-binding", + lifecycle: BundleVerificationCodeLifecycle::Unreleased, + introduced_in: None, + }, + BundleVerificationCodeDefinition { + code: BundleVerificationCode::REJECTED_ROLLBACK, + phase: "bundle_activation", + safe_meaning: + "The bundle or override does not satisfy local anti-rollback requirements.", + rule: "registry.platform.bundle_verification.rollback_constraints_satisfied", + safe_remediation: "Use a monotonic bundle or an authorized break-glass selection.", + safe_report_message: "The bundle or override does not satisfy local anti-rollback requirements. Use a monotonic bundle or an authorized break-glass selection.", + evidence_scope: "local anti-rollback state and bundle or override metadata", + evidence_policy: BundleVerificationEvidencePolicy::NoRuntimeValues, + evidence_limitation: + "The category does not disclose stored sequences, content digests, paths, or approval values.", + docs_slug: "rejected-rollback", + lifecycle: BundleVerificationCodeLifecycle::Unreleased, + introduced_in: None, + }, + BundleVerificationCodeDefinition { + code: BundleVerificationCode::REJECTED_SIGNATURE, + phase: "bundle_verification", + safe_meaning: + "Bundle authenticity or declared content integrity verification failed.", + rule: "registry.platform.bundle_verification.signature_and_integrity_accepted", + safe_remediation: + "Rebuild and sign the complete bundle with an accepted trust configuration.", + safe_report_message: "Bundle authenticity or declared content integrity verification failed. Rebuild and sign the complete bundle with an accepted trust configuration.", + evidence_scope: "bundle trust metadata, signature envelope, file closure, and content digests", + evidence_policy: BundleVerificationEvidencePolicy::NoRuntimeValues, + evidence_limitation: + "The category does not disclose signer identifiers, file names, or content digests.", + docs_slug: "rejected-signature", + lifecycle: BundleVerificationCodeLifecycle::Unreleased, + introduced_in: None, + }, + BundleVerificationCodeDefinition { + code: BundleVerificationCode::REJECTED_VALIDATION, + phase: "bundle_verification", + safe_meaning: + "The bundle or acceptance metadata is missing, unreadable, malformed, or unsupported.", + rule: "registry.platform.bundle_verification.input_is_valid", + safe_remediation: + "Regenerate the bundle and acceptance metadata using supported formats.", + safe_report_message: "The bundle or acceptance metadata is missing, unreadable, malformed, or unsupported. Regenerate the bundle and acceptance metadata using supported formats.", + evidence_scope: "bundle encoding, manifest, acceptance metadata, and required local inputs", + evidence_policy: BundleVerificationEvidencePolicy::NoRuntimeValues, + evidence_limitation: + "The category does not disclose parser messages, local paths, or supplied values.", + docs_slug: "rejected-validation", + lifecycle: BundleVerificationCodeLifecycle::Unreleased, + introduced_in: None, + }, +]; + +/// Value-free process-boundary failure for a rejected bundle verification. +/// +/// This carrier retains only the closed catalog code. In particular, it has no +/// source error and cannot carry paths, hashes, parser text, identities, or +/// supplied configuration values into stderr or another operator surface. +#[derive(Clone, Copy, Eq, PartialEq)] +pub struct BundleVerificationFailure { + code: BundleVerificationCode, +} + +impl BundleVerificationFailure { + #[must_use] + pub const fn code(self) -> BundleVerificationCode { + self.code + } + + #[must_use] + pub fn definition(self) -> &'static BundleVerificationCodeDefinition { + self.code.definition() + } +} + +impl fmt::Debug for BundleVerificationFailure { + fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result { + formatter + .debug_struct("BundleVerificationFailure") + .field("code", &self.code.as_str()) + .finish() + } +} + +impl Display for BundleVerificationFailure { + fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result { + write!( + formatter, + "{}: {}", + self.code, + self.definition().safe_report_message + ) + } +} + +impl std::error::Error for BundleVerificationFailure {} + +impl From for BundleVerificationFailure { + fn from(code: BundleVerificationCode) -> Self { + Self { code } + } +} + #[derive(Clone, Copy, Debug, Eq, PartialEq)] #[non_exhaustive] pub enum ApplyReportResult { @@ -880,6 +1141,17 @@ impl ApplyReportResult { } } +impl From for ApplyReportResult { + fn from(code: BundleVerificationCode) -> Self { + match code.0 { + BundleVerificationCodeValue::Binding => Self::RejectedBinding, + BundleVerificationCodeValue::Rollback => Self::RejectedRollback, + BundleVerificationCodeValue::Signature => Self::RejectedSignature, + BundleVerificationCodeValue::Validation => Self::RejectedValidation, + } + } +} + #[derive(Clone, Copy, Debug, Eq, PartialEq)] #[non_exhaustive] pub enum PostureApplyResult { @@ -1605,22 +1877,28 @@ pub enum ConfigBootError { } impl ConfigBootError { - pub fn bundle_rejection_result(&self) -> &'static str { + #[must_use] + pub fn bundle_rejection_code(&self) -> BundleVerificationCode { match self { - Self::Bundle(error) => bundle_verify_rejection_result(error), + Self::Bundle(error) => bundle_verify_rejection_code(error), Self::NonMonotonicSequence | Self::OverrideHashMismatch | Self::Store(_) | Self::MissingUnsignedConfigPath - | Self::UnsignedConfigHashMismatch { .. } => "rejected_rollback", + | Self::UnsignedConfigHashMismatch { .. } => BundleVerificationCode::REJECTED_ROLLBACK, Self::MissingSignedBundleId | Self::MissingSignedBundleManifestHash | Self::MissingSignedBundleSequence | Self::MissingOverridePin - | Self::InvalidOverridePath => "rejected_validation", + | Self::InvalidOverridePath => BundleVerificationCode::REJECTED_VALIDATION, } } + /// Compatibility wrapper for existing report producers. + pub fn bundle_rejection_result(&self) -> &'static str { + self.bundle_rejection_code().as_str() + } + pub fn break_glass_invalid_reason(&self) -> Option<&'static str> { match self { Self::OverrideHashMismatch => Some("hash_mismatch"), @@ -2491,26 +2769,41 @@ pub fn override_pin_posture(pin: &ConfigOverridePin) -> Value { }) } -pub fn bundle_verify_rejection_result( +/// Classify a bundle verification failure without carrying its source payload +/// across the public reporting boundary. +#[must_use] +pub fn bundle_verify_rejection_code( error: ®istry_platform_config::ConfigBundleError, -) -> &'static str { +) -> BundleVerificationCode { match error { - registry_platform_config::ConfigBundleError::BindingMismatch(_) => "rejected_binding", + registry_platform_config::ConfigBundleError::BindingMismatch(_) => { + BundleVerificationCode::REJECTED_BINDING + } registry_platform_config::ConfigBundleError::SignatureRejected | registry_platform_config::ConfigBundleError::InvalidSignatureEnvelope(_) | registry_platform_config::ConfigBundleError::InvalidTrustAnchor(_) | registry_platform_config::ConfigBundleError::InvalidPermissions(_) | registry_platform_config::ConfigBundleError::FileClosure(_) - | registry_platform_config::ConfigBundleError::HashMismatch { .. } => "rejected_signature", + | registry_platform_config::ConfigBundleError::HashMismatch { .. } => { + BundleVerificationCode::REJECTED_SIGNATURE + } registry_platform_config::ConfigBundleError::Io(_) | registry_platform_config::ConfigBundleError::Json(_) | registry_platform_config::ConfigBundleError::InvalidManifest(_) | registry_platform_config::ConfigBundleError::InvalidBreakGlass(_) => { - "rejected_validation" + BundleVerificationCode::REJECTED_VALIDATION } } } +/// Compatibility wrapper for existing report producers. +#[must_use] +pub fn bundle_verify_rejection_result( + error: ®istry_platform_config::ConfigBundleError, +) -> &'static str { + bundle_verify_rejection_code(error).as_str() +} + fn previous_hash_matched( previous_config_hash: Option<&str>, record: &AntiRollbackRecord, diff --git a/crates/registry-platform-ops/tests/bundle_verification_catalog.rs b/crates/registry-platform-ops/tests/bundle_verification_catalog.rs new file mode 100644 index 000000000..542be42a8 --- /dev/null +++ b/crates/registry-platform-ops/tests/bundle_verification_catalog.rs @@ -0,0 +1,360 @@ +use std::collections::BTreeSet; + +use registry_platform_config::ConfigBundleError; +use registry_platform_ops::{ + bundle_verify_rejection_code, bundle_verify_rejection_result, AntiRollbackStoreError, + ApplyReportResult, BundleVerificationCode, BundleVerificationCodeLifecycle, + BundleVerificationEvidencePolicy, BundleVerificationFailure, ConfigBootError, + BUNDLE_VERIFICATION_CODE_DEFINITIONS, +}; + +const PATH_SENTINEL: &str = "/Users/redaction-sentinel/private/config.json"; +const HASH_SENTINEL: &str = + "sha256:1111111111111111111111111111111111111111111111111111111111111111"; +const OTHER_HASH_SENTINEL: &str = + "sha256:2222222222222222222222222222222222222222222222222222222222222222"; +const PARSER_SENTINEL: &str = "line 7 column 42 near REDACTION_PARSER_SENTINEL"; +const USER_SENTINEL: &str = "redaction-user@example.test"; +const SECRET_SENTINEL: &str = "REDACTION_SECRET_SENTINEL"; +const COUNTRY_SENTINEL: &str = "REDACTION_COUNTRY_VALUE_SENTINEL"; + +fn bundle_error_cases() -> Vec<(ConfigBundleError, BundleVerificationCode)> { + vec![ + ( + ConfigBundleError::Io(PATH_SENTINEL.to_string()), + BundleVerificationCode::REJECTED_VALIDATION, + ), + ( + ConfigBundleError::Json(PARSER_SENTINEL.to_string()), + BundleVerificationCode::REJECTED_VALIDATION, + ), + ( + ConfigBundleError::InvalidManifest(COUNTRY_SENTINEL), + BundleVerificationCode::REJECTED_VALIDATION, + ), + ( + ConfigBundleError::InvalidTrustAnchor(USER_SENTINEL), + BundleVerificationCode::REJECTED_SIGNATURE, + ), + ( + ConfigBundleError::InvalidPermissions(PATH_SENTINEL), + BundleVerificationCode::REJECTED_SIGNATURE, + ), + ( + ConfigBundleError::InvalidBreakGlass(SECRET_SENTINEL), + BundleVerificationCode::REJECTED_VALIDATION, + ), + ( + ConfigBundleError::InvalidSignatureEnvelope(SECRET_SENTINEL), + BundleVerificationCode::REJECTED_SIGNATURE, + ), + ( + ConfigBundleError::BindingMismatch(COUNTRY_SENTINEL), + BundleVerificationCode::REJECTED_BINDING, + ), + ( + ConfigBundleError::SignatureRejected, + BundleVerificationCode::REJECTED_SIGNATURE, + ), + ( + ConfigBundleError::FileClosure(PATH_SENTINEL.to_string()), + BundleVerificationCode::REJECTED_SIGNATURE, + ), + ( + ConfigBundleError::HashMismatch { + path: PATH_SENTINEL.to_string(), + expected: HASH_SENTINEL.to_string(), + actual: OTHER_HASH_SENTINEL.to_string(), + }, + BundleVerificationCode::REJECTED_SIGNATURE, + ), + ] +} + +fn boot_error_cases() -> Vec<(ConfigBootError, BundleVerificationCode)> { + vec![ + ( + ConfigBootError::Store(AntiRollbackStoreError::InvalidState( + SECRET_SENTINEL.to_string(), + )), + BundleVerificationCode::REJECTED_ROLLBACK, + ), + ( + ConfigBootError::Bundle(ConfigBundleError::BindingMismatch(COUNTRY_SENTINEL)), + BundleVerificationCode::REJECTED_BINDING, + ), + ( + ConfigBootError::NonMonotonicSequence, + BundleVerificationCode::REJECTED_ROLLBACK, + ), + ( + ConfigBootError::OverrideHashMismatch, + BundleVerificationCode::REJECTED_ROLLBACK, + ), + ( + ConfigBootError::MissingUnsignedConfigPath, + BundleVerificationCode::REJECTED_ROLLBACK, + ), + ( + ConfigBootError::UnsignedConfigHashMismatch { + expected: HASH_SENTINEL.to_string(), + actual: OTHER_HASH_SENTINEL.to_string(), + }, + BundleVerificationCode::REJECTED_ROLLBACK, + ), + ( + ConfigBootError::MissingSignedBundleId, + BundleVerificationCode::REJECTED_VALIDATION, + ), + ( + ConfigBootError::MissingSignedBundleManifestHash, + BundleVerificationCode::REJECTED_VALIDATION, + ), + ( + ConfigBootError::MissingSignedBundleSequence, + BundleVerificationCode::REJECTED_VALIDATION, + ), + ( + ConfigBootError::MissingOverridePin, + BundleVerificationCode::REJECTED_VALIDATION, + ), + ( + ConfigBootError::InvalidOverridePath, + BundleVerificationCode::REJECTED_VALIDATION, + ), + ] +} + +#[test] +fn bundle_error_mapping_covers_every_source_variant() { + for (error, expected) in bundle_error_cases() { + assert_eq!(bundle_verify_rejection_code(&error), expected); + } +} + +#[test] +fn config_boot_mapping_covers_every_source_variant() { + for (error, expected) in boot_error_cases() { + assert_eq!(error.bundle_rejection_code(), expected); + } +} + +#[test] +fn catalog_is_complete_unique_and_sorted() { + let expected = [ + "rejected_binding", + "rejected_rollback", + "rejected_signature", + "rejected_validation", + ]; + let actual = BundleVerificationCode::ALL + .iter() + .map(|code| code.as_str()) + .collect::>(); + assert_eq!(actual, expected); + assert!( + actual.windows(2).all(|pair| pair[0] < pair[1]), + "codes must remain in stable lexical order" + ); + assert_eq!( + actual.iter().copied().collect::>().len(), + actual.len(), + "codes must be unique" + ); + + let definition_codes = BUNDLE_VERIFICATION_CODE_DEFINITIONS + .iter() + .map(|definition| definition.code) + .collect::>(); + assert_eq!(definition_codes, BundleVerificationCode::ALL); + for code in BundleVerificationCode::ALL { + assert_eq!(code.definition().code, *code); + } + assert!(BUNDLE_VERIFICATION_CODE_DEFINITIONS + .iter() + .all(|definition| { + definition.evidence_policy == BundleVerificationEvidencePolicy::NoRuntimeValues + && !definition.phase.is_empty() + && !definition.safe_meaning.is_empty() + && !definition.rule.is_empty() + && !definition.safe_remediation.is_empty() + && definition.safe_report_message + == format!( + "{} {}", + definition.safe_meaning, definition.safe_remediation + ) + && !definition.evidence_scope.is_empty() + && !definition.evidence_limitation.is_empty() + && !definition.docs_slug.is_empty() + && definition.lifecycle == BundleVerificationCodeLifecycle::Unreleased + && definition.introduced_in.is_none() + && definition.lifecycle_metadata_is_valid() + })); +} + +#[test] +fn lifecycle_metadata_requires_versions_only_for_released_codes() { + let base = BUNDLE_VERIFICATION_CODE_DEFINITIONS[0]; + let cases = [ + (BundleVerificationCodeLifecycle::Unreleased, None, true), + ( + BundleVerificationCodeLifecycle::Unreleased, + Some("1.2.3"), + false, + ), + (BundleVerificationCodeLifecycle::Active, None, false), + ( + BundleVerificationCodeLifecycle::Active, + Some("unreleased"), + false, + ), + (BundleVerificationCodeLifecycle::Active, Some("1.2"), false), + (BundleVerificationCodeLifecycle::Active, Some("1.2.3"), true), + (BundleVerificationCodeLifecycle::Deprecated, None, false), + ( + BundleVerificationCodeLifecycle::Deprecated, + Some("1.2.3"), + true, + ), + ]; + + for (lifecycle, introduced_in, expected) in cases { + let definition = registry_platform_ops::BundleVerificationCodeDefinition { + lifecycle, + introduced_in, + ..base + }; + assert_eq!( + definition.lifecycle_metadata_is_valid(), + expected, + "unexpected lifecycle validity for {lifecycle:?} with {introduced_in:?}" + ); + } + + let serialized = + serde_json::to_string(BUNDLE_VERIFICATION_CODE_DEFINITIONS).expect("serialize catalog"); + assert!(serialized.contains(r#""lifecycle":"unreleased""#)); + assert!(serialized.contains(r#""introduced_in":null"#)); + assert!( + !serialized.contains("0.13.0"), + "the post-v0.13.0 catalog must not claim that release" + ); +} + +#[test] +fn catalog_and_mappings_never_publish_source_values() { + let sentinels = [ + PATH_SENTINEL, + HASH_SENTINEL, + OTHER_HASH_SENTINEL, + PARSER_SENTINEL, + USER_SENTINEL, + SECRET_SENTINEL, + COUNTRY_SENTINEL, + ]; + let definitions = + serde_json::to_string(BUNDLE_VERIFICATION_CODE_DEFINITIONS).expect("serialize definitions"); + + for sentinel in sentinels { + assert!( + !definitions.contains(sentinel), + "static definitions leaked sentinel {sentinel:?}" + ); + } + + for (error, _) in bundle_error_cases() { + let public_output = serde_json::to_string(&bundle_verify_rejection_code(&error)) + .expect("serialize public code"); + for sentinel in sentinels { + assert!( + !public_output.contains(sentinel), + "public code leaked sentinel {sentinel:?}" + ); + } + } + + for (error, _) in boot_error_cases() { + let public_output = error.bundle_rejection_result(); + for sentinel in sentinels { + assert!( + !public_output.contains(sentinel), + "compatibility result leaked sentinel {sentinel:?}" + ); + } + } +} + +#[test] +fn compatibility_wrappers_preserve_existing_result_strings() { + for (error, expected) in bundle_error_cases() { + assert_eq!(bundle_verify_rejection_result(&error), expected.as_str()); + } + for (error, expected) in boot_error_cases() { + assert_eq!(error.bundle_rejection_result(), expected.as_str()); + } +} + +#[test] +fn codes_convert_to_the_existing_apply_report_vocabulary() { + let cases = [ + ( + BundleVerificationCode::REJECTED_BINDING, + ApplyReportResult::RejectedBinding, + ), + ( + BundleVerificationCode::REJECTED_ROLLBACK, + ApplyReportResult::RejectedRollback, + ), + ( + BundleVerificationCode::REJECTED_SIGNATURE, + ApplyReportResult::RejectedSignature, + ), + ( + BundleVerificationCode::REJECTED_VALIDATION, + ApplyReportResult::RejectedValidation, + ), + ]; + + for (code, expected) in cases { + let result = ApplyReportResult::from(code); + assert_eq!(result, expected); + assert_eq!(result.as_str(), code.as_str()); + assert_eq!( + serde_json::to_string(&code).expect("serialize code"), + format!("\"{}\"", code.as_str()) + ); + } +} + +#[test] +fn process_failure_retains_only_static_catalog_evidence() { + let sentinels = [ + PATH_SENTINEL, + HASH_SENTINEL, + OTHER_HASH_SENTINEL, + PARSER_SENTINEL, + USER_SENTINEL, + SECRET_SENTINEL, + COUNTRY_SENTINEL, + ]; + + for (source, code) in bundle_error_cases() { + let failure = BundleVerificationFailure::from(bundle_verify_rejection_code(&source)); + assert_eq!(failure.code(), code); + assert!( + std::error::Error::source(&failure).is_none(), + "the process carrier must not retain the source error" + ); + assert_eq!( + failure.to_string(), + format!("{}: {}", code, code.definition().safe_report_message) + ); + let rendered = format!("{failure:?}\n{failure}"); + for sentinel in sentinels { + assert!( + !rendered.contains(sentinel), + "process failure leaked sentinel {sentinel:?}: {rendered}" + ); + } + } +} diff --git a/crates/registry-relay/CHANGELOG.md b/crates/registry-relay/CHANGELOG.md index 425800fa6..46ce5bbc7 100644 --- a/crates/registry-relay/CHANGELOG.md +++ b/crates/registry-relay/CHANGELOG.md @@ -10,6 +10,15 @@ admin capabilities document and Relay image metadata. Profile versions use a portable URL-path grammar, and resolve JSON rejections now return Relay Problem Details with non-storable headers. +- Add product-owned, value-free startup and activation diagnostic catalogs, + stateful Config Bundle verification with explicit anti-rollback state, and + execute-time consultation contract verification before any source + continuation. A stale contract hash returns + `consultation.contract_mismatch` with zero source calls. Listener startup + failures identify the data-plane or administration field and a bounded + operating-system class, while configuration failures distinguish source, + environment, document, deprecated-field, validation, bundle, and + consultation-closure phases without rendering runtime values. ## 0.13.0 - 2026-07-25 diff --git a/crates/registry-relay/config/documentation-intent.json b/crates/registry-relay/config/documentation-intent.json new file mode 100644 index 000000000..1093d8ee6 --- /dev/null +++ b/crates/registry-relay/config/documentation-intent.json @@ -0,0 +1,8101 @@ +{ + "$schema": "https://id.registrystack.org/schemas/registryctl/project-documentation/registry.runtime.configuration_intent.v1.schema.json", + "format_version": "1.0", + "runtime_schema": "relay", + "schema_id": "https://id.registrystack.org/schemas/registry-relay/registry-relay.config.schema.json", + "schema_source": "registry-relay.config.schema.json", + "profiles": [ + { + "id": "relay_audit_internal", + "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ] + }, + { + "id": "relay_audit_secret_reference", + "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ] + }, + { + "id": "relay_audit_sensitive", + "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ] + }, + { + "id": "relay_auth_internal", + "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ] + }, + { + "id": "relay_auth_oidc_scope_map_open_map", + "purpose": "Each reviewed key is an external token scope and each value is the bounded Relay scope mapping granted for that exact token scope.", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "bound_by_environment", + "sensitivity": "structural", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "open_map_semantics": "Each reviewed key is an external token scope and each value is the bounded Relay scope mapping granted for that exact token scope." + }, + { + "id": "relay_auth_secret_reference", + "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ] + }, + { + "id": "relay_auth_sensitive", + "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ] + }, + { + "id": "relay_catalog_internal", + "purpose": "Controls Relay catalog identity and public metadata exposed for governed discovery.", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ] + }, + { + "id": "relay_catalog_public", + "purpose": "Publishes the reviewed Relay catalog identity and descriptive metadata used for governed discovery.", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.", + "environment_behavior": "bound_by_environment", + "sensitivity": "public", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.", + "example_guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ] + }, + { + "id": "relay_catalog_sensitive", + "purpose": "Controls Relay catalog identity and public metadata exposed for governed discovery.", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ] + }, + { + "id": "relay_config_trust_internal", + "purpose": "Controls Relay verification of signed configuration bundles, trust anchors, and rollback protection.", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ] + }, + { + "id": "relay_config_trust_sensitive", + "purpose": "Controls Relay verification of signed configuration bundles, trust anchors, and rollback protection.", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ] + }, + { + "id": "relay_consultation_internal", + "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ] + }, + { + "id": "relay_consultation_secret_reference", + "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ] + }, + { + "id": "relay_consultation_sensitive", + "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ] + }, + { + "id": "relay_datasets_internal", + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ] + }, + { + "id": "relay_datasets_secret_reference", + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ] + }, + { + "id": "relay_datasets_sensitive", + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ] + }, + { + "id": "relay_deployment_internal", + "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ] + }, + { + "id": "relay_deployment_sensitive", + "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ] + }, + { + "id": "relay_instance_internal", + "purpose": "Identifies the Relay instance and its deployment environment for operational correlation.", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ] + }, + { + "id": "relay_instance_public", + "purpose": "Identifies the public Relay instance labels surfaced by posture and operations tooling.", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "Public instance labels surfaced by Relay posture and operations tooling; this intent catalog records their contract without loading deployment values.", + "environment_behavior": "bound_by_environment", + "sensitivity": "public", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate changes to public instance identity with the Relay deployment and its operational inventory.", + "example_guidance": "Use synthetic public labels; never copy a country deployment identity into generated reference documentation.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ] + }, + { + "id": "relay_metadata_internal", + "purpose": "Controls Relay metadata publication and registry-description behavior.", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ] + }, + { + "id": "relay_metadata_sensitive", + "purpose": "Controls Relay metadata publication and registry-description behavior.", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ] + }, + { + "id": "relay_root_structural", + "purpose": "Defines the complete Relay runtime configuration boundary consumed when a Relay instance starts.", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "bound_by_environment", + "sensitivity": "structural", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ] + }, + { + "id": "relay_server_internal", + "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ] + }, + { + "id": "relay_server_sensitive", + "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ] + }, + { + "id": "relay_standards_internal", + "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ] + }, + { + "id": "relay_standards_sensitive", + "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ] + }, + { + "id": "relay_standards_spdci_registries_expression_fields_open_map", + "purpose": "Each reviewed key names an expression-visible field and each value defines the bounded source expression exposed under that name.", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "bound_by_environment", + "sensitivity": "structural", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "open_map_semantics": "Each reviewed key names an expression-visible field and each value defines the bounded source expression exposed under that name." + }, + { + "id": "relay_standards_spdci_registries_identifiers_open_map", + "purpose": "Each reviewed key names an identifier role and each value defines the exact request identifier binding for that role.", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "bound_by_environment", + "sensitivity": "structural", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "open_map_semantics": "Each reviewed key names an identifier role and each value defines the exact request identifier binding for that role." + }, + { + "id": "relay_standards_spdci_registries_open_map", + "purpose": "Each reviewed key names one SP DCI registry contract and each value defines that registry’s bounded request and response mapping.", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "bound_by_environment", + "sensitivity": "structural", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "open_map_semantics": "Each reviewed key names one SP DCI registry contract and each value defines that registry’s bounded request and response mapping." + }, + { + "id": "relay_standards_spdci_registries_response_fields_open_map", + "purpose": "Each reviewed key names a response field and each value defines the exact bounded response projection for that field.", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "bound_by_environment", + "sensitivity": "structural", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "open_map_semantics": "Each reviewed key names a response field and each value defines the exact bounded response projection for that field." + }, + { + "id": "relay_vocabularies_internal", + "purpose": "Controls the reviewed vocabulary bindings Relay uses to interpret namespaced terms.", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ] + }, + { + "id": "relay_vocabularies_open_map", + "purpose": "Each reviewed key is a vocabulary prefix and each value binds that prefix to its operator-approved vocabulary identifier.", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "environment_behavior": "bound_by_environment", + "sensitivity": "structural", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "introduced_in": "0.13.0", + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "example_guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "open_map_semantics": "Each reviewed key is a vocabulary prefix and each value binds that prefix to its operator-approved vocabulary identifier." + } + ], + "assignments": [ + { + "schema": "relay", + "pointer": "", + "key_path": "", + "path_kind": "root", + "profile": "relay_root_structural", + "purpose_source": "schema_description", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/properties/audit", + "key_path": "audit", + "path_kind": "property", + "profile": "relay_audit_internal", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AuditConfig/properties/chain", + "key_path": "audit.chain", + "path_kind": "property", + "profile": "relay_audit_internal", + "purpose_source": "override", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AuditConfig/properties/format", + "key_path": "audit.format", + "path_kind": "property", + "profile": "relay_audit_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AuditConfig/properties/hash_secret_env", + "key_path": "audit.hash_secret_env", + "path_kind": "property", + "profile": "relay_audit_secret_reference", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AuditConfig/properties/include_health", + "key_path": "audit.include_health", + "path_kind": "property", + "profile": "relay_audit_internal", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AuditConfig/oneOf/1/properties/path", + "key_path": "audit.path", + "path_kind": "property", + "profile": "relay_audit_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AuditConfig/oneOf/1/properties/rotate", + "key_path": "audit.rotate", + "path_kind": "property", + "profile": "relay_audit_internal", + "purpose_source": "schema_description", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/RotateConfig/properties/max_files", + "key_path": "audit.rotate.max_files", + "path_kind": "property", + "profile": "relay_audit_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/RotateConfig/properties/max_size_mb", + "key_path": "audit.rotate.max_size_mb", + "path_kind": "property", + "profile": "relay_audit_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AuditConfig/oneOf/0/properties/sink", + "key_path": "audit.sink", + "path_kind": "property", + "profile": "relay_audit_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AuditConfig/properties/write_policy", + "key_path": "audit.write_policy", + "path_kind": "property", + "profile": "relay_audit_internal", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/properties/auth", + "key_path": "auth", + "path_kind": "property", + "profile": "relay_auth_internal", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AuthConfig/properties/api_keys", + "key_path": "auth.api_keys", + "path_kind": "property", + "profile": "relay_auth_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AuthConfig/properties/api_keys/items", + "key_path": "auth.api_keys[]", + "path_kind": "array_item", + "profile": "relay_auth_sensitive", + "purpose_source": "schema_description", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ApiKeyConfig/properties/fingerprint", + "key_path": "auth.api_keys[].fingerprint", + "path_kind": "property", + "profile": "relay_auth_secret_reference", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/CredentialFingerprintSchema/oneOf/0/properties/name", + "key_path": "auth.api_keys[].fingerprint.name", + "path_kind": "property", + "profile": "relay_auth_secret_reference", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/CredentialFingerprintSchema/oneOf/1/properties/path", + "key_path": "auth.api_keys[].fingerprint.path", + "path_kind": "property", + "profile": "relay_auth_secret_reference", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/CredentialFingerprintSchema/oneOf/0/properties/provider", + "key_path": "auth.api_keys[].fingerprint.provider", + "path_kind": "property", + "profile": "relay_auth_secret_reference", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ApiKeyConfig/properties/id", + "key_path": "auth.api_keys[].id", + "path_kind": "property", + "profile": "relay_auth_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ApiKeyConfig/properties/scopes", + "key_path": "auth.api_keys[].scopes", + "path_kind": "property", + "profile": "relay_auth_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ApiKeyConfig/properties/scopes/items", + "key_path": "auth.api_keys[].scopes[]", + "path_kind": "array_item", + "profile": "relay_auth_sensitive", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AuthConfig/properties/failure_throttle", + "key_path": "auth.failure_throttle", + "path_kind": "property", + "profile": "relay_auth_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AuthFailureThrottleConfig/properties/enabled", + "key_path": "auth.failure_throttle.enabled", + "path_kind": "property", + "profile": "relay_auth_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AuthFailureThrottleConfig/properties/max_failures", + "key_path": "auth.failure_throttle.max_failures", + "path_kind": "property", + "profile": "relay_auth_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AuthFailureThrottleConfig/properties/window_seconds", + "key_path": "auth.failure_throttle.window_seconds", + "path_kind": "property", + "profile": "relay_auth_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AuthConfig/properties/mode", + "key_path": "auth.mode", + "path_kind": "property", + "profile": "relay_auth_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AuthConfig/properties/oidc", + "key_path": "auth.oidc", + "path_kind": "property", + "profile": "relay_auth_internal", + "purpose_source": "schema_description", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/allow_dev_insecure_fetch_urls", + "key_path": "auth.oidc.allow_dev_insecure_fetch_urls", + "path_kind": "property", + "profile": "relay_auth_sensitive", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/allowed_algorithms", + "key_path": "auth.oidc.allowed_algorithms", + "path_kind": "property", + "profile": "relay_auth_internal", + "purpose_source": "schema_description", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/allowed_algorithms/items", + "key_path": "auth.oidc.allowed_algorithms[]", + "path_kind": "array_item", + "profile": "relay_auth_internal", + "purpose_source": "schema_description", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/allowed_clients", + "key_path": "auth.oidc.allowed_clients", + "path_kind": "property", + "profile": "relay_auth_internal", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/allowed_clients/items", + "key_path": "auth.oidc.allowed_clients[]", + "path_kind": "array_item", + "profile": "relay_auth_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/allowed_token_types", + "key_path": "auth.oidc.allowed_token_types", + "path_kind": "property", + "profile": "relay_auth_sensitive", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/allowed_token_types/items", + "key_path": "auth.oidc.allowed_token_types[]", + "path_kind": "array_item", + "profile": "relay_auth_sensitive", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/audiences", + "key_path": "auth.oidc.audiences", + "path_kind": "property", + "profile": "relay_auth_sensitive", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/audiences/items", + "key_path": "auth.oidc.audiences[]", + "path_kind": "array_item", + "profile": "relay_auth_sensitive", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/discovery_url", + "key_path": "auth.oidc.discovery_url", + "path_kind": "property", + "profile": "relay_auth_sensitive", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/issuer", + "key_path": "auth.oidc.issuer", + "path_kind": "property", + "profile": "relay_auth_sensitive", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/jwks_cache_ttl", + "key_path": "auth.oidc.jwks_cache_ttl", + "path_kind": "property", + "profile": "relay_auth_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/jwks_url", + "key_path": "auth.oidc.jwks_url", + "path_kind": "property", + "profile": "relay_auth_sensitive", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/leeway", + "key_path": "auth.oidc.leeway", + "path_kind": "property", + "profile": "relay_auth_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/scope_claim", + "key_path": "auth.oidc.scope_claim", + "path_kind": "property", + "profile": "relay_auth_internal", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/scope_map", + "key_path": "auth.oidc.scope_map", + "path_kind": "property", + "profile": "relay_auth_internal", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/scope_map/additionalProperties", + "key_path": "auth.oidc.scope_map.*", + "path_kind": "map_value", + "profile": "relay_auth_oidc_scope_map_open_map", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/scope_object_required_keys", + "key_path": "auth.oidc.scope_object_required_keys", + "path_kind": "property", + "profile": "relay_auth_sensitive", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/scope_object_required_keys/items", + "key_path": "auth.oidc.scope_object_required_keys[]", + "path_kind": "array_item", + "profile": "relay_auth_sensitive", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/properties/catalog", + "key_path": "catalog", + "path_kind": "property", + "profile": "relay_catalog_internal", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/CatalogConfig/properties/authority_type", + "key_path": "catalog.authority_type", + "path_kind": "property", + "profile": "relay_catalog_public", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/CatalogConfig/properties/base_url", + "key_path": "catalog.base_url", + "path_kind": "property", + "profile": "relay_catalog_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/CatalogConfig/properties/default_spatial_coverage", + "key_path": "catalog.default_spatial_coverage", + "path_kind": "property", + "profile": "relay_catalog_public", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/CatalogConfig/properties/participant_id", + "key_path": "catalog.participant_id", + "path_kind": "property", + "profile": "relay_catalog_public", + "purpose_source": "override", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/CatalogConfig/properties/publisher", + "key_path": "catalog.publisher", + "path_kind": "property", + "profile": "relay_catalog_public", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/CatalogConfig/properties/publisher_iri", + "key_path": "catalog.publisher_iri", + "path_kind": "property", + "profile": "relay_catalog_public", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/CatalogConfig/properties/title", + "key_path": "catalog.title", + "path_kind": "property", + "profile": "relay_catalog_public", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/properties/config_trust", + "key_path": "config_trust", + "path_kind": "property", + "profile": "relay_config_trust_internal", + "purpose_source": "schema_description", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ConfigTrustConfig/properties/antirollback_state_path", + "key_path": "config_trust.antirollback_state_path", + "path_kind": "property", + "profile": "relay_config_trust_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ConfigTrustConfig/properties/break_glass_override_path", + "key_path": "config_trust.break_glass_override_path", + "path_kind": "property", + "profile": "relay_config_trust_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ConfigTrustConfig/properties/bundle_path", + "key_path": "config_trust.bundle_path", + "path_kind": "property", + "profile": "relay_config_trust_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ConfigTrustConfig/properties/trust_anchor_path", + "key_path": "config_trust.trust_anchor_path", + "path_kind": "property", + "profile": "relay_config_trust_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/properties/consultation", + "key_path": "consultation", + "path_kind": "property", + "profile": "relay_consultation_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ConsultationConfig/properties/artifacts", + "key_path": "consultation.artifacts", + "path_kind": "property", + "profile": "relay_consultation_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/evidence", + "key_path": "consultation.artifacts.evidence", + "path_kind": "property", + "profile": "relay_consultation_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/evidence/items", + "key_path": "consultation.artifacts.evidence[]", + "path_kind": "array_item", + "profile": "relay_consultation_internal", + "purpose_source": "schema_description", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ConsultationEvidenceArtifactConfig/properties/class", + "key_path": "consultation.artifacts.evidence[].class", + "path_kind": "property", + "profile": "relay_consultation_internal", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ConsultationEvidenceArtifactConfig/properties/path", + "key_path": "consultation.artifacts.evidence[].path", + "path_kind": "property", + "profile": "relay_consultation_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ConsultationEvidenceArtifactConfig/properties/sha256", + "key_path": "consultation.artifacts.evidence[].sha256", + "path_kind": "property", + "profile": "relay_consultation_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/integration_packs", + "key_path": "consultation.artifacts.integration_packs", + "path_kind": "property", + "profile": "relay_consultation_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/integration_packs/items", + "key_path": "consultation.artifacts.integration_packs[]", + "path_kind": "array_item", + "profile": "relay_consultation_internal", + "purpose_source": "schema_description", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/hash", + "key_path": "consultation.artifacts.integration_packs[].hash", + "path_kind": "property", + "profile": "relay_consultation_sensitive", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/path", + "key_path": "consultation.artifacts.integration_packs[].path", + "path_kind": "property", + "profile": "relay_consultation_sensitive", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/sha256", + "key_path": "consultation.artifacts.integration_packs[].sha256", + "path_kind": "property", + "profile": "relay_consultation_internal", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/private_bindings", + "key_path": "consultation.artifacts.private_bindings", + "path_kind": "property", + "profile": "relay_consultation_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/private_bindings/items", + "key_path": "consultation.artifacts.private_bindings[]", + "path_kind": "array_item", + "profile": "relay_consultation_internal", + "purpose_source": "schema_description", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/hash", + "key_path": "consultation.artifacts.private_bindings[].hash", + "path_kind": "property", + "profile": "relay_consultation_sensitive", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/path", + "key_path": "consultation.artifacts.private_bindings[].path", + "path_kind": "property", + "profile": "relay_consultation_sensitive", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/sha256", + "key_path": "consultation.artifacts.private_bindings[].sha256", + "path_kind": "property", + "profile": "relay_consultation_internal", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/public_contracts", + "key_path": "consultation.artifacts.public_contracts", + "path_kind": "property", + "profile": "relay_consultation_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/public_contracts/items", + "key_path": "consultation.artifacts.public_contracts[]", + "path_kind": "array_item", + "profile": "relay_consultation_internal", + "purpose_source": "schema_description", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/hash", + "key_path": "consultation.artifacts.public_contracts[].hash", + "path_kind": "property", + "profile": "relay_consultation_sensitive", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/path", + "key_path": "consultation.artifacts.public_contracts[].path", + "path_kind": "property", + "profile": "relay_consultation_sensitive", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/sha256", + "key_path": "consultation.artifacts.public_contracts[].sha256", + "path_kind": "property", + "profile": "relay_consultation_internal", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/rhai_scripts", + "key_path": "consultation.artifacts.rhai_scripts", + "path_kind": "property", + "profile": "relay_consultation_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/rhai_scripts/items", + "key_path": "consultation.artifacts.rhai_scripts[]", + "path_kind": "array_item", + "profile": "relay_consultation_internal", + "purpose_source": "schema_description", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ConsultationArtifactReferenceConfig/properties/path", + "key_path": "consultation.artifacts.rhai_scripts[].path", + "path_kind": "property", + "profile": "relay_consultation_sensitive", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ConsultationArtifactReferenceConfig/properties/sha256", + "key_path": "consultation.artifacts.rhai_scripts[].sha256", + "path_kind": "property", + "profile": "relay_consultation_internal", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ConsultationConfig/properties/audit_pseudonym_materials", + "key_path": "consultation.audit_pseudonym_materials", + "path_kind": "property", + "profile": "relay_consultation_internal", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AuditPseudonymMaterialCatalogConfig/items", + "key_path": "consultation.audit_pseudonym_materials[]", + "path_kind": "array_item", + "profile": "relay_consultation_internal", + "purpose_source": "schema_description", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AuditPseudonymMaterialConfig/properties/key_id", + "key_path": "consultation.audit_pseudonym_materials[].key_id", + "path_kind": "property", + "profile": "relay_consultation_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AuditPseudonymMaterialConfig/properties/source", + "key_path": "consultation.audit_pseudonym_materials[].source", + "path_kind": "property", + "profile": "relay_consultation_internal", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AuditPseudonymSecretSourceConfig/oneOf/0/properties/name", + "key_path": "consultation.audit_pseudonym_materials[].source.name", + "path_kind": "property", + "profile": "relay_consultation_secret_reference", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AuditPseudonymSecretSourceConfig/oneOf/0/properties/provider", + "key_path": "consultation.audit_pseudonym_materials[].source.provider", + "path_kind": "property", + "profile": "relay_consultation_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ConsultationConfig/properties/authorized_workload", + "key_path": "consultation.authorized_workload", + "path_kind": "property", + "profile": "relay_consultation_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ConsultationWorkloadConfig/properties/audience", + "key_path": "consultation.authorized_workload.audience", + "path_kind": "property", + "profile": "relay_consultation_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ConsultationWorkloadConfig/properties/client_claim_selector", + "key_path": "consultation.authorized_workload.client_claim_selector", + "path_kind": "property", + "profile": "relay_consultation_internal", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ConsultationWorkloadConfig/properties/client_value", + "key_path": "consultation.authorized_workload.client_value", + "path_kind": "property", + "profile": "relay_consultation_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ConsultationWorkloadConfig/properties/principal_id", + "key_path": "consultation.authorized_workload.principal_id", + "path_kind": "property", + "profile": "relay_consultation_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ConsultationConfig/properties/source_credentials", + "key_path": "consultation.source_credentials", + "path_kind": "property", + "profile": "relay_consultation_sensitive", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ConsultationSourceCredentialCatalogConfig/items", + "key_path": "consultation.source_credentials[]", + "path_kind": "array_item", + "profile": "relay_consultation_sensitive", + "purpose_source": "schema_description", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/4/properties/client_id_env", + "key_path": "consultation.source_credentials[].client_id_env", + "path_kind": "property", + "profile": "relay_consultation_secret_reference", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/4/properties/client_secret_env", + "key_path": "consultation.source_credentials[].client_secret_env", + "path_kind": "property", + "profile": "relay_consultation_secret_reference", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/generation", + "key_path": "consultation.source_credentials[].generation", + "path_kind": "property", + "profile": "relay_consultation_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/password_env", + "key_path": "consultation.source_credentials[].password_env", + "path_kind": "property", + "profile": "relay_consultation_secret_reference", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/ref", + "key_path": "consultation.source_credentials[].ref", + "path_kind": "property", + "profile": "relay_consultation_sensitive", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/1/properties/token_env", + "key_path": "consultation.source_credentials[].token_env", + "path_kind": "property", + "profile": "relay_consultation_secret_reference", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/type", + "key_path": "consultation.source_credentials[].type", + "path_kind": "property", + "profile": "relay_consultation_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/username_env", + "key_path": "consultation.source_credentials[].username_env", + "path_kind": "property", + "profile": "relay_consultation_secret_reference", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/2/properties/value_env", + "key_path": "consultation.source_credentials[].value_env", + "path_kind": "property", + "profile": "relay_consultation_secret_reference", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ConsultationConfig/properties/state_plane", + "key_path": "consultation.state_plane", + "path_kind": "property", + "profile": "relay_consultation_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ConsultationStatePlaneConfig/properties/audit_pseudonym_keyring_lock_key", + "key_path": "consultation.state_plane.audit_pseudonym_keyring_lock_key", + "path_kind": "property", + "profile": "relay_consultation_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ConsultationStatePlaneConfig/properties/chain_key_epoch_id", + "key_path": "consultation.state_plane.chain_key_epoch_id", + "path_kind": "property", + "profile": "relay_consultation_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ConsultationStatePlaneConfig/properties/database_url_env", + "key_path": "consultation.state_plane.database_url_env", + "path_kind": "property", + "profile": "relay_consultation_secret_reference", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ConsultationStatePlaneConfig/properties/root_certificate_path", + "key_path": "consultation.state_plane.root_certificate_path", + "path_kind": "property", + "profile": "relay_consultation_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ConsultationStatePlaneConfig/properties/serving_fence_lock_key", + "key_path": "consultation.state_plane.serving_fence_lock_key", + "path_kind": "property", + "profile": "relay_consultation_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/properties/datasets", + "key_path": "datasets", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/properties/datasets/items", + "key_path": "datasets[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/access_rights", + "key_path": "datasets[].access_rights", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/aggregates", + "key_path": "datasets[].aggregates", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/aggregates/items", + "key_path": "datasets[].aggregates[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/access", + "key_path": "datasets[].aggregates[].access", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_only_execution", + "key_path": "datasets[].aggregates[].access.aggregate_only_execution", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_scope", + "key_path": "datasets[].aggregates[].access.aggregate_scope", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateAccessConfig/properties/metadata_scope", + "key_path": "datasets[].aggregates[].access.metadata_scope", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/allowed_filters", + "key_path": "datasets[].aggregates[].allowed_filters", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/allowed_filters/items", + "key_path": "datasets[].aggregates[].allowed_filters[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AllowedFilter/properties/field", + "key_path": "datasets[].aggregates[].allowed_filters[].field", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AllowedFilter/properties/ops", + "key_path": "datasets[].aggregates[].allowed_filters[].ops", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AllowedFilter/properties/ops/items", + "key_path": "datasets[].aggregates[].allowed_filters[].ops[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/default_group_by", + "key_path": "datasets[].aggregates[].default_group_by", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/default_group_by/items", + "key_path": "datasets[].aggregates[].default_group_by[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/description", + "key_path": "datasets[].aggregates[].description", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/dimensions", + "key_path": "datasets[].aggregates[].dimensions", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/dimensions/items", + "key_path": "datasets[].aggregates[].dimensions[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateDimensionConfig/properties/codelist", + "key_path": "datasets[].aggregates[].dimensions[].codelist", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateDimensionConfig/properties/field", + "key_path": "datasets[].aggregates[].dimensions[].field", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateDimensionConfig/properties/id", + "key_path": "datasets[].aggregates[].dimensions[].id", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateDimensionConfig/properties/label", + "key_path": "datasets[].aggregates[].dimensions[].label", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/disclosure_control", + "key_path": "datasets[].aggregates[].disclosure_control", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/method", + "key_path": "datasets[].aggregates[].disclosure_control.method", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/method/items", + "key_path": "datasets[].aggregates[].disclosure_control.method[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/min_cell_size", + "key_path": "datasets[].aggregates[].disclosure_control.min_cell_size", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/min_group_size", + "key_path": "datasets[].aggregates[].disclosure_control.min_group_size", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "override", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/report_suppressed_rows", + "key_path": "datasets[].aggregates[].disclosure_control.report_suppressed_rows", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/suppression", + "key_path": "datasets[].aggregates[].disclosure_control.suppression", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/group_by", + "key_path": "datasets[].aggregates[].group_by", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/group_by/items", + "key_path": "datasets[].aggregates[].group_by[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/id", + "key_path": "datasets[].aggregates[].id", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/indicators", + "key_path": "datasets[].aggregates[].indicators", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/indicators/items", + "key_path": "datasets[].aggregates[].indicators[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/column", + "key_path": "datasets[].aggregates[].indicators[].column", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/decimals", + "key_path": "datasets[].aggregates[].indicators[].decimals", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/definition_uri", + "key_path": "datasets[].aggregates[].indicators[].definition_uri", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/frequency", + "key_path": "datasets[].aggregates[].indicators[].frequency", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/function", + "key_path": "datasets[].aggregates[].indicators[].function", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/id", + "key_path": "datasets[].aggregates[].indicators[].id", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/label", + "key_path": "datasets[].aggregates[].indicators[].label", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_measure", + "key_path": "datasets[].aggregates[].indicators[].unit_measure", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_mult", + "key_path": "datasets[].aggregates[].indicators[].unit_mult", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/joins", + "key_path": "datasets[].aggregates[].joins", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/joins/items", + "key_path": "datasets[].aggregates[].joins[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateJoinConfig/properties/relationship", + "key_path": "datasets[].aggregates[].joins[].relationship", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/measures", + "key_path": "datasets[].aggregates[].measures", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/measures/items", + "key_path": "datasets[].aggregates[].measures[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateMeasure/properties/column", + "key_path": "datasets[].aggregates[].measures[].column", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateMeasure/properties/function", + "key_path": "datasets[].aggregates[].measures[].function", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateMeasure/properties/name", + "key_path": "datasets[].aggregates[].measures[].name", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings", + "key_path": "datasets[].aggregates[].required_filter_bindings", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings/items", + "key_path": "datasets[].aggregates[].required_filter_bindings[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/RequiredFilterBindingConfig/properties/field", + "key_path": "datasets[].aggregates[].required_filter_bindings[].field", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/RequiredFilterBindingConfig/properties/source", + "key_path": "datasets[].aggregates[].required_filter_bindings[].source", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/required_filters", + "key_path": "datasets[].aggregates[].required_filters", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/required_filters/items", + "key_path": "datasets[].aggregates[].required_filters[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/source_entity", + "key_path": "datasets[].aggregates[].source_entity", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/spatial", + "key_path": "datasets[].aggregates[].spatial", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/bbox_fields", + "key_path": "datasets[].aggregates[].spatial.bbox_fields", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_x", + "key_path": "datasets[].aggregates[].spatial.bbox_fields.max_x", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_y", + "key_path": "datasets[].aggregates[].spatial.bbox_fields.max_y", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_x", + "key_path": "datasets[].aggregates[].spatial.bbox_fields.min_x", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_y", + "key_path": "datasets[].aggregates[].spatial.bbox_fields.min_y", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/collection_id", + "key_path": "datasets[].aggregates[].spatial.collection_id", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/dimension", + "key_path": "datasets[].aggregates[].spatial.dimension", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_entity", + "key_path": "datasets[].aggregates[].spatial.geometry_entity", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_field", + "key_path": "datasets[].aggregates[].spatial.geometry_field", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_id_field", + "key_path": "datasets[].aggregates[].spatial.geometry_id_field", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/max_geometry_vertices", + "key_path": "datasets[].aggregates[].spatial.max_geometry_vertices", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/mode", + "key_path": "datasets[].aggregates[].spatial.mode", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/temporal_field", + "key_path": "datasets[].aggregates[].temporal_field", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/title", + "key_path": "datasets[].aggregates[].title", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/applicable_legislation", + "key_path": "datasets[].applicable_legislation", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/applicable_legislation/items", + "key_path": "datasets[].applicable_legislation[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/conforms_to", + "key_path": "datasets[].conforms_to", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/conforms_to/items", + "key_path": "datasets[].conforms_to[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/defaults", + "key_path": "datasets[].defaults", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DatasetDefaultsConfig/properties/materialization", + "key_path": "datasets[].defaults.materialization", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DatasetDefaultsConfig/properties/refresh", + "key_path": "datasets[].defaults.refresh", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/RefreshConfig/oneOf/0/properties/interval", + "key_path": "datasets[].defaults.refresh.interval", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/RefreshConfig/oneOf/0/properties/mode", + "key_path": "datasets[].defaults.refresh.mode", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/description", + "key_path": "datasets[].description", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/entities", + "key_path": "datasets[].entities", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/entities/items", + "key_path": "datasets[].entities[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/access", + "key_path": "datasets[].entities[].access", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EntityAccessConfig/properties/aggregate_scope", + "key_path": "datasets[].entities[].access.aggregate_scope", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EntityAccessConfig/properties/evidence_verification_scope", + "key_path": "datasets[].entities[].access.evidence_verification_scope", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EntityAccessConfig/properties/metadata_scope", + "key_path": "datasets[].entities[].access.metadata_scope", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EntityAccessConfig/properties/read_scope", + "key_path": "datasets[].entities[].access.read_scope", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/aggregates", + "key_path": "datasets[].entities[].aggregates", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/aggregates/items", + "key_path": "datasets[].entities[].aggregates[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/access", + "key_path": "datasets[].entities[].aggregates[].access", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_only_execution", + "key_path": "datasets[].entities[].aggregates[].access.aggregate_only_execution", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_scope", + "key_path": "datasets[].entities[].aggregates[].access.aggregate_scope", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateAccessConfig/properties/metadata_scope", + "key_path": "datasets[].entities[].aggregates[].access.metadata_scope", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/allowed_filters", + "key_path": "datasets[].entities[].aggregates[].allowed_filters", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/allowed_filters/items", + "key_path": "datasets[].entities[].aggregates[].allowed_filters[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AllowedFilter/properties/field", + "key_path": "datasets[].entities[].aggregates[].allowed_filters[].field", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AllowedFilter/properties/ops", + "key_path": "datasets[].entities[].aggregates[].allowed_filters[].ops", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AllowedFilter/properties/ops/items", + "key_path": "datasets[].entities[].aggregates[].allowed_filters[].ops[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/default_group_by", + "key_path": "datasets[].entities[].aggregates[].default_group_by", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/default_group_by/items", + "key_path": "datasets[].entities[].aggregates[].default_group_by[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/description", + "key_path": "datasets[].entities[].aggregates[].description", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/dimensions", + "key_path": "datasets[].entities[].aggregates[].dimensions", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/dimensions/items", + "key_path": "datasets[].entities[].aggregates[].dimensions[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateDimensionConfig/properties/codelist", + "key_path": "datasets[].entities[].aggregates[].dimensions[].codelist", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateDimensionConfig/properties/field", + "key_path": "datasets[].entities[].aggregates[].dimensions[].field", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateDimensionConfig/properties/id", + "key_path": "datasets[].entities[].aggregates[].dimensions[].id", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateDimensionConfig/properties/label", + "key_path": "datasets[].entities[].aggregates[].dimensions[].label", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/disclosure_control", + "key_path": "datasets[].entities[].aggregates[].disclosure_control", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/method", + "key_path": "datasets[].entities[].aggregates[].disclosure_control.method", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/method/items", + "key_path": "datasets[].entities[].aggregates[].disclosure_control.method[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/min_cell_size", + "key_path": "datasets[].entities[].aggregates[].disclosure_control.min_cell_size", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/min_group_size", + "key_path": "datasets[].entities[].aggregates[].disclosure_control.min_group_size", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "override", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/report_suppressed_rows", + "key_path": "datasets[].entities[].aggregates[].disclosure_control.report_suppressed_rows", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/suppression", + "key_path": "datasets[].entities[].aggregates[].disclosure_control.suppression", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/group_by", + "key_path": "datasets[].entities[].aggregates[].group_by", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/group_by/items", + "key_path": "datasets[].entities[].aggregates[].group_by[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/id", + "key_path": "datasets[].entities[].aggregates[].id", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/indicators", + "key_path": "datasets[].entities[].aggregates[].indicators", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/indicators/items", + "key_path": "datasets[].entities[].aggregates[].indicators[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/column", + "key_path": "datasets[].entities[].aggregates[].indicators[].column", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/decimals", + "key_path": "datasets[].entities[].aggregates[].indicators[].decimals", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/definition_uri", + "key_path": "datasets[].entities[].aggregates[].indicators[].definition_uri", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/frequency", + "key_path": "datasets[].entities[].aggregates[].indicators[].frequency", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/function", + "key_path": "datasets[].entities[].aggregates[].indicators[].function", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/id", + "key_path": "datasets[].entities[].aggregates[].indicators[].id", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/label", + "key_path": "datasets[].entities[].aggregates[].indicators[].label", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_measure", + "key_path": "datasets[].entities[].aggregates[].indicators[].unit_measure", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_mult", + "key_path": "datasets[].entities[].aggregates[].indicators[].unit_mult", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/joins", + "key_path": "datasets[].entities[].aggregates[].joins", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/joins/items", + "key_path": "datasets[].entities[].aggregates[].joins[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateJoinConfig/properties/relationship", + "key_path": "datasets[].entities[].aggregates[].joins[].relationship", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/measures", + "key_path": "datasets[].entities[].aggregates[].measures", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/measures/items", + "key_path": "datasets[].entities[].aggregates[].measures[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateMeasure/properties/column", + "key_path": "datasets[].entities[].aggregates[].measures[].column", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateMeasure/properties/function", + "key_path": "datasets[].entities[].aggregates[].measures[].function", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateMeasure/properties/name", + "key_path": "datasets[].entities[].aggregates[].measures[].name", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings", + "key_path": "datasets[].entities[].aggregates[].required_filter_bindings", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings/items", + "key_path": "datasets[].entities[].aggregates[].required_filter_bindings[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/RequiredFilterBindingConfig/properties/field", + "key_path": "datasets[].entities[].aggregates[].required_filter_bindings[].field", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/RequiredFilterBindingConfig/properties/source", + "key_path": "datasets[].entities[].aggregates[].required_filter_bindings[].source", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/required_filters", + "key_path": "datasets[].entities[].aggregates[].required_filters", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/required_filters/items", + "key_path": "datasets[].entities[].aggregates[].required_filters[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/source_entity", + "key_path": "datasets[].entities[].aggregates[].source_entity", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/spatial", + "key_path": "datasets[].entities[].aggregates[].spatial", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/bbox_fields", + "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_x", + "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields.max_x", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_y", + "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields.max_y", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_x", + "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields.min_x", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_y", + "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields.min_y", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/collection_id", + "key_path": "datasets[].entities[].aggregates[].spatial.collection_id", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/dimension", + "key_path": "datasets[].entities[].aggregates[].spatial.dimension", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_entity", + "key_path": "datasets[].entities[].aggregates[].spatial.geometry_entity", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_field", + "key_path": "datasets[].entities[].aggregates[].spatial.geometry_field", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_id_field", + "key_path": "datasets[].entities[].aggregates[].spatial.geometry_id_field", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/max_geometry_vertices", + "key_path": "datasets[].entities[].aggregates[].spatial.max_geometry_vertices", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/mode", + "key_path": "datasets[].entities[].aggregates[].spatial.mode", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/temporal_field", + "key_path": "datasets[].entities[].aggregates[].temporal_field", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/title", + "key_path": "datasets[].entities[].aggregates[].title", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/api", + "key_path": "datasets[].entities[].api", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EntityApiConfig/properties/allowed_expansions", + "key_path": "datasets[].entities[].api.allowed_expansions", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EntityApiConfig/properties/allowed_expansions/items", + "key_path": "datasets[].entities[].api.allowed_expansions[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EntityApiConfig/properties/allowed_filters", + "key_path": "datasets[].entities[].api.allowed_filters", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EntityApiConfig/properties/allowed_filters/items", + "key_path": "datasets[].entities[].api.allowed_filters[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AllowedFilter/properties/field", + "key_path": "datasets[].entities[].api.allowed_filters[].field", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AllowedFilter/properties/ops", + "key_path": "datasets[].entities[].api.allowed_filters[].ops", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AllowedFilter/properties/ops/items", + "key_path": "datasets[].entities[].api.allowed_filters[].ops[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EntityApiConfig/properties/default_limit", + "key_path": "datasets[].entities[].api.default_limit", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EntityApiConfig/properties/governed_policy", + "key_path": "datasets[].entities[].api.governed_policy", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/GovernedPolicyConfig/properties/allowed_assurance", + "key_path": "datasets[].entities[].api.governed_policy.allowed_assurance", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/GovernedPolicyConfig/properties/allowed_assurance/items", + "key_path": "datasets[].entities[].api.governed_policy.allowed_assurance[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/GovernedPolicyConfig/properties/max_source_age_seconds", + "key_path": "datasets[].entities[].api.governed_policy.max_source_age_seconds", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/GovernedPolicyConfig/properties/minimum_assurance", + "key_path": "datasets[].entities[].api.governed_policy.minimum_assurance", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/GovernedPolicyConfig/properties/permitted_jurisdictions", + "key_path": "datasets[].entities[].api.governed_policy.permitted_jurisdictions", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/GovernedPolicyConfig/properties/permitted_jurisdictions/items", + "key_path": "datasets[].entities[].api.governed_policy.permitted_jurisdictions[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/GovernedPolicyConfig/properties/permitted_purposes", + "key_path": "datasets[].entities[].api.governed_policy.permitted_purposes", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/GovernedPolicyConfig/properties/permitted_purposes/items", + "key_path": "datasets[].entities[].api.governed_policy.permitted_purposes[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/GovernedPolicyConfig/properties/redaction_fields", + "key_path": "datasets[].entities[].api.governed_policy.redaction_fields", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/GovernedPolicyConfig/properties/redaction_fields/items", + "key_path": "datasets[].entities[].api.governed_policy.redaction_fields[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/GovernedPolicyConfig/properties/require_consent", + "key_path": "datasets[].entities[].api.governed_policy.require_consent", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/GovernedPolicyConfig/properties/require_legal_basis", + "key_path": "datasets[].entities[].api.governed_policy.require_legal_basis", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/GovernedPolicyConfig/properties/trusted_context", + "key_path": "datasets[].entities[].api.governed_policy.trusted_context", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/GovernedTrustedContextConfig/properties/asserted_assurance", + "key_path": "datasets[].entities[].api.governed_policy.trusted_context.asserted_assurance", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/GovernedTrustedContextConfig/properties/consent_ref", + "key_path": "datasets[].entities[].api.governed_policy.trusted_context.consent_ref", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/GovernedTrustedContextConfig/properties/jurisdiction", + "key_path": "datasets[].entities[].api.governed_policy.trusted_context.jurisdiction", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/GovernedTrustedContextConfig/properties/legal_basis_ref", + "key_path": "datasets[].entities[].api.governed_policy.trusted_context.legal_basis_ref", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/GovernedTrustedContextConfig/properties/source_observed_age_seconds", + "key_path": "datasets[].entities[].api.governed_policy.trusted_context.source_observed_age_seconds", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EntityApiConfig/properties/max_limit", + "key_path": "datasets[].entities[].api.max_limit", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EntityApiConfig/properties/require_purpose_header", + "key_path": "datasets[].entities[].api.require_purpose_header", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EntityApiConfig/properties/required_filter_bindings", + "key_path": "datasets[].entities[].api.required_filter_bindings", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EntityApiConfig/properties/required_filter_bindings/items", + "key_path": "datasets[].entities[].api.required_filter_bindings[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/RequiredFilterBindingConfig/properties/field", + "key_path": "datasets[].entities[].api.required_filter_bindings[].field", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/RequiredFilterBindingConfig/properties/source", + "key_path": "datasets[].entities[].api.required_filter_bindings[].source", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EntityApiConfig/properties/required_filters", + "key_path": "datasets[].entities[].api.required_filters", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EntityApiConfig/properties/required_filters/items", + "key_path": "datasets[].entities[].api.required_filters[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/attribute_release_profiles", + "key_path": "datasets[].entities[].attribute_release_profiles", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/attribute_release_profiles/items", + "key_path": "datasets[].entities[].attribute_release_profiles[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AttributeReleaseProfile/properties/claims", + "key_path": "datasets[].entities[].attribute_release_profiles[].claims", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AttributeReleaseProfile/properties/claims/items", + "key_path": "datasets[].entities[].attribute_release_profiles[].claims[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ReleaseClaimConfig/properties/expression", + "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].expression", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ReleaseExpressionConfig/properties/cel", + "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].expression.cel", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ReleaseClaimConfig/properties/format", + "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].format", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ReleaseClaimConfig/properties/locale", + "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].locale", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ReleaseClaimConfig/properties/name", + "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].name", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ReleaseClaimConfig/properties/required", + "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].required", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ReleaseClaimConfig/properties/sensitivity", + "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].sensitivity", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ReleaseClaimConfig/properties/source_field", + "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].source_field", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AttributeReleaseProfile/properties/description", + "key_path": "datasets[].entities[].attribute_release_profiles[].description", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AttributeReleaseProfile/properties/id", + "key_path": "datasets[].entities[].attribute_release_profiles[].id", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AttributeReleaseProfile/properties/purpose", + "key_path": "datasets[].entities[].attribute_release_profiles[].purpose", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AttributeReleaseProfile/properties/release_conditions", + "key_path": "datasets[].entities[].attribute_release_profiles[].release_conditions", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ReleaseConditionsConfig/properties/expression", + "key_path": "datasets[].entities[].attribute_release_profiles[].release_conditions.expression", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ReleaseExpressionConfig/properties/cel", + "key_path": "datasets[].entities[].attribute_release_profiles[].release_conditions.expression.cel", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AttributeReleaseProfile/properties/release_scope", + "key_path": "datasets[].entities[].attribute_release_profiles[].release_scope", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AttributeReleaseProfile/properties/response", + "key_path": "datasets[].entities[].attribute_release_profiles[].response", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ReleaseResponseConfig/properties/include_source_metadata", + "key_path": "datasets[].entities[].attribute_release_profiles[].response.include_source_metadata", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AttributeReleaseProfile/properties/subject", + "key_path": "datasets[].entities[].attribute_release_profiles[].subject", + "path_kind": "property", + "profile": "relay_datasets_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ReleaseSubjectConfig/properties/id_type", + "key_path": "datasets[].entities[].attribute_release_profiles[].subject.id_type", + "path_kind": "property", + "profile": "relay_datasets_sensitive", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ReleaseSubjectConfig/properties/source_field", + "key_path": "datasets[].entities[].attribute_release_profiles[].subject.source_field", + "path_kind": "property", + "profile": "relay_datasets_sensitive", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AttributeReleaseProfile/properties/title", + "key_path": "datasets[].entities[].attribute_release_profiles[].title", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AttributeReleaseProfile/properties/version", + "key_path": "datasets[].entities[].attribute_release_profiles[].version", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/concept_uri", + "key_path": "datasets[].entities[].concept_uri", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/description", + "key_path": "datasets[].entities[].description", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/fields", + "key_path": "datasets[].entities[].fields", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/fields/items", + "key_path": "datasets[].entities[].fields[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EntityFieldConfig/properties/codelist", + "key_path": "datasets[].entities[].fields[].codelist", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EntityFieldConfig/properties/concept_uri", + "key_path": "datasets[].entities[].fields[].concept_uri", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EntityFieldConfig/properties/from", + "key_path": "datasets[].entities[].fields[].from", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EntityFieldConfig/properties/language", + "key_path": "datasets[].entities[].fields[].language", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EntityFieldConfig/properties/name", + "key_path": "datasets[].entities[].fields[].name", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EntityFieldConfig/properties/sensitive", + "key_path": "datasets[].entities[].fields[].sensitive", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EntityFieldConfig/properties/unit", + "key_path": "datasets[].entities[].fields[].unit", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/name", + "key_path": "datasets[].entities[].name", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/relationships", + "key_path": "datasets[].entities[].relationships", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/relationships/items", + "key_path": "datasets[].entities[].relationships[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EntityRelationshipConfig/properties/concept_uri", + "key_path": "datasets[].entities[].relationships[].concept_uri", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EntityRelationshipConfig/properties/foreign_key", + "key_path": "datasets[].entities[].relationships[].foreign_key", + "path_kind": "property", + "profile": "relay_datasets_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EntityRelationshipConfig/properties/kind", + "key_path": "datasets[].entities[].relationships[].kind", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EntityRelationshipConfig/properties/name", + "key_path": "datasets[].entities[].relationships[].name", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EntityRelationshipConfig/properties/target", + "key_path": "datasets[].entities[].relationships[].target", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/spatial", + "key_path": "datasets[].entities[].spatial", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EntitySpatialConfig/properties/bbox_fields", + "key_path": "datasets[].entities[].spatial.bbox_fields", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_x", + "key_path": "datasets[].entities[].spatial.bbox_fields.max_x", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_y", + "key_path": "datasets[].entities[].spatial.bbox_fields.max_y", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_x", + "key_path": "datasets[].entities[].spatial.bbox_fields.min_x", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_y", + "key_path": "datasets[].entities[].spatial.bbox_fields.min_y", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EntitySpatialConfig/properties/collection_id", + "key_path": "datasets[].entities[].spatial.collection_id", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EntitySpatialConfig/properties/datetime_field", + "key_path": "datasets[].entities[].spatial.datetime_field", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EntitySpatialConfig/properties/description", + "key_path": "datasets[].entities[].spatial.description", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EntitySpatialConfig/properties/geometry", + "key_path": "datasets[].entities[].spatial.geometry", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SpatialGeometryConfig/oneOf/0/properties/crs", + "key_path": "datasets[].entities[].spatial.geometry.crs", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SpatialGeometryConfig/oneOf/1/properties/field", + "key_path": "datasets[].entities[].spatial.geometry.field", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SpatialGeometryConfig/oneOf/0/properties/kind", + "key_path": "datasets[].entities[].spatial.geometry.kind", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SpatialGeometryConfig/oneOf/0/properties/latitude_field", + "key_path": "datasets[].entities[].spatial.geometry.latitude_field", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SpatialGeometryConfig/oneOf/0/properties/longitude_field", + "key_path": "datasets[].entities[].spatial.geometry.longitude_field", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EntitySpatialConfig/properties/max_bbox_degrees", + "key_path": "datasets[].entities[].spatial.max_bbox_degrees", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EntitySpatialConfig/properties/max_geometry_vertices", + "key_path": "datasets[].entities[].spatial.max_geometry_vertices", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EntitySpatialConfig/properties/title", + "key_path": "datasets[].entities[].spatial.title", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/table", + "key_path": "datasets[].entities[].table", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/title", + "key_path": "datasets[].entities[].title", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/id", + "key_path": "datasets[].id", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/owner", + "key_path": "datasets[].owner", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/public_services", + "key_path": "datasets[].public_services", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/public_services/items", + "key_path": "datasets[].public_services[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/PublicServiceConfig/properties/description", + "key_path": "datasets[].public_services[].description", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/PublicServiceConfig/properties/id", + "key_path": "datasets[].public_services[].id", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/PublicServiceConfig/properties/title", + "key_path": "datasets[].public_services[].title", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/sensitivity", + "key_path": "datasets[].sensitivity", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/spatial_coverage", + "key_path": "datasets[].spatial_coverage", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/status", + "key_path": "datasets[].status", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "override", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/tables", + "key_path": "datasets[].tables", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/tables/items", + "key_path": "datasets[].tables[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ResourceConfig/properties/access", + "key_path": "datasets[].tables[].access", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ResourceAccessConfig/properties/aggregate_scope", + "key_path": "datasets[].tables[].access.aggregate_scope", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ResourceAccessConfig/properties/metadata_scope", + "key_path": "datasets[].tables[].access.metadata_scope", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ResourceConfig/properties/aggregates", + "key_path": "datasets[].tables[].aggregates", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ResourceConfig/properties/aggregates/items", + "key_path": "datasets[].tables[].aggregates[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/access", + "key_path": "datasets[].tables[].aggregates[].access", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_only_execution", + "key_path": "datasets[].tables[].aggregates[].access.aggregate_only_execution", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_scope", + "key_path": "datasets[].tables[].aggregates[].access.aggregate_scope", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateAccessConfig/properties/metadata_scope", + "key_path": "datasets[].tables[].aggregates[].access.metadata_scope", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/allowed_filters", + "key_path": "datasets[].tables[].aggregates[].allowed_filters", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/allowed_filters/items", + "key_path": "datasets[].tables[].aggregates[].allowed_filters[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AllowedFilter/properties/field", + "key_path": "datasets[].tables[].aggregates[].allowed_filters[].field", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AllowedFilter/properties/ops", + "key_path": "datasets[].tables[].aggregates[].allowed_filters[].ops", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AllowedFilter/properties/ops/items", + "key_path": "datasets[].tables[].aggregates[].allowed_filters[].ops[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/default_group_by", + "key_path": "datasets[].tables[].aggregates[].default_group_by", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/default_group_by/items", + "key_path": "datasets[].tables[].aggregates[].default_group_by[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/description", + "key_path": "datasets[].tables[].aggregates[].description", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/dimensions", + "key_path": "datasets[].tables[].aggregates[].dimensions", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/dimensions/items", + "key_path": "datasets[].tables[].aggregates[].dimensions[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateDimensionConfig/properties/codelist", + "key_path": "datasets[].tables[].aggregates[].dimensions[].codelist", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateDimensionConfig/properties/field", + "key_path": "datasets[].tables[].aggregates[].dimensions[].field", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateDimensionConfig/properties/id", + "key_path": "datasets[].tables[].aggregates[].dimensions[].id", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateDimensionConfig/properties/label", + "key_path": "datasets[].tables[].aggregates[].dimensions[].label", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/disclosure_control", + "key_path": "datasets[].tables[].aggregates[].disclosure_control", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/method", + "key_path": "datasets[].tables[].aggregates[].disclosure_control.method", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/method/items", + "key_path": "datasets[].tables[].aggregates[].disclosure_control.method[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/min_cell_size", + "key_path": "datasets[].tables[].aggregates[].disclosure_control.min_cell_size", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/min_group_size", + "key_path": "datasets[].tables[].aggregates[].disclosure_control.min_group_size", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "override", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/report_suppressed_rows", + "key_path": "datasets[].tables[].aggregates[].disclosure_control.report_suppressed_rows", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/suppression", + "key_path": "datasets[].tables[].aggregates[].disclosure_control.suppression", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/group_by", + "key_path": "datasets[].tables[].aggregates[].group_by", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/group_by/items", + "key_path": "datasets[].tables[].aggregates[].group_by[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/id", + "key_path": "datasets[].tables[].aggregates[].id", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/indicators", + "key_path": "datasets[].tables[].aggregates[].indicators", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/indicators/items", + "key_path": "datasets[].tables[].aggregates[].indicators[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/column", + "key_path": "datasets[].tables[].aggregates[].indicators[].column", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/decimals", + "key_path": "datasets[].tables[].aggregates[].indicators[].decimals", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/definition_uri", + "key_path": "datasets[].tables[].aggregates[].indicators[].definition_uri", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/frequency", + "key_path": "datasets[].tables[].aggregates[].indicators[].frequency", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/function", + "key_path": "datasets[].tables[].aggregates[].indicators[].function", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/id", + "key_path": "datasets[].tables[].aggregates[].indicators[].id", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/label", + "key_path": "datasets[].tables[].aggregates[].indicators[].label", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_measure", + "key_path": "datasets[].tables[].aggregates[].indicators[].unit_measure", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_mult", + "key_path": "datasets[].tables[].aggregates[].indicators[].unit_mult", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/joins", + "key_path": "datasets[].tables[].aggregates[].joins", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/joins/items", + "key_path": "datasets[].tables[].aggregates[].joins[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateJoinConfig/properties/relationship", + "key_path": "datasets[].tables[].aggregates[].joins[].relationship", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/measures", + "key_path": "datasets[].tables[].aggregates[].measures", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/measures/items", + "key_path": "datasets[].tables[].aggregates[].measures[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateMeasure/properties/column", + "key_path": "datasets[].tables[].aggregates[].measures[].column", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateMeasure/properties/function", + "key_path": "datasets[].tables[].aggregates[].measures[].function", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateMeasure/properties/name", + "key_path": "datasets[].tables[].aggregates[].measures[].name", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings", + "key_path": "datasets[].tables[].aggregates[].required_filter_bindings", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings/items", + "key_path": "datasets[].tables[].aggregates[].required_filter_bindings[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/RequiredFilterBindingConfig/properties/field", + "key_path": "datasets[].tables[].aggregates[].required_filter_bindings[].field", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/RequiredFilterBindingConfig/properties/source", + "key_path": "datasets[].tables[].aggregates[].required_filter_bindings[].source", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/required_filters", + "key_path": "datasets[].tables[].aggregates[].required_filters", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/required_filters/items", + "key_path": "datasets[].tables[].aggregates[].required_filters[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/source_entity", + "key_path": "datasets[].tables[].aggregates[].source_entity", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/spatial", + "key_path": "datasets[].tables[].aggregates[].spatial", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/bbox_fields", + "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_x", + "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields.max_x", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_y", + "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields.max_y", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_x", + "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields.min_x", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_y", + "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields.min_y", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/collection_id", + "key_path": "datasets[].tables[].aggregates[].spatial.collection_id", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/dimension", + "key_path": "datasets[].tables[].aggregates[].spatial.dimension", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_entity", + "key_path": "datasets[].tables[].aggregates[].spatial.geometry_entity", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_field", + "key_path": "datasets[].tables[].aggregates[].spatial.geometry_field", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_id_field", + "key_path": "datasets[].tables[].aggregates[].spatial.geometry_id_field", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/max_geometry_vertices", + "key_path": "datasets[].tables[].aggregates[].spatial.max_geometry_vertices", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/mode", + "key_path": "datasets[].tables[].aggregates[].spatial.mode", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/temporal_field", + "key_path": "datasets[].tables[].aggregates[].temporal_field", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/title", + "key_path": "datasets[].tables[].aggregates[].title", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ResourceConfig/properties/api", + "key_path": "datasets[].tables[].api", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ResourceApiConfig/properties/allowed_filters", + "key_path": "datasets[].tables[].api.allowed_filters", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ResourceApiConfig/properties/allowed_filters/items", + "key_path": "datasets[].tables[].api.allowed_filters[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AllowedFilter/properties/field", + "key_path": "datasets[].tables[].api.allowed_filters[].field", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AllowedFilter/properties/ops", + "key_path": "datasets[].tables[].api.allowed_filters[].ops", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/AllowedFilter/properties/ops/items", + "key_path": "datasets[].tables[].api.allowed_filters[].ops[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ResourceApiConfig/properties/default_limit", + "key_path": "datasets[].tables[].api.default_limit", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ResourceApiConfig/properties/max_limit", + "key_path": "datasets[].tables[].api.max_limit", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ResourceApiConfig/properties/require_purpose_header", + "key_path": "datasets[].tables[].api.require_purpose_header", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ResourceConfig/properties/id", + "key_path": "datasets[].tables[].id", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ResourceConfig/properties/materialization", + "key_path": "datasets[].tables[].materialization", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ResourceConfig/properties/primary_key", + "key_path": "datasets[].tables[].primary_key", + "path_kind": "property", + "profile": "relay_datasets_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ResourceConfig/properties/refresh", + "key_path": "datasets[].tables[].refresh", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/RefreshConfig/oneOf/0/properties/interval", + "key_path": "datasets[].tables[].refresh.interval", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/RefreshConfig/oneOf/0/properties/mode", + "key_path": "datasets[].tables[].refresh.mode", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ResourceConfig/properties/schema", + "key_path": "datasets[].tables[].schema", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SchemaConfig/properties/fields", + "key_path": "datasets[].tables[].schema.fields", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SchemaConfig/properties/fields/items", + "key_path": "datasets[].tables[].schema.fields[]", + "path_kind": "array_item", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/FieldConfig/properties/codelist", + "key_path": "datasets[].tables[].schema.fields[].codelist", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/FieldConfig/properties/concept_uri", + "key_path": "datasets[].tables[].schema.fields[].concept_uri", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/FieldConfig/properties/language", + "key_path": "datasets[].tables[].schema.fields[].language", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/FieldConfig/properties/name", + "key_path": "datasets[].tables[].schema.fields[].name", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/FieldConfig/properties/nullable", + "key_path": "datasets[].tables[].schema.fields[].nullable", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/FieldConfig/properties/sensitive", + "key_path": "datasets[].tables[].schema.fields[].sensitive", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/FieldConfig/properties/type", + "key_path": "datasets[].tables[].schema.fields[].type", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/FieldConfig/properties/unit", + "key_path": "datasets[].tables[].schema.fields[].unit", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SchemaConfig/properties/strict", + "key_path": "datasets[].tables[].schema.strict", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ResourceConfig/properties/source", + "key_path": "datasets[].tables[].source", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SourceConfig/oneOf/1/properties/change_token_sql", + "key_path": "datasets[].tables[].source.change_token_sql", + "path_kind": "property", + "profile": "relay_datasets_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SourceConfig/oneOf/1/properties/connect_timeout", + "key_path": "datasets[].tables[].source.connect_timeout", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SourceConfig/oneOf/1/properties/connection_env", + "key_path": "datasets[].tables[].source.connection_env", + "path_kind": "property", + "profile": "relay_datasets_secret_reference", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SourceConfig/oneOf/0/properties/format", + "key_path": "datasets[].tables[].source.format", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ResourceFormatConfig/properties/csv", + "key_path": "datasets[].tables[].source.format.csv", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/CsvFormatConfig/properties/delimiter", + "key_path": "datasets[].tables[].source.format.csv.delimiter", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/CsvFormatConfig/properties/header_row", + "key_path": "datasets[].tables[].source.format.csv.header_row", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/CsvFormatConfig/properties/quote", + "key_path": "datasets[].tables[].source.format.csv.quote", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ResourceFormatConfig/properties/parquet", + "key_path": "datasets[].tables[].source.format.parquet", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ResourceFormatConfig/properties/xlsx", + "key_path": "datasets[].tables[].source.format.xlsx", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/XlsxFormatConfig/properties/data_range", + "key_path": "datasets[].tables[].source.format.xlsx.data_range", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/XlsxFormatConfig/properties/header_row", + "key_path": "datasets[].tables[].source.format.xlsx.header_row", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/XlsxFormatConfig/properties/sheet", + "key_path": "datasets[].tables[].source.format.xlsx.sheet", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SourceConfig/oneOf/0/properties/path", + "key_path": "datasets[].tables[].source.path", + "path_kind": "property", + "profile": "relay_datasets_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SourceConfig/oneOf/1/properties/query", + "key_path": "datasets[].tables[].source.query", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SourceConfig/oneOf/1/properties/query_timeout", + "key_path": "datasets[].tables[].source.query_timeout", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SourceConfig/oneOf/1/properties/table", + "key_path": "datasets[].tables[].source.table", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/PostgresTableConfig/properties/name", + "key_path": "datasets[].tables[].source.table.name", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/PostgresTableConfig/properties/schema", + "key_path": "datasets[].tables[].source.table.schema", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SourceConfig/oneOf/0/properties/type", + "key_path": "datasets[].tables[].source.type", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/title", + "key_path": "datasets[].title", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/update_frequency", + "key_path": "datasets[].update_frequency", + "path_kind": "property", + "profile": "relay_datasets_internal", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/properties/deployment", + "key_path": "deployment", + "path_kind": "property", + "profile": "relay_deployment_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DeploymentConfig/properties/evidence", + "key_path": "deployment.evidence", + "path_kind": "property", + "profile": "relay_deployment_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DeploymentEvidenceConfig/properties/api_key_rotation", + "key_path": "deployment.evidence.api_key_rotation", + "path_kind": "property", + "profile": "relay_deployment_sensitive", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_ack_cursor_path", + "key_path": "deployment.evidence.audit_ack_cursor_path", + "path_kind": "property", + "profile": "relay_deployment_sensitive", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_ack_max_age_secs", + "key_path": "deployment.evidence.audit_ack_max_age_secs", + "path_kind": "property", + "profile": "relay_deployment_internal", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_offhost_shipping", + "key_path": "deployment.evidence.audit_offhost_shipping", + "path_kind": "property", + "profile": "relay_deployment_internal", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DeploymentEvidenceConfig/properties/ingress_rate_limit", + "key_path": "deployment.evidence.ingress_rate_limit", + "path_kind": "property", + "profile": "relay_deployment_internal", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DeploymentConfig/properties/profile", + "key_path": "deployment.profile", + "path_kind": "property", + "profile": "relay_deployment_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DeploymentConfig/properties/waivers", + "key_path": "deployment.waivers", + "path_kind": "property", + "profile": "relay_deployment_internal", + "purpose_source": "schema_description", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DeploymentConfig/properties/waivers/items", + "key_path": "deployment.waivers[]", + "path_kind": "array_item", + "profile": "relay_deployment_internal", + "purpose_source": "schema_description", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DeploymentWaiverConfig/properties/expires", + "key_path": "deployment.waivers[].expires", + "path_kind": "property", + "profile": "relay_deployment_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DeploymentWaiverConfig/properties/finding", + "key_path": "deployment.waivers[].finding", + "path_kind": "property", + "profile": "relay_deployment_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DeploymentWaiverConfig/properties/reference", + "key_path": "deployment.waivers[].reference", + "path_kind": "property", + "profile": "relay_deployment_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/DeploymentWaiverConfig/properties/summary", + "key_path": "deployment.waivers[].summary", + "path_kind": "property", + "profile": "relay_deployment_internal", + "purpose_source": "schema_description", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/properties/instance", + "key_path": "instance", + "path_kind": "property", + "profile": "relay_instance_internal", + "purpose_source": "schema_description", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/InstanceConfig/properties/environment", + "key_path": "instance.environment", + "path_kind": "property", + "profile": "relay_instance_public", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/InstanceConfig/properties/id", + "key_path": "instance.id", + "path_kind": "property", + "profile": "relay_instance_public", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/InstanceConfig/properties/jurisdiction", + "key_path": "instance.jurisdiction", + "path_kind": "property", + "profile": "relay_instance_public", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/InstanceConfig/properties/owner", + "key_path": "instance.owner", + "path_kind": "property", + "profile": "relay_instance_public", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/properties/metadata", + "key_path": "metadata", + "path_kind": "property", + "profile": "relay_metadata_internal", + "purpose_source": "schema_description", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/MetadataConfig/properties/ecosystem_binding", + "key_path": "metadata.ecosystem_binding", + "path_kind": "property", + "profile": "relay_metadata_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EcosystemBindingSelectorConfig/properties/id", + "key_path": "metadata.ecosystem_binding.id", + "path_kind": "property", + "profile": "relay_metadata_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/EcosystemBindingSelectorConfig/properties/version", + "key_path": "metadata.ecosystem_binding.version", + "path_kind": "property", + "profile": "relay_metadata_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/MetadataConfig/properties/source", + "key_path": "metadata.source", + "path_kind": "property", + "profile": "relay_metadata_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/MetadataSourceConfig/properties/digest", + "key_path": "metadata.source.digest", + "path_kind": "property", + "profile": "relay_metadata_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/MetadataSourceConfig/properties/path", + "key_path": "metadata.source.path", + "path_kind": "property", + "profile": "relay_metadata_sensitive", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/properties/server", + "key_path": "server", + "path_kind": "property", + "profile": "relay_server_internal", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ServerConfig/properties/admin_bind", + "key_path": "server.admin_bind", + "path_kind": "property", + "profile": "relay_server_sensitive", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ServerConfig/properties/bind", + "key_path": "server.bind", + "path_kind": "property", + "profile": "relay_server_internal", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ServerConfig/properties/cache_dir", + "key_path": "server.cache_dir", + "path_kind": "property", + "profile": "relay_server_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ServerConfig/properties/cors", + "key_path": "server.cors", + "path_kind": "property", + "profile": "relay_server_internal", + "purpose_source": "schema_description", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/CorsConfig/properties/allowed_origins", + "key_path": "server.cors.allowed_origins", + "path_kind": "property", + "profile": "relay_server_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/CorsConfig/properties/allowed_origins/items", + "key_path": "server.cors.allowed_origins[]", + "path_kind": "array_item", + "profile": "relay_server_sensitive", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ServerConfig/properties/http1_header_read_timeout", + "key_path": "server.http1_header_read_timeout", + "path_kind": "property", + "profile": "relay_server_internal", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ServerConfig/properties/max_connections", + "key_path": "server.max_connections", + "path_kind": "property", + "profile": "relay_server_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ServerConfig/properties/max_source_file_bytes", + "key_path": "server.max_source_file_bytes", + "path_kind": "property", + "profile": "relay_server_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ServerConfig/properties/openapi_requires_auth", + "key_path": "server.openapi_requires_auth", + "path_kind": "property", + "profile": "relay_server_internal", + "purpose_source": "override", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ServerConfig/properties/request_body_timeout", + "key_path": "server.request_body_timeout", + "path_kind": "property", + "profile": "relay_server_internal", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ServerConfig/properties/request_timeout", + "key_path": "server.request_timeout", + "path_kind": "property", + "profile": "relay_server_internal", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ServerConfig/properties/trust_proxy", + "key_path": "server.trust_proxy", + "path_kind": "property", + "profile": "relay_server_internal", + "purpose_source": "schema_description", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/TrustProxyConfig/properties/enabled", + "key_path": "server.trust_proxy.enabled", + "path_kind": "property", + "profile": "relay_server_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/TrustProxyConfig/properties/trusted_proxies", + "key_path": "server.trust_proxy.trusted_proxies", + "path_kind": "property", + "profile": "relay_server_sensitive", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/TrustProxyConfig/properties/trusted_proxies/items", + "key_path": "server.trust_proxy.trusted_proxies[]", + "path_kind": "array_item", + "profile": "relay_server_sensitive", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/ServerConfig/properties/xlsx_max_file_bytes", + "key_path": "server.xlsx_max_file_bytes", + "path_kind": "property", + "profile": "relay_server_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/properties/standards", + "key_path": "standards", + "path_kind": "property", + "profile": "relay_standards_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/StandardsConfig/properties/spdci", + "key_path": "standards.spdci", + "path_kind": "property", + "profile": "relay_standards_internal", + "purpose_source": "schema_description", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SpdciStandardsConfig/properties/disability_registry", + "key_path": "standards.spdci.disability_registry", + "path_kind": "property", + "profile": "relay_standards_internal", + "purpose_source": "schema_description", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/dataset", + "key_path": "standards.spdci.disability_registry.dataset", + "path_kind": "property", + "profile": "relay_standards_internal", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/disabled_positive_values", + "key_path": "standards.spdci.disability_registry.disabled_positive_values", + "path_kind": "property", + "profile": "relay_standards_internal", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/disabled_positive_values/items", + "key_path": "standards.spdci.disability_registry.disabled_positive_values[]", + "path_kind": "array_item", + "profile": "relay_standards_internal", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/disabled_status_field", + "key_path": "standards.spdci.disability_registry.disabled_status_field", + "path_kind": "property", + "profile": "relay_standards_internal", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/entity", + "key_path": "standards.spdci.disability_registry.entity", + "path_kind": "property", + "profile": "relay_standards_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/query_field", + "key_path": "standards.spdci.disability_registry.query_field", + "path_kind": "property", + "profile": "relay_standards_internal", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/query_key", + "key_path": "standards.spdci.disability_registry.query_key", + "path_kind": "property", + "profile": "relay_standards_sensitive", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SpdciStandardsConfig/properties/registries", + "key_path": "standards.spdci.registries", + "path_kind": "property", + "profile": "relay_standards_internal", + "purpose_source": "profile", + "default_source": "reviewed_runtime_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SpdciStandardsConfig/properties/registries/additionalProperties", + "key_path": "standards.spdci.registries.*", + "path_kind": "map_value", + "profile": "relay_standards_spdci_registries_open_map", + "purpose_source": "schema_description", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SpdciRegistryConfig/properties/dataset", + "key_path": "standards.spdci.registries.*.dataset", + "path_kind": "property", + "profile": "relay_standards_internal", + "purpose_source": "schema_description", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SpdciRegistryConfig/properties/default_limit", + "key_path": "standards.spdci.registries.*.default_limit", + "path_kind": "property", + "profile": "relay_standards_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SpdciRegistryConfig/properties/entity", + "key_path": "standards.spdci.registries.*.entity", + "path_kind": "property", + "profile": "relay_standards_internal", + "purpose_source": "profile", + "default_source": "no_schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SpdciRegistryConfig/properties/expression_fields", + "key_path": "standards.spdci.registries.*.expression_fields", + "path_kind": "property", + "profile": "relay_standards_internal", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SpdciRegistryConfig/properties/expression_fields/additionalProperties", + "key_path": "standards.spdci.registries.*.expression_fields.*", + "path_kind": "map_value", + "profile": "relay_standards_spdci_registries_expression_fields_open_map", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SpdciRegistryConfig/properties/identifiers", + "key_path": "standards.spdci.registries.*.identifiers", + "path_kind": "property", + "profile": "relay_standards_internal", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SpdciRegistryConfig/properties/identifiers/additionalProperties", + "key_path": "standards.spdci.registries.*.identifiers.*", + "path_kind": "map_value", + "profile": "relay_standards_spdci_registries_identifiers_open_map", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SpdciRegistryConfig/properties/record_type", + "key_path": "standards.spdci.registries.*.record_type", + "path_kind": "property", + "profile": "relay_standards_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SpdciRegistryConfig/properties/registry_type", + "key_path": "standards.spdci.registries.*.registry_type", + "path_kind": "property", + "profile": "relay_standards_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SpdciRegistryConfig/properties/response_fields", + "key_path": "standards.spdci.registries.*.response_fields", + "path_kind": "property", + "profile": "relay_standards_internal", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SpdciRegistryConfig/properties/response_fields/additionalProperties", + "key_path": "standards.spdci.registries.*.response_fields.*", + "path_kind": "map_value", + "profile": "relay_standards_spdci_registries_response_fields_open_map", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SpdciRegistryConfig/properties/response_mapping_path", + "key_path": "standards.spdci.registries.*.response_mapping_path", + "path_kind": "property", + "profile": "relay_standards_sensitive", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/$defs/SpdciRegistryConfig/properties/response_schema_path", + "key_path": "standards.spdci.registries.*.response_schema_path", + "path_kind": "property", + "profile": "relay_standards_sensitive", + "purpose_source": "schema_description", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/properties/vocabularies", + "key_path": "vocabularies", + "path_kind": "property", + "profile": "relay_vocabularies_internal", + "purpose_source": "profile", + "default_source": "schema_default", + "schema_facts_reviewed": true + }, + { + "schema": "relay", + "pointer": "/properties/vocabularies/additionalProperties", + "key_path": "vocabularies.*", + "path_kind": "map_value", + "profile": "relay_vocabularies_open_map", + "purpose_source": "profile", + "default_source": "not_applicable", + "schema_facts_reviewed": true + } + ], + "overrides": [ + { + "schema": "relay", + "pointer": "/$defs/AuditConfig/properties/chain", + "key_path": "audit.chain", + "path_kind": "property", + "purpose": "Retains the compatibility switch in the authored contract; Relay audit envelopes remain integrity-chained regardless of this setting." + }, + { + "schema": "relay", + "pointer": "/$defs/AuditConfig/properties/format", + "key_path": "audit.format", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference." + }, + { + "schema": "relay", + "pointer": "/$defs/AuditConfig/oneOf/1/properties/rotate", + "key_path": "audit.rotate", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + { + "schema": "relay", + "pointer": "/$defs/AuthConfig/properties/api_keys", + "key_path": "auth.api_keys", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + { + "schema": "relay", + "pointer": "/$defs/AuthConfig/properties/failure_throttle", + "key_path": "auth.failure_throttle", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + { + "schema": "relay", + "pointer": "/$defs/AuthConfig/properties/oidc", + "key_path": "auth.oidc", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/allowed_algorithms", + "key_path": "auth.oidc.allowed_algorithms", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + { + "schema": "relay", + "pointer": "/$defs/CatalogConfig/properties/participant_id", + "key_path": "catalog.participant_id", + "path_kind": "property", + "purpose": "Identifies the participant in catalog output; when omitted, Relay derives the participant identifier from the reviewed catalog base URL." + }, + { + "schema": "relay", + "pointer": "/properties/config_trust", + "key_path": "config_trust", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "relay", + "pointer": "/properties/consultation", + "key_path": "consultation", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "relay", + "pointer": "/$defs/ConsultationConfig/properties/artifacts", + "key_path": "consultation.artifacts", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "relay", + "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/rhai_scripts", + "key_path": "consultation.artifacts.rhai_scripts", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + { + "schema": "relay", + "pointer": "/$defs/ConsultationConfig/properties/source_credentials", + "key_path": "consultation.source_credentials", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/aggregates", + "key_path": "datasets[].aggregates", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/access", + "key_path": "datasets[].aggregates[].access", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/allowed_filters", + "key_path": "datasets[].aggregates[].allowed_filters", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/dimensions", + "key_path": "datasets[].aggregates[].dimensions", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/min_group_size", + "key_path": "datasets[].aggregates[].disclosure_control.min_group_size", + "path_kind": "property", + "purpose": "Optionally overrides the effective disclosure threshold for grouped results; when omitted, Relay uses the configured cell threshold." + }, + { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/suppression", + "key_path": "datasets[].aggregates[].disclosure_control.suppression", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference." + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/indicators", + "key_path": "datasets[].aggregates[].indicators", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/joins", + "key_path": "datasets[].aggregates[].joins", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/measures", + "key_path": "datasets[].aggregates[].measures", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings", + "key_path": "datasets[].aggregates[].required_filter_bindings", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + { + "schema": "relay", + "pointer": "/$defs/RequiredFilterBindingConfig/properties/source", + "key_path": "datasets[].aggregates[].required_filter_bindings[].source", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference." + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/spatial", + "key_path": "datasets[].aggregates[].spatial", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/bbox_fields", + "key_path": "datasets[].aggregates[].spatial.bbox_fields", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/defaults", + "key_path": "datasets[].defaults", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + { + "schema": "relay", + "pointer": "/$defs/DatasetDefaultsConfig/properties/materialization", + "key_path": "datasets[].defaults.materialization", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "relay", + "pointer": "/$defs/DatasetDefaultsConfig/properties/refresh", + "key_path": "datasets[].defaults.refresh", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/entities", + "key_path": "datasets[].entities", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/aggregates", + "key_path": "datasets[].entities[].aggregates", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/access", + "key_path": "datasets[].entities[].aggregates[].access", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/allowed_filters", + "key_path": "datasets[].entities[].aggregates[].allowed_filters", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/dimensions", + "key_path": "datasets[].entities[].aggregates[].dimensions", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/min_group_size", + "key_path": "datasets[].entities[].aggregates[].disclosure_control.min_group_size", + "path_kind": "property", + "purpose": "Optionally overrides the effective disclosure threshold for grouped results; when omitted, Relay uses the configured cell threshold." + }, + { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/suppression", + "key_path": "datasets[].entities[].aggregates[].disclosure_control.suppression", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference." + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/indicators", + "key_path": "datasets[].entities[].aggregates[].indicators", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/joins", + "key_path": "datasets[].entities[].aggregates[].joins", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/measures", + "key_path": "datasets[].entities[].aggregates[].measures", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings", + "key_path": "datasets[].entities[].aggregates[].required_filter_bindings", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + { + "schema": "relay", + "pointer": "/$defs/RequiredFilterBindingConfig/properties/source", + "key_path": "datasets[].entities[].aggregates[].required_filter_bindings[].source", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference." + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/spatial", + "key_path": "datasets[].entities[].aggregates[].spatial", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/bbox_fields", + "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "relay", + "pointer": "/$defs/EntityApiConfig/properties/allowed_filters", + "key_path": "datasets[].entities[].api.allowed_filters", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + { + "schema": "relay", + "pointer": "/$defs/EntityApiConfig/properties/governed_policy", + "key_path": "datasets[].entities[].api.governed_policy", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "relay", + "pointer": "/$defs/GovernedPolicyConfig/properties/trusted_context", + "key_path": "datasets[].entities[].api.governed_policy.trusted_context", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + { + "schema": "relay", + "pointer": "/$defs/EntityApiConfig/properties/required_filter_bindings", + "key_path": "datasets[].entities[].api.required_filter_bindings", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + { + "schema": "relay", + "pointer": "/$defs/RequiredFilterBindingConfig/properties/source", + "key_path": "datasets[].entities[].api.required_filter_bindings[].source", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference." + }, + { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/attribute_release_profiles", + "key_path": "datasets[].entities[].attribute_release_profiles", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + { + "schema": "relay", + "pointer": "/$defs/ReleaseClaimConfig/properties/expression", + "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].expression", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "relay", + "pointer": "/$defs/ReleaseClaimConfig/properties/sensitivity", + "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].sensitivity", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "relay", + "pointer": "/$defs/AttributeReleaseProfile/properties/release_conditions", + "key_path": "datasets[].entities[].attribute_release_profiles[].release_conditions", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "relay", + "pointer": "/$defs/AttributeReleaseProfile/properties/response", + "key_path": "datasets[].entities[].attribute_release_profiles[].response", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/fields", + "key_path": "datasets[].entities[].fields", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/relationships", + "key_path": "datasets[].entities[].relationships", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/spatial", + "key_path": "datasets[].entities[].spatial", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "relay", + "pointer": "/$defs/EntitySpatialConfig/properties/bbox_fields", + "key_path": "datasets[].entities[].spatial.bbox_fields", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/public_services", + "key_path": "datasets[].public_services", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/status", + "key_path": "datasets[].status", + "path_kind": "property", + "purpose": "Publishes the dataset lifecycle status; when omitted, Relay emits its weakest lifecycle claim instead of inferring a stronger status." + }, + { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/tables", + "key_path": "datasets[].tables", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + { + "schema": "relay", + "pointer": "/$defs/ResourceConfig/properties/access", + "key_path": "datasets[].tables[].access", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + { + "schema": "relay", + "pointer": "/$defs/ResourceConfig/properties/aggregates", + "key_path": "datasets[].tables[].aggregates", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/access", + "key_path": "datasets[].tables[].aggregates[].access", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/allowed_filters", + "key_path": "datasets[].tables[].aggregates[].allowed_filters", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/dimensions", + "key_path": "datasets[].tables[].aggregates[].dimensions", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/min_group_size", + "key_path": "datasets[].tables[].aggregates[].disclosure_control.min_group_size", + "path_kind": "property", + "purpose": "Optionally overrides the effective disclosure threshold for grouped results; when omitted, Relay uses the configured cell threshold." + }, + { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/suppression", + "key_path": "datasets[].tables[].aggregates[].disclosure_control.suppression", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference." + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/indicators", + "key_path": "datasets[].tables[].aggregates[].indicators", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/joins", + "key_path": "datasets[].tables[].aggregates[].joins", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/measures", + "key_path": "datasets[].tables[].aggregates[].measures", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings", + "key_path": "datasets[].tables[].aggregates[].required_filter_bindings", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + { + "schema": "relay", + "pointer": "/$defs/RequiredFilterBindingConfig/properties/source", + "key_path": "datasets[].tables[].aggregates[].required_filter_bindings[].source", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference." + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/spatial", + "key_path": "datasets[].tables[].aggregates[].spatial", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/bbox_fields", + "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "relay", + "pointer": "/$defs/ResourceConfig/properties/api", + "key_path": "datasets[].tables[].api", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + { + "schema": "relay", + "pointer": "/$defs/ResourceApiConfig/properties/allowed_filters", + "key_path": "datasets[].tables[].api.allowed_filters", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + { + "schema": "relay", + "pointer": "/$defs/ResourceConfig/properties/materialization", + "key_path": "datasets[].tables[].materialization", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "relay", + "pointer": "/$defs/ResourceConfig/properties/refresh", + "key_path": "datasets[].tables[].refresh", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "relay", + "pointer": "/$defs/SourceConfig/oneOf/0/properties/format", + "key_path": "datasets[].tables[].source.format", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "relay", + "pointer": "/$defs/ResourceFormatConfig/properties/csv", + "key_path": "datasets[].tables[].source.format.csv", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "relay", + "pointer": "/$defs/ResourceFormatConfig/properties/parquet", + "key_path": "datasets[].tables[].source.format.parquet", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "relay", + "pointer": "/$defs/ResourceFormatConfig/properties/xlsx", + "key_path": "datasets[].tables[].source.format.xlsx", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "relay", + "pointer": "/$defs/SourceConfig/oneOf/1/properties/table", + "key_path": "datasets[].tables[].source.table", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "relay", + "pointer": "/properties/deployment", + "key_path": "deployment", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + { + "schema": "relay", + "pointer": "/$defs/DeploymentConfig/properties/evidence", + "key_path": "deployment.evidence", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + { + "schema": "relay", + "pointer": "/$defs/DeploymentConfig/properties/waivers", + "key_path": "deployment.waivers", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + { + "schema": "relay", + "pointer": "/$defs/DeploymentWaiverConfig/properties/summary", + "key_path": "deployment.waivers[].summary", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference." + }, + { + "schema": "relay", + "pointer": "/properties/instance", + "key_path": "instance", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + { + "schema": "relay", + "pointer": "/properties/metadata", + "key_path": "metadata", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "relay", + "pointer": "/$defs/MetadataConfig/properties/ecosystem_binding", + "key_path": "metadata.ecosystem_binding", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "relay", + "pointer": "/$defs/ServerConfig/properties/cors", + "key_path": "server.cors", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + { + "schema": "relay", + "pointer": "/$defs/ServerConfig/properties/openapi_requires_auth", + "key_path": "server.openapi_requires_auth", + "path_kind": "property", + "purpose": "Keeps the configured OpenAPI document behind Relay authentication unless an operator explicitly accepts unauthenticated contract discovery." + }, + { + "schema": "relay", + "pointer": "/$defs/ServerConfig/properties/trust_proxy", + "key_path": "server.trust_proxy", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + { + "schema": "relay", + "pointer": "/properties/standards", + "key_path": "standards", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + { + "schema": "relay", + "pointer": "/$defs/StandardsConfig/properties/spdci", + "key_path": "standards.spdci", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "relay", + "pointer": "/$defs/SpdciStandardsConfig/properties/disability_registry", + "key_path": "standards.spdci.disability_registry", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + { + "schema": "relay", + "pointer": "/$defs/SpdciStandardsConfig/properties/registries", + "key_path": "standards.spdci.registries", + "path_kind": "property", + "runtime_default_note": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + } + ] +} diff --git a/crates/registry-relay/docs/api.md b/crates/registry-relay/docs/api.md index c98b6d615..43f339f9c 100644 --- a/crates/registry-relay/docs/api.md +++ b/crates/registry-relay/docs/api.md @@ -54,7 +54,17 @@ POST /admin/v1/reload `GET /admin/v1/posture` returns a redacted operations posture document for callers with `registry_relay:ops_read`. Pass `?tier=restricted` only to trusted operations users who need the restricted posture projection. -`POST /admin/v1/reload` reloads every configured source resource and returns a compact `status` plus `counts` summary. It requires `registry_relay:admin`, does not reload startup runtime config, and has a table-specific companion route when you need to reload only one source. Reload-all publishes as one coherent generation: if any source resource cannot prepare, Relay keeps the previous generation active and returns `500` with `status: "failed"`. +`POST /admin/v1/reload` requires `registry_relay:admin` and does not reload startup runtime +config. Relay supports this route only when no configured source is bound to the audited +SnapshotExact materialization coordinator. When any audited SnapshotExact source is configured, +Relay rejects the whole request before opening a source, returns `500` with +`ingest.materialization_failed`, counts every configured resource as failed, and refreshes none. +Use the table-specific route for each intended resource. Current Relay does not provide atomic +multi-materialization reload. + +Without audited SnapshotExact, reload-all prepares every configured source before publication. If +any source cannot prepare, Relay retains the previous coherent ordinary-table generation and +returns `500` with `status: "failed"`. Relay no longer exposes admin config verify, dry-run, or apply routes. Signed config bundles are verified only at boot from the local paths in @@ -171,6 +181,11 @@ The public failure taxonomy is deliberately small: Treat `429` according to its bounded `Retry-After` header. Treat `503` as indeterminate and do not infer whether a source request began. Relay publishes a successful result only after the matching durable completion is committed. +For SnapshotExact, Relay checks snapshot age during execution. A stale snapshot returns +`503 consultation.unavailable` without live source fallback. This request-specific staleness does +not change global `/ready`, which can remain `200`; use a bounded consultation canary to verify the +materialization that a workload depends on. + ## Entity reads Entity routes use configured entity names, not storage table ids. For example: diff --git a/crates/registry-relay/docs/ops.md b/crates/registry-relay/docs/ops.md index e3406f175..5bebec4dd 100644 --- a/crates/registry-relay/docs/ops.md +++ b/crates/registry-relay/docs/ops.md @@ -189,7 +189,7 @@ just build Build a container image: ```sh -scripts/build-image.sh registry-relay: +scripts/build-image.sh registry-relay:local ``` The helper verifies that the local `registry-manifest` build context is a clean @@ -205,7 +205,7 @@ release or lab images must retain the canonical features explicitly: ```sh REGISTRY_RELAY_FEATURES=attribute-release,crosswalk-runtime,ogcapi-edr,spdci-api-standards,standards-cel-mapping \ - scripts/build-image.sh registry-relay:-standards + scripts/build-image.sh registry-relay:local-standards ``` Custom profiles use unique comma-separated Cargo feature names in alphabetical @@ -386,6 +386,7 @@ ownership, migrations, and recovery decision. Treat the following items as one Relay recovery set: +- The immutable registry source inputs and the complete Relay ingest cache. - The complete consultation database, never a selection of state tables. - The Relay release, config, signed artifact closure, and PostgreSQL trust root. - The migration login name plus the owner, runtime, keyring-maintenance, and @@ -394,15 +395,20 @@ Treat the following items as one Relay recovery set: inputs, audit HMAC material, and every retained audit-pseudonym key material. - The recovery timestamp or write-ahead-log position and the last externally acknowledged audit watermark available to the operator. +- Access-controlled evidence that binds each source-input and cache artifact to + the database active pointer and history, exact generation, and restricted + content digest. For a quiesced backup, remove traffic from every Notary that can call this Relay, stop the active Relay fence holder, and prevent another Relay process -from acquiring the fence. Then capture one transactionally consistent database -backup. If Relay and Notary are recovered as one service, either keep both -products quiesced while their backups are taken or use a database-platform -snapshot that gives both product databases one coordinated recovery point. -Independent live backups can leave Notary with a completion that the restored -Relay no longer remembers. +from acquiring the fence. Keep the source inputs and ingest cache unchanged, +then capture them and the transactionally consistent database backup at one +coordinated recovery point. If Relay and Notary are recovered as one service, +either keep both products quiesced while every source, cache, and database +backup is taken or use a platform snapshot that gives every store one +coordinated recovery point. Independent live backups can leave the database +pointer, retained cache generation, source input, or Notary completion out of +agreement. A custom-format `pg_dump` is suitable for a database dedicated to Relay and for restoring an empty database in the same PostgreSQL cluster, where the four @@ -439,6 +445,14 @@ accepted the existing catalog and keyring. A drift response is not a repair instruction. Do not drop either Relay schema or rerun bootstrap with different inputs to make the restore pass. +For audited SnapshotExact, verify the access-controlled recovery record before +startup. Its source-input, ingest-cache, and Relay-database artifact hashes must +bind the same active pointer and history, exact generation, and restricted +content digest. Startup reconciles the database-authoritative publication with +the retained cache before opening a newer source generation. A missing or +mismatched retained generation keeps the dependent SnapshotExact publication +unavailable; do not edit the cache or database pointer to make it pass. + Start one Relay without admitting traffic and require `/healthz` and `/ready` to return `200`. Readiness attests the current catalog, role binding, keyring, fence, quota, audit, and materialization capabilities. It does not prove that a @@ -556,10 +570,26 @@ Refresh modes: - `interval`: reload unconditionally on the configured interval. - `manual`: reload only through an admin request. -The original source file is never modified. When a refresh fails after a successful ingest, Relay -keeps serving the last-good table and `/ready` remains `200`. Relay records the failure against that -resource without advancing the last successful data-load timestamp. A resource with no successful -generation remains not ready. +The original source file is never modified. When an ordinary refresh fails after a successful +ingest, Relay keeps serving the last-good table and `/ready` remains `200`. Relay records the +failure against that resource without advancing the last successful data-load timestamp. A +resource with no successful generation remains not ready. + +Audited SnapshotExact adds a separate fail-closed boundary. If durable publication advances but +local table registration fails, ordinary reads keep their last-good table and global `/ready` +remains `200` when every other readiness dependency is healthy. Relay makes the affected +SnapshotExact publication slot unavailable, so every dependent consultation returns +`consultation.unavailable` instead of using the former handle. A snapshot that exceeds its +execution-time freshness bound also returns `consultation.unavailable`; that per-execution +staleness does not change global `/ready`. The next table-specific refresh reconciles the exact +durable generation and digest before Relay opens the source for a newer generation. + +For project-authored audited SnapshotExact, `retain_generations` accepts `1` +through `16` and includes the active completed cache generation. The setting +defines a bounded recovery set for cache cleanup and readers. It does not +provide an operation that selects an arbitrary retained generation for +rollback. Ordinary resources keep the built-in current and previous cache +generations. This refresh-health signal reports whether Relay can still poll and load a source. It does not establish semantic or domain freshness. A successful refresh can load source data whose business @@ -573,14 +603,25 @@ curl -X POST -H "Authorization: Bearer $ADMIN_API_KEY" \ http://127.0.0.1:8081/admin/v1/datasets/social_registry/tables/individuals_table/reload ``` -Manual source-resource reload: +Manual reload-all for deployments without audited SnapshotExact: ```sh curl -X POST -H "Authorization: Bearer $ADMIN_API_KEY" \ http://127.0.0.1:8081/admin/v1/reload ``` -The reload-all response includes `status` and aggregate `counts` for total, succeeded, and failed resources. Reload-all prepares every configured source resource before publishing any of them; if any resource cannot prepare, Relay keeps the previous coherent generation active and returns HTTP 500 with `status: "failed"`. Inspect the audit and operational logs for the resource-level failure context. This route reloads configured source resources, not startup runtime config. +The reload-all response includes `status` and aggregate `counts` for total, succeeded, and failed +resources. When any source is bound to the audited SnapshotExact materialization coordinator, +Relay rejects the whole reload-all request before source access, counts every configured resource +as failed, returns HTTP `500` with `ingest.materialization_failed`, and refreshes none. Use the +table-specific endpoint for every intended source. Current Relay does not provide atomic +multi-materialization refresh. + +When no audited SnapshotExact source is configured, reload-all prepares every configured source +resource before publishing any of them. If any resource cannot prepare, Relay keeps the previous +coherent ordinary-table generation active and returns HTTP `500` with `status: "failed"`. Inspect +the audit and operational logs for the resource-level failure context. This route reloads +configured source resources, not startup runtime config. ## Admin posture and config bundles @@ -704,6 +745,59 @@ Recommended scrape posture: ## Troubleshooting +### Startup diagnostics and generated input ownership + +Relay startup failures cross the process boundary as one product-owned +`relay.startup.*` code with static meaning and remediation. The terminal failure +line remains visible when `RUST_LOG=off`. Listener codes identify the owning +field and a closed bind-failure category without printing the configured +address, port, service identity, or operating-system error: + +- `relay.startup.data_listener_address_in_use`, + `relay.startup.data_listener_permission_denied`, and + `relay.startup.data_listener_unavailable` refer to `server.bind`. +- `relay.startup.admin_listener_address_in_use`, + `relay.startup.admin_listener_permission_denied`, and + `relay.startup.admin_listener_unavailable` refer to `server.admin_bind`. + +Configuration loading is classified by the safe phase that failed: + +- `relay.startup.config_source_unavailable` covers an unreadable `--config` + source or configured split metadata source. +- `relay.startup.config_environment_binding_rejected` covers unsafe or + unresolved environment expansion. +- `relay.startup.config_deprecated_field_rejected` distinguishes a field that + the current runtime no longer accepts. +- `relay.startup.config_document_invalid` covers document syntax, unknown + fields, and typed-schema mismatches. +- `relay.startup.config_validation_rejected` covers cross-field and runtime + binding invariants after the document is typed. +- `relay.startup.bundle_*` and + `relay.startup.consultation_artifacts_rejected` retain the governed bundle and + consultation-closure boundaries. + +Relay deliberately has no raw or verbose startup-error escape hatch. Parser, +validator, source, and operating-system errors can contain country-local paths, +URLs, environment names, identifiers, supplied values, or secret-bearing +excerpts. Those values must not reach stderr, collected logs, CI output, or +support bundles. This is the concrete confidentiality invariant behind +suppressed source diagnostics. These terminal categories do not claim to emit a +field path. Run authored-project validation for field-addressed guidance. + +When Relay input was generated from a Registry Stack project, do not edit the +generated runtime file to clear a startup error. Validate the human-authored +project, correct the reported field or environment binding there, and regenerate +the complete product input: + +```sh +registryctl check --project-dir registry-project --environment local --explain +registryctl build --project-dir registry-project --environment local +``` + +For a directly authored Relay configuration, make the equivalent correction in +its owning source and run the normal validation and review gate before +restarting. + Config fails at startup: - Check YAML shape against [config/example.yaml](../config/example.yaml). @@ -755,7 +849,11 @@ Admin reload fails: - Confirm `server.admin_bind` is configured and reachable only from the private admin network. - Confirm the key has the independent `registry_relay:admin` scope. -- Check the per-resource `error_code` in the reload-all response. Use the table-specific endpoint to retry one failed source after correcting the underlying data or connectivity issue. +- When audited SnapshotExact is configured, do not retry reload-all. Use the + table-specific endpoint for the intended resource. +- Without audited SnapshotExact, use the reload-all counts plus protected + operational and audit logs to identify the failed resource, then retry only + that resource through the table-specific endpoint. Metrics missing: diff --git a/crates/registry-relay/src/api/consultation.rs b/crates/registry-relay/src/api/consultation.rs index 45ac6e103..87f9b6c37 100644 --- a/crates/registry-relay/src/api/consultation.rs +++ b/crates/registry-relay/src/api/consultation.rs @@ -6,6 +6,8 @@ //! workload-visible profile, then acquire and parse the bounded subject body. //! No raw HTTP request reaches a source backend. +use std::future::Future; + use axum::body::Body; use axum::extract::OriginalUri; use axum::http::{header, HeaderMap, HeaderValue, StatusCode}; @@ -113,7 +115,44 @@ async fn execute( Ok(context) => context, Err(error) => return service_error_response(error), }; + execute_after_resolution( + context, + headers, + body, + move |context, envelope| async move { service.execute(context, envelope).await }, + ) + .await +} + +trait ExecuteGateContext { + fn resolved_profile(&self) -> &ResolvedConsultationProfile; + fn authorized_workload(&self) -> &AuthenticatedConsultationWorkload; +} + +impl ExecuteGateContext for crate::consultation::ResolvedConsultationContext { + fn resolved_profile(&self) -> &ResolvedConsultationProfile { + self.resolved_profile() + } + + fn authorized_workload(&self) -> &AuthenticatedConsultationWorkload { + self.authorized_workload() + } +} +/// Keep request parsing and the only execution continuation in one ordered +/// boundary. A rejected contract identity therefore cannot invoke service or +/// source dispatch. +async fn execute_after_resolution( + context: C, + headers: HeaderMap, + body: Body, + dispatch: F, +) -> Response +where + C: ExecuteGateContext, + F: FnOnce(C, ParsedConsultationEnvelope) -> Fut, + Fut: Future, ConsultationExecutionError>>, +{ // Do not poll the subject-bearing body until authentication and exact // workload-visible profile resolution have both produced their proofs. let authorized_workload = context.authorized_workload(); @@ -144,7 +183,7 @@ async fn execute( Ok(envelope) => envelope, Err(error) => return wire_error_response(error), }; - match service.execute(context, envelope).await { + match dispatch(context, envelope).await { Ok(bytes) => json_response(bytes), Err(error) => execution_error_response(error), } @@ -832,7 +871,7 @@ fn optional_header<'a>( #[cfg(test)] mod tests { use std::convert::Infallible; - use std::sync::atomic::{AtomicBool, Ordering}; + use std::sync::atomic::{AtomicBool, AtomicUsize, Ordering}; use std::sync::Arc; use axum::body::to_bytes; @@ -842,6 +881,8 @@ mod tests { use futures::stream; use proptest::prelude::*; use serde_json::{json, Value}; + use tokio::net::TcpListener; + use tokio::sync::oneshot; use tower::ServiceExt; use super::*; @@ -879,6 +920,21 @@ mod tests { AuthenticatedConsultationWorkload::for_runtime_vector_test(i64::MAX) } + struct ExecuteGateTestContext { + resolved_profile: ResolvedConsultationProfile, + authorized_workload: AuthenticatedConsultationWorkload, + } + + impl ExecuteGateContext for ExecuteGateTestContext { + fn resolved_profile(&self) -> &ResolvedConsultationProfile { + &self.resolved_profile + } + + fn authorized_workload(&self) -> &AuthenticatedConsultationWorkload { + &self.authorized_workload + } + } + fn route_app() -> Router { let authentication = AuthenticationResult::api_key(Principal { principal_id: "route-test-caller".to_string(), @@ -1000,6 +1056,94 @@ mod tests { ); } + #[tokio::test] + async fn execute_time_contract_mismatch_fails_before_any_http_source_access() { + let source_calls = Arc::new(AtomicUsize::new(0)); + let source_counter = Arc::clone(&source_calls); + let source_app = Router::new().route( + "/source", + get(move || { + let source_counter = Arc::clone(&source_counter); + async move { + source_counter.fetch_add(1, Ordering::SeqCst); + StatusCode::NO_CONTENT + } + }), + ); + let listener = TcpListener::bind("127.0.0.1:0") + .await + .expect("instrumented source binds"); + let source_url = format!("http://{}/source", listener.local_addr().unwrap()); + let (shutdown, shutdown_requested) = oneshot::channel(); + let source_task = tokio::spawn(async move { + axum::serve(listener, source_app) + .with_graceful_shutdown(async { + let _ = shutdown_requested.await; + }) + .await + .expect("instrumented source serves"); + }); + + let resolved = resolved_profile(); + let active_contract = resolved.contract_hash().as_str().to_owned(); + let control_context = ExecuteGateTestContext { + resolved_profile: resolved, + authorized_workload: authorized_workload(), + }; + let active_request = + format!(r#"{{"contract_hash":"{active_contract}","inputs":{{"subject_id":"12345"}}}}"#); + let control_response = + execute_after_resolution(control_context, headers(), Body::from(active_request), { + let source_url = source_url.clone(); + move |_context, _envelope| async move { + let response = reqwest::get(source_url) + .await + .expect("accepted execution reaches the HTTP source"); + assert_eq!(response.status(), StatusCode::NO_CONTENT); + Ok(Vec::new()) + } + }) + .await; + assert_eq!(control_response.status(), StatusCode::OK); + assert_eq!(source_calls.load(Ordering::SeqCst), 1); + source_calls.store(0, Ordering::SeqCst); + + let stale_context = ExecuteGateTestContext { + resolved_profile: resolved_profile(), + authorized_workload: authorized_workload(), + }; + let stale_contract = br#"{"contract_hash":"sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","inputs":{"subject_id":"12345"}}"#; + let response = execute_after_resolution( + stale_context, + headers(), + Body::from(stale_contract.as_slice()), + { + move |_context, _envelope| async move { + let response = reqwest::get(source_url) + .await + .expect("accepted execution reaches the HTTP source"); + assert_eq!(response.status(), StatusCode::NO_CONTENT); + Ok(Vec::new()) + } + }, + ) + .await; + + assert_eq!(response.status(), StatusCode::CONFLICT); + assert_eq!( + response_code(response).await, + "consultation.contract_mismatch" + ); + assert_eq!( + source_calls.load(Ordering::SeqCst), + 0, + "a profile contract mismatch must fail before source access" + ); + + let _ = shutdown.send(()); + source_task.await.expect("instrumented source stops"); + } + #[tokio::test] async fn router_exposes_only_the_exact_get_and_post_paths() { const PROFILE: &str = "/v1/consultations/synthetic.person-status.exact"; diff --git a/crates/registry-relay/src/config/loader.rs b/crates/registry-relay/src/config/loader.rs index 5009253c5..aea7e055a 100644 --- a/crates/registry-relay/src/config/loader.rs +++ b/crates/registry-relay/src/config/loader.rs @@ -2,10 +2,11 @@ //! Read a config file from disk, parse it, and run cross-field //! validation. //! -//! The loader deliberately scrubs the surfaced [`crate::error::Error`] -//! detail: response and audit detail strings never carry the source -//! path. The operational `tracing::error!` line includes the path so -//! operators can locate the offending file in their logs. +//! The loader deliberately scrubs both the surfaced [`crate::error::Error`] +//! detail and the default operational tracing boundary. Source paths, parser +//! excerpts, supplied values, hashes, and identities never cross that +//! boundary. Operators receive stable product-owned codes with static meaning +//! and remediation from [`crate::process_startup`]. use std::fs; use std::path::{Path, PathBuf}; @@ -18,7 +19,7 @@ use registry_platform_config::{ ConfigBundleError, DeprecatedConfigField, VerifiedConfigBundle, }; use registry_platform_ops::{ - antirollback_key_from_verified_bundle, bundle_verify_rejection_result, internal_config_hash, + antirollback_key_from_verified_bundle, bundle_verify_rejection_code, internal_config_hash, is_sha256_config_hash, load_unsigned_break_glass_or_pin, posture_safe_runtime_config_hash, resolve_bundle_state_action, BundleStateRequest, ConfigBootError, ConfigProvenance, ConfigSource, UnsignedConfigSelection, @@ -27,6 +28,7 @@ pub use registry_platform_ops::{BundleStateAction, PendingBundleAcceptance}; use serde_json::Value; use crate::error::{ConfigError, Error, MetadataError}; +use crate::process_startup::{emit_process_startup_failure, ProcessStartupCode}; use super::consultation_artifacts::{ load_consultation_artifacts, ConsultationArtifactClosureError, SignedBundleRuntimeFiles, @@ -56,8 +58,8 @@ pub struct LoadOptions { /// # Errors /// /// - [`ConfigError::ParseError`] on filesystem read failure or YAML -/// deserialisation failure. The path and serde error are logged via -/// `tracing` at error level; the returned `Error` is scrubbed. +/// deserialisation failure. The process boundary emits only a stable, +/// catalog-owned classification without the path or parser detail. /// - [`ConfigError::ValidationError`], [`ConfigError::MissingSecret`], /// [`ConfigError::DuplicateId`] propagated from /// [`validate::run`] on cross-field validation failures. @@ -68,60 +70,35 @@ pub fn load(path: &Path) -> Result { fn load_config_document(path: &Path, options: LoadOptions) -> Result { let raw = match fs::read_to_string(path) { Ok(s) => s, - Err(err) => { - tracing::error!( - code = "config.parse_error", - path = %path.display(), - error = %err, - "failed to read config file" - ); + Err(_) => { + emit_process_startup_failure(ProcessStartupCode::CONFIG_SOURCE_UNAVAILABLE); return Err(Error::from(ConfigError::ParseError)); } }; let expanded = match expand_config_env_vars(&raw) { Ok(expanded) => expanded, - Err(err) => { - tracing::error!( - code = "config.parse_error", - path = %path.display(), - error = %err, - "failed to expand config environment expressions" - ); + Err(_) => { + emit_process_startup_failure(ProcessStartupCode::CONFIG_ENVIRONMENT_BINDING_REJECTED); return Err(Error::from(ConfigError::ParseError)); } }; let config_value: Value = match serde_saphyr::from_str(&expanded) { Ok(value) => value, - Err(err) => { - tracing::error!( - code = "config.parse_error", - path = %path.display(), - error = %err, - "failed to parse config YAML" - ); + Err(_) => { + emit_process_startup_failure(ProcessStartupCode::CONFIG_DOCUMENT_INVALID); return Err(Error::from(ConfigError::ParseError)); } }; - if let Err(err) = reject_deprecated_config_fields(&config_value, &deprecated_config_fields()) { - tracing::error!( - code = "config.parse_error", - path = %path.display(), - error = %err, - "config uses a removed or renamed field" - ); + if reject_deprecated_config_fields(&config_value, &deprecated_config_fields()).is_err() { + emit_process_startup_failure(ProcessStartupCode::CONFIG_DEPRECATED_FIELD_REJECTED); return Err(Error::from(ConfigError::ParseError)); } let config: Config = match serde_saphyr::from_str(&expanded) { Ok(c) => c, - Err(err) => { - tracing::error!( - code = "config.parse_error", - path = %path.display(), - error = %err, - "failed to parse config YAML" - ); + Err(_) => { + emit_process_startup_failure(ProcessStartupCode::CONFIG_DOCUMENT_INVALID); return Err(Error::from(ConfigError::ParseError)); } }; @@ -130,10 +107,13 @@ fn load_config_document(path: &Path, options: LoadOptions) -> Result Result<(Config, Value), Error> { - let config_text = std::str::from_utf8(bytes).map_err(|error| { - tracing::error!( - code = "config.bundle_rejected", - result = "rejected_validation", - error = %error, - "config bundle primary config is not UTF-8" - ); - eprintln!("config.bundle_rejected result=rejected_validation error={error}"); + let config_text = std::str::from_utf8(bytes).map_err(|_| { + emit_process_startup_failure(ProcessStartupCode::BUNDLE_VALIDATION_REJECTED); Error::from(ConfigError::ParseError) })?; - let expanded_config_text = expand_config_env_vars(config_text).map_err(|error| { - tracing::error!( - code = "config.bundle_rejected", - result = "rejected_validation", - error = %error, - "config bundle primary config failed environment expansion" - ); - eprintln!("config.bundle_rejected result=rejected_validation error={error}"); + let expanded_config_text = expand_config_env_vars(config_text).map_err(|_| { + emit_process_startup_failure(ProcessStartupCode::BUNDLE_VALIDATION_REJECTED); Error::from(ConfigError::ParseError) })?; - let config_value: Value = serde_saphyr::from_str(&expanded_config_text).map_err(|error| { - tracing::error!( - code = "config.bundle_rejected", - result = "rejected_validation", - error = %error, - "config bundle primary config failed to parse" - ); - eprintln!("config.bundle_rejected result=rejected_validation error={error}"); + let config_value: Value = serde_saphyr::from_str(&expanded_config_text).map_err(|_| { + emit_process_startup_failure(ProcessStartupCode::BUNDLE_VALIDATION_REJECTED); Error::from(ConfigError::ParseError) })?; - if let Err(err) = reject_deprecated_config_fields(&config_value, &deprecated_config_fields()) { - tracing::error!( - code = "config.bundle_rejected", - result = "rejected_validation", - error = %err, - "config bundle primary config uses a removed or renamed field" - ); - eprintln!("config.bundle_rejected result=rejected_validation error={err}"); + if reject_deprecated_config_fields(&config_value, &deprecated_config_fields()).is_err() { + emit_process_startup_failure(ProcessStartupCode::BUNDLE_VALIDATION_REJECTED); return Err(Error::from(ConfigError::ParseError)); } - let config: Config = serde_saphyr::from_str(&expanded_config_text).map_err(|error| { - tracing::error!( - code = "config.bundle_rejected", - result = "rejected_validation", - error = %error, - "config bundle primary config failed to deserialize" - ); - eprintln!("config.bundle_rejected result=rejected_validation error={error}"); + let config: Config = serde_saphyr::from_str(&expanded_config_text).map_err(|_| { + emit_process_startup_failure(ProcessStartupCode::BUNDLE_VALIDATION_REJECTED); Error::from(ConfigError::ParseError) })?; - validate::run_with_source(&config, source).map_err(|error| { - tracing::error!( - code = "config.bundle_rejected", - result = "rejected_validation", - error = %error, - "config bundle primary config failed product validation" - ); - eprintln!("config.bundle_rejected result=rejected_validation error={error}"); - error - })?; + suppress_source_diagnostics(|| validate::run_with_source(&config, source)).inspect_err( + |_| { + emit_process_startup_failure(ProcessStartupCode::BUNDLE_VALIDATION_REJECTED); + }, + )?; Ok((config, config_value)) } fn log_bundle_verification_error(error: &ConfigBundleError) { - let result = bundle_verify_rejection_result(error); - tracing::error!( - code = "config.bundle_rejected", - result, - error = %error, - "signed config bundle verification failed" - ); - eprintln!("config.bundle_rejected result={result} error={error}"); + emit_process_startup_failure(ProcessStartupCode::from_bundle_verification( + bundle_verify_rejection_code(error), + )); } fn map_config_boot_error(error: ConfigBootError) -> Error { - if let Some(reason) = error.break_glass_invalid_reason() { - tracing::error!( - code = "config.break_glass_invalid", - error = %error, - reason, - "config break-glass override rejected" - ); - eprintln!("config.break_glass_invalid error={error}"); - } - let result = error.bundle_rejection_result(); - tracing::error!( - code = "config.bundle_rejected", - result, - error = %error, - "config bundle boot state rejected startup" - ); - eprintln!("config.bundle_rejected result={result} error={error}"); + emit_process_startup_failure(ProcessStartupCode::from_bundle_verification( + error.bundle_rejection_code(), + )); Error::from(ConfigError::ValidationError) } +fn suppress_source_diagnostics(action: impl FnOnce() -> T) -> T { + let dispatch = tracing::Dispatch::new(tracing::subscriber::NoSubscriber::default()); + tracing::dispatcher::with_default(&dispatch, action) +} + fn deprecated_config_fields() -> Vec { vec![ DeprecatedConfigField::renamed("auth.oidc.audience", "auth.oidc.audiences"), @@ -505,31 +440,23 @@ fn load_config_metadata_for_source( if (config.config_trust.is_some() || source == ConfigSource::SignedBundleFile) && metadata.source.digest.is_none() { - tracing::error!( - code = "metadata.manifest.digest_required", - "governed configuration requires metadata.source.digest" - ); + emit_process_startup_failure(ProcessStartupCode::CONFIG_VALIDATION_REJECTED); return Err(MetadataError::ManifestDigestRequired.into()); } if let Some(expected) = metadata.source.digest.as_deref() { if !is_sha256_config_hash(expected) { - tracing::error!( - code = "metadata.manifest.digest_invalid", - "metadata manifest configured digest is not a canonical sha256 digest" - ); + emit_process_startup_failure(ProcessStartupCode::CONFIG_VALIDATION_REJECTED); return Err(MetadataError::ManifestDigestInvalid.into()); } if expected != digest { - tracing::error!( - code = "metadata.manifest.digest_mismatch", - expected = %expected, - actual = %digest, - "metadata manifest configured digest does not match loaded manifest" - ); + emit_process_startup_failure(ProcessStartupCode::CONFIG_VALIDATION_REJECTED); return Err(MetadataError::ManifestDigestMismatch.into()); } } - validate::validate_runtime_bindings(config, &compiled)?; + suppress_source_diagnostics(|| validate::validate_runtime_bindings(config, &compiled)) + .inspect_err(|_| { + emit_process_startup_failure(ProcessStartupCode::CONFIG_VALIDATION_REJECTED); + })?; (Some(compiled), Some(digest)) } None => (None, None), @@ -555,48 +482,24 @@ pub fn load_metadata_manifest_with_digest( ) -> Result<(CompiledMetadata, String), Error> { let raw = match fs::read_to_string(path) { Ok(s) => s, - Err(err) => { - tracing::error!( - code = "metadata.manifest.file_not_found", - path = %path.display(), - error = %err, - "failed to read metadata manifest" - ); + Err(_) => { + emit_process_startup_failure(ProcessStartupCode::CONFIG_SOURCE_UNAVAILABLE); return Err(MetadataError::ManifestFileNotFound.into()); } }; let manifest: MetadataManifest = match serde_saphyr::from_str(&raw) { Ok(manifest) => manifest, - Err(err) => { - tracing::error!( - code = "metadata.manifest.parse_failed", - path = %path.display(), - error = %err, - "failed to parse metadata manifest YAML" - ); + Err(_) => { + emit_process_startup_failure(ProcessStartupCode::CONFIG_DOCUMENT_INVALID); return Err(MetadataError::ManifestParseFailed.into()); } }; - let digest = metadata_core::source_manifest_digest(&manifest).map_err(|err| { - tracing::error!( - code = "metadata.manifest.digest_invalid", - path = %path.display(), - error = %err, - "failed to compute metadata manifest digest" - ); + let digest = metadata_core::source_manifest_digest(&manifest).map_err(|_| { + emit_process_startup_failure(ProcessStartupCode::CONFIG_VALIDATION_REJECTED); Error::from(MetadataError::ManifestDigestInvalid) })?; let compiled = metadata_core::compile_manifest(&manifest).map_err(|err| { - let code = match &err { - CoreMetadataError::VersionUnsupported => "metadata.manifest.version_unsupported", - CoreMetadataError::Validation { .. } => "metadata.manifest.validation_failed", - }; - tracing::error!( - code = code, - path = %path.display(), - error = %err, - "metadata manifest failed validation" - ); + emit_process_startup_failure(ProcessStartupCode::CONFIG_VALIDATION_REJECTED); match err { CoreMetadataError::VersionUnsupported => { Error::from(MetadataError::ManifestVersionUnsupported) @@ -619,12 +522,8 @@ fn resolve_relative_to_config(config_path: &Path, target: &Path) -> PathBuf { .join(target) } -fn map_consultation_artifact_error(error: ConsultationArtifactClosureError) -> Error { - tracing::error!( - code = "config.consultation_artifact_closure_rejected", - error = %error, - "consultation artifact closure rejected startup" - ); +fn map_consultation_artifact_error(_error: ConsultationArtifactClosureError) -> Error { + emit_process_startup_failure(ProcessStartupCode::CONSULTATION_ARTIFACTS_REJECTED); Error::from(ConfigError::ValidationError) } diff --git a/crates/registry-relay/src/consultation/mod.rs b/crates/registry-relay/src/consultation/mod.rs index c4b0177bb..d31c5c621 100644 --- a/crates/registry-relay/src/consultation/mod.rs +++ b/crates/registry-relay/src/consultation/mod.rs @@ -48,6 +48,13 @@ pub use identifiers::{ ConsultationId, ConsultationIdentifierError, ConsultationKey, NotaryEvaluationId, ResolvedConsultationProfile, }; +pub use service::{ + consultation_service_activation_definitions, ConsultationService, + ConsultationServiceActivationCode, ConsultationServiceActivationDefinition, + ConsultationServiceActivationError, ConsultationServiceActivationFailure, + ConsultationServiceActivationLifecycle, ConsultationServiceActivationVersion, + ConsultationServiceReadiness, ConsultationServiceShutdownError, +}; #[allow( unused_imports, reason = "reachable crate-private service return and error member types for the HTTP boundary" @@ -57,10 +64,6 @@ pub(crate) use service::{ ConsultationExecutionError, ConsultationRetryAfter, ConsultationServiceError, ResolvedConsultationContext, }; -pub use service::{ - ConsultationService, ConsultationServiceActivationError, ConsultationServiceReadiness, - ConsultationServiceShutdownError, -}; pub use types::{ AcquiredField, AcquisitionClass, ConsultationOutcome, ConsultationValidationError, DeclaredOperationFootprint, IntegrationPackHash, IntegrationPackId, IntegrationPackIdentity, diff --git a/crates/registry-relay/src/consultation/service.rs b/crates/registry-relay/src/consultation/service.rs index 3489abd2b..ee75c07f6 100644 --- a/crates/registry-relay/src/consultation/service.rs +++ b/crates/registry-relay/src/consultation/service.rs @@ -13,6 +13,7 @@ use registry_platform_audit::{ DurableAuditStreamKind, DurableAuditWrite, DurableAuditWriteError, DurableAuditWriteOutcome, }; use registry_platform_httputil::destination::json::MAX_CLOSED_JSON_STRING_BYTES; +use serde::{Serialize, Serializer}; use serde_json::json; use thiserror::Error; use tokio::sync::{oneshot, Semaphore}; @@ -151,6 +152,529 @@ pub enum ConsultationServiceActivationError { StatePlane, } +/// Stable, product-owned code for one Relay consultation activation failure. +/// +/// The representation is private so callers can only observe reviewed codes +/// from [`Self::ALL`] or an exact activation-error mapping. +#[derive(Clone, Copy, Eq, Hash, Ord, PartialEq, PartialOrd)] +pub struct ConsultationServiceActivationCode(ConsultationServiceActivationCodeRepr); + +#[derive(Clone, Copy, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)] +enum ConsultationServiceActivationCodeRepr { + ArtifactRegistryInvalid, + ConfigurationMissing, + ProtectedMetadataInvalid, + PseudonymMaterialUnavailable, + QuotaLimitsInvalid, + SourceCredentialsUnavailable, + StatePlaneUnavailable, + UnsupportedPlan, + WorkloadBindingInvalid, +} + +impl ConsultationServiceActivationCode { + pub const ARTIFACT_REGISTRY_INVALID: Self = + Self(ConsultationServiceActivationCodeRepr::ArtifactRegistryInvalid); + pub const CONFIGURATION_MISSING: Self = + Self(ConsultationServiceActivationCodeRepr::ConfigurationMissing); + pub const PROTECTED_METADATA_INVALID: Self = + Self(ConsultationServiceActivationCodeRepr::ProtectedMetadataInvalid); + pub const PSEUDONYM_MATERIAL_UNAVAILABLE: Self = + Self(ConsultationServiceActivationCodeRepr::PseudonymMaterialUnavailable); + pub const QUOTA_LIMITS_INVALID: Self = + Self(ConsultationServiceActivationCodeRepr::QuotaLimitsInvalid); + pub const SOURCE_CREDENTIALS_UNAVAILABLE: Self = + Self(ConsultationServiceActivationCodeRepr::SourceCredentialsUnavailable); + pub const STATE_PLANE_UNAVAILABLE: Self = + Self(ConsultationServiceActivationCodeRepr::StatePlaneUnavailable); + pub const UNSUPPORTED_PLAN: Self = Self(ConsultationServiceActivationCodeRepr::UnsupportedPlan); + pub const WORKLOAD_BINDING_INVALID: Self = + Self(ConsultationServiceActivationCodeRepr::WorkloadBindingInvalid); + + /// Complete stable code set in lexical code order. + pub const ALL: [Self; 9] = [ + Self::ARTIFACT_REGISTRY_INVALID, + Self::CONFIGURATION_MISSING, + Self::PROTECTED_METADATA_INVALID, + Self::PSEUDONYM_MATERIAL_UNAVAILABLE, + Self::QUOTA_LIMITS_INVALID, + Self::SOURCE_CREDENTIALS_UNAVAILABLE, + Self::STATE_PLANE_UNAVAILABLE, + Self::UNSUPPORTED_PLAN, + Self::WORKLOAD_BINDING_INVALID, + ]; + + #[must_use] + pub const fn as_str(self) -> &'static str { + match self.0 { + ConsultationServiceActivationCodeRepr::ArtifactRegistryInvalid => { + "relay.consultation.activation.artifact_registry_invalid" + } + ConsultationServiceActivationCodeRepr::ConfigurationMissing => { + "relay.consultation.activation.configuration_missing" + } + ConsultationServiceActivationCodeRepr::ProtectedMetadataInvalid => { + "relay.consultation.activation.protected_metadata_invalid" + } + ConsultationServiceActivationCodeRepr::PseudonymMaterialUnavailable => { + "relay.consultation.activation.pseudonym_material_unavailable" + } + ConsultationServiceActivationCodeRepr::QuotaLimitsInvalid => { + "relay.consultation.activation.quota_limits_invalid" + } + ConsultationServiceActivationCodeRepr::SourceCredentialsUnavailable => { + "relay.consultation.activation.source_credentials_unavailable" + } + ConsultationServiceActivationCodeRepr::StatePlaneUnavailable => { + "relay.consultation.activation.state_plane_unavailable" + } + ConsultationServiceActivationCodeRepr::UnsupportedPlan => { + "relay.consultation.activation.unsupported_plan" + } + ConsultationServiceActivationCodeRepr::WorkloadBindingInvalid => { + "relay.consultation.activation.workload_binding_invalid" + } + } + } + + #[must_use] + pub const fn definition(self) -> &'static ConsultationServiceActivationDefinition { + match self.0 { + ConsultationServiceActivationCodeRepr::ArtifactRegistryInvalid => { + &CONSULTATION_SERVICE_ACTIVATION_DEFINITIONS[0] + } + ConsultationServiceActivationCodeRepr::ConfigurationMissing => { + &CONSULTATION_SERVICE_ACTIVATION_DEFINITIONS[1] + } + ConsultationServiceActivationCodeRepr::ProtectedMetadataInvalid => { + &CONSULTATION_SERVICE_ACTIVATION_DEFINITIONS[2] + } + ConsultationServiceActivationCodeRepr::PseudonymMaterialUnavailable => { + &CONSULTATION_SERVICE_ACTIVATION_DEFINITIONS[3] + } + ConsultationServiceActivationCodeRepr::QuotaLimitsInvalid => { + &CONSULTATION_SERVICE_ACTIVATION_DEFINITIONS[4] + } + ConsultationServiceActivationCodeRepr::SourceCredentialsUnavailable => { + &CONSULTATION_SERVICE_ACTIVATION_DEFINITIONS[5] + } + ConsultationServiceActivationCodeRepr::StatePlaneUnavailable => { + &CONSULTATION_SERVICE_ACTIVATION_DEFINITIONS[6] + } + ConsultationServiceActivationCodeRepr::UnsupportedPlan => { + &CONSULTATION_SERVICE_ACTIVATION_DEFINITIONS[7] + } + ConsultationServiceActivationCodeRepr::WorkloadBindingInvalid => { + &CONSULTATION_SERVICE_ACTIVATION_DEFINITIONS[8] + } + } + } +} + +impl fmt::Debug for ConsultationServiceActivationCode { + fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result { + formatter + .debug_tuple("ConsultationServiceActivationCode") + .field(&self.as_str()) + .finish() + } +} + +impl fmt::Display for ConsultationServiceActivationCode { + fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result { + formatter.write_str(self.as_str()) + } +} + +impl Serialize for ConsultationServiceActivationCode { + fn serialize(&self, serializer: S) -> Result + where + S: Serializer, + { + serializer.serialize_str(self.as_str()) + } +} + +/// Release lifecycle for a product-owned activation code. +#[derive(Clone, Copy, Debug, Eq, PartialEq, Serialize)] +#[non_exhaustive] +#[serde(rename_all = "snake_case")] +pub enum ConsultationServiceActivationLifecycle { + Unreleased, + Active, + Deprecated, +} + +/// Product release that first published a stable activation code. +/// +/// The representation is private so release versions can only be introduced +/// through reviewed Relay-owned constants. +#[derive(Clone, Copy, Eq, Hash, Ord, PartialEq, PartialOrd)] +pub struct ConsultationServiceActivationVersion(&'static str); + +impl ConsultationServiceActivationVersion { + /// Construct a release version only from a reviewed static catalog value. + /// + /// Each canonical numeric component is bounded to `u16`, which limits the + /// complete representation to 17 ASCII bytes. + const fn from_reviewed(value: &'static str) -> Option { + match parse_bounded_numeric_release_version(value) { + Some(_) => Some(Self(value)), + None => None, + } + } + + #[must_use] + pub const fn as_str(self) -> &'static str { + self.0 + } + + const fn is_valid(self) -> bool { + parse_bounded_numeric_release_version(self.0).is_some() + } +} + +impl fmt::Debug for ConsultationServiceActivationVersion { + fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result { + formatter + .debug_tuple("ConsultationServiceActivationVersion") + .field(&self.as_str()) + .finish() + } +} + +impl fmt::Display for ConsultationServiceActivationVersion { + fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result { + formatter.write_str(self.as_str()) + } +} + +impl Serialize for ConsultationServiceActivationVersion { + fn serialize(&self, serializer: S) -> Result + where + S: Serializer, + { + serializer.serialize_str(self.as_str()) + } +} + +const fn parse_bounded_numeric_release_version(value: &str) -> Option<[u16; 3]> { + let bytes = value.as_bytes(); + if bytes.len() < 5 || bytes.len() > 17 { + return None; + } + + let mut components = [0_u16; 3]; + let mut component_index = 0_usize; + let mut digits_in_component = 0_usize; + let mut index = 0_usize; + while index < bytes.len() { + let byte = bytes[index]; + if byte == b'.' { + if digits_in_component == 0 || component_index == 2 { + return None; + } + component_index += 1; + digits_in_component = 0; + } else if byte.is_ascii_digit() { + if digits_in_component > 0 && components[component_index] == 0 { + return None; + } + let digit = (byte - b'0') as u16; + let Some(shifted) = components[component_index].checked_mul(10) else { + return None; + }; + let Some(next) = shifted.checked_add(digit) else { + return None; + }; + components[component_index] = next; + digits_in_component += 1; + } else { + return None; + } + index += 1; + } + + if component_index == 2 && digits_in_component > 0 { + Some(components) + } else { + None + } +} + +const TAGGED_BEFORE_ACTIVATION_CATALOG: ConsultationServiceActivationVersion = + match ConsultationServiceActivationVersion::from_reviewed("0.13.0") { + Some(version) => version, + None => panic!("the tagged release sentinel must be valid"), + }; + +/// Static, value-free meaning and recovery contract for an activation code. +#[derive(Clone, Copy, Debug, Eq, PartialEq, Serialize)] +#[non_exhaustive] +pub struct ConsultationServiceActivationDefinition { + pub code: ConsultationServiceActivationCode, + pub lifecycle: ConsultationServiceActivationLifecycle, + pub introduced_in: Option, + pub phase: &'static str, + pub meaning: &'static str, + pub rule: &'static str, + pub remediation: &'static str, + pub evidence_scope: &'static str, + pub evidence_policy: &'static str, + pub evidence_limitation: &'static str, + pub docs_slug: &'static str, +} + +impl ConsultationServiceActivationDefinition { + /// Check the typed lifecycle/version relationship required by release + /// gates and downstream catalog aggregation. + #[must_use] + pub const fn lifecycle_metadata_is_valid(&self) -> bool { + match self.lifecycle { + ConsultationServiceActivationLifecycle::Unreleased => self.introduced_in.is_none(), + ConsultationServiceActivationLifecycle::Active + | ConsultationServiceActivationLifecycle::Deprecated => match self.introduced_in { + Some(version) => version.is_valid(), + None => false, + }, + } + } + + /// Check catalog-specific release attribution in addition to lifecycle + /// shape. These definitions were created after v0.13.0 was tagged. + #[must_use] + pub const fn catalog_metadata_is_valid(&self) -> bool { + self.lifecycle_metadata_is_valid() + && match self.introduced_in { + Some(version) => { + !release_versions_are_equal(version, TAGGED_BEFORE_ACTIVATION_CATALOG) + } + None => true, + } + } +} + +const fn release_versions_are_equal( + left: ConsultationServiceActivationVersion, + right: ConsultationServiceActivationVersion, +) -> bool { + let left = left.as_str().as_bytes(); + let right = right.as_str().as_bytes(); + if left.len() != right.len() { + return false; + } + let mut index = 0_usize; + while index < left.len() { + if left[index] != right[index] { + return false; + } + index += 1; + } + true +} + +/// Safe public projection of one Relay consultation activation failure. +/// +/// Every field comes from the static product catalog. Source errors, paths, +/// hashes, parser text, credentials, identifiers, and authored values cannot +/// enter this shape. +#[derive(Clone, Copy, Debug, Eq, PartialEq, Serialize)] +#[non_exhaustive] +pub struct ConsultationServiceActivationFailure { + pub code: ConsultationServiceActivationCode, + pub lifecycle: ConsultationServiceActivationLifecycle, + pub introduced_in: Option, + pub phase: &'static str, + pub meaning: &'static str, + pub rule: &'static str, + pub remediation: &'static str, + pub evidence_scope: &'static str, + pub evidence_policy: &'static str, + pub evidence_limitation: &'static str, + pub docs_slug: &'static str, +} + +const ACTIVATION_EVIDENCE_POLICY: &str = "Publish only this stable Relay code and static definition; keep any source diagnostic only in protected operator logs."; +const ACTIVATION_EVIDENCE_LIMITATION: &str = "The category does not disclose paths, URLs, parser excerpts, hashes, credentials, identifiers, or authored values."; + +static CONSULTATION_SERVICE_ACTIVATION_DEFINITIONS: + [ConsultationServiceActivationDefinition; 9] = [ + ConsultationServiceActivationDefinition { + code: ConsultationServiceActivationCode::ARTIFACT_REGISTRY_INVALID, + lifecycle: ConsultationServiceActivationLifecycle::Unreleased, + introduced_in: None, + phase: "consultation_activation", + meaning: "Relay could not compile the verified consultation artifact registry.", + rule: "The verified artifact closure must compile into one closed registry without conflicting public profiles.", + remediation: "Rebuild and verify the exact consultation artifact closure before restarting Relay.", + evidence_scope: "verified consultation artifact closure and compiled public profiles", + evidence_policy: ACTIVATION_EVIDENCE_POLICY, + evidence_limitation: ACTIVATION_EVIDENCE_LIMITATION, + docs_slug: "artifact-registry-invalid", + }, + ConsultationServiceActivationDefinition { + code: ConsultationServiceActivationCode::CONFIGURATION_MISSING, + lifecycle: ConsultationServiceActivationLifecycle::Unreleased, + introduced_in: None, + phase: "consultation_activation", + meaning: "Relay consultation activation requires configuration that is not present.", + rule: "The closed consultation configuration must exist before Relay compiles serving authority.", + remediation: "Provide a validated Relay consultation configuration and restart Relay.", + evidence_scope: "Relay consultation configuration and serving authority", + evidence_policy: ACTIVATION_EVIDENCE_POLICY, + evidence_limitation: ACTIVATION_EVIDENCE_LIMITATION, + docs_slug: "configuration-missing", + }, + ConsultationServiceActivationDefinition { + code: ConsultationServiceActivationCode::PROTECTED_METADATA_INVALID, + lifecycle: ConsultationServiceActivationLifecycle::Unreleased, + introduced_in: None, + phase: "consultation_activation", + meaning: "Relay could not construct bounded protected consultation metadata.", + rule: "Protected metadata must contain one strict bounded public contract and its reviewed binding.", + remediation: "Regenerate and verify the consultation artifact closure, then restart Relay.", + evidence_scope: "protected consultation metadata, public contract, and reviewed binding", + evidence_policy: ACTIVATION_EVIDENCE_POLICY, + evidence_limitation: ACTIVATION_EVIDENCE_LIMITATION, + docs_slug: "protected-metadata-invalid", + }, + ConsultationServiceActivationDefinition { + code: ConsultationServiceActivationCode::PSEUDONYM_MATERIAL_UNAVAILABLE, + lifecycle: ConsultationServiceActivationLifecycle::Unreleased, + introduced_in: None, + phase: "consultation_activation", + meaning: "Relay could not activate the pseudonym material required for consultation audit evidence.", + rule: "The configured pseudonym material must be valid and bind to the current write authority.", + remediation: "Restore the reviewed pseudonym material and write authority, then restart Relay.", + evidence_scope: "consultation pseudonym material and current write authority", + evidence_policy: ACTIVATION_EVIDENCE_POLICY, + evidence_limitation: ACTIVATION_EVIDENCE_LIMITATION, + docs_slug: "pseudonym-material-unavailable", + }, + ConsultationServiceActivationDefinition { + code: ConsultationServiceActivationCode::QUOTA_LIMITS_INVALID, + lifecycle: ConsultationServiceActivationLifecycle::Unreleased, + introduced_in: None, + phase: "consultation_activation", + meaning: "Relay could not activate the bounded consultation quota contract.", + rule: "Public and effective quota limits must remain representable, positive, and non-widening.", + remediation: "Correct the reviewed quota limits and rebuild the consultation artifacts.", + evidence_scope: "public and effective consultation quota limits", + evidence_policy: ACTIVATION_EVIDENCE_POLICY, + evidence_limitation: ACTIVATION_EVIDENCE_LIMITATION, + docs_slug: "quota-limits-invalid", + }, + ConsultationServiceActivationDefinition { + code: ConsultationServiceActivationCode::SOURCE_CREDENTIALS_UNAVAILABLE, + lifecycle: ConsultationServiceActivationLifecycle::Unreleased, + introduced_in: None, + phase: "consultation_activation", + meaning: "Relay could not activate the source-credential capability required by the consultation registry.", + rule: "Every compiled source plan must have exactly the credential capability it declares.", + remediation: "Restore the reviewed source-credential references and restart Relay.", + evidence_scope: "compiled consultation source plans and credential capabilities", + evidence_policy: ACTIVATION_EVIDENCE_POLICY, + evidence_limitation: ACTIVATION_EVIDENCE_LIMITATION, + docs_slug: "source-credentials-unavailable", + }, + ConsultationServiceActivationDefinition { + code: ConsultationServiceActivationCode::STATE_PLANE_UNAVAILABLE, + lifecycle: ConsultationServiceActivationLifecycle::Unreleased, + introduced_in: None, + phase: "consultation_activation", + meaning: "Relay could not activate the consultation state plane and its current authority.", + rule: "The state plane, durable audit boundary, quota state, and current write authority must activate together.", + remediation: "Restore the reviewed Relay state-plane dependencies and restart Relay.", + evidence_scope: "consultation state plane, audit boundary, quota state, and write authority", + evidence_policy: ACTIVATION_EVIDENCE_POLICY, + evidence_limitation: ACTIVATION_EVIDENCE_LIMITATION, + docs_slug: "state-plane-unavailable", + }, + ConsultationServiceActivationDefinition { + code: ConsultationServiceActivationCode::UNSUPPORTED_PLAN, + lifecycle: ConsultationServiceActivationLifecycle::Unreleased, + introduced_in: None, + phase: "consultation_activation", + meaning: "A compiled consultation plan requires a capability this Relay runtime cannot activate.", + rule: "Every plan, worker, transport, snapshot binding, and dispatch budget must use a compiled supported capability.", + remediation: "Use a Relay release that supports the reviewed plan or rebuild the plan with supported capabilities.", + evidence_scope: "compiled consultation plan and Relay runtime capabilities", + evidence_policy: ACTIVATION_EVIDENCE_POLICY, + evidence_limitation: ACTIVATION_EVIDENCE_LIMITATION, + docs_slug: "unsupported-plan", + }, + ConsultationServiceActivationDefinition { + code: ConsultationServiceActivationCode::WORKLOAD_BINDING_INVALID, + lifecycle: ConsultationServiceActivationLifecycle::Unreleased, + introduced_in: None, + phase: "consultation_activation", + meaning: "The configured consultation workload binding is incompatible with Relay authentication.", + rule: "Issuer, audience, client binding, principal, and selector must satisfy the closed Relay workload contract.", + remediation: "Align the reviewed consultation workload binding with Relay authentication and restart Relay.", + evidence_scope: "consultation workload binding and Relay authentication contract", + evidence_policy: ACTIVATION_EVIDENCE_POLICY, + evidence_limitation: ACTIVATION_EVIDENCE_LIMITATION, + docs_slug: "workload-binding-invalid", + }, +]; + +/// Product-owned static catalog for downstream diagnostic aggregation. +#[must_use] +pub const fn consultation_service_activation_definitions( +) -> &'static [ConsultationServiceActivationDefinition; 9] { + &CONSULTATION_SERVICE_ACTIVATION_DEFINITIONS +} + +impl ConsultationServiceActivationError { + /// Exhaustive public-code mapping for the closed activation error taxonomy. + #[must_use] + pub const fn code(self) -> ConsultationServiceActivationCode { + match self { + Self::MissingConfiguration => ConsultationServiceActivationCode::CONFIGURATION_MISSING, + Self::InvalidWorkloadBinding => { + ConsultationServiceActivationCode::WORKLOAD_BINDING_INVALID + } + Self::RegistryActivation => { + ConsultationServiceActivationCode::ARTIFACT_REGISTRY_INVALID + } + Self::UnsupportedPlan => ConsultationServiceActivationCode::UNSUPPORTED_PLAN, + Self::InvalidQuotaLimits => ConsultationServiceActivationCode::QUOTA_LIMITS_INVALID, + Self::InvalidMetadata => ConsultationServiceActivationCode::PROTECTED_METADATA_INVALID, + Self::SourceCredentials => { + ConsultationServiceActivationCode::SOURCE_CREDENTIALS_UNAVAILABLE + } + Self::PseudonymMaterial => { + ConsultationServiceActivationCode::PSEUDONYM_MATERIAL_UNAVAILABLE + } + Self::StatePlane => ConsultationServiceActivationCode::STATE_PLANE_UNAVAILABLE, + } + } + + #[must_use] + pub const fn safe_projection(self) -> ConsultationServiceActivationFailure { + let definition = self.code().definition(); + ConsultationServiceActivationFailure { + code: definition.code, + lifecycle: definition.lifecycle, + introduced_in: definition.introduced_in, + phase: definition.phase, + meaning: definition.meaning, + rule: definition.rule, + remediation: definition.remediation, + evidence_scope: definition.evidence_scope, + evidence_policy: definition.evidence_policy, + evidence_limitation: definition.evidence_limitation, + docs_slug: definition.docs_slug, + } + } +} + +impl From for ConsultationServiceActivationFailure { + fn from(error: ConsultationServiceActivationError) -> Self { + error.safe_projection() + } +} + /// Conjunctive readiness for consultation admission. #[derive(Debug, Clone, Copy, PartialEq, Eq)] pub enum ConsultationServiceReadiness { @@ -1466,6 +1990,125 @@ mod tests { rhai_runtime_vector_plan_fixture, }; + #[test] + fn activation_catalog_versions_require_bounded_canonical_numeric_releases() { + for version in ["0.0.0", "1.2.3", "65535.65535.65535"] { + assert_eq!( + ConsultationServiceActivationVersion::from_reviewed(version) + .expect("version is valid") + .as_str(), + version + ); + } + + for version in [ + "", + "1", + "1.2", + "1.2.3.4", + "v1.2.3", + "1.2.3-alpha", + "1.2.3+build", + "01.2.3", + "1.02.3", + "1.2.03", + "65536.0.0", + "0.65536.0", + "0.0.65536", + " 1.2.3", + "1.2.3 ", + ] { + assert!( + ConsultationServiceActivationVersion::from_reviewed(version).is_none(), + "{version:?}" + ); + } + } + + #[test] + fn activation_catalog_lifecycle_requires_valid_non_retroactive_versions() { + let base = CONSULTATION_SERVICE_ACTIVATION_DEFINITIONS[0]; + let released = + ConsultationServiceActivationVersion::from_reviewed("0.13.1").expect("valid version"); + let tagged = ConsultationServiceActivationVersion::from_reviewed("0.13.0") + .expect("valid tagged version"); + let invalid = ConsultationServiceActivationVersion("unreleased"); + let cases = [ + ( + ConsultationServiceActivationLifecycle::Unreleased, + None, + true, + true, + ), + ( + ConsultationServiceActivationLifecycle::Unreleased, + Some(released), + false, + false, + ), + ( + ConsultationServiceActivationLifecycle::Active, + None, + false, + false, + ), + ( + ConsultationServiceActivationLifecycle::Active, + Some(invalid), + false, + false, + ), + ( + ConsultationServiceActivationLifecycle::Active, + Some(released), + true, + true, + ), + ( + ConsultationServiceActivationLifecycle::Deprecated, + None, + false, + false, + ), + ( + ConsultationServiceActivationLifecycle::Deprecated, + Some(invalid), + false, + false, + ), + ( + ConsultationServiceActivationLifecycle::Deprecated, + Some(released), + true, + true, + ), + ( + ConsultationServiceActivationLifecycle::Active, + Some(tagged), + true, + false, + ), + ]; + + for (lifecycle, introduced_in, lifecycle_valid, catalog_valid) in cases { + let definition = ConsultationServiceActivationDefinition { + lifecycle, + introduced_in, + ..base + }; + assert_eq!( + definition.lifecycle_metadata_is_valid(), + lifecycle_valid, + "{lifecycle:?} with {introduced_in:?}" + ); + assert_eq!( + definition.catalog_metadata_is_valid(), + catalog_valid, + "{lifecycle:?} with {introduced_in:?}" + ); + } + } + fn fixed_identity() -> ConfiguredOidcWorkloadProof { ConfiguredOidcWorkloadProof::new( ConfiguredIssuer::try_from("https://issuer.example.test/realms/registry").unwrap(), diff --git a/crates/registry-relay/src/ingest/cache.rs b/crates/registry-relay/src/ingest/cache.rs index 312f027c5..a03f983f0 100644 --- a/crates/registry-relay/src/ingest/cache.rs +++ b/crates/registry-relay/src/ingest/cache.rs @@ -320,7 +320,7 @@ mod tests { use futures::stream; use tempfile::TempDir; - use super::{gc_resource, write_atomic, CacheLayout}; + use super::{gc_resource, gc_resource_with_retention, write_atomic, CacheLayout}; use crate::config::{DatasetId, ResourceId}; use crate::error::IngestError; @@ -439,4 +439,34 @@ mod tests { assert!(!layout.final_path(&dataset, &resource, future).exists()); assert!(!layout.tmp_path(&dataset, &resource, current).exists()); } + + #[tokio::test] + async fn later_publication_bounds_retained_recovery_generations() { + let tmp = TempDir::new().expect("tempdir"); + let layout = CacheLayout::new(Arc::from(tmp.path())); + let dataset: DatasetId = id("dataset"); + let resource: ResourceId = id("resource"); + let oldest = ulid::Ulid::from_string("01ARZ3NDEKTSV4RRFFQ69G5FAV").unwrap(); + let previous = ulid::Ulid::from_string("01BRZ3NDEKTSV4RRFFQ69G5FAV").unwrap(); + let recovered = ulid::Ulid::from_string("01CRZ3NDEKTSV4RRFFQ69G5FAV").unwrap(); + let successor = ulid::Ulid::from_string("01DRZ3NDEKTSV4RRFFQ69G5FAV").unwrap(); + + for generation in [oldest, previous, recovered, successor] { + let path = layout.final_path(&dataset, &resource, generation); + tokio::fs::create_dir_all(path.parent().unwrap()) + .await + .unwrap(); + tokio::fs::write(path, b"cache").await.unwrap(); + } + + gc_resource_with_retention(&layout, &dataset, &resource, successor, 2).await; + + assert!(!layout.final_path(&dataset, &resource, oldest).exists()); + assert!(!layout.final_path(&dataset, &resource, previous).exists()); + assert!( + layout.final_path(&dataset, &resource, recovered).exists(), + "the recovered active generation remains as the bounded rollback predecessor" + ); + assert!(layout.final_path(&dataset, &resource, successor).exists()); + } } diff --git a/crates/registry-relay/src/ingest/mod.rs b/crates/registry-relay/src/ingest/mod.rs index c3e13225a..aafa10cd6 100644 --- a/crates/registry-relay/src/ingest/mod.rs +++ b/crates/registry-relay/src/ingest/mod.rs @@ -240,12 +240,12 @@ impl IngestPlan { ) -> Result<(), IngestError> { let provider_id = table_name(&self.dataset_id, &self.resource_id); - if matches!(prior, ResourceReadiness::NotReady) { - if let Some(active) = coordinator - .active_candidate(&provider_id) - .await - .map_err(|_| IngestError::MaterializationFailed)? - { + if let Some(active) = coordinator + .active_candidate(&provider_id) + .await + .map_err(|_| IngestError::MaterializationFailed)? + { + if snapshot_exact_requires_reconciliation(prior, active.generation) { return self.reconcile_snapshot_exact(coordinator, active).await; } } @@ -284,20 +284,17 @@ impl IngestPlan { return Err(IngestError::MaterializationFailed); } }; - let result = { - let _publication_guard = publication_write_guard().await; - self.commit_prepared(&prepared).await - }; + let result = { self.commit_durably_published_snapshot(&prepared).await }; match result { Ok(()) => { pending.finish(); self.finalize_prepared(&prepared).await; Ok(()) } - Err(error) => { - self.discard_prepared(&prepared).await; - Err(error) - } + // The state-plane active pointer already names this exact + // generation. Keep its immutable bytes for restart reconciliation; + // dropping `pending` leaves the local publication slot unavailable. + Err(error) => Err(error), } } @@ -307,13 +304,9 @@ impl IngestPlan { active: crate::source_backend::ActiveSnapshotCandidate, ) -> Result<(), IngestError> { let provider_id = table_name(&self.dataset_id, &self.resource_id); - let path = - self.cache_layout - .final_path(&self.dataset_id, &self.resource_id, active.generation); - let digest = sha256_file(&path).await?; - if digest != active.digest { - return Err(IngestError::MaterializationFailed); - } + let (path, digest) = self + .verified_active_snapshot_path(active.generation, active.digest) + .await?; let schema = self.declared.to_arrow_schema(); let provider = self .snapshot_table_provider(&path, Arc::clone(&schema)) @@ -350,12 +343,27 @@ impl IngestPlan { source_revision: None, source_observed_at_unix_ms: None, }; - self.commit_prepared(&prepared).await?; + self.commit_durably_published_snapshot(&prepared).await?; pending.finish(); self.finalize_prepared(&prepared).await; Ok(()) } + async fn verified_active_snapshot_path( + &self, + generation: Ulid, + expected_digest: [u8; 32], + ) -> Result<(PathBuf, [u8; 32]), IngestError> { + let path = self + .cache_layout + .final_path(&self.dataset_id, &self.resource_id, generation); + let digest = sha256_file(&path).await?; + if digest != expected_digest { + return Err(IngestError::MaterializationFailed); + } + Ok((path, digest)) + } + /// Current readiness state. Cheap arc-swap load. pub fn readiness(&self) -> ResourceReadiness { self.readiness.load_full().as_ref().clone() @@ -599,23 +607,12 @@ impl IngestPlan { use datafusion::datasource::file_format::parquet::ParquetFormat as DFParquetFormat; let parquet_path = tokio::fs::canonicalize(parquet_path).await.map_err(|e| { - tracing::error!( - event = "ingest.registration_failed", - dataset_id = %self.dataset_id, - resource_id = %self.resource_id, - path = %parquet_path.display(), - error = %e, - ); + self.log_registration_failure(&e, Some(parquet_path)); IngestError::RegistrationFailed })?; let url_str = format!("file://{}", parquet_path.display()); let table_url = ListingTableUrl::parse(&url_str).map_err(|e| { - tracing::error!( - event = "ingest.registration_failed", - dataset_id = %self.dataset_id, - resource_id = %self.resource_id, - error = %e, - ); + self.log_registration_failure(&e, None); IngestError::RegistrationFailed })?; @@ -627,16 +624,41 @@ impl IngestPlan { .with_schema(schema); let table = ListingTable::try_new(config).map_err(|e| { + self.log_registration_failure(&e, None); + IngestError::RegistrationFailed + })?; + + Ok(Arc::new(table)) + } + + fn log_registration_failure( + &self, + error: &dyn std::fmt::Display, + path: Option<&std::path::Path>, + ) { + if self.materializations.get().is_some() { tracing::error!( event = "ingest.registration_failed", dataset_id = %self.dataset_id, resource_id = %self.resource_id, - error = %e, + "snapshot-exact registration failed with redacted diagnostics", ); - IngestError::RegistrationFailed - })?; - - Ok(Arc::new(table)) + } else if let Some(path) = path { + tracing::error!( + event = "ingest.registration_failed", + dataset_id = %self.dataset_id, + resource_id = %self.resource_id, + path = %path.display(), + error = %error, + ); + } else { + tracing::error!( + event = "ingest.registration_failed", + dataset_id = %self.dataset_id, + resource_id = %self.resource_id, + error = %error, + ); + } } async fn commit_prepared(&self, prepared: &PreparedIngest) -> Result<(), IngestError> { @@ -648,12 +670,7 @@ impl IngestPlan { ) .await .map_err(|e| { - tracing::error!( - event = "ingest.registration_failed", - dataset_id = %self.dataset_id, - resource_id = %self.resource_id, - error = %e, - ); + self.log_registration_failure(&e, None); IngestError::RegistrationFailed })?; @@ -669,6 +686,21 @@ impl IngestPlan { Ok(()) } + /// Install a candidate after its audited publication advanced the durable + /// active pointer. + /// + /// A registration failure must leave the exact Parquet candidate intact. + /// The pending publication guard then leaves consultations unavailable, + /// and the next attempt reconciles these bytes against the durable pointer + /// before the connector may be opened again. + async fn commit_durably_published_snapshot( + &self, + prepared: &PreparedIngest, + ) -> Result<(), IngestError> { + let _publication_guard = publication_write_guard().await; + self.commit_prepared(prepared).await + } + async fn finalize_prepared(&self, prepared: &PreparedIngest) { if prepared.cache_path.is_some() { cache::gc_resource_with_retention( @@ -684,7 +716,15 @@ impl IngestPlan { .await; } - if let Some(path) = &prepared.cache_path { + if self.materializations.get().is_some() { + tracing::info!( + event = "ingest.complete", + dataset_id = %self.dataset_id, + resource_id = %self.resource_id, + ingest_ulid = %prepared.readiness_ingest_ulid, + materialization = materialization_label(self.materialization), + ); + } else if let Some(path) = &prepared.cache_path { tracing::info!( event = "ingest.complete", dataset_id = %self.dataset_id, @@ -710,24 +750,43 @@ impl IngestPlan { }; match tokio::fs::remove_file(path).await { Ok(()) => { - tracing::debug!( - event = "ingest.prepared_cache_discarded", - dataset_id = %self.dataset_id, - resource_id = %self.resource_id, - ingest_ulid = %prepared.readiness_ingest_ulid, - path = %path.display(), - ); + if self.materializations.get().is_some() { + tracing::debug!( + event = "ingest.prepared_cache_discarded", + dataset_id = %self.dataset_id, + resource_id = %self.resource_id, + ingest_ulid = %prepared.readiness_ingest_ulid, + ); + } else { + tracing::debug!( + event = "ingest.prepared_cache_discarded", + dataset_id = %self.dataset_id, + resource_id = %self.resource_id, + ingest_ulid = %prepared.readiness_ingest_ulid, + path = %path.display(), + ); + } } Err(error) if error.kind() == io::ErrorKind::NotFound => {} Err(error) => { - tracing::warn!( - event = "ingest.prepared_cache_cleanup_failed", - dataset_id = %self.dataset_id, - resource_id = %self.resource_id, - ingest_ulid = %prepared.readiness_ingest_ulid, - path = %path.display(), - error = %error, - ); + if self.materializations.get().is_some() { + tracing::warn!( + event = "ingest.prepared_cache_cleanup_failed", + dataset_id = %self.dataset_id, + resource_id = %self.resource_id, + ingest_ulid = %prepared.readiness_ingest_ulid, + "snapshot-exact cache cleanup failed with redacted diagnostics", + ); + } else { + tracing::warn!( + event = "ingest.prepared_cache_cleanup_failed", + dataset_id = %self.dataset_id, + resource_id = %self.resource_id, + ingest_ulid = %prepared.readiness_ingest_ulid, + path = %path.display(), + error = %error, + ); + } } } } @@ -795,6 +854,16 @@ pub enum ResourceReadiness { }, } +fn snapshot_exact_requires_reconciliation( + prior: &ResourceReadiness, + active_generation: Ulid, +) -> bool { + match prior { + ResourceReadiness::Ready { ingest_ulid, .. } => *ingest_ulid != active_generation, + ResourceReadiness::NotReady | ResourceReadiness::Failed { .. } => true, + } +} + // ── IngestRegistry ──────────────────────────────────────────────────────────── /// Top-level registry of every configured resource's [`IngestPlan`]. @@ -1591,6 +1660,7 @@ mod tests { use std::pin::Pin; use std::sync::atomic::{AtomicBool, AtomicUsize, Ordering}; + use datafusion::execution::context::SessionConfig; use tempfile::TempDir; use tokio::sync::Notify; use tokio::time::{timeout, Duration}; @@ -1787,6 +1857,119 @@ mod tests { } } + #[test] + fn snapshot_exact_reconciles_uninstalled_durable_generation_before_acquisition() { + let active = Ulid::from_string("01J5K8M0000000000000000002").expect("active generation"); + let previous = + Ulid::from_string("01J5K8M0000000000000000001").expect("previous generation"); + let schema = DeclaredSchema::from(&csv_schema_config()).to_arrow_schema(); + let failed = ResourceReadiness::Failed { + code: "ingest.registration_failed", + since: OffsetDateTime::UNIX_EPOCH, + }; + let stale_ready = ResourceReadiness::Ready { + ingest_ulid: previous, + schema: Arc::clone(&schema), + registered_at: OffsetDateTime::UNIX_EPOCH, + source_revision: None, + }; + let current_ready = ResourceReadiness::Ready { + ingest_ulid: active, + schema, + registered_at: OffsetDateTime::UNIX_EPOCH, + source_revision: None, + }; + + assert!(snapshot_exact_requires_reconciliation( + &ResourceReadiness::NotReady, + active + )); + assert!(snapshot_exact_requires_reconciliation(&failed, active)); + assert!(snapshot_exact_requires_reconciliation(&stale_ready, active)); + assert!( + !snapshot_exact_requires_reconciliation(¤t_ready, active), + "only an already installed exact generation may acquire a successor" + ); + } + + #[tokio::test] + async fn snapshot_exact_reconciliation_rejects_missing_and_mismatched_active_bytes() { + let tmp = TempDir::new().expect("tempdir"); + let source = ToggleSource::new("resource"); + let plan = successful_plan( + "dataset", + "resource", + Arc::clone(&source), + Arc::from(tmp.path()), + Arc::new(SessionContext::new()), + ); + let generation = + Ulid::from_string("01J5K8M0000000000000000002").expect("active generation"); + let path = plan + .cache_layout + .final_path(&id("dataset"), &id("resource"), generation); + let expected_digest: [u8; 32] = Sha256::digest(b"exact active bytes").into(); + + assert!(matches!( + plan.verified_active_snapshot_path(generation, expected_digest) + .await, + Err(IngestError::MaterializationFailed) + )); + + tokio::fs::create_dir_all(path.parent().expect("cache path has parent")) + .await + .expect("create cache directory"); + tokio::fs::write(&path, b"different bytes") + .await + .expect("write mismatched candidate"); + assert!(matches!( + plan.verified_active_snapshot_path(generation, expected_digest) + .await, + Err(IngestError::MaterializationFailed) + )); + assert_eq!( + source.open_count.load(Ordering::SeqCst), + 0, + "reconciliation failures must not fall back to connector access" + ); + } + + #[tokio::test] + async fn durably_published_candidate_survives_local_registration_failure() { + let tmp = TempDir::new().expect("tempdir"); + let source = ToggleSource::new("resource"); + let session = SessionContext::new_with_config( + SessionConfig::new().with_create_default_catalog_and_schema(false), + ); + let plan = successful_plan( + "dataset", + "resource", + source, + Arc::from(tmp.path()), + Arc::new(session), + ); + let prepared = plan + .prepare_snapshot_pipeline(None) + .await + .expect("candidate preparation succeeds before registration"); + let candidate_path = prepared + .cache_path + .clone() + .expect("snapshot candidate has a cache path"); + + let error = plan + .commit_durably_published_snapshot(&prepared) + .await + .expect_err("missing catalog makes local registration fail"); + + assert!(matches!(error, IngestError::RegistrationFailed)); + assert!( + candidate_path.exists(), + "durable active bytes must remain available for exact reconciliation" + ); + assert!(matches!(plan.readiness(), ResourceReadiness::NotReady)); + } + #[tokio::test] async fn repeated_failures_preserve_failed_since_until_success() { let plan = test_plan(Arc::new(FailingFormat)); diff --git a/crates/registry-relay/src/lib.rs b/crates/registry-relay/src/lib.rs index b51d5de8d..1b80fe2cd 100644 --- a/crates/registry-relay/src/lib.rs +++ b/crates/registry-relay/src/lib.rs @@ -31,6 +31,7 @@ pub mod metadata; mod net; pub mod observability; pub use consultation::offline_fixture; +pub mod process_startup; pub mod query; pub mod rhai_worker; pub mod runtime_config; diff --git a/crates/registry-relay/src/main.rs b/crates/registry-relay/src/main.rs index 829150f59..38bb7a227 100644 --- a/crates/registry-relay/src/main.rs +++ b/crates/registry-relay/src/main.rs @@ -19,10 +19,10 @@ //! //! ## Error handling //! -//! `main` propagates failures as [`crate::error::Error`]. The error -//! taxonomy already covers config parsing and binding failures; the -//! process exit code is non-zero on any error and the failing line is -//! also emitted via `tracing::error!` so operators can correlate. +//! `main` returns a non-zero process exit on failure. Before a failure crosses +//! the default stderr/tracing boundary, it is reduced to a product-owned +//! [`registry_relay::process_startup`] code with static meaning and +//! remediation. Inner errors and runtime values are never rendered there. use std::collections::BTreeMap; use std::env; @@ -46,10 +46,10 @@ use registry_platform_audit::AuditChainProfile; use registry_platform_authcommon::{fingerprint_api_key, CredentialFingerprintProvider}; use registry_platform_config::{expand_config_env_vars, verify_config_bundle}; use registry_platform_ops::{ - antirollback_key_from_verified_bundle, audit_shipping_target, bundle_verify_rejection_result, + antirollback_key_from_verified_bundle, audit_shipping_target, bundle_verify_rejection_code, internal_config_hash, persist_bundle_acceptance as persist_config_bundle_acceptance, - verify_bundle_state_read_only, AuditSinkKind, ConfigOverrideMode, ConfigSource, - DeploymentProfile, + verify_bundle_state_read_only, ApplyReportResult, AuditSinkKind, BundleVerificationCode, + ConfigOverrideMode, ConfigSource, DeploymentProfile, }; use registry_relay::audit::{ AuditPipeline, ConfigAuditExt, FileSink, OperationalAuditEvent, StdoutSink, SyslogSink, @@ -60,12 +60,17 @@ use registry_relay::config::{self, AuditSinkConfig, Config, SourceConfig}; use registry_relay::consultation::operator::{ bootstrap_state, BootstrapStateRequest, BootstrapStateResult, }; -use registry_relay::consultation::ConsultationService; +use registry_relay::consultation::{ + ConsultationService, ConsultationServiceActivationError, ConsultationServiceActivationFailure, +}; use registry_relay::entity::EntityRegistry; use registry_relay::error::{ConfigError, Error}; use registry_relay::format::FormatRegistry; use registry_relay::ingest::{IngestRegistry, ReadinessSnapshot}; use registry_relay::observability::RequestMetrics; +use registry_relay::process_startup::{ + emit_process_startup_failure, ProcessStartupCode, ProcessStartupFailure, +}; use registry_relay::query::{AggregateQueryEngine, EntityQueryEngine}; use registry_relay::runtime_config::{RelayRuntimeHandle, RelayRuntimeSnapshot}; use registry_relay::serve::{serve_listener, ServeLimits}; @@ -76,6 +81,7 @@ use serde_json::{json, Value}; use time::{format_description::well_known::Rfc3339, OffsetDateTime}; use tokio::net::TcpListener; use tokio::sync::watch; +use tracing::instrument::WithSubscriber; use tracing::{error, info, warn}; use tracing_subscriber::{fmt, prelude::*, EnvFilter}; use ulid::Ulid; @@ -249,6 +255,28 @@ impl std_fmt::Display for CliError { impl StdError for CliError {} +/// Marker for a configuration-loader error whose stable process diagnostic was +/// emitted by the loader before it returned. +/// +/// The loader owns the detailed classification because it can distinguish +/// source, document, validation, bundle, metadata, and consultation failures. +/// Keeping this marker value-free prevents `main` from adding a second, +/// generic startup code or exposing the source error. +#[derive(Debug)] +struct ReportedConfigLoadFailure; + +impl std_fmt::Display for ReportedConfigLoadFailure { + fn fmt(&self, formatter: &mut std_fmt::Formatter<'_>) -> std_fmt::Result { + formatter.write_str("configuration load failure was already reported") + } +} + +impl StdError for ReportedConfigLoadFailure {} + +fn reported_config_load(result: Result) -> Result { + result.map_err(|_| ReportedConfigLoadFailure) +} + #[derive(Debug, Clone, Copy, PartialEq, Eq)] enum OperationalLogFormat { Text, @@ -284,11 +312,19 @@ async fn async_main() -> ExitCode { match run().await { Ok(()) => ExitCode::SUCCESS, Err(err) => { - // The error itself has already been logged at the failing - // site (config loader logs operator context; bind/serve - // failures are logged here). The exit code is the only - // surface left. - error!(error = %err, "registry-relay exiting with failure"); + if let Some(failure) = err.downcast_ref::() { + failure.emit(); + } else if err.downcast_ref::().is_none() { + let failure = err + .downcast_ref::() + .copied() + .unwrap_or_else(|| { + ProcessStartupFailure::new( + ProcessStartupCode::RUNTIME_INITIALIZATION_FAILED, + ) + }); + emit_process_startup_failure(failure.code()); + } ExitCode::FAILURE } } @@ -362,11 +398,21 @@ async fn run_server( let runtime = handle.load_full(); let app = build_relay_app_from_runtime(Arc::clone(&handle))?; - let listener = TcpListener::bind(runtime.bind).await.map_err(|err| { - error!(error = %err, bind = %runtime.bind, "failed to bind listener"); - err + let listener = TcpListener::bind(runtime.bind).await.map_err(|error| { + ProcessStartupFailure::new(ProcessStartupCode::from_data_listener_bind(error.kind())) })?; + let admin_listener = match runtime.admin_bind { + Some(addr) => Some(TcpListener::bind(addr).await.map_err(|error| { + ProcessStartupFailure::new(ProcessStartupCode::from_admin_listener_bind(error.kind())) + })?), + None => None, + }; + + // Do not render either configured binding before both requested listeners + // have opened successfully. A bind failure crosses the value-free process + // diagnostic boundary and must not inherit the other listener's address + // from a preceding informational event. info!( bind = %runtime.bind, admin_bind = ?runtime.admin_bind, @@ -377,14 +423,6 @@ async fn run_server( "registry-relay listening" ); - let admin_listener = match runtime.admin_bind { - Some(addr) => Some(TcpListener::bind(addr).await.map_err(|err| { - error!(error = %err, bind = %addr, "failed to bind admin listener"); - err - })?), - None => None, - }; - let serve_limits = ServeLimits::from_config(&runtime.config.server); let admin_app = if admin_listener.is_some() { let auth: AuthProviderRef = Arc::new(RuntimeAuthProvider::new(Arc::clone(&handle))); @@ -480,7 +518,7 @@ async fn run_openapi( env_file: Option, ) -> Result<(), Box> { load_env_file_arg(env_file.as_deref())?; - let config = config::load(&config_path)?; + let config = reported_config_load(config::load(&config_path))?; let registry = EntityRegistry::from_config(&config)?; let document = registry_relay::api::openapi::release_artifact_document(&config, ®istry); println!("{}", serde_json::to_string_pretty(&document)?); @@ -500,7 +538,7 @@ async fn run_doctor( if report.exit_success { Ok(()) } else { - Err(io::Error::other("registry-relay doctor failed").into()) + Err(ProcessStartupFailure::new(ProcessStartupCode::DOCTOR_FAILED).into()) } } } @@ -514,10 +552,10 @@ async fn run_explain_config( match format { OutputFormat::Json => { load_env_file_arg(env_file.as_deref())?; + let config = reported_config_load(config::load(&config_path))?; let raw = fs::read_to_string(&config_path)?; let expanded = expand_config_env_vars(&raw)?; let resolved_config = redacted_resolved_config(&expanded)?; - let config = config::load(&config_path)?; let report = json!({ "schema_version": "registry.config.explanation.v1", "product": "registry-relay", @@ -557,8 +595,8 @@ fn build_doctor_report( env_file: Option<&std::path::Path>, profile_override: Option, ) -> DoctorReport { - let raw_config = fs::read_to_string(config_path).ok(); let mut checks = Vec::new(); + let mut report_source = ConfigSource::LocalFile; if let Some(env_file) = env_file { match load_env_file_arg(Some(env_file)) { Ok(()) => checks.push(DoctorCheck::passed( @@ -577,24 +615,21 @@ fn build_doctor_report( } if checks.iter().any(|check| check.status == "failed") { - return DoctorReport::new( - checks, - None, - profile_override, - config_path, - raw_config.as_deref(), - ); + return DoctorReport::new(checks, None, profile_override, report_source); } let loaded_config = match config::load_with_metadata(config_path) { Ok(mut loaded) => { + report_source = loaded.provenance.source; checks.push(DoctorCheck::passed( "config", "relay.config.loaded", "config parsed and validated", None, )); - match EntityRegistry::from_config(&loaded.runtime) { + match suppress_runtime_source_diagnostics(|| { + EntityRegistry::from_config(&loaded.runtime) + }) { Ok(_) => checks.push(DoctorCheck::passed( "entity_registry", "relay.entity_registry.verified", @@ -635,22 +670,16 @@ fn build_doctor_report( loaded.runtime.consultation.is_some(), loaded.consultation_artifacts.take(), ) { - (true, Some(artifacts)) => match ConsultationService::validate_configuration( - &loaded.runtime, - artifacts, - ) { + (true, Some(artifacts)) => match suppress_runtime_source_diagnostics(|| { + ConsultationService::validate_configuration(&loaded.runtime, artifacts) + }) { Ok(()) => checks.push(DoctorCheck::passed( "consultation_artifacts", "relay.consultation_artifacts.verified", "consultation artifact closure compiled with closed runtime capabilities", None, )), - Err(_) => checks.push(DoctorCheck::failed( - "consultation_artifacts", - "relay.consultation_artifacts.failed", - "consultation artifact compilation failed", - Some("check the hash-pinned contracts, packs, bindings, and environment references"), - )), + Err(error) => checks.push(consultation_activation_doctor_check(error)), }, (false, None) => checks.push(DoctorCheck::passed( "consultation_artifacts", @@ -658,11 +687,11 @@ fn build_doctor_report( "consultation artifacts are not configured", None, )), - _ => checks.push(DoctorCheck::failed( - "consultation_artifacts", - "relay.consultation_artifacts.failed", - "consultation configuration and artifact closure disagree", - Some("check the consultation artifact manifest and runtime configuration"), + (true, None) => checks.push(consultation_activation_doctor_check( + ConsultationServiceActivationError::RegistryActivation, + )), + (false, Some(_)) => checks.push(consultation_activation_doctor_check( + ConsultationServiceActivationError::MissingConfiguration, )), } Some(loaded.runtime.clone()) @@ -682,8 +711,7 @@ fn build_doctor_report( checks, loaded_config.as_ref(), profile_override, - config_path, - raw_config.as_deref(), + report_source, ) } @@ -693,6 +721,11 @@ fn parse_doctor_config_without_validation(config_path: &std::path::Path) -> Opti serde_saphyr::from_str(&expanded).ok() } +fn suppress_runtime_source_diagnostics(action: impl FnOnce() -> T) -> T { + let dispatch = tracing::Dispatch::new(tracing::subscriber::NoSubscriber::default()); + tracing::dispatcher::with_default(&dispatch, action) +} + struct DoctorReport { output: Value, exit_success: bool, @@ -703,8 +736,7 @@ impl DoctorReport { checks: Vec, config: Option<&Config>, profile_override: Option, - config_path: &std::path::Path, - raw_config: Option<&str>, + source: ConfigSource, ) -> Self { let deployment_profile = resolve_deployment_profile(config, profile_override); let findings = deployment_findings(config, &deployment_profile); @@ -730,8 +762,7 @@ impl DoctorReport { "product": "registry-relay", "config_schema_version": RELAY_CONFIG_SCHEMA_VERSION, "source": { - "kind": "local_file", - "path": path_for_json(config_path), + "kind": source.as_posture_str(), }, "status": if error_count > 0 { ReportStatus::Error.as_str() @@ -752,11 +783,6 @@ impl DoctorReport { if let Some(config) = config { output["audit_shipping"] = audit_shipping_report(config); } - if let Some(raw) = raw_config { - output["hashes"] = json!({ - "internal_config_hash": internal_config_hash(raw.as_bytes()), - }); - } Self { output, exit_success, @@ -890,6 +916,48 @@ impl DoctorCheck { } } +fn consultation_activation_doctor_check(error: ConsultationServiceActivationError) -> DoctorCheck { + let projection = error.safe_projection(); + DoctorCheck::failed( + "consultation_artifacts", + projection.code.as_str(), + projection.meaning, + Some(projection.remediation), + ) +} + +#[derive(Debug)] +struct OperatorSafeConsultationActivationFailure(ConsultationServiceActivationFailure); + +impl From for OperatorSafeConsultationActivationFailure { + fn from(error: ConsultationServiceActivationError) -> Self { + Self(error.safe_projection()) + } +} + +impl std_fmt::Display for OperatorSafeConsultationActivationFailure { + fn fmt(&self, formatter: &mut std_fmt::Formatter<'_>) -> std_fmt::Result { + write!( + formatter, + "{}: {} Next action: {}", + self.0.code, self.0.meaning, self.0.remediation + ) + } +} + +impl StdError for OperatorSafeConsultationActivationFailure {} + +impl OperatorSafeConsultationActivationFailure { + fn emit(&self) { + error!( + code = self.0.code.as_str(), + meaning = self.0.meaning, + remediation = self.0.remediation, + "registry-relay consultation activation rejected startup" + ); + } +} + fn doctor_check_diagnostic(check: &DoctorCheck) -> Value { let mut message = check.message.to_string(); if let Some(action) = check.action { @@ -1150,17 +1218,20 @@ async fn run_config_verify_bundle( let verified = match verify_config_bundle(&command.bundle_dir, &command.anchor_path) { Ok(verified) => verified, Err(error) => { - let result = bundle_verify_rejection_result(&error); + let code = bundle_verify_rejection_code(&error); print_json_report(config_verify_bundle_report( - result, - "unknown", + ApplyReportResult::from(code), + None, None, None, None, None, - Some((result, error.to_string())), + Some(code), ))?; - return Err(Box::new(error)); + return Err( + ProcessStartupFailure::new(ProcessStartupCode::from_bundle_verification(code)) + .into(), + ); } }; let key = antirollback_key_from_verified_bundle(&verified); @@ -1171,33 +1242,39 @@ async fn run_config_verify_bundle( &verified.manifest.config_hash, &verified.manifest_hash, ) { + let code = error.bundle_rejection_code(); print_json_report(config_verify_bundle_report( - "rejected_rollback", - &verified.manifest.stream_id, - Some(verified.manifest.bundle_id.clone()), - Some(verified.manifest.sequence), - verified.manifest.previous_config_hash.clone(), - Some(verified.manifest.config_hash.clone()), - Some(("rejected_rollback", error.to_string())), + ApplyReportResult::from(code), + None, + None, + None, + None, + None, + Some(code), ))?; - return Err(Box::new(error)); + return Err( + ProcessStartupFailure::new(ProcessStartupCode::from_bundle_verification(code)).into(), + ); } - if let Err(error) = config::validate_verified_bundle_runtime(&verified) { + if config::validate_verified_bundle_runtime(&verified).is_err() { + let code = BundleVerificationCode::REJECTED_VALIDATION; print_json_report(config_verify_bundle_report( - "rejected_validation", - &verified.manifest.stream_id, - Some(verified.manifest.bundle_id.clone()), - Some(verified.manifest.sequence), - verified.manifest.previous_config_hash.clone(), - Some(verified.manifest.config_hash.clone()), - Some(("rejected_validation", error.to_string())), + ApplyReportResult::from(code), + None, + None, + None, + None, + None, + Some(code), ))?; - return Err(io::Error::new(io::ErrorKind::InvalidData, error.to_string()).into()); + return Err( + ProcessStartupFailure::new(ProcessStartupCode::BUNDLE_VALIDATION_REJECTED).into(), + ); } print_json_report(config_verify_bundle_report( - "verified", - &verified.manifest.stream_id, + ApplyReportResult::Verified, + Some(verified.manifest.stream_id), Some(verified.manifest.bundle_id), Some(verified.manifest.sequence), verified.manifest.previous_config_hash, @@ -1213,16 +1290,37 @@ fn print_json_report(value: Value) -> Result<(), Box, bundle_id: Option, bundle_sequence: Option, previous_config_hash: Option, config_hash: Option, - error: Option<(&'static str, String)>, + error: Option, ) -> Value { + // Rejection inputs are untrusted. Even when authenticity succeeded before + // a later anti-rollback or product-validation failure, do not publish + // bundle, stream, sequence, or hash identity through this report. + let (stream_id, bundle_id, bundle_sequence, previous_config_hash, config_hash) = + if error.is_some() { + (None, None, None, None, None) + } else { + ( + stream_id, + bundle_id, + bundle_sequence, + previous_config_hash, + config_hash, + ) + }; let errors = error - .map(|(code, message)| vec![json!({ "code": code, "message": message })]) + .map(|code| { + let definition = code.definition(); + vec![json!({ + "code": code.as_str(), + "message": definition.safe_report_message, + })] + }) .unwrap_or_default(); json!({ "schema": "registry.platform.config_apply_report.v1", @@ -1234,7 +1332,7 @@ fn config_verify_bundle_report( "bundle_sequence": bundle_sequence, "previous_config_hash": previous_config_hash, "config_hash": config_hash, - "result": result, + "result": result.as_str(), "restart_required": false, "change_classes": [], "affected_components": [], @@ -1310,9 +1408,12 @@ async fn compile_relay_runtime_with_options( bind_override: Option, load_options: config::LoadOptions, ) -> Result> { - info!(path = %config_path.display(), "loading registry-relay config"); + info!("loading registry-relay config"); - let loaded = config::load_with_metadata_options(&config_path, load_options)?; + let loaded = reported_config_load(config::load_with_metadata_options( + &config_path, + load_options, + ))?; let config_provenance = loaded.provenance.clone(); let pending_bundle_acceptance = loaded.pending_bundle_acceptance.clone(); let compiled_metadata = loaded.metadata.map(Arc::new); @@ -1320,18 +1421,21 @@ async fn compile_relay_runtime_with_options( let consultation_artifacts = loaded.consultation_artifacts; let config = Arc::new(loaded.runtime); - let auth = build_auth(&config).await?; - let audit_chain_profile = build_audit_chain_profile(&config)?; + let auth = build_auth(&config) + .with_subscriber(tracing::subscriber::NoSubscriber::default()) + .await + .map_err(|_| ProcessStartupFailure::new(ProcessStartupCode::CONFIG_VALIDATION_REJECTED))?; + let audit_chain_profile = build_audit_chain_profile(&config) + .map_err(|_| ProcessStartupFailure::new(ProcessStartupCode::CONFIG_VALIDATION_REJECTED))?; let audit_sink = build_audit_sink(&config, audit_chain_profile.clone())?; // Eagerly verify the retained audit chain so a chain bricked by an earlier // fork surfaces as an actionable /ready signal instead of a per-request 503 // behind a green healthcheck (#196). Startup is not aborted: readiness // reports not-ready until the operator recovers with `registry-relay audit // quarantine`. - if let Err(err) = audit_sink.verify_chain_eager().await { + if audit_sink.verify_chain_eager().await.is_err() { error!( code = registry_relay::audit::AUDIT_CHAIN_INCONSISTENT_CODE, - error = %err, "audit chain failed startup verification; /ready will report not-ready until it is recovered" ); } @@ -1349,13 +1453,19 @@ async fn compile_relay_runtime_with_options( let df_ctx = Arc::new(SessionContext::new()); let formats = Arc::new(FormatRegistry::with_v1_defaults()); let cache_root = Arc::from(config.server.cache_dir.as_path()); - let ingest = Arc::new(IngestRegistry::from_config( - &config, - formats, - cache_root, - Arc::clone(&df_ctx), - )?); - let entity_registry = Arc::new(EntityRegistry::from_config(&config)?); + let ingest = Arc::new( + suppress_runtime_source_diagnostics(|| { + IngestRegistry::from_config(&config, formats, cache_root, Arc::clone(&df_ctx)) + }) + .map_err(|_| { + ProcessStartupFailure::new(ProcessStartupCode::RUNTIME_INITIALIZATION_FAILED) + })?, + ); + let entity_registry = Arc::new( + suppress_runtime_source_diagnostics(|| EntityRegistry::from_config(&config)).map_err( + |_| ProcessStartupFailure::new(ProcessStartupCode::CONFIG_VALIDATION_REJECTED), + )?, + ); let query = Arc::new(EntityQueryEngine::new( Arc::clone(&df_ctx), Arc::clone(&entity_registry), @@ -1381,17 +1491,15 @@ async fn compile_relay_runtime_with_options( audit_chain_profile.hasher(), Arc::clone(&df_ctx), ) - .await?, + .with_subscriber(tracing::subscriber::NoSubscriber::default()) + .await + .map_err(OperatorSafeConsultationActivationFailure::from)?, ), - (configured, artifacts) => { - error!( - code = "config.validation_error", - field = "consultation.artifacts", - consultation_configured = configured, - verified_artifacts_present = artifacts.is_some(), - "consultation configuration and verified artifact closure disagree" - ); - return Err(Error::from(ConfigError::ValidationError).into()); + _ => { + return Err(ProcessStartupFailure::new( + ProcessStartupCode::CONSULTATION_ARTIFACTS_REJECTED, + ) + .into()); } }; if let Some(service) = consultation.as_ref() { @@ -1442,6 +1550,10 @@ async fn write_bundle_acceptance_audit( audit_sink: &AuditPipeline, acceptance: &config::PendingBundleAcceptance, ) -> Result<(), Box> { + // Accepted bundle identity and signer evidence is intentionally retained + // here. The audit sink, including the stdout sink, is a governed protected + // evidence boundary. This must not be weakened to match the untrusted + // rejection-report boundary. let audit = ConfigAuditExt { action: "boot", source: acceptance.source.as_posture_str(), @@ -2441,10 +2553,8 @@ fn build_audit_chain_profile(config: &Config) -> Result Result Result, Error> { +) -> Result, ProcessStartupFailure> { let sink: Arc = match &config.audit.sink { AuditSinkConfig::Stdout {} => Arc::new(StdoutSink::new()), AuditSinkConfig::File { path, rotate } => { match FileSink::new(path, rotate.max_size_mb, rotate.max_files) { Ok(sink) => Arc::new(sink), - Err(err) => { - error!( - error = %err, - requested = "file", - path = %path.display(), - "configured audit file sink is unavailable" - ); - return Err(Error::from(ConfigError::ValidationError)); + Err(_) => { + return Err(ProcessStartupFailure::new( + ProcessStartupCode::RUNTIME_INITIALIZATION_FAILED, + )); } } } AuditSinkConfig::Syslog {} => Arc::new(SyslogSink::new()), _ => { - error!("unknown audit sink variant"); - return Err(Error::from(ConfigError::ValidationError)); + return Err(ProcessStartupFailure::new( + ProcessStartupCode::CONFIG_VALIDATION_REJECTED, + )); } }; if !config.audit.chain { @@ -2589,13 +2696,15 @@ fn install_sigterm_listener() -> io::Result { #[cfg(test)] mod tests { use super::{ - build_audit_chain_profile, build_audit_sink, compile_relay_runtime, load_env_file_arg, + build_audit_chain_profile, build_audit_sink, compile_relay_runtime, + consultation_activation_doctor_check, doctor_check_diagnostic, load_env_file_arg, parse_cli_command_from, parse_env_file_value, redacted_resolved_config, relay_config_value_classification, relay_live_apply_classes, render_generated_api_key, required_env_report, run_audit_quarantine, run_healthcheck, url_contains_userinfo, CliCommand, ConfigValueClassification, ConsultationBootstrapStateCommand, - GenerateApiKeyCommand, OperationalLogFormat, OutputFormat, DEFAULT_HEALTHCHECK_TIMEOUT_MS, - DEFAULT_HEALTHCHECK_URL, MAX_EXACT_JSON_INTEGER, + ConsultationServiceActivationError, GenerateApiKeyCommand, OperationalLogFormat, + OperatorSafeConsultationActivationFailure, OutputFormat, ReportedConfigLoadFailure, + DEFAULT_HEALTHCHECK_TIMEOUT_MS, DEFAULT_HEALTHCHECK_URL, MAX_EXACT_JSON_INTEGER, }; use axum::routing::get; use axum::Router; @@ -2623,6 +2732,81 @@ mod tests { const CONFIG_BUNDLE_PRIVATE_JWK: &str = r#"{"kty":"OKP","crv":"Ed25519","d":"2oPoxdKuO7Kpd-3JLfNW_4xwpFxItbS-fxe03ZybYEw","x":"1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc","alg":"EdDSA"}"#; + #[test] + fn consultation_activation_boundary_doctor_preserves_exact_distinct_codes() { + let errors = [ + ConsultationServiceActivationError::MissingConfiguration, + ConsultationServiceActivationError::UnsupportedPlan, + ]; + let checks = errors.map(consultation_activation_doctor_check); + + assert_ne!(checks[0].code, checks[1].code); + assert_ne!(checks[0].message, checks[1].message); + for (error, check) in errors.into_iter().zip(checks) { + let projection = error.safe_projection(); + assert_eq!(check.code, projection.code.as_str()); + assert_eq!(check.message, projection.meaning); + assert_eq!(check.action, Some(projection.remediation)); + assert_ne!(check.code, "relay.consultation_artifacts.failed"); + + let diagnostic = doctor_check_diagnostic(&check); + assert_eq!(diagnostic["code"], projection.code.as_str()); + assert_eq!( + diagnostic["message"], + format!( + "{} Next action: {}", + projection.meaning, projection.remediation + ) + ); + } + } + + #[test] + fn consultation_activation_boundary_startup_uses_only_static_safe_projection() { + let errors = [ + ConsultationServiceActivationError::MissingConfiguration, + ConsultationServiceActivationError::InvalidWorkloadBinding, + ConsultationServiceActivationError::RegistryActivation, + ConsultationServiceActivationError::UnsupportedPlan, + ConsultationServiceActivationError::InvalidQuotaLimits, + ConsultationServiceActivationError::InvalidMetadata, + ConsultationServiceActivationError::SourceCredentials, + ConsultationServiceActivationError::PseudonymMaterial, + ConsultationServiceActivationError::StatePlane, + ]; + let sentinels = [ + "/tmp/COUNTRY/private/source.yaml", + "sha256:COUNTRY_HASH", + "COUNTRY_PARSER_ERROR", + "redaction-user@example.test", + "COUNTRY_SECRET_VALUE", + "COUNTRY_VALUE", + ]; + + for error in errors { + let old_display = error.to_string(); + let projection = error.safe_projection(); + let rendered = OperatorSafeConsultationActivationFailure::from(error).to_string(); + assert_eq!( + rendered, + format!( + "{}: {} Next action: {}", + projection.code, projection.meaning, projection.remediation + ) + ); + assert_ne!( + rendered, old_display, + "startup must not propagate the legacy activation Display" + ); + for sentinel in sentinels { + assert!( + !rendered.contains(sentinel), + "operator-safe startup failure leaked sentinel {sentinel:?}" + ); + } + } + } + #[cfg(unix)] #[tokio::test] async fn sigterm_listener_can_be_installed() { @@ -2918,11 +3102,26 @@ config_trust: .await .expect("signed recovery audit writes"); - let signed_events = audit_event_names(&signed_sink.snapshot()); + let signed_lines = signed_sink.snapshot(); + let signed_events = audit_event_names(&signed_lines); assert_eq!(signed_events, vec!["config.bundle_accepted"]); assert!(!signed_events .iter() .any(|event| event == "config.break_glass_used")); + let accepted_envelope: Value = + serde_json::from_str(&signed_lines[0]).expect("accepted audit envelope json"); + assert_eq!( + accepted_envelope["record"]["config"]["bundle_id"], + "relay-loader-bundle" + ); + assert_eq!( + accepted_envelope["record"]["config"]["signer_kids"], + json!(["kid-1"]) + ); + assert_eq!( + accepted_envelope["record"]["config"]["config_hash"], + signed_acceptance.config_hash + ); let unsigned_hash = test_hash('c'); let mut unsigned_pin = @@ -3056,7 +3255,9 @@ config_trust: .expect_err("occupied listener rejects startup"); assert!( - error.to_string().contains("Address already in use"), + error + .to_string() + .contains("relay.startup.data_listener_address_in_use"), "unexpected error: {error}" ); let key = AntiRollbackKey { @@ -4089,10 +4290,24 @@ consultation: }; assert!( - err.to_string() - .contains("set deployment.profile: local for development"), + err.downcast_ref::().is_some(), "unexpected error: {err}" ); + let rendered = err.to_string(); + assert_eq!( + rendered, "configuration load failure was already reported", + "loader boundary must remain value-free" + ); + for forbidden in [ + "deployment.profile_undeclared", + "set deployment.profile: local for development", + "production/evidence_grade", + ] { + assert!( + !rendered.contains(forbidden), + "loader boundary leaked profile-local detail {forbidden:?}: {rendered}" + ); + } } #[test] diff --git a/crates/registry-relay/src/process_startup.rs b/crates/registry-relay/src/process_startup.rs new file mode 100644 index 000000000..0beb0289d --- /dev/null +++ b/crates/registry-relay/src/process_startup.rs @@ -0,0 +1,560 @@ +// SPDX-License-Identifier: Apache-2.0 +//! Stable, value-free operator diagnostics for the Relay process boundary. +//! +//! Startup source errors can contain local paths, parser excerpts, URLs, +//! identities, hashes, and supplied values. They must be classified before +//! crossing the default stderr or tracing boundary. The private representation +//! prevents callers from constructing unreviewed codes, while [`ProcessStartupCode::ALL`] +//! and [`PROCESS_STARTUP_CODE_DEFINITIONS`] expose the complete catalog for +//! generated references and release checks. + +use std::fmt::{self, Display}; +use std::io; + +use registry_platform_ops::BundleVerificationCode; +use serde::Serialize; + +/// One reviewed Relay process-boundary failure category. +#[derive(Clone, Copy, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)] +pub struct ProcessStartupCode(ProcessStartupCodeValue); + +#[derive(Clone, Copy, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)] +enum ProcessStartupCodeValue { + AdminListenerAddressInUse, + AdminListenerPermissionDenied, + AdminListenerUnavailable, + BundleBindingRejected, + BundleRollbackRejected, + BundleSignatureRejected, + BundleValidationRejected, + ConfigDeprecatedFieldRejected, + ConfigDocumentInvalid, + ConfigEnvironmentBindingRejected, + ConfigSourceUnavailable, + ConfigValidationRejected, + ConsultationArtifactsRejected, + DataListenerAddressInUse, + DataListenerPermissionDenied, + DataListenerUnavailable, + DoctorFailed, + RuntimeInitializationFailed, +} + +impl ProcessStartupCode { + pub const ADMIN_LISTENER_ADDRESS_IN_USE: Self = + Self(ProcessStartupCodeValue::AdminListenerAddressInUse); + pub const ADMIN_LISTENER_PERMISSION_DENIED: Self = + Self(ProcessStartupCodeValue::AdminListenerPermissionDenied); + pub const ADMIN_LISTENER_UNAVAILABLE: Self = + Self(ProcessStartupCodeValue::AdminListenerUnavailable); + pub const BUNDLE_BINDING_REJECTED: Self = Self(ProcessStartupCodeValue::BundleBindingRejected); + pub const BUNDLE_ROLLBACK_REJECTED: Self = + Self(ProcessStartupCodeValue::BundleRollbackRejected); + pub const BUNDLE_SIGNATURE_REJECTED: Self = + Self(ProcessStartupCodeValue::BundleSignatureRejected); + pub const BUNDLE_VALIDATION_REJECTED: Self = + Self(ProcessStartupCodeValue::BundleValidationRejected); + pub const CONFIG_DEPRECATED_FIELD_REJECTED: Self = + Self(ProcessStartupCodeValue::ConfigDeprecatedFieldRejected); + pub const CONFIG_DOCUMENT_INVALID: Self = Self(ProcessStartupCodeValue::ConfigDocumentInvalid); + pub const CONFIG_ENVIRONMENT_BINDING_REJECTED: Self = + Self(ProcessStartupCodeValue::ConfigEnvironmentBindingRejected); + pub const CONFIG_SOURCE_UNAVAILABLE: Self = + Self(ProcessStartupCodeValue::ConfigSourceUnavailable); + pub const CONFIG_VALIDATION_REJECTED: Self = + Self(ProcessStartupCodeValue::ConfigValidationRejected); + pub const CONSULTATION_ARTIFACTS_REJECTED: Self = + Self(ProcessStartupCodeValue::ConsultationArtifactsRejected); + pub const DATA_LISTENER_ADDRESS_IN_USE: Self = + Self(ProcessStartupCodeValue::DataListenerAddressInUse); + pub const DATA_LISTENER_PERMISSION_DENIED: Self = + Self(ProcessStartupCodeValue::DataListenerPermissionDenied); + pub const DATA_LISTENER_UNAVAILABLE: Self = + Self(ProcessStartupCodeValue::DataListenerUnavailable); + pub const DOCTOR_FAILED: Self = Self(ProcessStartupCodeValue::DoctorFailed); + pub const RUNTIME_INITIALIZATION_FAILED: Self = + Self(ProcessStartupCodeValue::RuntimeInitializationFailed); + + /// Every published Relay process-boundary code in stable string order. + pub const ALL: &'static [Self] = &[ + Self::ADMIN_LISTENER_ADDRESS_IN_USE, + Self::ADMIN_LISTENER_PERMISSION_DENIED, + Self::ADMIN_LISTENER_UNAVAILABLE, + Self::BUNDLE_BINDING_REJECTED, + Self::BUNDLE_ROLLBACK_REJECTED, + Self::BUNDLE_SIGNATURE_REJECTED, + Self::BUNDLE_VALIDATION_REJECTED, + Self::CONFIG_DEPRECATED_FIELD_REJECTED, + Self::CONFIG_DOCUMENT_INVALID, + Self::CONFIG_ENVIRONMENT_BINDING_REJECTED, + Self::CONFIG_SOURCE_UNAVAILABLE, + Self::CONFIG_VALIDATION_REJECTED, + Self::CONSULTATION_ARTIFACTS_REJECTED, + Self::DATA_LISTENER_ADDRESS_IN_USE, + Self::DATA_LISTENER_PERMISSION_DENIED, + Self::DATA_LISTENER_UNAVAILABLE, + Self::DOCTOR_FAILED, + Self::RUNTIME_INITIALIZATION_FAILED, + ]; + + #[must_use] + pub const fn as_str(self) -> &'static str { + match self.0 { + ProcessStartupCodeValue::AdminListenerAddressInUse => { + "relay.startup.admin_listener_address_in_use" + } + ProcessStartupCodeValue::AdminListenerPermissionDenied => { + "relay.startup.admin_listener_permission_denied" + } + ProcessStartupCodeValue::AdminListenerUnavailable => { + "relay.startup.admin_listener_unavailable" + } + ProcessStartupCodeValue::BundleBindingRejected => { + "relay.startup.bundle_binding_rejected" + } + ProcessStartupCodeValue::BundleRollbackRejected => { + "relay.startup.bundle_rollback_rejected" + } + ProcessStartupCodeValue::BundleSignatureRejected => { + "relay.startup.bundle_signature_rejected" + } + ProcessStartupCodeValue::BundleValidationRejected => { + "relay.startup.bundle_validation_rejected" + } + ProcessStartupCodeValue::ConfigDeprecatedFieldRejected => { + "relay.startup.config_deprecated_field_rejected" + } + ProcessStartupCodeValue::ConfigDocumentInvalid => { + "relay.startup.config_document_invalid" + } + ProcessStartupCodeValue::ConfigEnvironmentBindingRejected => { + "relay.startup.config_environment_binding_rejected" + } + ProcessStartupCodeValue::ConfigSourceUnavailable => { + "relay.startup.config_source_unavailable" + } + ProcessStartupCodeValue::ConfigValidationRejected => { + "relay.startup.config_validation_rejected" + } + ProcessStartupCodeValue::ConsultationArtifactsRejected => { + "relay.startup.consultation_artifacts_rejected" + } + ProcessStartupCodeValue::DataListenerAddressInUse => { + "relay.startup.data_listener_address_in_use" + } + ProcessStartupCodeValue::DataListenerPermissionDenied => { + "relay.startup.data_listener_permission_denied" + } + ProcessStartupCodeValue::DataListenerUnavailable => { + "relay.startup.data_listener_unavailable" + } + ProcessStartupCodeValue::DoctorFailed => "relay.startup.doctor_failed", + ProcessStartupCodeValue::RuntimeInitializationFailed => { + "relay.startup.runtime_initialization_failed" + } + } + } + + #[must_use] + pub fn definition(self) -> &'static ProcessStartupCodeDefinition { + PROCESS_STARTUP_CODE_DEFINITIONS + .iter() + .find(|definition| definition.code == self) + .expect("every closed Relay process code has one catalog definition") + } + + /// Classify a data-plane listener bind failure without retaining the + /// address, port, or operating-system error text. + #[must_use] + pub fn from_data_listener_bind(error_kind: io::ErrorKind) -> Self { + match error_kind { + io::ErrorKind::AddrInUse => Self::DATA_LISTENER_ADDRESS_IN_USE, + io::ErrorKind::PermissionDenied => Self::DATA_LISTENER_PERMISSION_DENIED, + _ => Self::DATA_LISTENER_UNAVAILABLE, + } + } + + /// Classify an administration listener bind failure without retaining the + /// address, port, or operating-system error text. + #[must_use] + pub fn from_admin_listener_bind(error_kind: io::ErrorKind) -> Self { + match error_kind { + io::ErrorKind::AddrInUse => Self::ADMIN_LISTENER_ADDRESS_IN_USE, + io::ErrorKind::PermissionDenied => Self::ADMIN_LISTENER_PERMISSION_DENIED, + _ => Self::ADMIN_LISTENER_UNAVAILABLE, + } + } + + /// Project a shared bundle-verification category into the Relay process + /// namespace without carrying its source error payload. + #[must_use] + pub fn from_bundle_verification(code: BundleVerificationCode) -> Self { + if code == BundleVerificationCode::REJECTED_BINDING { + Self::BUNDLE_BINDING_REJECTED + } else if code == BundleVerificationCode::REJECTED_ROLLBACK { + Self::BUNDLE_ROLLBACK_REJECTED + } else if code == BundleVerificationCode::REJECTED_SIGNATURE { + Self::BUNDLE_SIGNATURE_REJECTED + } else if code == BundleVerificationCode::REJECTED_VALIDATION { + Self::BUNDLE_VALIDATION_REJECTED + } else { + panic!("unmapped shared bundle-verification code") + } + } +} + +impl Display for ProcessStartupCode { + fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result { + formatter.write_str(self.as_str()) + } +} + +impl Serialize for ProcessStartupCode { + fn serialize(&self, serializer: S) -> Result + where + S: serde::Serializer, + { + serializer.serialize_str(self.as_str()) + } +} + +/// Publication lifecycle for one Relay process-boundary code. +#[derive(Clone, Copy, Debug, Eq, PartialEq, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum ProcessStartupCodeLifecycle { + Unreleased, + Active, + Deprecated, +} + +/// Restriction applied to process-boundary evidence. +#[derive(Clone, Copy, Debug, Eq, PartialEq, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum ProcessStartupEvidencePolicy { + /// Publish only catalog-owned code and static guidance. + NoRuntimeValues, +} + +/// Reviewed, value-free operator guidance for one process-boundary code. +#[derive(Clone, Copy, Debug, Eq, PartialEq, Serialize)] +pub struct ProcessStartupCodeDefinition { + pub code: ProcessStartupCode, + pub phase: &'static str, + pub safe_meaning: &'static str, + pub rule: &'static str, + pub safe_remediation: &'static str, + pub evidence_scope: &'static str, + pub evidence_policy: ProcessStartupEvidencePolicy, + pub evidence_limitation: &'static str, + pub docs_slug: &'static str, + pub lifecycle: ProcessStartupCodeLifecycle, + pub introduced_in: Option<&'static str>, +} + +impl ProcessStartupCodeDefinition { + #[must_use] + pub fn lifecycle_metadata_is_valid(&self) -> bool { + match self.lifecycle { + ProcessStartupCodeLifecycle::Unreleased => self.introduced_in.is_none(), + ProcessStartupCodeLifecycle::Active | ProcessStartupCodeLifecycle::Deprecated => { + self.introduced_in.is_some_and(is_numeric_release_version) + } + } + } +} + +fn is_numeric_release_version(version: &str) -> bool { + let mut parts = version.split('.'); + (0..3).all(|_| { + parts + .next() + .is_some_and(|part| !part.is_empty() && part.bytes().all(|byte| byte.is_ascii_digit())) + }) && parts.next().is_none() +} + +/// Complete product-owned Relay process-boundary catalog. +pub const PROCESS_STARTUP_CODE_DEFINITIONS: &[ProcessStartupCodeDefinition] = &[ + ProcessStartupCodeDefinition { + code: ProcessStartupCode::ADMIN_LISTENER_ADDRESS_IN_USE, + phase: "listener_binding", + safe_meaning: "Relay could not open the administration listener because its binding is already in use.", + rule: "registry.relay.startup.admin_listener_binding_is_unused", + safe_remediation: "Resolve the listener conflict for server.admin_bind in its owning deployment input; if generated, update the authored project and regenerate the Relay input, then retry.", + evidence_scope: "configured Relay administration listener and closed bind-failure category", + evidence_policy: ProcessStartupEvidencePolicy::NoRuntimeValues, + evidence_limitation: "The category names server.admin_bind and address-in-use status but does not disclose its address, port, or operating-system error.", + docs_slug: "admin-listener-address-in-use", + lifecycle: ProcessStartupCodeLifecycle::Unreleased, + introduced_in: None, + }, + ProcessStartupCodeDefinition { + code: ProcessStartupCode::ADMIN_LISTENER_PERMISSION_DENIED, + phase: "listener_binding", + safe_meaning: "Relay lacks permission to open the configured administration listener.", + rule: "registry.relay.startup.admin_listener_binding_is_permitted", + safe_remediation: "Choose a permitted server.admin_bind and correct the service account or network policy in its owning deployment input; regenerate generated Relay input, then retry.", + evidence_scope: "configured Relay administration listener and closed bind-failure category", + evidence_policy: ProcessStartupEvidencePolicy::NoRuntimeValues, + evidence_limitation: "The category names server.admin_bind and permission-denied status but does not disclose its address, port, account identity, or operating-system error.", + docs_slug: "admin-listener-permission-denied", + lifecycle: ProcessStartupCodeLifecycle::Unreleased, + introduced_in: None, + }, + ProcessStartupCodeDefinition { + code: ProcessStartupCode::ADMIN_LISTENER_UNAVAILABLE, + phase: "listener_binding", + safe_meaning: "Relay could not open the configured administration listener.", + rule: "registry.relay.startup.admin_listener_is_available", + safe_remediation: "Check interface availability, address-family support, and deployment networking for server.admin_bind in its owning input; regenerate generated Relay input, then retry.", + evidence_scope: "configured Relay administration listener and closed bind-failure category", + evidence_policy: ProcessStartupEvidencePolicy::NoRuntimeValues, + evidence_limitation: "The fallback category names server.admin_bind but does not disclose its address, port, or operating-system error.", + docs_slug: "admin-listener-unavailable", + lifecycle: ProcessStartupCodeLifecycle::Unreleased, + introduced_in: None, + }, + ProcessStartupCodeDefinition { + code: ProcessStartupCode::BUNDLE_BINDING_REJECTED, + phase: "bundle_verification", + safe_meaning: "The governed bundle does not match this Relay runtime target.", + rule: "registry.relay.startup.bundle_binding_matches_runtime", + safe_remediation: "Use a governed bundle issued for this Relay runtime target.", + evidence_scope: "governed bundle and Relay runtime binding", + evidence_policy: ProcessStartupEvidencePolicy::NoRuntimeValues, + evidence_limitation: "The category does not disclose configured or received binding values.", + docs_slug: "bundle-binding-rejected", + lifecycle: ProcessStartupCodeLifecycle::Unreleased, + introduced_in: None, + }, + ProcessStartupCodeDefinition { + code: ProcessStartupCode::BUNDLE_ROLLBACK_REJECTED, + phase: "bundle_activation", + safe_meaning: "The governed bundle or override failed Relay anti-rollback checks.", + rule: "registry.relay.startup.bundle_antirollback_satisfied", + safe_remediation: "Use a monotonic governed bundle or an authorized break-glass selection.", + evidence_scope: "local anti-rollback state and governed bundle or override metadata", + evidence_policy: ProcessStartupEvidencePolicy::NoRuntimeValues, + evidence_limitation: "The category does not disclose sequences, hashes, paths, operators, or approval values.", + docs_slug: "bundle-rollback-rejected", + lifecycle: ProcessStartupCodeLifecycle::Unreleased, + introduced_in: None, + }, + ProcessStartupCodeDefinition { + code: ProcessStartupCode::BUNDLE_SIGNATURE_REJECTED, + phase: "bundle_verification", + safe_meaning: "The governed bundle failed authenticity or content-integrity verification.", + rule: "registry.relay.startup.bundle_authenticity_and_integrity_accepted", + safe_remediation: "Rebuild and sign the complete bundle with an accepted trust configuration.", + evidence_scope: "bundle trust metadata, signature envelope, file closure, and content digests", + evidence_policy: ProcessStartupEvidencePolicy::NoRuntimeValues, + evidence_limitation: "The category does not disclose signer identifiers, file names, hashes, or trust-anchor values.", + docs_slug: "bundle-signature-rejected", + lifecycle: ProcessStartupCodeLifecycle::Unreleased, + introduced_in: None, + }, + ProcessStartupCodeDefinition { + code: ProcessStartupCode::BUNDLE_VALIDATION_REJECTED, + phase: "bundle_verification", + safe_meaning: "The governed bundle or local acceptance metadata is invalid.", + rule: "registry.relay.startup.bundle_inputs_are_valid", + safe_remediation: "Regenerate the bundle and acceptance metadata using supported formats.", + evidence_scope: "bundle encoding, manifest, acceptance metadata, and required local inputs", + evidence_policy: ProcessStartupEvidencePolicy::NoRuntimeValues, + evidence_limitation: "The category does not disclose parser excerpts, local paths, hashes, identities, or supplied values.", + docs_slug: "bundle-validation-rejected", + lifecycle: ProcessStartupCodeLifecycle::Unreleased, + introduced_in: None, + }, + ProcessStartupCodeDefinition { + code: ProcessStartupCode::CONFIG_DEPRECATED_FIELD_REJECTED, + phase: "config_document_validation", + safe_meaning: "A Relay configuration document uses a field that the current runtime no longer accepts.", + rule: "registry.relay.startup.config_uses_current_fields", + safe_remediation: "Compare the authored input with the current Relay schema and migration guidance, replace deprecated fields, regenerate generated Relay input, then retry.", + evidence_scope: "Relay configuration field names and the product-owned deprecated-field registry", + evidence_policy: ProcessStartupEvidencePolicy::NoRuntimeValues, + evidence_limitation: "The category does not disclose the configured field path, replacement, source path, or supplied values. Run authored-project validation for field-addressed guidance.", + docs_slug: "config-deprecated-field-rejected", + lifecycle: ProcessStartupCodeLifecycle::Unreleased, + introduced_in: None, + }, + ProcessStartupCodeDefinition { + code: ProcessStartupCode::CONFIG_DOCUMENT_INVALID, + phase: "config_document_validation", + safe_meaning: "A Relay configuration or metadata document does not match its required syntax or typed schema.", + rule: "registry.relay.startup.config_document_is_typed", + safe_remediation: "Compare the authored input with the current Relay schema, run authored-project validation when generated, correct the document, regenerate generated Relay input, then retry.", + evidence_scope: "Relay configuration and metadata document encoding, syntax, field grammar, and types", + evidence_policy: ProcessStartupEvidencePolicy::NoRuntimeValues, + evidence_limitation: "The category does not disclose parser excerpts, field paths, local paths, or supplied values. It does not claim field-level diagnostics were emitted.", + docs_slug: "config-document-invalid", + lifecycle: ProcessStartupCodeLifecycle::Unreleased, + introduced_in: None, + }, + ProcessStartupCodeDefinition { + code: ProcessStartupCode::CONFIG_ENVIRONMENT_BINDING_REJECTED, + phase: "config_environment_expansion", + safe_meaning: "A required Relay configuration environment binding could not be expanded safely.", + rule: "registry.relay.startup.config_environment_bindings_expand", + safe_remediation: "Check the authored environment expressions and required deployment bindings, then run Relay doctor against the same configuration before retrying.", + evidence_scope: "Relay configuration environment expressions and deployment-provided bindings", + evidence_policy: ProcessStartupEvidencePolicy::NoRuntimeValues, + evidence_limitation: "The category does not disclose environment names, expansion errors, source paths, or supplied values. It does not claim field-level diagnostics were emitted.", + docs_slug: "config-environment-binding-rejected", + lifecycle: ProcessStartupCodeLifecycle::Unreleased, + introduced_in: None, + }, + ProcessStartupCodeDefinition { + code: ProcessStartupCode::CONFIG_SOURCE_UNAVAILABLE, + phase: "config_loading", + safe_meaning: "A required Relay configuration or metadata source could not be read.", + rule: "registry.relay.startup.config_source_is_readable", + safe_remediation: "Check the --config source and any configured metadata.source.path, restore readable input from its owner, regenerate generated Relay input instead of editing it in place, then retry.", + evidence_scope: "Relay configuration and metadata sources", + evidence_policy: ProcessStartupEvidencePolicy::NoRuntimeValues, + evidence_limitation: "The category does not disclose local paths, operating-system errors, or source contents.", + docs_slug: "config-source-unavailable", + lifecycle: ProcessStartupCodeLifecycle::Unreleased, + introduced_in: None, + }, + ProcessStartupCodeDefinition { + code: ProcessStartupCode::CONFIG_VALIDATION_REJECTED, + phase: "config_validation", + safe_meaning: "The parsed Relay configuration failed product validation.", + rule: "registry.relay.startup.config_product_invariants_hold", + safe_remediation: "Run the authored-project validator, correct its field-addressed issues and governed bindings, regenerate the Relay input, then retry.", + evidence_scope: "parsed Relay configuration and governed runtime bindings", + evidence_policy: ProcessStartupEvidencePolicy::NoRuntimeValues, + evidence_limitation: "The category does not disclose configured identifiers, URLs, environment names, hashes, or source values.", + docs_slug: "config-validation-rejected", + lifecycle: ProcessStartupCodeLifecycle::Unreleased, + introduced_in: None, + }, + ProcessStartupCodeDefinition { + code: ProcessStartupCode::CONSULTATION_ARTIFACTS_REJECTED, + phase: "consultation_activation", + safe_meaning: "The governed consultation artifact closure failed startup validation.", + rule: "registry.relay.startup.consultation_artifact_closure_is_valid", + safe_remediation: "Rebuild the complete hash-covered consultation artifact closure and retry.", + evidence_scope: "governed consultation artifact closure and runtime bindings", + evidence_policy: ProcessStartupEvidencePolicy::NoRuntimeValues, + evidence_limitation: "The category does not disclose artifact paths, hashes, selectors, identities, or parser excerpts.", + docs_slug: "consultation-artifacts-rejected", + lifecycle: ProcessStartupCodeLifecycle::Unreleased, + introduced_in: None, + }, + ProcessStartupCodeDefinition { + code: ProcessStartupCode::DATA_LISTENER_ADDRESS_IN_USE, + phase: "listener_binding", + safe_meaning: "Relay could not open the data-plane listener because its binding is already in use.", + rule: "registry.relay.startup.data_listener_binding_is_unused", + safe_remediation: "Resolve the listener conflict for server.bind in its owning deployment input; if generated, update the authored project and regenerate the Relay input, then retry.", + evidence_scope: "configured Relay data-plane listener and closed bind-failure category", + evidence_policy: ProcessStartupEvidencePolicy::NoRuntimeValues, + evidence_limitation: "The category names server.bind and address-in-use status but does not disclose its address, port, or operating-system error.", + docs_slug: "data-listener-address-in-use", + lifecycle: ProcessStartupCodeLifecycle::Unreleased, + introduced_in: None, + }, + ProcessStartupCodeDefinition { + code: ProcessStartupCode::DATA_LISTENER_PERMISSION_DENIED, + phase: "listener_binding", + safe_meaning: "Relay lacks permission to open the configured data-plane listener.", + rule: "registry.relay.startup.data_listener_binding_is_permitted", + safe_remediation: "Choose a permitted server.bind and correct the service account or network policy in its owning deployment input; regenerate generated Relay input, then retry.", + evidence_scope: "configured Relay data-plane listener and closed bind-failure category", + evidence_policy: ProcessStartupEvidencePolicy::NoRuntimeValues, + evidence_limitation: "The category names server.bind and permission-denied status but does not disclose its address, port, account identity, or operating-system error.", + docs_slug: "data-listener-permission-denied", + lifecycle: ProcessStartupCodeLifecycle::Unreleased, + introduced_in: None, + }, + ProcessStartupCodeDefinition { + code: ProcessStartupCode::DATA_LISTENER_UNAVAILABLE, + phase: "listener_binding", + safe_meaning: "Relay could not open the configured data-plane listener.", + rule: "registry.relay.startup.data_listener_is_available", + safe_remediation: "Check interface availability, address-family support, and deployment networking for server.bind in its owning input; regenerate generated Relay input, then retry.", + evidence_scope: "configured Relay data-plane listener and closed bind-failure category", + evidence_policy: ProcessStartupEvidencePolicy::NoRuntimeValues, + evidence_limitation: "The fallback category names server.bind but does not disclose its address, port, or operating-system error.", + docs_slug: "data-listener-unavailable", + lifecycle: ProcessStartupCodeLifecycle::Unreleased, + introduced_in: None, + }, + ProcessStartupCodeDefinition { + code: ProcessStartupCode::DOCTOR_FAILED, + phase: "operator_diagnostics", + safe_meaning: "Relay doctor found one or more blocking diagnostics.", + rule: "registry.relay.startup.doctor_has_no_blocking_diagnostics", + safe_remediation: "Use the static diagnostic codes and actions in the doctor report.", + evidence_scope: "offline Relay readiness and deployment diagnostics", + evidence_policy: ProcessStartupEvidencePolicy::NoRuntimeValues, + evidence_limitation: "The process failure does not repeat diagnostic source values or report internals.", + docs_slug: "doctor-failed", + lifecycle: ProcessStartupCodeLifecycle::Unreleased, + introduced_in: None, + }, + ProcessStartupCodeDefinition { + code: ProcessStartupCode::RUNTIME_INITIALIZATION_FAILED, + phase: "runtime_initialization", + safe_meaning: "Relay runtime initialization failed.", + rule: "registry.relay.startup.runtime_initializes", + safe_remediation: "Review preceding static diagnostic codes, correct the runtime inputs, and retry.", + evidence_scope: "Relay runtime dependencies and protected startup capabilities", + evidence_policy: ProcessStartupEvidencePolicy::NoRuntimeValues, + evidence_limitation: "The category does not disclose inner errors, paths, URLs, identities, hashes, or supplied values.", + docs_slug: "runtime-initialization-failed", + lifecycle: ProcessStartupCodeLifecycle::Unreleased, + introduced_in: None, + }, +]; + +/// Error carrier whose rendered form contains catalog-owned static text only. +#[derive(Clone, Copy, Debug, Eq, PartialEq)] +pub struct ProcessStartupFailure { + code: ProcessStartupCode, +} + +impl ProcessStartupFailure { + #[must_use] + pub const fn new(code: ProcessStartupCode) -> Self { + Self { code } + } + + #[must_use] + pub const fn code(self) -> ProcessStartupCode { + self.code + } +} + +impl Display for ProcessStartupFailure { + fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result { + let definition = self.code.definition(); + write!( + formatter, + "{}: {} Next action: {}", + definition.code, definition.safe_meaning, definition.safe_remediation + ) + } +} + +impl std::error::Error for ProcessStartupFailure {} + +/// Emit one value-free process-boundary diagnostic. +pub fn emit_process_startup_failure(code: ProcessStartupCode) { + let definition = code.definition(); + if tracing::enabled!(tracing::Level::ERROR) { + tracing::error!( + code = definition.code.as_str(), + meaning = definition.safe_meaning, + remediation = definition.safe_remediation, + "registry-relay process boundary rejected the operation" + ); + } else { + eprintln!( + "ERROR {}: {}; next action: {}", + definition.code, definition.safe_meaning, definition.safe_remediation + ); + } +} diff --git a/crates/registry-relay/tests/config_schema.rs b/crates/registry-relay/tests/config_schema.rs index 732a15d7c..5de4cd1a9 100644 --- a/crates/registry-relay/tests/config_schema.rs +++ b/crates/registry-relay/tests/config_schema.rs @@ -17,6 +17,7 @@ use serde_json::{json, Value}; const SCHEMA_ARTIFACT: &str = "../../schemas/registry-relay.config.schema.json"; const CONFIG_REFERENCE: &str = "docs/configuration.md"; +const DOCUMENTATION_INTENT: &str = "config/documentation-intent.json"; const KEY_PATHS_START: &str = "{/* registry-relay-config-key-paths:start */}"; const KEY_PATHS_END: &str = "{/* registry-relay-config-key-paths:end */}"; const NON_PORTABLE_ENVIRONMENT_NAME: &str = "REGISTRY.RELAY-SCHEMA-RUNTIME-KEY"; @@ -1070,3 +1071,41 @@ fn schema_and_configuration_reference_have_exact_bidirectional_key_path_parity() schema_paths.iter().cloned().collect::>().join("\n") ); } + +#[test] +fn product_owned_documentation_intent_has_exact_runtime_key_inventory() { + let schema = document(); + let mut schema_paths = BTreeSet::new(); + collect_key_paths(&schema, &schema, "", &mut schema_paths, &mut HashSet::new()); + let intent: Value = serde_json::from_slice( + &fs::read(relay_root().join(DOCUMENTATION_INTENT)) + .expect("Relay documentation intent exists"), + ) + .expect("Relay documentation intent parses"); + assert_eq!(intent["runtime_schema"], "relay"); + assert_eq!(intent["schema_id"], CONFIG_SCHEMA_ID); + let assignments = intent["assignments"] + .as_array() + .expect("Relay intent assignments are an array"); + assert_eq!(assignments.len(), 584); + let assigned_paths = assignments + .iter() + .map(|assignment| { + assert_eq!(assignment["schema"], "relay"); + assert_eq!(assignment["schema_facts_reviewed"], true); + assignment["key_path"] + .as_str() + .expect("assignment key_path is a string") + .to_owned() + }) + .filter(|path| !path.is_empty()) + .collect::>(); + assert_eq!(assigned_paths, schema_paths); + assert_eq!( + assignments + .iter() + .filter(|assignment| assignment["path_kind"] == "map_value") + .count(), + 6 + ); +} diff --git a/crates/registry-relay/tests/config_verify_bundle_cli.rs b/crates/registry-relay/tests/config_verify_bundle_cli.rs index ac62a1c16..4f11f723c 100644 --- a/crates/registry-relay/tests/config_verify_bundle_cli.rs +++ b/crates/registry-relay/tests/config_verify_bundle_cli.rs @@ -12,13 +12,22 @@ use registry_platform_config::{ use registry_platform_crypto::{canonicalize_json, sign, PrivateJwk}; use registry_platform_ops::{ AntiRollbackKey, AntiRollbackRecord, ConfigOverrideMode, ConfigOverridePin, - FileAntiRollbackStore, + FileAntiRollbackStore, BUNDLE_VERIFICATION_CODE_DEFINITIONS, }; use serde_json::Value; use tempfile::TempDir; const PRIVATE_JWK: &str = r#"{"kty":"OKP","crv":"Ed25519","d":"2oPoxdKuO7Kpd-3JLfNW_4xwpFxItbS-fxe03ZybYEw","x":"1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc","alg":"EdDSA"}"#; const ZERO_HASH: &str = "sha256:0000000000000000000000000000000000000000000000000000000000000000"; +const VALIDATION_SENTINEL_PATH: &str = "REDACTION_COUNTRY_VALUE/redaction-user@example.test/REDACTION_SECRET_VALUE/REDACTION_PARSER_STRING/REDACTION_LOCAL_PATH.yaml"; +const ERROR_MESSAGE_SENTINELS: &[&str] = &[ + "REDACTION_COUNTRY_VALUE", + "redaction-user@example.test", + "REDACTION_SECRET_VALUE", + "REDACTION_PARSER_STRING", + "REDACTION_LOCAL_PATH", + "/Users/", +]; struct BundleFixture { bundle_dir: PathBuf, @@ -64,6 +73,17 @@ fn config_verify_bundle_cli_reports_rejected_rollback() { let report = stdout_json(&output); assert_eq!(report["result"], "rejected_rollback"); assert_eq!(report["errors"][0]["code"], "rejected_rollback"); + assert_safe_bundle_error(&report, "rejected_rollback"); + assert_rejected_identity_is_redacted(&report); + assert_output_excludes( + &output, + &[ + "relay-test-stream", + "relay-test-bundle", + fixture.config_hash.as_str(), + fixture.state_path.to_str().expect("path is UTF-8"), + ], + ); } #[test] @@ -111,6 +131,19 @@ fn config_verify_bundle_cli_rejects_expired_override_pin() { let report = stdout_json(&output); assert_eq!(report["result"], "rejected_rollback"); assert_eq!(report["errors"][0]["code"], "rejected_rollback"); + assert_safe_bundle_error(&report, "rejected_rollback"); + assert_rejected_identity_is_redacted(&report); + assert_output_excludes( + &output, + &[ + "jeremi", + "expired rollback", + "relay-test-stream", + "relay-test-bundle", + fixture.config_hash.as_str(), + fixture.state_path.to_str().expect("path is UTF-8"), + ], + ); } #[test] @@ -126,13 +159,25 @@ fn config_verify_bundle_cli_reports_rejected_binding() { let report = stdout_json(&output); assert_eq!(report["result"], "rejected_binding"); assert_eq!(report["errors"][0]["code"], "rejected_binding"); + assert_safe_bundle_error(&report, "rejected_binding"); + assert_rejected_identity_is_redacted(&report); + assert_output_excludes( + &output, + &[ + "relay-test-stream", + "relay-test-bundle", + fixture.config_hash.as_str(), + ], + ); } #[test] fn config_verify_bundle_cli_reports_rejected_signature_for_hash_mismatch() { let temp = TempDir::new().expect("tempdir"); let fixture = write_bundle_fixture(&temp, "registry-relay", 0); - std::fs::write(&fixture.config_path, b"changed config bytes").expect("config changes"); + let changed = b"changed config bytes"; + let actual_hash = sha256_uri(changed); + std::fs::write(&fixture.config_path, changed).expect("config changes"); let output = verify_bundle_command(&fixture) .output() @@ -142,6 +187,25 @@ fn config_verify_bundle_cli_reports_rejected_signature_for_hash_mismatch() { let report = stdout_json(&output); assert_eq!(report["result"], "rejected_signature"); assert_eq!(report["errors"][0]["code"], "rejected_signature"); + assert_safe_bundle_error(&report, "rejected_signature"); + assert_error_message_excludes( + &report, + &[ + "config/relay.yaml", + fixture.config_hash.as_str(), + actual_hash.as_str(), + fixture.config_path.to_str().expect("path is UTF-8"), + ], + ); + assert_rejected_identity_is_redacted(&report); + assert_output_excludes( + &output, + &[ + fixture.config_hash.as_str(), + actual_hash.as_str(), + fixture.config_path.to_str().expect("path is UTF-8"), + ], + ); } #[test] @@ -202,6 +266,8 @@ fn config_verify_bundle_cli_shared_parity_matrix() { assert_eq!(report["component"], "registry-relay", "{name}"); } else { assert_eq!(report["errors"][0]["code"], expected, "{name}"); + assert_safe_bundle_error(&report, expected); + assert_rejected_identity_is_redacted(&report); } } } @@ -211,7 +277,7 @@ fn config_verify_bundle_cli_rejects_missing_split_metadata() { let temp = TempDir::new().expect("tempdir"); let config = relay_config_yaml().replace( "catalog:\n", - "metadata:\n source:\n path: missing-metadata.yaml\ncatalog:\n", + &format!("metadata:\n source:\n path: {VALIDATION_SENTINEL_PATH}\ncatalog:\n"), ); let fixture = write_bundle_fixture_with_config(&temp, "registry-relay", 0, config); @@ -223,6 +289,13 @@ fn config_verify_bundle_cli_rejects_missing_split_metadata() { let report = stdout_json(&output); assert_eq!(report["result"], "rejected_validation"); assert_eq!(report["errors"][0]["code"], "rejected_validation"); + assert_safe_bundle_error(&report, "rejected_validation"); + assert_error_message_excludes( + &report, + &[fixture.config_path.to_str().expect("path is UTF-8")], + ); + assert_rejected_identity_is_redacted(&report); + assert_output_excludes(&output, ERROR_MESSAGE_SENTINELS); } #[test] @@ -251,6 +324,160 @@ fn config_verify_bundle_cli_requires_signed_metadata_digest() { let report = stdout_json(&output); assert_eq!(report["result"], "rejected_validation"); assert_eq!(report["errors"][0]["code"], "rejected_validation"); + assert_safe_bundle_error(&report, "rejected_validation"); + assert_rejected_identity_is_redacted(&report); +} + +#[test] +fn config_verify_bundle_cli_redacts_malformed_anchor_from_stdout_and_stderr() { + let temp = TempDir::new().expect("tempdir"); + let fixture = write_bundle_fixture(&temp, "registry-relay", 0); + let sentinel = "COUNTRY_PARSER_ERROR redaction-user@example.test /COUNTRY/private/anchor.json"; + std::fs::write(&fixture.anchor_path, format!("{{ {sentinel}")).expect("anchor corrupts"); + + let output = verify_bundle_command(&fixture) + .output() + .expect("command runs"); + + assert!(!output.status.success()); + let report = stdout_json(&output); + assert_safe_bundle_error(&report, "rejected_validation"); + assert_rejected_identity_is_redacted(&report); + assert_output_excludes( + &output, + &[ + sentinel, + "redaction-user@example.test", + "/COUNTRY/private/anchor.json", + fixture.anchor_path.to_str().expect("path is UTF-8"), + ], + ); +} + +#[test] +fn config_verify_bundle_cli_redacts_file_closure_from_stdout_and_stderr() { + let temp = TempDir::new().expect("tempdir"); + let fixture = write_bundle_fixture(&temp, "registry-relay", 0); + let unlisted = fixture + .bundle_dir + .join("COUNTRY_PRIVATE_REDACTION_SENTINEL.yaml"); + std::fs::write(&unlisted, "country: COUNTRY_VALUE").expect("unlisted file writes"); + + let output = verify_bundle_command(&fixture) + .output() + .expect("command runs"); + + assert!(!output.status.success()); + let report = stdout_json(&output); + assert_safe_bundle_error(&report, "rejected_signature"); + assert_rejected_identity_is_redacted(&report); + assert_output_excludes( + &output, + &[ + "COUNTRY_PRIVATE_REDACTION_SENTINEL", + "COUNTRY_VALUE", + unlisted.to_str().expect("path is UTF-8"), + ], + ); +} + +#[test] +fn config_verify_bundle_cli_redacts_bundle_parser_sentinel_from_stdout_and_stderr() { + let temp = TempDir::new().expect("tempdir"); + let parser_sentinel = + "COUNTRY_PARSER_ERROR redaction-user@example.test /COUNTRY/private/config.yaml"; + let fixture = write_bundle_fixture_with_config( + &temp, + "registry-relay", + 0, + format!("deployment:\n profile: local\n{parser_sentinel}\n\t- invalid"), + ); + + let output = verify_bundle_command(&fixture) + .output() + .expect("command runs"); + + assert!(!output.status.success()); + let report = stdout_json(&output); + assert_safe_bundle_error(&report, "rejected_validation"); + assert_rejected_identity_is_redacted(&report); + assert_output_excludes( + &output, + &[ + parser_sentinel, + "COUNTRY_PARSER_ERROR", + "redaction-user@example.test", + "/COUNTRY/private/config.yaml", + ], + ); +} + +fn assert_safe_bundle_error(report: &Value, expected_code: &str) { + assert_eq!(report["result"], expected_code); + assert_eq!(report["errors"][0]["code"], expected_code); + let definition = BUNDLE_VERIFICATION_CODE_DEFINITIONS + .iter() + .find(|definition| definition.code.as_str() == expected_code) + .expect("published code has a catalog definition"); + assert_eq!( + report["errors"][0]["message"], definition.safe_report_message, + "public message must be the reviewed static catalog meaning and remediation" + ); + assert_error_message_excludes(report, ERROR_MESSAGE_SENTINELS); +} + +fn assert_error_message_excludes(report: &Value, sentinels: &[&str]) { + let message = report["errors"][0]["message"] + .as_str() + .expect("error message is a string"); + for sentinel in sentinels { + assert!( + !message.contains(sentinel), + "public error message leaked sentinel {sentinel:?}: {message:?}" + ); + } +} + +fn assert_rejected_identity_is_redacted(report: &Value) { + for field in [ + "stream_id", + "bundle_id", + "bundle_sequence", + "previous_config_hash", + "config_hash", + ] { + assert!( + report[field].is_null(), + "rejected report leaked untrusted identity field {field}: {}", + report[field] + ); + } + let object = report.as_object().expect("report is an object"); + for field in ["signer_kids", "signers", "operator", "operator_id"] { + assert!( + object.get(field).is_none_or(Value::is_null), + "rejected report leaked untrusted identity field {field}" + ); + } +} + +fn assert_output_excludes(output: &std::process::Output, sentinels: &[&str]) { + let stdout = String::from_utf8_lossy(&output.stdout); + let stderr = String::from_utf8_lossy(&output.stderr); + for sentinel in sentinels { + assert!( + !stdout.contains(sentinel), + "stdout leaked sentinel {sentinel:?}: {stdout}" + ); + assert!( + !stderr.contains(sentinel), + "stderr leaked sentinel {sentinel:?}: {stderr}" + ); + } + assert!( + stderr.contains("relay.startup."), + "stderr must contain a stable Relay startup code: {stderr}" + ); } fn verify_bundle_command(fixture: &BundleFixture) -> Command { diff --git a/crates/registry-relay/tests/consultation_activation_error_catalog.rs b/crates/registry-relay/tests/consultation_activation_error_catalog.rs new file mode 100644 index 000000000..c898ba206 --- /dev/null +++ b/crates/registry-relay/tests/consultation_activation_error_catalog.rs @@ -0,0 +1,224 @@ +// SPDX-License-Identifier: Apache-2.0 + +use std::collections::BTreeSet; + +use registry_relay::consultation::{ + consultation_service_activation_definitions, ConsultationServiceActivationCode, + ConsultationServiceActivationError, ConsultationServiceActivationLifecycle, + ConsultationServiceActivationVersion, +}; +use serde_json::{json, Value}; + +const ERROR_MAPPINGS: [( + ConsultationServiceActivationError, + ConsultationServiceActivationCode, +); 9] = [ + ( + ConsultationServiceActivationError::MissingConfiguration, + ConsultationServiceActivationCode::CONFIGURATION_MISSING, + ), + ( + ConsultationServiceActivationError::InvalidWorkloadBinding, + ConsultationServiceActivationCode::WORKLOAD_BINDING_INVALID, + ), + ( + ConsultationServiceActivationError::RegistryActivation, + ConsultationServiceActivationCode::ARTIFACT_REGISTRY_INVALID, + ), + ( + ConsultationServiceActivationError::UnsupportedPlan, + ConsultationServiceActivationCode::UNSUPPORTED_PLAN, + ), + ( + ConsultationServiceActivationError::InvalidQuotaLimits, + ConsultationServiceActivationCode::QUOTA_LIMITS_INVALID, + ), + ( + ConsultationServiceActivationError::InvalidMetadata, + ConsultationServiceActivationCode::PROTECTED_METADATA_INVALID, + ), + ( + ConsultationServiceActivationError::SourceCredentials, + ConsultationServiceActivationCode::SOURCE_CREDENTIALS_UNAVAILABLE, + ), + ( + ConsultationServiceActivationError::PseudonymMaterial, + ConsultationServiceActivationCode::PSEUDONYM_MATERIAL_UNAVAILABLE, + ), + ( + ConsultationServiceActivationError::StatePlane, + ConsultationServiceActivationCode::STATE_PLANE_UNAVAILABLE, + ), +]; + +#[test] +fn every_activation_variant_maps_to_one_stable_code_and_definition() { + for (error, expected_code) in ERROR_MAPPINGS { + assert_eq!(error.code(), expected_code); + assert_eq!(error.safe_projection().code, expected_code); + assert_eq!(expected_code.definition().code, expected_code); + } +} + +#[test] +fn code_and_definition_catalogs_are_unique_complete_and_lexically_ordered() { + fn assert_typed_version(_: Option) {} + + let codes = + ConsultationServiceActivationCode::ALL.map(ConsultationServiceActivationCode::as_str); + assert_eq!( + codes, + [ + "relay.consultation.activation.artifact_registry_invalid", + "relay.consultation.activation.configuration_missing", + "relay.consultation.activation.protected_metadata_invalid", + "relay.consultation.activation.pseudonym_material_unavailable", + "relay.consultation.activation.quota_limits_invalid", + "relay.consultation.activation.source_credentials_unavailable", + "relay.consultation.activation.state_plane_unavailable", + "relay.consultation.activation.unsupported_plan", + "relay.consultation.activation.workload_binding_invalid", + ] + ); + assert!(codes.windows(2).all(|pair| pair[0] < pair[1])); + assert_eq!(codes.into_iter().collect::>().len(), 9); + + let definitions = consultation_service_activation_definitions(); + assert_eq!( + definitions.len(), + ConsultationServiceActivationCode::ALL.len() + ); + assert_eq!( + definitions + .iter() + .map(|definition| definition.code) + .collect::>(), + ConsultationServiceActivationCode::ALL + ); + assert!(definitions.iter().all(|definition| { + assert_typed_version(definition.introduced_in); + definition.lifecycle == ConsultationServiceActivationLifecycle::Unreleased + && definition.introduced_in.is_none() + && definition.lifecycle_metadata_is_valid() + && definition.catalog_metadata_is_valid() + && definition.phase == "consultation_activation" + && !definition.meaning.is_empty() + && !definition.rule.is_empty() + && !definition.remediation.is_empty() + && !definition.evidence_scope.is_empty() + && !definition.evidence_policy.is_empty() + && !definition.evidence_limitation.is_empty() + && !definition.docs_slug.is_empty() + })); + assert_eq!( + definitions + .iter() + .map(|definition| definition.docs_slug) + .collect::>() + .len(), + definitions.len() + ); +} + +#[test] +fn safe_projection_is_static_value_free_and_has_a_closed_boundary_shape() { + for (error, _) in ERROR_MAPPINGS { + let projection = + serde_json::to_value(error.safe_projection()).expect("safe projection serializes"); + assert_eq!( + projection + .as_object() + .expect("projection is an object") + .len(), + 11 + ); + for field in [ + "code", + "lifecycle", + "introduced_in", + "phase", + "meaning", + "rule", + "remediation", + "evidence_scope", + "evidence_policy", + "evidence_limitation", + "docs_slug", + ] { + assert!(projection.get(field).is_some(), "{field}"); + } + assert_eq!( + projection["code"], + json!(error.code().as_str()), + "the public boundary renders the stable code string" + ); + assert_eq!(projection["lifecycle"], json!("unreleased")); + assert!(projection["introduced_in"].is_null()); + assert_eq!(projection["phase"], json!("consultation_activation")); + + let serialized = projection.to_string(); + assert!(!serialized.contains("0.13.0")); + assert!(!serialized.contains("0.14.0")); + for sentinel in [ + "/COUNTRY/private/source.yaml", + "sha256:COUNTRY_HASH", + "COUNTRY_PARSER_ERROR", + "COUNTRY_SOURCE_CREDENTIAL", + "COUNTRY_IDENTIFIER", + "COUNTRY_VALUE", + ] { + assert!(!serialized.contains(sentinel), "{sentinel}"); + } + let lower = serialized.to_ascii_lowercase(); + for forbidden in [ + "sha256:", + "://", + "/tmp/", + ".yaml", + "parser error", + "client_secret", + "api_key", + "registry_id", + "country_", + ] { + assert!(!lower.contains(forbidden), "{forbidden}"); + } + } +} + +#[test] +fn existing_activation_error_display_contract_remains_compatible_and_value_free() { + let expected = [ + "consultation service configuration is unavailable", + "consultation service workload binding is invalid", + "consultation service registry activation failed", + "consultation service plan is unsupported", + "consultation service quota limits are invalid", + "consultation service protected metadata is invalid", + "consultation service source credentials are unavailable", + "consultation service pseudonym material is unavailable", + "consultation service state plane is unavailable", + ]; + assert_eq!( + ERROR_MAPPINGS + .map(|(error, _)| error.to_string()) + .as_slice(), + expected + ); +} + +#[test] +fn catalog_and_projection_render_identically_at_the_public_boundary() { + for (error, code) in ERROR_MAPPINGS { + let definition = serde_json::to_value(code.definition()).expect("definition serializes"); + let projection = + serde_json::to_value(error.safe_projection()).expect("projection serializes"); + assert_eq!(projection, definition); + assert_eq!( + serde_json::to_value(code).expect("code serializes"), + Value::String(code.as_str().to_owned()) + ); + assert_eq!(code.to_string(), code.as_str()); + assert!(format!("{code:?}").contains(code.as_str())); + } +} diff --git a/crates/registry-relay/tests/doctor_cli.rs b/crates/registry-relay/tests/doctor_cli.rs index c60f41553..95583faba 100644 --- a/crates/registry-relay/tests/doctor_cli.rs +++ b/crates/registry-relay/tests/doctor_cli.rs @@ -13,7 +13,7 @@ use registry_platform_crypto::{canonicalize_json, sign, PrivateJwk}; use registry_platform_ops::{ AntiRollbackKey, AntiRollbackRecord, FileAntiRollbackStore, AUDIT_ACK_CURSOR_FIXTURE_V1, }; -use serde_json::Value; +use serde_json::{json, Value}; use tempfile::TempDir; use time::{format_description::well_known::Rfc3339, OffsetDateTime}; @@ -341,6 +341,21 @@ fn assert_diagnostic_report(report: &Value) { ); assert_eq!(report["product"], "registry-relay"); assert_eq!(report["config_schema_version"], "registry.relay.config.v1"); + assert!( + matches!( + report["source"]["kind"].as_str(), + Some("local_file" | "signed_bundle_file") + ), + "doctor must report a bounded source classification" + ); + assert!( + report.get("hashes").is_none(), + "doctor must not expose raw internal config hashes by default" + ); + assert!( + report["source"].get("path").is_none(), + "doctor must classify its source without exposing its local path" + ); } fn assert_config_explanation(report: &Value) { @@ -425,6 +440,7 @@ fn doctor_json_reports_success_and_redacts_env_file_values() { ); let report = parse_stdout_json(&output.stdout); assert_diagnostic_report(&report); + assert_eq!(report["source"], json!({ "kind": "local_file" })); assert_eq!(report["status"], "ok"); assert!(diagnostic_with_code(&report, "relay.config.loaded").is_some()); assert!(diagnostic_with_code(&report, "relay.entity_registry.verified").is_some()); @@ -609,6 +625,66 @@ fn doctor_json_reports_config_failure_with_nonzero_exit() { assert!(diagnostic_with_code(&report, "config.missing_secret").is_some()); } +#[test] +fn doctor_json_redacts_config_path_parser_text_and_hash_from_all_process_output() { + let tmp = tempfile::tempdir().expect("tempdir"); + let sentinel_dir = tmp + .path() + .join("COUNTRY_PRIVATE") + .join("redaction-user@example.test"); + std::fs::create_dir_all(&sentinel_dir).expect("sentinel directory creates"); + let config_path = sentinel_dir.join("COUNTRY_CONFIG_PATH.yaml"); + let parser_sentinel = "COUNTRY_PARSER_ERROR COUNTRY_SECRET_VALUE"; + std::fs::write( + &config_path, + format!("deployment:\n profile: local\n{parser_sentinel}\n\t- invalid"), + ) + .expect("malformed config writes"); + + let output = Command::new(env!("CARGO_BIN_EXE_registry-relay")) + .args([ + "doctor", + "--config", + config_path.to_str().expect("utf-8 path"), + "--format=json", + ]) + .output() + .expect("doctor command runs"); + + assert!(!output.status.success()); + let report = parse_stdout_json(&output.stdout); + assert_diagnostic_report(&report); + assert!(diagnostic_with_code(&report, "config.parse_error").is_some()); + let stdout = String::from_utf8_lossy(&output.stdout); + let stderr = String::from_utf8_lossy(&output.stderr); + for sentinel in [ + parser_sentinel, + "COUNTRY_PRIVATE", + "redaction-user@example.test", + "COUNTRY_CONFIG_PATH", + config_path.to_str().expect("utf-8 path"), + "internal_config_hash", + "sha256:", + ] { + assert!( + !stdout.contains(sentinel), + "stdout leaked {sentinel:?}: {stdout}" + ); + assert!( + !stderr.contains(sentinel), + "stderr leaked {sentinel:?}: {stderr}" + ); + } + assert!( + stderr.contains("relay.startup.config_document_invalid"), + "stderr lacks the product-owned parser classification: {stderr}" + ); + assert!( + stderr.contains("relay.startup.doctor_failed"), + "stderr lacks the product-owned doctor exit classification: {stderr}" + ); +} + #[test] fn doctor_json_accepts_profile_override_without_undeclared_finding() { let tmp = tempfile::tempdir().expect("tempdir"); diff --git a/crates/registry-relay/tests/process_startup_catalog.rs b/crates/registry-relay/tests/process_startup_catalog.rs new file mode 100644 index 000000000..58dd19d90 --- /dev/null +++ b/crates/registry-relay/tests/process_startup_catalog.rs @@ -0,0 +1,173 @@ +// SPDX-License-Identifier: Apache-2.0 + +use std::collections::BTreeSet; + +use registry_platform_ops::BundleVerificationCode; +use registry_relay::process_startup::{ + ProcessStartupCode, ProcessStartupCodeLifecycle, ProcessStartupEvidencePolicy, + ProcessStartupFailure, PROCESS_STARTUP_CODE_DEFINITIONS, +}; + +#[test] +fn process_startup_catalog_is_complete_unique_and_lexically_ordered() { + let codes = ProcessStartupCode::ALL + .iter() + .copied() + .map(ProcessStartupCode::as_str) + .collect::>(); + assert_eq!( + codes, + [ + "relay.startup.admin_listener_address_in_use", + "relay.startup.admin_listener_permission_denied", + "relay.startup.admin_listener_unavailable", + "relay.startup.bundle_binding_rejected", + "relay.startup.bundle_rollback_rejected", + "relay.startup.bundle_signature_rejected", + "relay.startup.bundle_validation_rejected", + "relay.startup.config_deprecated_field_rejected", + "relay.startup.config_document_invalid", + "relay.startup.config_environment_binding_rejected", + "relay.startup.config_source_unavailable", + "relay.startup.config_validation_rejected", + "relay.startup.consultation_artifacts_rejected", + "relay.startup.data_listener_address_in_use", + "relay.startup.data_listener_permission_denied", + "relay.startup.data_listener_unavailable", + "relay.startup.doctor_failed", + "relay.startup.runtime_initialization_failed", + ] + ); + assert!(codes.windows(2).all(|pair| pair[0] < pair[1])); + assert_eq!( + codes.iter().copied().collect::>().len(), + codes.len() + ); + assert_eq!( + PROCESS_STARTUP_CODE_DEFINITIONS + .iter() + .map(|definition| definition.code) + .collect::>(), + ProcessStartupCode::ALL + ); + assert_eq!( + PROCESS_STARTUP_CODE_DEFINITIONS + .iter() + .map(|definition| definition.docs_slug) + .collect::>() + .len(), + ProcessStartupCode::ALL.len() + ); +} + +#[test] +fn process_startup_catalog_metadata_is_static_complete_and_unreleased() { + for definition in PROCESS_STARTUP_CODE_DEFINITIONS { + assert_eq!( + definition.lifecycle, + ProcessStartupCodeLifecycle::Unreleased + ); + assert_eq!(definition.introduced_in, None); + assert!(definition.lifecycle_metadata_is_valid()); + assert_eq!( + definition.evidence_policy, + ProcessStartupEvidencePolicy::NoRuntimeValues + ); + for value in [ + definition.code.as_str(), + definition.phase, + definition.safe_meaning, + definition.rule, + definition.safe_remediation, + definition.evidence_scope, + definition.evidence_limitation, + definition.docs_slug, + ] { + assert!(!value.is_empty()); + assert_eq!(value.trim(), value); + } + + let rendered = + serde_json::to_string(definition).expect("catalog definition serializes safely"); + assert_safe_value_free(&rendered); + let failure = ProcessStartupFailure::new(definition.code).to_string(); + assert!(failure.contains(definition.code.as_str())); + assert!(failure.contains(definition.safe_meaning)); + assert!(failure.contains(definition.safe_remediation)); + assert_safe_value_free(&failure); + } +} + +#[test] +fn listener_bind_errors_map_to_closed_value_free_categories() { + for (error_kind, data_code, admin_code) in [ + ( + std::io::ErrorKind::AddrInUse, + ProcessStartupCode::DATA_LISTENER_ADDRESS_IN_USE, + ProcessStartupCode::ADMIN_LISTENER_ADDRESS_IN_USE, + ), + ( + std::io::ErrorKind::PermissionDenied, + ProcessStartupCode::DATA_LISTENER_PERMISSION_DENIED, + ProcessStartupCode::ADMIN_LISTENER_PERMISSION_DENIED, + ), + ( + std::io::ErrorKind::AddrNotAvailable, + ProcessStartupCode::DATA_LISTENER_UNAVAILABLE, + ProcessStartupCode::ADMIN_LISTENER_UNAVAILABLE, + ), + ( + std::io::ErrorKind::Other, + ProcessStartupCode::DATA_LISTENER_UNAVAILABLE, + ProcessStartupCode::ADMIN_LISTENER_UNAVAILABLE, + ), + ] { + assert_eq!( + ProcessStartupCode::from_data_listener_bind(error_kind), + data_code + ); + assert_eq!( + ProcessStartupCode::from_admin_listener_bind(error_kind), + admin_code + ); + } +} + +#[test] +fn shared_bundle_codes_have_an_exhaustive_relay_process_projection() { + let expected = [ + ProcessStartupCode::BUNDLE_BINDING_REJECTED, + ProcessStartupCode::BUNDLE_ROLLBACK_REJECTED, + ProcessStartupCode::BUNDLE_SIGNATURE_REJECTED, + ProcessStartupCode::BUNDLE_VALIDATION_REJECTED, + ]; + assert_eq!( + BundleVerificationCode::ALL + .iter() + .copied() + .map(ProcessStartupCode::from_bundle_verification) + .collect::>(), + expected + ); +} + +fn assert_safe_value_free(value: &str) { + let lower = value.to_ascii_lowercase(); + for forbidden in [ + "/country/private/source.yaml", + "/tmp/", + "/users/", + "sha256:", + "://", + "country_parser_error", + "country_secret", + "country@example.test", + "client_secret", + "api_key=", + ] { + assert!( + !lower.contains(forbidden), + "catalog-owned value contains forbidden runtime material {forbidden:?}: {value}" + ); + } +} diff --git a/crates/registry-relay/tests/startup_redaction.rs b/crates/registry-relay/tests/startup_redaction.rs new file mode 100644 index 000000000..44ce2f5ee --- /dev/null +++ b/crates/registry-relay/tests/startup_redaction.rs @@ -0,0 +1,633 @@ +// SPDX-License-Identifier: Apache-2.0 +//! Child-process regressions for the default Relay startup stderr boundary. + +use std::process::{Command, Output}; + +use registry_relay::process_startup::ProcessStartupCode; + +#[test] +fn missing_local_config_emits_only_the_specific_source_code() { + let tmp = tempfile::tempdir().expect("tempdir"); + let config_path = tmp.path().join("COUNTRY_MISSING_CONFIG_PATH.yaml"); + + let output = Command::new(env!("CARGO_BIN_EXE_registry-relay")) + .args([ + "--config", + config_path.to_str().expect("config path is UTF-8"), + ]) + .output() + .expect("Relay runs"); + + assert_failed_output_is_safe( + &output, + "relay.startup.config_source_unavailable", + &[ + "COUNTRY_MISSING_CONFIG_PATH", + config_path.to_str().expect("config path is UTF-8"), + ], + ); +} + +#[test] +fn malformed_local_config_emits_only_static_product_diagnostics() { + let tmp = tempfile::tempdir().expect("tempdir"); + let private_dir = tmp + .path() + .join("COUNTRY_PRIVATE") + .join("redaction-user@example.test"); + std::fs::create_dir_all(&private_dir).expect("private dir creates"); + let config_path = private_dir.join("COUNTRY_CONFIG_PATH.yaml"); + let parser_sentinel = "COUNTRY_PARSER_ERROR COUNTRY_SECRET_VALUE"; + std::fs::write( + &config_path, + format!("deployment:\n profile: local\n{parser_sentinel}\n\t- invalid"), + ) + .expect("malformed config writes"); + + let output = Command::new(env!("CARGO_BIN_EXE_registry-relay")) + .args([ + "--config", + config_path.to_str().expect("config path is UTF-8"), + ]) + .output() + .expect("Relay runs"); + + assert_failed_output_is_safe( + &output, + "relay.startup.config_document_invalid", + &[ + parser_sentinel, + "COUNTRY_PRIVATE", + "redaction-user@example.test", + "COUNTRY_CONFIG_PATH", + config_path.to_str().expect("config path is UTF-8"), + ], + ); + let stderr = String::from_utf8_lossy(&output.stderr); + assert_eq!( + stderr + .matches("relay.startup.runtime_initialization_failed") + .count(), + 0, + "a classified loader failure must not also emit the generic startup code: {stderr}" + ); +} + +#[test] +fn missing_environment_binding_emits_exact_value_free_terminal_guidance() { + let tmp = tempfile::tempdir().expect("tempdir"); + let config_path = tmp.path().join("COUNTRY_ENV_BINDING_PATH.yaml"); + let env_sentinel = "COUNTRY_MISSING_ENV_BINDING"; + std::fs::write( + &config_path, + format!("server:\n bind: ${{{env_sentinel}:?COUNTRY_ENV_ERROR_SENTINEL}}\n"), + ) + .expect("environment-bound config writes"); + + let output = Command::new(env!("CARGO_BIN_EXE_registry-relay")) + .env("RUST_LOG", "off") + .env_remove(env_sentinel) + .args([ + "--config", + config_path.to_str().expect("config path is UTF-8"), + ]) + .output() + .expect("Relay runs"); + + assert_failed_terminal_output_is_exact( + &output, + ProcessStartupCode::CONFIG_ENVIRONMENT_BINDING_REJECTED, + &[ + env_sentinel, + "COUNTRY_ENV_ERROR_SENTINEL", + "COUNTRY_ENV_BINDING_PATH", + config_path.to_str().expect("config path is UTF-8"), + ], + ); +} + +#[test] +fn deprecated_config_field_emits_exact_value_free_terminal_guidance() { + let tmp = tempfile::tempdir().expect("tempdir"); + let config_path = tmp.path().join("COUNTRY_DEPRECATED_FIELD_PATH.yaml"); + let value_sentinel = "COUNTRY_DEPRECATED_FIELD_VALUE"; + std::fs::write( + &config_path, + format!("auth:\n oidc:\n audience: {value_sentinel}\n"), + ) + .expect("deprecated-field config writes"); + + let output = Command::new(env!("CARGO_BIN_EXE_registry-relay")) + .env("RUST_LOG", "off") + .args([ + "--config", + config_path.to_str().expect("config path is UTF-8"), + ]) + .output() + .expect("Relay runs"); + + assert_failed_terminal_output_is_exact( + &output, + ProcessStartupCode::CONFIG_DEPRECATED_FIELD_REJECTED, + &[ + "auth.oidc.audience", + "auth.oidc.audiences", + value_sentinel, + "COUNTRY_DEPRECATED_FIELD_PATH", + config_path.to_str().expect("config path is UTF-8"), + ], + ); +} + +#[test] +fn typed_config_document_failure_emits_exact_value_free_terminal_guidance() { + let tmp = tempfile::tempdir().expect("tempdir"); + let config_path = tmp.path().join("COUNTRY_TYPED_DOCUMENT_PATH.yaml"); + let field_sentinel = "COUNTRY_UNKNOWN_TYPED_FIELD"; + let value_sentinel = "COUNTRY_TYPED_FIELD_VALUE"; + std::fs::write( + &config_path, + format!("server:\n bind: 127.0.0.1:0\n{field_sentinel}: {value_sentinel}\n"), + ) + .expect("typed-invalid config writes"); + + let output = Command::new(env!("CARGO_BIN_EXE_registry-relay")) + .env("RUST_LOG", "off") + .args([ + "--config", + config_path.to_str().expect("config path is UTF-8"), + ]) + .output() + .expect("Relay runs"); + + assert_failed_terminal_output_is_exact( + &output, + ProcessStartupCode::CONFIG_DOCUMENT_INVALID, + &[ + field_sentinel, + value_sentinel, + "COUNTRY_TYPED_DOCUMENT_PATH", + config_path.to_str().expect("config path is UTF-8"), + ], + ); +} + +#[test] +fn openapi_malformed_config_matches_serve_classification() { + assert_subcommand_config_failure_is_exact( + "openapi", + "COUNTRY_OPENAPI_MALFORMED_PATH.yaml", + "deployment:\n profile: local\nCOUNTRY_OPENAPI_PARSER_SENTINEL\n\t- invalid", + ProcessStartupCode::CONFIG_DOCUMENT_INVALID, + &["COUNTRY_OPENAPI_PARSER_SENTINEL"], + ); +} + +#[test] +fn openapi_typed_invalid_config_matches_serve_classification() { + assert_subcommand_config_failure_is_exact( + "openapi", + "COUNTRY_OPENAPI_TYPED_PATH.yaml", + "server:\n bind: 127.0.0.1:0\nCOUNTRY_OPENAPI_TYPED_FIELD: COUNTRY_OPENAPI_TYPED_VALUE\n", + ProcessStartupCode::CONFIG_DOCUMENT_INVALID, + &["COUNTRY_OPENAPI_TYPED_FIELD", "COUNTRY_OPENAPI_TYPED_VALUE"], + ); +} + +#[test] +fn explain_config_malformed_config_matches_serve_classification() { + assert_subcommand_config_failure_is_exact( + "explain-config", + "COUNTRY_EXPLAIN_MALFORMED_PATH.yaml", + "deployment:\n profile: local\nCOUNTRY_EXPLAIN_PARSER_SENTINEL\n\t- invalid", + ProcessStartupCode::CONFIG_DOCUMENT_INVALID, + &["COUNTRY_EXPLAIN_PARSER_SENTINEL"], + ); +} + +#[test] +fn explain_config_typed_invalid_config_matches_serve_classification() { + assert_subcommand_config_failure_is_exact( + "explain-config", + "COUNTRY_EXPLAIN_TYPED_PATH.yaml", + "server:\n bind: 127.0.0.1:0\nCOUNTRY_EXPLAIN_TYPED_FIELD: COUNTRY_EXPLAIN_TYPED_VALUE\n", + ProcessStartupCode::CONFIG_DOCUMENT_INVALID, + &["COUNTRY_EXPLAIN_TYPED_FIELD", "COUNTRY_EXPLAIN_TYPED_VALUE"], + ); +} + +#[test] +fn config_validation_does_not_repeat_environment_or_authored_values() { + let tmp = tempfile::tempdir().expect("tempdir"); + let config_path = tmp.path().join("COUNTRY_VALIDATION_PATH.yaml"); + let env_sentinel = "COUNTRY_SECRET_ENV_REFERENCE"; + std::fs::write( + &config_path, + format!( + r#" +deployment: + profile: local +server: + bind: 127.0.0.1:0 +catalog: + title: COUNTRY_AUTHORED_VALUE + base_url: https://country-user@example.test/private + publisher: Test +vocabularies: {{}} +auth: + mode: api_key + api_keys: + - id: country_operator + fingerprint: + provider: env + name: {env_sentinel} +datasets: [] +audit: + sink: stdout +"# + ), + ) + .expect("invalid config writes"); + + let output = Command::new(env!("CARGO_BIN_EXE_registry-relay")) + .env_remove(env_sentinel) + .args([ + "--config", + config_path.to_str().expect("config path is UTF-8"), + ]) + .output() + .expect("Relay runs"); + + assert_failed_output_is_safe( + &output, + "relay.startup.config_validation_rejected", + &[ + env_sentinel, + "COUNTRY_AUTHORED_VALUE", + "country-user@example.test", + "country_operator", + "COUNTRY_VALIDATION_PATH", + config_path.to_str().expect("config path is UTF-8"), + ], + ); +} + +#[test] +fn undeclared_profile_emits_only_safe_config_validation_code() { + let tmp = tempfile::tempdir().expect("tempdir"); + let config_path = tmp.path().join("COUNTRY_UNDECLARED_PROFILE_PATH.yaml"); + std::fs::write( + &config_path, + r#" +server: + bind: 127.0.0.1:0 +catalog: + title: Test + base_url: https://data.example.test + publisher: Test +vocabularies: {} +auth: + mode: api_key + api_keys: [] +datasets: [] +audit: + sink: stdout +"#, + ) + .expect("undeclared profile config writes"); + + let output = Command::new(env!("CARGO_BIN_EXE_registry-relay")) + .args([ + "--config", + config_path.to_str().expect("config path is UTF-8"), + ]) + .output() + .expect("Relay runs"); + + assert_failed_output_is_safe( + &output, + "relay.startup.config_validation_rejected", + &[ + "deployment.profile_undeclared", + "set deployment.profile: local for development", + "production/evidence_grade", + "COUNTRY_UNDECLARED_PROFILE_PATH", + config_path.to_str().expect("config path is UTF-8"), + ], + ); +} + +#[test] +fn runtime_protected_dependency_failure_does_not_repeat_secret_or_inner_error() { + let tmp = tempfile::tempdir().expect("tempdir"); + let config_path = tmp.path().join("COUNTRY_RUNTIME_PATH.yaml"); + let secret_env = "COUNTRY_RUNTIME_AUDIT_SECRET"; + std::fs::write( + &config_path, + format!( + r#" +deployment: + profile: local +server: + bind: 127.0.0.1:0 +catalog: + title: Test + base_url: https://data.example.test + publisher: Test +vocabularies: {{}} +auth: + mode: api_key + api_keys: [] +datasets: [] +audit: + sink: stdout + hash_secret_env: {secret_env} +"# + ), + ) + .expect("runtime config writes"); + let secret_sentinel = "COUNTRY_RUNTIME_SECRET_VALUE"; + + let output = Command::new(env!("CARGO_BIN_EXE_registry-relay")) + .env(secret_env, secret_sentinel) + .args([ + "--config", + config_path.to_str().expect("config path is UTF-8"), + ]) + .output() + .expect("Relay runs"); + + assert_failed_output_is_safe( + &output, + "relay.startup.config_validation_rejected", + &[ + secret_env, + secret_sentinel, + "COUNTRY_RUNTIME_PATH", + config_path.to_str().expect("config path is UTF-8"), + ], + ); +} + +#[test] +fn occupied_data_listener_emits_exact_value_free_terminal_guidance() { + let listener = std::net::TcpListener::bind("127.0.0.1:0").expect("held listener binds"); + let occupied_addr = listener.local_addr().expect("listener exposes address"); + let tmp = tempfile::tempdir().expect("tempdir"); + let config_path = tmp.path().join("COUNTRY_LISTENER_PATH.yaml"); + let secret_env = "COUNTRY_LISTENER_AUDIT_SECRET"; + let secret_value = "COUNTRY_LISTENER_SECRET_VALUE_32_BYTES"; + write_listener_config(&config_path, occupied_addr, None, secret_env); + + let output = Command::new(env!("CARGO_BIN_EXE_registry-relay")) + .env("RUST_LOG", "off") + .env(secret_env, secret_value) + .args([ + "--config", + config_path.to_str().expect("config path is UTF-8"), + ]) + .output() + .expect("Relay runs"); + + assert_failed_terminal_output_is_exact( + &output, + ProcessStartupCode::DATA_LISTENER_ADDRESS_IN_USE, + &[ + secret_env, + secret_value, + "COUNTRY_LISTENER_PATH", + config_path.to_str().expect("config path is UTF-8"), + &occupied_addr.to_string(), + ], + ); +} + +#[test] +fn occupied_admin_listener_emits_exact_value_free_terminal_guidance() { + let listener = std::net::TcpListener::bind("127.0.0.1:0").expect("held listener binds"); + let occupied_addr = listener.local_addr().expect("listener exposes address"); + let tmp = tempfile::tempdir().expect("tempdir"); + let config_path = tmp.path().join("COUNTRY_ADMIN_LISTENER_PATH.yaml"); + let secret_env = "COUNTRY_ADMIN_LISTENER_AUDIT_SECRET"; + let secret_value = "COUNTRY_ADMIN_LISTENER_SECRET_VALUE_32_BYTES"; + write_listener_config( + &config_path, + "127.0.0.1:0".parse().expect("data listener parses"), + Some(occupied_addr), + secret_env, + ); + + let output = Command::new(env!("CARGO_BIN_EXE_registry-relay")) + .env("RUST_LOG", "off") + .env(secret_env, secret_value) + .args([ + "--config", + config_path.to_str().expect("config path is UTF-8"), + ]) + .output() + .expect("Relay runs"); + + assert_failed_terminal_output_is_exact( + &output, + ProcessStartupCode::ADMIN_LISTENER_ADDRESS_IN_USE, + &[ + secret_env, + secret_value, + "COUNTRY_ADMIN_LISTENER_PATH", + config_path.to_str().expect("config path is UTF-8"), + &occupied_addr.to_string(), + ], + ); +} + +#[test] +fn occupied_admin_listener_default_logging_does_not_render_bindings() { + let listener = std::net::TcpListener::bind("127.0.0.1:0").expect("held listener binds"); + let occupied_addr = listener.local_addr().expect("listener exposes address"); + let tmp = tempfile::tempdir().expect("tempdir"); + let config_path = tmp + .path() + .join("COUNTRY_DEFAULT_LOG_ADMIN_LISTENER_PATH.yaml"); + let secret_env = "COUNTRY_DEFAULT_LOG_ADMIN_LISTENER_AUDIT_SECRET"; + let secret_value = "COUNTRY_DEFAULT_LOG_ADMIN_LISTENER_SECRET_32_BYTES"; + write_listener_config( + &config_path, + "127.0.0.1:0".parse().expect("data listener parses"), + Some(occupied_addr), + secret_env, + ); + + let output = Command::new(env!("CARGO_BIN_EXE_registry-relay")) + .env("RUST_LOG", "info") + .env(secret_env, secret_value) + .args([ + "--config", + config_path.to_str().expect("config path is UTF-8"), + ]) + .output() + .expect("Relay runs"); + + assert_failed_output_is_safe( + &output, + ProcessStartupCode::ADMIN_LISTENER_ADDRESS_IN_USE.as_str(), + &[ + secret_env, + secret_value, + "COUNTRY_DEFAULT_LOG_ADMIN_LISTENER_PATH", + config_path.to_str().expect("config path is UTF-8"), + &occupied_addr.to_string(), + ], + ); +} + +#[test] +fn unknown_process_error_does_not_render_the_inner_cli_error() { + let cli_sentinel = "--COUNTRY_UNKNOWN_ARGUMENT_redaction-user@example.test"; + let output = Command::new(env!("CARGO_BIN_EXE_registry-relay")) + .arg(cli_sentinel) + .output() + .expect("Relay runs"); + + assert_failed_output_is_safe( + &output, + "relay.startup.runtime_initialization_failed", + &[cli_sentinel, "redaction-user@example.test"], + ); +} + +fn write_listener_config( + config_path: &std::path::Path, + data_bind: std::net::SocketAddr, + admin_bind: Option, + secret_env: &str, +) { + let admin_bind = admin_bind + .map(|address| format!(" admin_bind: {address}\n")) + .unwrap_or_default(); + std::fs::write( + config_path, + format!( + r#" +deployment: + profile: local +server: + bind: {data_bind} +{admin_bind}catalog: + title: Test + base_url: https://data.example.test + publisher: Test +vocabularies: {{}} +auth: + mode: api_key + api_keys: [] +datasets: [] +audit: + sink: stdout + hash_secret_env: {secret_env} +"# + ), + ) + .expect("listener config writes"); +} + +fn assert_subcommand_config_failure_is_exact( + subcommand: &str, + file_name: &str, + document: &str, + expected_code: ProcessStartupCode, + forbidden_values: &[&str], +) { + let tmp = tempfile::tempdir().expect("tempdir"); + let config_path = tmp.path().join(file_name); + std::fs::write(&config_path, document).expect("invalid config writes"); + + let output = Command::new(env!("CARGO_BIN_EXE_registry-relay")) + .env("RUST_LOG", "off") + .env_remove("REGISTRY_RELAY_ENV_FILE") + .args([ + subcommand, + "--config", + config_path.to_str().expect("config path is UTF-8"), + ]) + .output() + .expect("Relay subcommand runs"); + + let mut forbidden_values = forbidden_values.to_vec(); + forbidden_values.push(file_name); + forbidden_values.push(config_path.to_str().expect("config path is UTF-8")); + assert_failed_terminal_output_is_exact(&output, expected_code, &forbidden_values); +} + +fn assert_failed_terminal_output_is_exact( + output: &Output, + expected_code: ProcessStartupCode, + forbidden_values: &[&str], +) { + assert!(!output.status.success()); + let definition = expected_code.definition(); + let expected = format!( + "ERROR {}: {}; next action: {}\n", + definition.code, definition.safe_meaning, definition.safe_remediation + ); + let stdout = String::from_utf8_lossy(&output.stdout); + let stderr = String::from_utf8_lossy(&output.stderr); + assert!(stdout.is_empty(), "startup failure wrote stdout: {stdout}"); + assert_eq!(stderr, expected); + assert_eq!(stderr.lines().count(), 1); + for forbidden in forbidden_values { + assert!( + !stderr.contains(forbidden), + "terminal failure exposed forbidden value {forbidden:?}: {stderr}" + ); + } +} + +fn assert_failed_output_is_safe(output: &Output, expected_code: &str, forbidden_values: &[&str]) { + assert!(!output.status.success()); + let stdout = String::from_utf8_lossy(&output.stdout); + let stderr = String::from_utf8_lossy(&output.stderr); + assert!( + stderr.contains(expected_code), + "stderr lacks expected stable code {expected_code}: {stderr}" + ); + assert_eq!( + stderr.matches(expected_code).count(), + 1, + "stderr must emit the expected stable code exactly once: {stderr}" + ); + if expected_code != ProcessStartupCode::RUNTIME_INITIALIZATION_FAILED.as_str() { + assert_eq!( + stderr + .matches(ProcessStartupCode::RUNTIME_INITIALIZATION_FAILED.as_str()) + .count(), + 0, + "a specifically classified failure must not also emit the generic startup code: {stderr}" + ); + } + let emitted_codes = ProcessStartupCode::ALL + .iter() + .map(|code| code.as_str()) + .filter(|code| stderr.contains(code)) + .collect::>(); + assert_eq!( + emitted_codes, + vec![expected_code], + "stderr must contain exactly one product startup code: {stderr}" + ); + for forbidden in forbidden_values { + assert!( + !stdout.contains(forbidden), + "stdout leaked forbidden value {forbidden:?}: {stdout}" + ); + assert!( + !stderr.contains(forbidden), + "stderr leaked forbidden value {forbidden:?}: {stderr}" + ); + } + for generic_forbidden in ["sha256:", "COUNTRY_PARSER_ERROR", "/Users/"] { + assert!( + !stderr.contains(generic_forbidden), + "stderr leaked forbidden value {generic_forbidden:?}: {stderr}" + ); + } +} diff --git a/crates/registryctl/CHANGELOG.md b/crates/registryctl/CHANGELOG.md index c1f0bef50..16b848b55 100644 --- a/crates/registryctl/CHANGELOG.md +++ b/crates/registryctl/CHANGELOG.md @@ -6,8 +6,34 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/). ## [Unreleased] +### Added + +- Added strict, value-free project authoring reports and commands for field + explanation, offline preflight, capability inventory, semantic comparison, + signed-baseline promotion analysis, same-v1 migration, fixture coverage, and + generated artifact provenance. `registryctl compare` supports exact embedded + starter, local project, and same-project environment baselines without + reading runtime state or treating local files as signed approval. +- Added generated seven-domain configuration and ownership reference data plus + separate authoring, fixture, and operator diagnostic catalogs. Release gates + fail when schemas, runtime semantics, editor metadata, examples, generated + references, or stable diagnostics drift. +- Added platform-generated fixture boundary cases and per-integration coverage + classifications. Offline coverage remains explicitly distinct from live + source compatibility or country acceptance. + ### Changed +- **BREAKING:** Before the Registry Stack 1.0 compatibility promise takes + effect, `registry.project.fixture_coverage.v1` now distinguishes + mapping-derived fixtures from independently executed, per-consultation + governed-request witnesses. The closed report adds governed-request proof scope, + reachable service/consultation identities, per-fixture binding evidence, and + the `request_to_consultation_binding` requirement. Previously saved v1 + reports are intentionally rejected. Regenerate them with + `registryctl test --project-dir --format json` and update consumers + to use the per-target requirement state as the authoritative pass or missing + result. - Attribute-release project authoring now emits the stable Relay profile contract with required purpose, exact subject type, and exact-one lookup semantics. It rejects non-portable profile version path segments and Relay diff --git a/crates/registryctl/Cargo.toml b/crates/registryctl/Cargo.toml index be99021bc..4db2ee5f7 100644 --- a/crates/registryctl/Cargo.toml +++ b/crates/registryctl/Cargo.toml @@ -14,6 +14,7 @@ relay-contract-test-support = ["registry-notary-server/relay-contract-test-suppo [dependencies] anyhow = "1" +async-trait.workspace = true base64 = "0.22" cel.workspace = true clap = { version = "4.5", features = ["derive"] } @@ -23,6 +24,7 @@ getrandom = "0.4" hex.workspace = true include_dir = "0.7" ipnet.workspace = true +jsonschema.workspace = true rcgen.workspace = true registry-config-report = { workspace = true } registry-language-server.workspace = true @@ -31,6 +33,7 @@ registry-notary-server = { workspace = true, features = ["registry-notary-cel"] registry-platform-authcommon = { workspace = true } registry-platform-config = { workspace = true } registry-platform-crypto = { workspace = true } +registry-platform-ops = { workspace = true } registry-relay = { workspace = true, features = ["attribute-release", "ogcapi-features", "spdci-api-standards"] } regex = "1" rustix.workspace = true @@ -46,4 +49,4 @@ url = "2" zeroize.workspace = true [dev-dependencies] -jsonschema = { workspace = true } +schemars.workspace = true diff --git a/crates/registryctl/README.md b/crates/registryctl/README.md index adfdc5ca3..a3ba92190 100644 --- a/crates/registryctl/README.md +++ b/crates/registryctl/README.md @@ -44,6 +44,16 @@ For the full walkthroughs, use the Registry Docs tutorials: ## Registry Stack project authoring +The project-authoring workflow in this section documents the current +unreleased source revision. The `v0.13.0` installer shown earlier does not +contain the complete workflow. Build `registryctl` from the same reviewed +Registry Stack source revision as these instructions until a later release +publishes this surface. +The public +[current-source test procedure](https://docs.registrystack.org/start/test-current-source-revision/) +pins one commit, builds its CLI, runs the matching local product gate, and records the boundary +between source-test and release evidence. + Start from a built-in Registry Stack project starter, run its closed offline fixtures, inspect the redacted generated plan, and build deterministic Relay and Notary inputs. Available starters are `http`, `dhis2-tracker`, @@ -87,6 +97,11 @@ environment YAML file included in the project digest, even when that environment is not selected. Any diagnostic prevents compilation, generated product validation, fixture execution, and build output. +Treat generated Relay and Notary configuration as build output, not as another +authoring surface. `registryctl` diagnostics apply to the project sources that +produced that output. Hand-editing compiled configuration is unsupported and +has no project-level diagnostic path; change the project and regenerate it. + `script` uses the release-gated Rhai v1 authoring ABI. Its offline conformance fixtures use the isolated implementation-owned worker harness, and deployment uses the same fixed source authority, budgets, and reviewed script closure. diff --git a/crates/registryctl/assets/project-starters/bounded-http/integrations/person-record/fixtures/active.yaml b/crates/registryctl/assets/project-starters/bounded-http/integrations/person-record/fixtures/active.yaml index 25e137d8d..cfb842ce4 100644 --- a/crates/registryctl/assets/project-starters/bounded-http/integrations/person-record/fixtures/active.yaml +++ b/crates/registryctl/assets/project-starters/bounded-http/integrations/person-record/fixtures/active.yaml @@ -1,5 +1,13 @@ name: active-person classification: synthetic +request: + target: + type: Person + identifiers: [{ scheme: registry_person_id, value: AB-123456 }] + claims: [person-record-exists] + disclosure: predicate + format: application/vnd.registry-notary.claim-result+json + purpose: public-service-person-verification input: { person_id: AB-123456 } interactions: - expect: diff --git a/crates/registryctl/assets/project-starters/bounded-http/registry-stack.yaml b/crates/registryctl/assets/project-starters/bounded-http/registry-stack.yaml index 2922137d0..3ea2d70ec 100644 --- a/crates/registryctl/assets/project-starters/bounded-http/registry-stack.yaml +++ b/crates/registryctl/assets/project-starters/bounded-http/registry-stack.yaml @@ -2,7 +2,7 @@ version: 1 starter: id: http release: 0.13.0 - content_digest: sha256:08d5bbc9a9de3a55f6915abe87b1274c8af4c3ccc186302952f177ea383b9918 + content_digest: sha256:a4e0263957f3dd7756ef1a270483f4aa5f856102f070c6e0325e8cc9b1413b76 registry: id: fictional-citizen-registry diff --git a/crates/registryctl/build.rs b/crates/registryctl/build.rs new file mode 100644 index 000000000..fc3d25b9d --- /dev/null +++ b/crates/registryctl/build.rs @@ -0,0 +1,52 @@ +// SPDX-License-Identifier: Apache-2.0 + +use std::fs; +use std::path::Path; + +const EMBEDDED_PROJECT_TREES: &[&str] = &[ + "assets/project-starters", + "tests/fixtures/project-authoring/dhis2-tracker", + "tests/fixtures/project-authoring/fhir-r4-coverage-active", + "tests/fixtures/project-authoring/opencrvs", + "tests/fixtures/project-authoring/snapshot-exact", +]; + +fn main() { + for tree in EMBEDDED_PROJECT_TREES { + track_tree(Path::new(tree)); + } +} + +fn track_tree(path: &Path) { + println!("cargo:rerun-if-changed={}", path.display()); + let metadata = fs::symlink_metadata(path).unwrap_or_else(|error| { + panic!( + "failed to inspect embedded project path {}: {error}", + path.display() + ) + }); + if !metadata.file_type().is_dir() { + return; + } + + let mut entries = fs::read_dir(path) + .unwrap_or_else(|error| { + panic!( + "failed to read embedded project tree {}: {error}", + path.display() + ) + }) + .map(|entry| { + entry.unwrap_or_else(|error| { + panic!( + "failed to inspect embedded project tree {}: {error}", + path.display() + ) + }) + }) + .collect::>(); + entries.sort_by_key(|entry| entry.file_name()); + for entry in entries { + track_tree(&entry.path()); + } +} diff --git a/crates/registryctl/schemas/project-authoring/documentation-intent.json b/crates/registryctl/schemas/project-authoring/documentation-intent.json new file mode 100644 index 000000000..4e0ca7a4f --- /dev/null +++ b/crates/registryctl/schemas/project-authoring/documentation-intent.json @@ -0,0 +1,1486 @@ +{ + "$schema": "https://id.registrystack.org/schemas/registryctl/project-authoring/documentation-intent.v1.schema.json", + "format_version": "1.0", + "policy": { + "human_sources": [ + "schema_description", + "reviewed_override", + "structural_taxonomy" + ], + "prohibited_sources": [ + "country_workspace", + "country_value", + "runtime_configuration", + "derived_field_label" + ], + "prose_required_for": [ + "root", + "property", + "map_key", + "map_value", + "array_item", + "branch" + ] + }, + "structural_intents": { + "map_key": { + "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field." + }, + "map_value": { + "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map." + }, + "array_item": { + "purpose": "Defines the contract shared by each ordered item in the enclosing authored list." + }, + "branch": { + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field." + } + }, + "structural_reviews": [ + { "schema": "project", "pointer": "/properties/integrations/propertyNames", "path_kind": "map_key" }, + { "schema": "project", "pointer": "/properties/integrations/additionalProperties", "path_kind": "map_value" }, + { "schema": "project", "pointer": "/properties/entities/propertyNames", "path_kind": "map_key" }, + { "schema": "project", "pointer": "/properties/entities/additionalProperties", "path_kind": "map_value" }, + { "schema": "project", "pointer": "/properties/services/propertyNames", "path_kind": "map_key" }, + { "schema": "project", "pointer": "/properties/services/additionalProperties", "path_kind": "map_value" }, + { "schema": "project", "pointer": "/anyOf/0", "path_kind": "branch" }, + { "schema": "project", "pointer": "/anyOf/1", "path_kind": "branch" }, + { "schema": "project", "pointer": "/anyOf/2", "path_kind": "branch" }, + { "schema": "project", "pointer": "/$defs/recordsApi/properties/purposes/items", "path_kind": "array_item" }, + { "schema": "project", "pointer": "/$defs/recordsApi/properties/projection/items", "path_kind": "array_item" }, + { "schema": "project", "pointer": "/$defs/recordsApi/properties/filters/propertyNames", "path_kind": "map_key" }, + { "schema": "project", "pointer": "/$defs/recordsApi/properties/filters/additionalProperties", "path_kind": "map_value" }, + { "schema": "project", "pointer": "/$defs/recordsApi/properties/relationships/propertyNames", "path_kind": "map_key" }, + { "schema": "project", "pointer": "/$defs/recordsApi/properties/relationships/additionalProperties", "path_kind": "map_value" }, + { "schema": "project", "pointer": "/$defs/recordsApi/properties/aggregates/propertyNames", "path_kind": "map_key" }, + { "schema": "project", "pointer": "/$defs/recordsApi/properties/aggregates/additionalProperties", "path_kind": "map_value" }, + { "schema": "project", "pointer": "/$defs/recordsApi/properties/standards/properties/ogc_features/oneOf/0", "path_kind": "branch" }, + { "schema": "project", "pointer": "/$defs/recordsApi/properties/standards/properties/ogc_features/oneOf/1", "path_kind": "branch" }, + { "schema": "project", "pointer": "/$defs/recordsApi/properties/standards/properties/sp_dci/oneOf/0", "path_kind": "branch" }, + { "schema": "project", "pointer": "/$defs/recordsApi/properties/standards/properties/sp_dci/oneOf/1", "path_kind": "branch" }, + { "schema": "project", "pointer": "/$defs/recordAttributeReleaseProfiles/propertyNames", "path_kind": "map_key" }, + { "schema": "project", "pointer": "/$defs/recordAttributeReleaseProfiles/additionalProperties", "path_kind": "map_value" }, + { "schema": "project", "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/propertyNames", "path_kind": "map_key" }, + { "schema": "project", "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/additionalProperties", "path_kind": "map_value" }, + { "schema": "project", "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/additionalProperties/oneOf/0", "path_kind": "branch" }, + { "schema": "project", "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/additionalProperties/oneOf/1", "path_kind": "branch" }, + { "schema": "project", "pointer": "/$defs/filterOperators/items", "path_kind": "array_item" }, + { "schema": "project", "pointer": "/$defs/fieldList/items", "path_kind": "array_item" }, + { "schema": "project", "pointer": "/$defs/recordAggregate/properties/dimensions/items", "path_kind": "array_item" }, + { "schema": "project", "pointer": "/$defs/recordAggregate/properties/indicators/items", "path_kind": "array_item" }, + { "schema": "project", "pointer": "/$defs/recordAggregate/properties/allowed_filters/additionalProperties", "path_kind": "map_value" }, + { "schema": "project", "pointer": "/$defs/recordAggregate/properties/measures/items", "path_kind": "array_item" }, + { "schema": "project", "pointer": "/$defs/recordAggregate/anyOf/0", "path_kind": "branch" }, + { "schema": "project", "pointer": "/$defs/recordAggregate/anyOf/1", "path_kind": "branch" }, + { "schema": "project", "pointer": "/$defs/recordSpatialGeometry/oneOf/0", "path_kind": "branch" }, + { "schema": "project", "pointer": "/$defs/recordSpatialGeometry/oneOf/1", "path_kind": "branch" }, + { "schema": "project", "pointer": "/$defs/recordFieldMap/propertyNames", "path_kind": "map_key" }, + { "schema": "project", "pointer": "/$defs/recordFieldMap/additionalProperties", "path_kind": "map_value" }, + { "schema": "project", "pointer": "/$defs/disclosure/oneOf/0", "path_kind": "branch" }, + { "schema": "project", "pointer": "/$defs/disclosure/oneOf/1", "path_kind": "branch" }, + { "schema": "project", "pointer": "/$defs/disclosure/oneOf/1/properties/allowed/items", "path_kind": "array_item" }, + { "schema": "project", "pointer": "/$defs/service/oneOf/0", "path_kind": "branch" }, + { "schema": "project", "pointer": "/$defs/service/oneOf/1", "path_kind": "branch" }, + { "schema": "project", "pointer": "/$defs/recordsService/properties/conforms_to/items", "path_kind": "array_item" }, + { "schema": "project", "pointer": "/$defs/evidenceService/properties/claims/propertyNames", "path_kind": "map_key" }, + { "schema": "project", "pointer": "/$defs/evidenceService/properties/claims/additionalProperties", "path_kind": "map_value" }, + { "schema": "project", "pointer": "/$defs/evidenceService/properties/claims/additionalProperties/oneOf/0", "path_kind": "branch" }, + { "schema": "project", "pointer": "/$defs/evidenceService/properties/claims/additionalProperties/oneOf/1", "path_kind": "branch" }, + { "schema": "project", "pointer": "/$defs/evidenceService/properties/credential_profiles/propertyNames", "path_kind": "map_key" }, + { "schema": "project", "pointer": "/$defs/evidenceService/properties/credential_profiles/additionalProperties", "path_kind": "map_value" }, + { "schema": "project", "pointer": "/$defs/evidenceService/properties/credential_profiles/additionalProperties/properties/claims/items", "path_kind": "array_item" }, + { "schema": "project", "pointer": "/$defs/access/properties/scopes/items", "path_kind": "array_item" }, + { "schema": "project", "pointer": "/$defs/variables/propertyNames", "path_kind": "map_key" }, + { "schema": "project", "pointer": "/$defs/variables/additionalProperties", "path_kind": "map_value" }, + { "schema": "project", "pointer": "/$defs/consultations/propertyNames", "path_kind": "map_key" }, + { "schema": "project", "pointer": "/$defs/consultations/additionalProperties", "path_kind": "map_value" }, + { "schema": "project", "pointer": "/$defs/consultations/additionalProperties/properties/input/propertyNames", "path_kind": "map_key" }, + { "schema": "project", "pointer": "/$defs/consultations/additionalProperties/properties/input/additionalProperties", "path_kind": "map_value" }, + { "schema": "environment", "pointer": "/properties/integrations/propertyNames", "path_kind": "map_key" }, + { "schema": "environment", "pointer": "/properties/integrations/additionalProperties", "path_kind": "map_value" }, + { "schema": "environment", "pointer": "/properties/entities/propertyNames", "path_kind": "map_key" }, + { "schema": "environment", "pointer": "/properties/entities/additionalProperties", "path_kind": "map_value" }, + { "schema": "environment", "pointer": "/properties/callers/propertyNames", "path_kind": "map_key" }, + { "schema": "environment", "pointer": "/properties/callers/additionalProperties", "path_kind": "map_value" }, + { "schema": "environment", "pointer": "/properties/callers/additionalProperties/properties/scopes/items", "path_kind": "array_item" }, + { "schema": "environment", "pointer": "/properties/relay/properties/allowed_clients/items", "path_kind": "array_item" }, + { "schema": "environment", "pointer": "/properties/deployment/anyOf/0", "path_kind": "branch" }, + { "schema": "environment", "pointer": "/properties/deployment/anyOf/1", "path_kind": "branch" }, + { "schema": "environment", "pointer": "/allOf/0", "path_kind": "branch" }, + { "schema": "environment", "pointer": "/allOf/0/if", "path_kind": "branch" }, + { "schema": "environment", "pointer": "/allOf/0/then", "path_kind": "branch" }, + { "schema": "environment", "pointer": "/allOf/0/else", "path_kind": "branch" }, + { "schema": "environment", "pointer": "/allOf/0/else/not", "path_kind": "branch" }, + { "schema": "environment", "pointer": "/allOf/1", "path_kind": "branch" }, + { "schema": "environment", "pointer": "/allOf/1/if", "path_kind": "branch" }, + { "schema": "environment", "pointer": "/allOf/1/then", "path_kind": "branch" }, + { "schema": "environment", "pointer": "/allOf/2", "path_kind": "branch" }, + { "schema": "environment", "pointer": "/allOf/2/if", "path_kind": "branch" }, + { "schema": "environment", "pointer": "/allOf/2/then", "path_kind": "branch" }, + { "schema": "environment", "pointer": "/allOf/3", "path_kind": "branch" }, + { "schema": "environment", "pointer": "/allOf/3/if", "path_kind": "branch" }, + { "schema": "environment", "pointer": "/allOf/3/then", "path_kind": "branch" }, + { "schema": "environment", "pointer": "/allOf/4", "path_kind": "branch" }, + { "schema": "environment", "pointer": "/allOf/4/if", "path_kind": "branch" }, + { "schema": "environment", "pointer": "/allOf/4/then", "path_kind": "branch" }, + { "schema": "environment", "pointer": "/allOf/5", "path_kind": "branch" }, + { "schema": "environment", "pointer": "/allOf/5/if", "path_kind": "branch" }, + { "schema": "environment", "pointer": "/allOf/5/then", "path_kind": "branch" }, + { "schema": "environment", "pointer": "/allOf/5/else", "path_kind": "branch" }, + { "schema": "environment", "pointer": "/allOf/6", "path_kind": "branch" }, + { "schema": "environment", "pointer": "/allOf/6/if", "path_kind": "branch" }, + { "schema": "environment", "pointer": "/allOf/6/else", "path_kind": "branch" }, + { "schema": "environment", "pointer": "/$defs/internalOrigin/anyOf/0", "path_kind": "branch" }, + { "schema": "environment", "pointer": "/$defs/internalOrigin/anyOf/1", "path_kind": "branch" }, + { "schema": "environment", "pointer": "/$defs/relayOrigin/anyOf/0", "path_kind": "branch" }, + { "schema": "environment", "pointer": "/$defs/relayOrigin/anyOf/1", "path_kind": "branch" }, + { "schema": "environment", "pointer": "/$defs/relayResource/anyOf/0", "path_kind": "branch" }, + { "schema": "environment", "pointer": "/$defs/relayResource/anyOf/1", "path_kind": "branch" }, + { "schema": "environment", "pointer": "/$defs/oid4vci/properties/allowed_wallet_origins/items", "path_kind": "array_item" }, + { "schema": "environment", "pointer": "/$defs/privateCidrs/items", "path_kind": "array_item" }, + { "schema": "environment", "pointer": "/$defs/credential/oneOf/0", "path_kind": "branch" }, + { "schema": "environment", "pointer": "/$defs/credential/oneOf/1", "path_kind": "branch" }, + { "schema": "environment", "pointer": "/$defs/credential/oneOf/2", "path_kind": "branch" }, + { "schema": "environment", "pointer": "/$defs/credential/oneOf/3", "path_kind": "branch" }, + { "schema": "environment", "pointer": "/$defs/provider/oneOf/0", "path_kind": "branch" }, + { "schema": "environment", "pointer": "/$defs/provider/oneOf/1", "path_kind": "branch" }, + { "schema": "environment", "pointer": "/$defs/provider/oneOf/2", "path_kind": "branch" }, + { "schema": "environment", "pointer": "/$defs/provider/oneOf/3", "path_kind": "branch" }, + { "schema": "environment", "pointer": "/$defs/entity/properties/columns/propertyNames", "path_kind": "map_key" }, + { "schema": "environment", "pointer": "/$defs/entity/properties/columns/additionalProperties", "path_kind": "map_value" }, + { "schema": "integration", "pointer": "/properties/input/propertyNames", "path_kind": "map_key" }, + { "schema": "integration", "pointer": "/properties/input/additionalProperties", "path_kind": "map_value" }, + { "schema": "integration", "pointer": "/properties/outputs/oneOf/0", "path_kind": "branch" }, + { "schema": "integration", "pointer": "/properties/outputs/oneOf/0/propertyNames", "path_kind": "map_key" }, + { "schema": "integration", "pointer": "/properties/outputs/oneOf/0/propertyNames/allOf/0", "path_kind": "branch" }, + { "schema": "integration", "pointer": "/properties/outputs/oneOf/0/propertyNames/allOf/1", "path_kind": "branch" }, + { "schema": "integration", "pointer": "/properties/outputs/oneOf/0/propertyNames/allOf/1/not", "path_kind": "branch" }, + { "schema": "integration", "pointer": "/properties/outputs/oneOf/0/additionalProperties", "path_kind": "map_value" }, + { "schema": "integration", "pointer": "/properties/outputs/oneOf/1", "path_kind": "branch" }, + { "schema": "integration", "pointer": "/properties/outputs/oneOf/1/items", "path_kind": "array_item" }, + { "schema": "integration", "pointer": "/$defs/byteSize/oneOf/0", "path_kind": "branch" }, + { "schema": "integration", "pointer": "/$defs/byteSize/oneOf/1", "path_kind": "branch" }, + { "schema": "integration", "pointer": "/$defs/scalarType/oneOf/0", "path_kind": "branch" }, + { "schema": "integration", "pointer": "/$defs/scalarType/oneOf/1", "path_kind": "branch" }, + { "schema": "integration", "pointer": "/$defs/scalarType/oneOf/1/prefixItems/0", "path_kind": "array_item" }, + { "schema": "integration", "pointer": "/$defs/scalarType/oneOf/1/prefixItems/1", "path_kind": "array_item" }, + { "schema": "integration", "pointer": "/$defs/versions/anyOf/0", "path_kind": "branch" }, + { "schema": "integration", "pointer": "/$defs/versions/anyOf/1", "path_kind": "branch" }, + { "schema": "integration", "pointer": "/$defs/versionList/items", "path_kind": "array_item" }, + { "schema": "integration", "pointer": "/$defs/credential/oneOf/0", "path_kind": "branch" }, + { "schema": "integration", "pointer": "/$defs/credential/oneOf/1", "path_kind": "branch" }, + { "schema": "integration", "pointer": "/$defs/credential/oneOf/2", "path_kind": "branch" }, + { "schema": "integration", "pointer": "/$defs/credential/oneOf/3", "path_kind": "branch" }, + { "schema": "integration", "pointer": "/$defs/source/properties/allow/items", "path_kind": "array_item" }, + { "schema": "integration", "pointer": "/$defs/source/properties/request_headers/items", "path_kind": "array_item" }, + { "schema": "integration", "pointer": "/$defs/source/properties/response_headers/items", "path_kind": "array_item" }, + { "schema": "integration", "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors/propertyNames", "path_kind": "map_key" }, + { "schema": "integration", "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors/additionalProperties", "path_kind": "map_value" }, + { "schema": "integration", "pointer": "/$defs/inputOrLiteral/oneOf/0", "path_kind": "branch" }, + { "schema": "integration", "pointer": "/$defs/inputOrLiteral/oneOf/1", "path_kind": "branch" }, + { "schema": "integration", "pointer": "/$defs/httpRequest/properties/query/additionalProperties", "path_kind": "map_value" }, + { "schema": "integration", "pointer": "/$defs/httpRequest/properties/headers/additionalProperties", "path_kind": "map_value" }, + { "schema": "integration", "pointer": "/$defs/httpResponse/properties/no_match/items", "path_kind": "array_item" }, + { "schema": "integration", "pointer": "/$defs/httpResponse/properties/ambiguous/items", "path_kind": "array_item" }, + { "schema": "integration", "pointer": "/$defs/httpResponse/properties/shape/oneOf/0", "path_kind": "branch" }, + { "schema": "integration", "pointer": "/$defs/httpResponse/properties/shape/oneOf/1", "path_kind": "branch" }, + { "schema": "integration", "pointer": "/$defs/capability/oneOf/0", "path_kind": "branch" }, + { "schema": "integration", "pointer": "/$defs/capability/oneOf/1", "path_kind": "branch" }, + { "schema": "integration", "pointer": "/$defs/capability/oneOf/1/properties/script/properties/modules/items", "path_kind": "array_item" }, + { "schema": "integration", "pointer": "/$defs/capability/oneOf/2", "path_kind": "branch" }, + { "schema": "integration", "pointer": "/$defs/capability/oneOf/2/properties/snapshot/properties/exact/additionalProperties", "path_kind": "map_value" }, + { "schema": "fixture", "pointer": "/properties/input/propertyNames", "path_kind": "map_key" }, + { "schema": "fixture", "pointer": "/properties/input/additionalProperties", "path_kind": "map_value" }, + { "schema": "fixture", "pointer": "/properties/variables/propertyNames", "path_kind": "map_key" }, + { "schema": "fixture", "pointer": "/properties/variables/additionalProperties", "path_kind": "map_value" }, + { "schema": "fixture", "pointer": "/properties/interactions/items", "path_kind": "array_item" }, + { "schema": "fixture", "pointer": "/$defs/governedRequest/properties/variables/propertyNames", "path_kind": "map_key" }, + { "schema": "fixture", "pointer": "/$defs/governedRequest/properties/variables/additionalProperties", "path_kind": "map_value" }, + { "schema": "fixture", "pointer": "/$defs/governedRequest/properties/claims/items", "path_kind": "array_item" }, + { "schema": "fixture", "pointer": "/$defs/governedTarget/properties/identifiers/items", "path_kind": "array_item" }, + { "schema": "fixture", "pointer": "/$defs/governedTarget/properties/attributes/additionalProperties", "path_kind": "map_value" }, + { "schema": "fixture", "pointer": "/$defs/governedClaimRef/oneOf/0", "path_kind": "branch" }, + { "schema": "fixture", "pointer": "/$defs/governedClaimRef/oneOf/1", "path_kind": "branch" }, + { "schema": "fixture", "pointer": "/$defs/request/properties/query/additionalProperties", "path_kind": "map_value" }, + { "schema": "fixture", "pointer": "/$defs/request/properties/query/additionalProperties/oneOf/0", "path_kind": "branch" }, + { "schema": "fixture", "pointer": "/$defs/request/properties/query/additionalProperties/oneOf/1", "path_kind": "branch" }, + { "schema": "fixture", "pointer": "/$defs/request/properties/query/additionalProperties/oneOf/1/items", "path_kind": "array_item" }, + { "schema": "fixture", "pointer": "/$defs/request/properties/headers/propertyNames", "path_kind": "map_key" }, + { "schema": "fixture", "pointer": "/$defs/request/properties/headers/additionalProperties", "path_kind": "map_value" }, + { "schema": "fixture", "pointer": "/$defs/response/oneOf/0", "path_kind": "branch" }, + { "schema": "fixture", "pointer": "/$defs/response/oneOf/0/properties/headers/additionalProperties", "path_kind": "map_value" }, + { "schema": "fixture", "pointer": "/$defs/response/oneOf/1", "path_kind": "branch" }, + { "schema": "fixture", "pointer": "/$defs/fixtureBody/oneOf/0", "path_kind": "branch" }, + { "schema": "fixture", "pointer": "/$defs/fixtureBody/oneOf/1", "path_kind": "branch" }, + { "schema": "fixture", "pointer": "/$defs/fixtureBody/oneOf/1/not", "path_kind": "branch" }, + { "schema": "entity", "pointer": "/properties/materialization/properties/max_bytes/oneOf/0", "path_kind": "branch" }, + { "schema": "entity", "pointer": "/properties/materialization/properties/max_bytes/oneOf/1", "path_kind": "branch" }, + { "schema": "entity", "pointer": "/properties/materialization/properties/refresh/oneOf/0", "path_kind": "branch" }, + { "schema": "entity", "pointer": "/properties/materialization/properties/refresh/oneOf/1", "path_kind": "branch" }, + { "schema": "entity", "pointer": "/$defs/scalarType/oneOf/0", "path_kind": "branch" }, + { "schema": "entity", "pointer": "/$defs/scalarType/oneOf/1", "path_kind": "branch" }, + { "schema": "entity", "pointer": "/$defs/scalarType/oneOf/1/prefixItems/0", "path_kind": "array_item" }, + { "schema": "entity", "pointer": "/$defs/scalarType/oneOf/1/prefixItems/1", "path_kind": "array_item" }, + { "schema": "entity", "pointer": "/$defs/objectSchema/properties/required/items", "path_kind": "array_item" } + ], + "domains": [ + { + "schema": "project", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "state": "authored", + "environment_behavior": "narrows_reviewed_authority", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "example_guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data." + }, + { + "schema": "environment", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "state": "environment_bound", + "environment_behavior": "narrows_reviewed_authority", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "example_guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details." + }, + { + "schema": "integration", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "state": "authored", + "environment_behavior": "narrows_reviewed_authority", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "example_guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record." + }, + { + "schema": "fixture", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "state": "authored", + "environment_behavior": "environment_independent", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "example_guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data." + }, + { + "schema": "entity", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "state": "authored", + "environment_behavior": "narrows_reviewed_authority", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "example_guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace." + } + ], + "overrides": [ + { + "schema": "project", + "pointer": "/properties/registry/properties/id", + "purpose": "Assigns the stable project-local registry identifier used to bind generated product inputs and review artifacts." + }, + { + "schema": "project", + "pointer": "/properties/integrations/additionalProperties/properties/file", + "purpose": "Selects the project-relative authored integration document for this project-local integration identifier." + }, + { + "schema": "project", + "pointer": "/properties/entities/additionalProperties/properties/file", + "purpose": "Selects the project-relative authored entity document for this project-local entity identifier." + }, + { + "schema": "environment", + "pointer": "/properties/issuance/properties/issuer", + "purpose": "Binds the operator-approved credential issuer identifier without granting claim or disclosure authority." + }, + { + "schema": "environment", + "pointer": "/properties/issuance/properties/signing_key", + "purpose": "Names the operator-managed secret reference for credential signing; the signing key value is never authored or reported." + }, + { + "schema": "environment", + "pointer": "/properties/issuance/properties/signing_kid", + "purpose": "Selects the reviewed signing-key identifier exposed in issued credential metadata without containing private key material." + }, + { + "schema": "environment", + "pointer": "/properties/issuance/properties/generation", + "purpose": "Records the operator-controlled issuance-key generation used for explicit rotation and rollback checks." + }, + { + "schema": "environment", + "pointer": "/properties/callers/additionalProperties/properties/api_key_fingerprint", + "purpose": "Names the secret reference used to verify one caller API key; neither the key nor fingerprint value is authored here." + }, + { + "schema": "environment", + "pointer": "/properties/callers/additionalProperties/properties/scopes", + "purpose": "Narrows one caller to the explicitly reviewed service scopes available in this environment." + }, + { + "schema": "environment", + "pointer": "/properties/relay/properties/origin", + "purpose": "Binds the externally visible Relay origin reviewed by the operator and local network policy." + }, + { + "schema": "environment", + "pointer": "/properties/relay/properties/issuer", + "purpose": "Binds the expected token issuer for Relay authentication in this deployment environment." + }, + { + "schema": "environment", + "pointer": "/properties/relay/properties/jwks_url", + "purpose": "Binds the operator-reviewed key-set endpoint Relay uses to verify caller tokens." + }, + { + "schema": "environment", + "pointer": "/properties/relay/properties/audience", + "purpose": "Binds the token audience Relay requires so tokens issued for another service are rejected." + }, + { + "schema": "environment", + "pointer": "/properties/relay/properties/allowed_clients", + "purpose": "Narrows Relay authentication to the operator-reviewed client identifiers listed for this environment." + }, + { + "schema": "environment", + "pointer": "/properties/notary_relay/properties/base_url", + "purpose": "Binds Notary to the operator-reviewed Relay origin used for governed evidence consultations." + }, + { + "schema": "environment", + "pointer": "/properties/notary_relay/properties/workload_client_id", + "purpose": "Identifies the Notary workload client authorized to request reviewed Relay consultations." + }, + { + "schema": "environment", + "pointer": "/properties/notary_relay/properties/token_file", + "purpose": "Selects the operator-managed token-file binding for Notary-to-Relay authentication without exposing its contents." + }, + { + "schema": "environment", + "pointer": "/properties/relay_state/properties/postgresql/properties/root_certificate_path", + "purpose": "Binds Relay state storage to an operator-managed PostgreSQL trust root at a deployment-local path." + }, + { + "schema": "environment", + "pointer": "/properties/notary_state/properties/postgresql/properties/root_certificate_path", + "purpose": "Binds Notary state storage to an operator-managed PostgreSQL trust root at a deployment-local path." + }, + { + "schema": "integration", + "pointer": "/$defs/input/properties/role", + "purpose": "Declares how one typed authoring input participates in source lookup, selection, or result shaping." + }, + { + "schema": "integration", + "pointer": "/$defs/input/properties/type", + "purpose": "Declares the closed scalar or array type accepted for one integration input." + }, + { + "schema": "integration", + "pointer": "/$defs/input/properties/canonicalization", + "purpose": "Selects the reviewed normalization rule applied before an input is compared, interpolated, or sent to a source." + }, + { + "schema": "integration", + "pointer": "/$defs/source/properties/auth", + "purpose": "Declares the credential interface the source contract permits without embedding an environment credential value." + }, + { + "schema": "integration", + "pointer": "/$defs/source/properties/allow", + "purpose": "Constrains source access to the explicitly reviewed method and path templates in this integration contract." + }, + { + "schema": "integration", + "pointer": "/$defs/credential/oneOf/3/properties/audience", + "purpose": "Constrains OAuth token acquisition to the reviewed source audience and is treated as sensitive operational metadata." + }, + { + "schema": "integration", + "pointer": "/$defs/allowRule/properties/path", + "purpose": "Defines one reviewed source path template; concrete private endpoints and identifiers remain environment-owned." + }, + { + "schema": "fixture", + "pointer": "/$defs/request/properties/method", + "purpose": "States the synthetic request method expected from the offline integration fixture." + }, + { + "schema": "fixture", + "pointer": "/$defs/request/properties/path", + "purpose": "States the synthetic request path expected from the offline integration fixture." + }, + { + "schema": "fixture", + "pointer": "/$defs/request/properties/body", + "purpose": "Defines the synthetic request body expectation or fixture-local file reference without reading a source." + }, + { + "schema": "fixture", + "pointer": "/$defs/response/oneOf/0/properties/body", + "purpose": "Defines the synthetic response body returned by the offline fixture harness to the integration." + }, + { + "schema": "fixture", + "pointer": "/$defs/expectation/properties/claims", + "purpose": "States the synthetic Notary claim outcomes expected after the reviewed Relay consultation behavior." + }, + { + "schema": "entity", + "pointer": "/$defs/fieldSchema/properties/type", + "purpose": "Declares the closed scalar, array, or object type accepted for one entity field." + }, + { + "schema": "entity", + "pointer": "/$defs/fieldSchema/properties/format", + "purpose": "Adds a reviewed semantic format constraint to one string-valued entity field." + }, + { + "schema": "entity", + "pointer": "/$defs/objectSchema/properties/additionalProperties", + "purpose": "Controls whether the entity object accepts fields outside its declared closed property set." + }, + { + "schema": "entity", + "pointer": "/$defs/objectSchema/properties/required", + "purpose": "Lists the entity properties that every validated materialized record must contain." + }, + { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/scopes", + "purpose": "Groups the authorization scopes required for records metadata, row access, aggregates, and evidence verification." + }, + { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/purposes", + "purpose": "Lists the bounded purpose identifiers accepted by this records API policy." + }, + { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/projection", + "purpose": "Lists the entity fields that the records API is permitted to project into row responses." + }, + { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/required_principal_filters", + "purpose": "Lists principal-bound fields required for records queries; it must be empty when attribute-release profiles are configured because subject lookup cannot supply principal filters." + }, + { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/pagination", + "purpose": "Defines the default and maximum row limits enforced by records API pagination." + }, + { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/pagination/properties/default_limit", + "purpose": "Sets the row limit applied when a records request does not supply its own limit." + }, + { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/pagination/properties/max_limit", + "purpose": "Caps the row limit that any records request may select; it must be at least 2 when attribute-release profiles are configured so ambiguous subjects can be detected." + }, + { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/filters", + "purpose": "Maps filterable entity fields to the comparison operators the records API permits for each field." + }, + { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/relationships", + "purpose": "Declares the bounded named relationships that records queries may follow between authored entities." + }, + { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/relationships/additionalProperties/properties/kind", + "purpose": "Selects whether one declared records relationship belongs to, has many, or has one target record." + }, + { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/aggregates", + "purpose": "Maps aggregate identifiers to governed aggregate definitions exposed by the records API." + }, + { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/standards", + "purpose": "Declares whether this records API exposes its reviewed OGC Features and SP-DCI standards profiles." + }, + { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/standards/properties/ogc_features", + "purpose": "Disables OGC API Features support or supplies the reviewed spatial profile used to enable it." + }, + { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/standards/properties/sp_dci", + "purpose": "Disables SP-DCI support or supplies the reviewed registry mapping used to enable it." + }, + { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfile/properties/version", + "purpose": "Assigns a portable path-segment version matching [A-Za-z0-9][A-Za-z0-9._-]{0,63} to identify one attribute-release profile contract." + }, + { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfile/properties/purpose", + "purpose": "Binds the release to one permitted records purpose and requires a bounded visible-ASCII header token." + }, + { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfile/properties/release_scope", + "purpose": "Requires the exact entity-bound :identity_release scope and keeps release access distinct from records API scopes." + }, + { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfile/properties/subject", + "purpose": "Defines the projected source field and identifier type used for exact-one subject resolution." + }, + { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfile/properties/subject/properties/source_field", + "purpose": "Selects the projected entity field whose value is matched for exact-one subject resolution." + }, + { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfile/properties/subject/properties/id_type", + "purpose": "Labels the identifier type represented by the resolved subject identifier." + }, + { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfile/properties/release_conditions", + "purpose": "Contains the bounded expression that must authorize this purpose-bound attribute release." + }, + { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims", + "purpose": "Maps released claim names to their reviewed source or expression, requiredness, and sensitivity." + }, + { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/additionalProperties/properties/required", + "purpose": "States whether failure to produce this released claim makes the attribute-release result invalid." + }, + { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/additionalProperties/properties/sensitivity", + "purpose": "Classifies the released claim as a direct identifier, personal, public, or pseudonymous value." + }, + { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseExpression/properties/cel", + "purpose": "Provides the bounded CEL expression evaluated only against the projected source object." + }, + { + "schema": "project", + "pointer": "/$defs/recordAggregate/properties/dimensions", + "purpose": "Lists the labeled entity fields available as governed aggregate dimensions." + }, + { + "schema": "project", + "pointer": "/$defs/recordAggregate/properties/indicators", + "purpose": "Lists the named aggregate indicators, functions, source columns, and measurement metadata." + }, + { + "schema": "project", + "pointer": "/$defs/recordAggregate/properties/allowed_filters", + "purpose": "Maps aggregate filter fields to the comparison operators permitted for each field." + }, + { + "schema": "project", + "pointer": "/$defs/recordAggregate/properties/access", + "purpose": "Defines optional metadata and aggregate scopes and whether execution is restricted to aggregate-only access." + }, + { + "schema": "project", + "pointer": "/$defs/recordAggregate/properties/spatial", + "purpose": "Defines the reviewed administrative-area spatial aggregation and geometry materialization bindings." + }, + { + "schema": "project", + "pointer": "/$defs/recordAggregate/properties/measures", + "purpose": "Lists the named aggregation functions and entity columns used to compute this aggregate." + }, + { + "schema": "project", + "pointer": "/$defs/recordAggregate/properties/disclosure_control", + "purpose": "Defines the minimum group size and suppression behavior applied before aggregate results are disclosed." + }, + { + "schema": "project", + "pointer": "/$defs/recordAggregate/properties/disclosure_control/properties/min_group_size", + "purpose": "Sets the smallest result group that may be disclosed without suppression." + }, + { + "schema": "project", + "pointer": "/$defs/recordAggregate/properties/disclosure_control/properties/suppression", + "purpose": "Selects whether undersized aggregate groups are omitted, masked, or represented as null." + }, + { + "schema": "project", + "pointer": "/$defs/recordAggregateAccess/properties/aggregate_only_execution", + "purpose": "Restricts this definition to aggregate execution so it cannot be used as a record-level result path." + }, + { + "schema": "project", + "pointer": "/$defs/recordAggregateIndicator/properties/function", + "purpose": "Selects the aggregation function used to compute this named indicator." + }, + { + "schema": "project", + "pointer": "/$defs/recordAggregateIndicator/properties/decimals", + "purpose": "Sets the non-negative decimal precision published for this aggregate indicator." + }, + { + "schema": "project", + "pointer": "/$defs/recordAggregateIndicator/properties/unit_mult", + "purpose": "Declares the base-ten unit multiplier published with this aggregate indicator." + }, + { + "schema": "project", + "pointer": "/$defs/recordAggregateMeasure/properties/function", + "purpose": "Selects the aggregation function applied to the optional source column for this measure." + }, + { + "schema": "project", + "pointer": "/$defs/recordAggregateSpatial/properties/mode", + "purpose": "Selects the supported administrative-area aggregation mode for this spatial definition." + }, + { + "schema": "project", + "pointer": "/$defs/recordAggregateSpatial/properties/bbox_fields", + "purpose": "Maps the geometry entity fields that provide the minimum and maximum coordinates of its bounding box." + }, + { + "schema": "project", + "pointer": "/$defs/recordAggregateSpatial/properties/max_geometry_vertices", + "purpose": "Caps the number of vertices accepted when materializing one administrative-area geometry." + }, + { + "schema": "project", + "pointer": "/$defs/recordSpatial/properties/geometry", + "purpose": "Defines whether feature geometry comes from point-coordinate fields or one encoded geometry field." + }, + { + "schema": "project", + "pointer": "/$defs/recordSpatial/properties/bbox_fields", + "purpose": "Maps optional entity fields containing precomputed minimum and maximum bounding-box coordinates." + }, + { + "schema": "project", + "pointer": "/$defs/recordSpatial/properties/max_bbox_degrees", + "purpose": "Caps the geographic span accepted for one bounding-box query." + }, + { + "schema": "project", + "pointer": "/$defs/recordSpatial/properties/max_geometry_vertices", + "purpose": "Caps the number of vertices accepted when returning one feature geometry." + }, + { + "schema": "project", + "pointer": "/$defs/recordSpatialGeometry/oneOf/0/properties/kind", + "purpose": "Selects geometry assembled from separate longitude and latitude entity fields." + }, + { + "schema": "project", + "pointer": "/$defs/recordSpatialGeometry/oneOf/1/properties/kind", + "purpose": "Selects the GeoJSON, WKT, or WKB encoding used by the configured geometry field." + }, + { + "schema": "project", + "pointer": "/$defs/recordSpdci/properties/identifiers", + "purpose": "Maps SP-DCI identifier names to the entity fields used to identify a record." + }, + { + "schema": "project", + "pointer": "/$defs/recordSpdci/properties/expression_fields", + "purpose": "Maps SP-DCI expression input names to the entity fields available during expression evaluation." + }, + { + "schema": "project", + "pointer": "/$defs/recordSpdci/properties/response_fields", + "purpose": "Maps SP-DCI response names to the entity fields returned for an authorized record." + }, + { + "schema": "project", + "pointer": "/$defs/disclosure/oneOf/1/properties/allowed", + "purpose": "Lists the disclosure modes that may be selected in addition to the policy's declared default." + }, + { + "schema": "project", + "pointer": "/$defs/recordsService/properties/kind", + "purpose": "Identifies this service declaration as a Relay records API backed by an authored entity." + }, + { + "schema": "project", + "pointer": "/$defs/recordsService/properties/sensitivity", + "purpose": "Classifies the overall sensitivity of records exposed by this service declaration." + }, + { + "schema": "project", + "pointer": "/$defs/recordsService/properties/access_rights", + "purpose": "Classifies the records service as public, restricted, or non-public for catalog and access metadata." + }, + { + "schema": "project", + "pointer": "/$defs/recordsService/properties/update_frequency", + "purpose": "Declares the reviewed cadence at which the records service's backing data is updated." + }, + { + "schema": "project", + "pointer": "/$defs/recordsService/properties/conforms_to", + "purpose": "Lists the standards or specifications to which the records service declares conformance." + }, + { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/kind", + "purpose": "Identifies this service declaration as a Notary evidence policy." + }, + { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/version", + "purpose": "Assigns the positive authored version used to track this evidence-service policy contract." + }, + { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/consent", + "purpose": "States whether evaluation of this evidence service requires consent." + }, + { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/claims", + "purpose": "Maps evidence claim identifiers to an output or CEL expression, value contract, and disclosure policy." + }, + { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/claims/additionalProperties/properties/output", + "purpose": "Selects the exact Relay consultation output that backs this evidence claim." + }, + { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/claims/additionalProperties/properties/cel", + "purpose": "Provides the CEL expression used for a source-free evaluation-only evidence claim." + }, + { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/credential_profiles/additionalProperties/properties/type", + "purpose": "Declares the credential type identifier emitted for this reviewed credential profile." + }, + { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/credential_profiles/additionalProperties/properties/validity", + "purpose": "Bounds the lifetime of credentials issued from this profile using a positive duration." + }, + { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/credential_profiles/additionalProperties/properties/claims", + "purpose": "Lists the registry-backed evidence claims selected into this credential profile." + }, + { + "schema": "project", + "pointer": "/$defs/access/properties/scopes", + "purpose": "Lists the scopes a caller must hold to use the enclosing evidence service." + }, + { + "schema": "project", + "pointer": "/$defs/variables/additionalProperties/properties/from", + "purpose": "Binds one evidence variable to its caller-supplied request variable path." + }, + { + "schema": "project", + "pointer": "/$defs/variables/additionalProperties/properties/type", + "purpose": "Declares the request variable as a date value for typed evidence evaluation." + }, + { + "schema": "project", + "pointer": "/$defs/consultations/additionalProperties/properties/input", + "purpose": "Maps integration input names to reviewed target-request identifier or attribute bindings." + }, + { + "schema": "project", + "pointer": "/$defs/claimValue/properties/type", + "purpose": "Declares the boolean, integer, string, or date type of a source-free claim value." + }, + { + "schema": "project", + "pointer": "/$defs/claimValue/properties/nullable", + "purpose": "States whether the source-free claim value may be null." + }, + { + "schema": "project", + "pointer": "/$defs/claimValue/properties/max_bytes", + "purpose": "Bounds the encoded size of a source-free claim value." + }, + { + "schema": "project", + "pointer": "/anyOf/0/properties/integrations", + "purpose": "Requires at least one authored integration when the project satisfies the integration-content alternative." + }, + { + "schema": "project", + "pointer": "/anyOf/1/properties/entities", + "purpose": "Requires at least one authored entity when the project satisfies the entity-content alternative." + }, + { + "schema": "project", + "pointer": "/anyOf/2/properties/services", + "purpose": "Requires at least one authored service when the project satisfies the service-content alternative." + }, + { + "schema": "environment", + "pointer": "/$defs/secret/properties/secret", + "purpose": "Names the operator-managed environment secret reference without containing the secret value." + }, + { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/tx_code/properties/required", + "purpose": "States whether OID4VCI authorization requires a transaction code before credential issuance." + }, + { + "schema": "environment", + "pointer": "/$defs/ca/properties/generation", + "purpose": "Records the operator-controlled trust-root generation used for explicit certificate-authority rotation." + }, + { + "schema": "environment", + "pointer": "/$defs/mtls/properties/generation", + "purpose": "Records the operator-controlled mutual-TLS generation used for explicit certificate and key rotation." + }, + { + "schema": "environment", + "pointer": "/$defs/endpoint/properties/path", + "purpose": "Binds a reviewed private endpoint path beneath its separately configured origin." + }, + { + "schema": "environment", + "pointer": "/$defs/endpoint/properties/generation", + "purpose": "Records the operator-controlled private-endpoint generation used for explicit binding rotation." + }, + { + "schema": "environment", + "pointer": "/$defs/credential/oneOf/0/properties/generation", + "purpose": "Records the generation of the operator-managed basic-authentication credential references." + }, + { + "schema": "environment", + "pointer": "/$defs/credential/oneOf/1/properties/generation", + "purpose": "Records the generation of the operator-managed bearer-token credential reference." + }, + { + "schema": "environment", + "pointer": "/$defs/credential/oneOf/2/properties/generation", + "purpose": "Records the generation of the operator-managed OAuth client credential references." + }, + { + "schema": "environment", + "pointer": "/$defs/credential/oneOf/3/properties/generation", + "purpose": "Records the generation of the operator-managed API-key credential reference." + }, + { + "schema": "environment", + "pointer": "/$defs/provider/oneOf/0/properties/type", + "purpose": "Selects CSV as the environment-owned materialization provider for an authored entity." + }, + { + "schema": "environment", + "pointer": "/$defs/provider/oneOf/0/properties/header_row", + "purpose": "Selects the one-based CSV row containing source column headers." + }, + { + "schema": "environment", + "pointer": "/$defs/provider/oneOf/0/properties/delimiter", + "purpose": "Selects the byte used to delimit fields in the bound CSV source." + }, + { + "schema": "environment", + "pointer": "/$defs/provider/oneOf/0/properties/quote", + "purpose": "Selects the byte used to quote fields in the bound CSV source." + }, + { + "schema": "environment", + "pointer": "/$defs/provider/oneOf/1/properties/type", + "purpose": "Selects XLSX as the environment-owned materialization provider for an authored entity." + }, + { + "schema": "environment", + "pointer": "/$defs/provider/oneOf/1/properties/sheet", + "purpose": "Names the worksheet read from the environment-owned XLSX source." + }, + { + "schema": "environment", + "pointer": "/$defs/provider/oneOf/1/properties/header_row", + "purpose": "Selects the one-based XLSX row containing source column headers." + }, + { + "schema": "environment", + "pointer": "/$defs/provider/oneOf/1/properties/data_range", + "purpose": "Restricts entity materialization to the reviewed range within the selected worksheet." + }, + { + "schema": "environment", + "pointer": "/$defs/provider/oneOf/2/properties/type", + "purpose": "Selects Parquet as the environment-owned materialization provider for an authored entity." + }, + { + "schema": "environment", + "pointer": "/$defs/provider/oneOf/3/properties/type", + "purpose": "Selects PostgreSQL as the environment-owned materialization provider for an authored entity." + }, + { + "schema": "environment", + "pointer": "/$defs/entity/properties/columns", + "purpose": "Maps authored entity field names to columns supplied by the environment-owned provider." + }, + { + "schema": "environment", + "pointer": "/$defs/entity/properties/source_revision", + "purpose": "Records the operator-supplied revision label of the bound entity source." + }, + { + "schema": "environment", + "pointer": "/$defs/entity/properties/generation", + "purpose": "Records the operator-controlled generation of this entity materialization binding." + }, + { + "schema": "environment", + "pointer": "/$defs/source/properties/rate", + "purpose": "Defines the per-minute request rate and burst bounds applied to one environment source." + }, + { + "schema": "environment", + "pointer": "/$defs/source/properties/rate/properties/per_minute", + "purpose": "Caps the number of requests permitted to this source during one minute." + }, + { + "schema": "environment", + "pointer": "/$defs/source/properties/rate/properties/burst", + "purpose": "Caps the short request burst permitted by the source rate limiter." + }, + { + "schema": "environment", + "pointer": "/$defs/source/properties/concurrency", + "purpose": "Caps the number of requests that may be in flight concurrently for this source." + }, + { + "schema": "environment", + "pointer": "/$defs/source/properties/timeout", + "purpose": "Bounds the elapsed time allowed for one request to this environment source." + }, + { + "schema": "environment", + "pointer": "/properties/relay_state/properties/postgresql", + "purpose": "Selects the PostgreSQL trust binding used by Relay state storage." + }, + { + "schema": "environment", + "pointer": "/properties/notary_state/properties/postgresql", + "purpose": "Selects the PostgreSQL trust binding used by Notary state storage." + }, + { + "schema": "environment", + "pointer": "/properties/notary_cel/properties/worker_memory_bytes", + "purpose": "Caps the memory available to one isolated Notary CEL worker." + }, + { + "schema": "environment", + "pointer": "/properties/deployment/properties/profile", + "purpose": "Selects the deployment assurance profile whose service and transport conditions the environment must satisfy." + }, + { + "schema": "environment", + "pointer": "/allOf/0/if/properties/deployment", + "purpose": "Matches environments whose deployment declaration enables Relay so the corresponding Relay binding is required." + }, + { + "schema": "environment", + "pointer": "/allOf/1/then/properties/deployment", + "purpose": "Requires both Relay and Notary deployment services when a Notary-to-Relay binding is present." + }, + { + "schema": "environment", + "pointer": "/allOf/2/then/properties/deployment", + "purpose": "Requires the Relay deployment service when Relay state storage is configured." + }, + { + "schema": "environment", + "pointer": "/allOf/3/then/properties/deployment", + "purpose": "Requires the Notary deployment service when Notary state storage is configured." + }, + { + "schema": "environment", + "pointer": "/allOf/4/then/properties/deployment", + "purpose": "Requires the Notary deployment service when a Notary CEL worker memory bound is configured." + }, + { + "schema": "environment", + "pointer": "/allOf/5/else/properties/callers", + "purpose": "When callers are authored without OID4VCI, requires the caller map to contain at least one binding; cross-file validation separately requires callers for Notary environments and rejects them for Relay-only topology." + }, + { + "schema": "environment", + "pointer": "/allOf/5/then/properties/deployment", + "purpose": "Requires the Notary deployment service when OID4VCI issuance is configured." + }, + { + "schema": "environment", + "pointer": "/allOf/6/else/properties/relay", + "purpose": "Applies non-local HTTPS constraints to the Relay origin, issuer, and key-set bindings." + }, + { + "schema": "environment", + "pointer": "/allOf/6/else/properties/oid4vci", + "purpose": "Applies non-local HTTPS constraints to public OID4VCI endpoints." + }, + { + "schema": "environment", + "pointer": "/allOf/6/else/properties/oid4vci/properties/authorization_server", + "purpose": "Applies non-local HTTPS constraints to all configured OID4VCI authorization-server endpoints." + }, + { + "schema": "environment", + "pointer": "/allOf/6/if/properties/deployment", + "purpose": "Matches the local deployment profile before relaxing public endpoint transport constraints." + }, + { + "schema": "environment", + "pointer": "/allOf/6/if/properties/deployment/properties/profile", + "purpose": "Selects the local-profile condition used by the environment transport-validation branch." + }, + { + "schema": "integration", + "pointer": "/$defs/input/properties/format", + "purpose": "Applies the full-date semantic format to a string-valued integration input." + }, + { + "schema": "integration", + "pointer": "/$defs/input/properties/maxLength", + "purpose": "Caps the character length accepted for a string-valued integration input." + }, + { + "schema": "integration", + "pointer": "/$defs/input/properties/minLength", + "purpose": "Sets the minimum character length accepted for a string-valued integration input." + }, + { + "schema": "integration", + "pointer": "/$defs/input/properties/pattern", + "purpose": "Constrains a string-valued integration input with the authored regular expression." + }, + { + "schema": "integration", + "pointer": "/$defs/input/properties/minimum", + "purpose": "Sets the inclusive lower bound accepted for an integer-valued integration input." + }, + { + "schema": "integration", + "pointer": "/$defs/input/properties/maximum", + "purpose": "Sets the inclusive upper bound accepted for an integer-valued integration input." + }, + { + "schema": "integration", + "pointer": "/$defs/versions/anyOf/0/properties/tested", + "purpose": "Requires at least one source product version to be classified as tested in this integration contract." + }, + { + "schema": "integration", + "pointer": "/$defs/versions/anyOf/1/properties/unverified", + "purpose": "Requires at least one source product version to be classified as unverified in this integration contract." + }, + { + "schema": "integration", + "pointer": "/$defs/credential/oneOf/0/properties/type", + "purpose": "Selects an unauthenticated, basic-authentication, or static-bearer credential interface." + }, + { + "schema": "integration", + "pointer": "/$defs/credential/oneOf/1/properties/type", + "purpose": "Selects the fixed-header API-key credential interface for this source contract." + }, + { + "schema": "integration", + "pointer": "/$defs/credential/oneOf/1/properties/name", + "purpose": "Declares the fixed HTTP header name used by the API-key credential interface." + }, + { + "schema": "integration", + "pointer": "/$defs/credential/oneOf/1/properties/max_value_bytes", + "purpose": "Caps the credential value size accepted by the fixed-header API-key interface." + }, + { + "schema": "integration", + "pointer": "/$defs/credential/oneOf/2/properties/type", + "purpose": "Selects the fixed-query-parameter API-key credential interface for this source contract." + }, + { + "schema": "integration", + "pointer": "/$defs/credential/oneOf/2/properties/name", + "purpose": "Declares the fixed query parameter name used by the API-key credential interface." + }, + { + "schema": "integration", + "pointer": "/$defs/credential/oneOf/2/properties/max_value_bytes", + "purpose": "Caps the credential value size accepted by the fixed-query API-key interface." + }, + { + "schema": "integration", + "pointer": "/$defs/credential/oneOf/3/properties/type", + "purpose": "Selects the OAuth 2.0 client-credentials interface for source authentication." + }, + { + "schema": "integration", + "pointer": "/$defs/credential/oneOf/3/properties/request", + "purpose": "Selects form-encoded or JSON token requests for the OAuth client-credentials interface." + }, + { + "schema": "integration", + "pointer": "/$defs/credential/oneOf/3/properties/response_profile", + "purpose": "Requires the bounded OAuth bearer-token response profile supported by the source adapter." + }, + { + "schema": "integration", + "pointer": "/$defs/credential/oneOf/3/properties/scope", + "purpose": "Declares the bounded OAuth scope string requested for this source credential." + }, + { + "schema": "integration", + "pointer": "/$defs/credential/oneOf/3/properties/refresh_skew", + "purpose": "Sets the positive interval before token expiry at which the OAuth credential is refreshed." + }, + { + "schema": "integration", + "pointer": "/$defs/allowRule/properties/method", + "purpose": "Selects the GET or POST method permitted by one reviewed source allow rule." + }, + { + "schema": "integration", + "pointer": "/$defs/allowRule/properties/semantics", + "purpose": "Declares that the permitted source operation has read-only semantics." + }, + { + "schema": "integration", + "pointer": "/$defs/source/properties/product", + "purpose": "Names the source product whose version labels are classified by this integration contract." + }, + { + "schema": "integration", + "pointer": "/$defs/source/properties/request_headers", + "purpose": "Lists the bounded source request header names available to the integration adapter." + }, + { + "schema": "integration", + "pointer": "/$defs/source/properties/response_headers", + "purpose": "Lists the bounded source response header names available to the integration adapter." + }, + { + "schema": "integration", + "pointer": "/$defs/source/properties/response", + "purpose": "Defines the reviewed source response representation and optional byte bound." + }, + { + "schema": "integration", + "pointer": "/$defs/source/properties/response/properties/format", + "purpose": "Selects JSON decoding or text handling for reviewed source responses." + }, + { + "schema": "integration", + "pointer": "/$defs/protocol/properties/signed_dci", + "purpose": "Enables the bounded signed DCI search helper and declares its protocol and selector bindings." + }, + { + "schema": "integration", + "pointer": "/$defs/protocol/properties/signed_dci/properties/profile", + "purpose": "Selects the supported DCI search request profile used by the signed protocol helper." + }, + { + "schema": "integration", + "pointer": "/$defs/protocol/properties/signed_dci/properties/path", + "purpose": "Declares the exact private source path used for signed DCI search requests." + }, + { + "schema": "integration", + "pointer": "/$defs/protocol/properties/signed_dci/properties/jwks_profile", + "purpose": "Selects the supported RSA signing-key-set profile used to verify signed DCI responses." + }, + { + "schema": "integration", + "pointer": "/$defs/protocol/properties/signed_dci/properties/sender", + "purpose": "Declares the signed DCI sender identifier included in protocol requests." + }, + { + "schema": "integration", + "pointer": "/$defs/protocol/properties/signed_dci/properties/receiver", + "purpose": "Declares the signed DCI receiver identifier included in protocol requests." + }, + { + "schema": "integration", + "pointer": "/$defs/protocol/properties/signed_dci/properties/registry_type", + "purpose": "Declares the registry type requested through the signed DCI search profile." + }, + { + "schema": "integration", + "pointer": "/$defs/protocol/properties/signed_dci/properties/record_type", + "purpose": "Declares the record type requested through the signed DCI search profile." + }, + { + "schema": "integration", + "pointer": "/$defs/protocol/properties/signed_dci/properties/locale", + "purpose": "Declares the language or locale tag carried by signed DCI search requests." + }, + { + "schema": "integration", + "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors", + "purpose": "Maps every selector input to its signed DCI request field and response location." + }, + { + "schema": "integration", + "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors/additionalProperties/properties/field", + "purpose": "Declares the signed DCI identifier field bound to one selector input." + }, + { + "schema": "integration", + "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors/additionalProperties/properties/response_pointer", + "purpose": "Selects the canonical signed-record response location used to recover one selector value." + }, + { + "schema": "integration", + "pointer": "/$defs/httpRequest/properties/method", + "purpose": "Selects the single GET or POST request performed by a declarative HTTP capability." + }, + { + "schema": "integration", + "pointer": "/$defs/httpRequest/properties/path", + "purpose": "Defines the reviewed source path template used by the declarative HTTP request." + }, + { + "schema": "integration", + "pointer": "/$defs/httpRequest/properties/semantics", + "purpose": "Declares that the declarative HTTP request has read-only source semantics." + }, + { + "schema": "integration", + "pointer": "/$defs/httpRequest/properties/query", + "purpose": "Maps reviewed query parameter names to authored request values and input substitutions." + }, + { + "schema": "integration", + "pointer": "/$defs/httpRequest/properties/headers", + "purpose": "Maps reviewed request header names to authored values and input substitutions." + }, + { + "schema": "integration", + "pointer": "/$defs/httpRequest/properties/body", + "purpose": "Defines the optional authored body template sent by the declarative HTTP request." + }, + { + "schema": "integration", + "pointer": "/$defs/httpResponse/properties/no_match", + "purpose": "Lists HTTP response statuses that produce the integration's no-match outcome." + }, + { + "schema": "integration", + "pointer": "/$defs/httpResponse/properties/ambiguous", + "purpose": "Lists HTTP response statuses that produce the integration's ambiguous outcome." + }, + { + "schema": "integration", + "pointer": "/$defs/httpResponse/properties/shape", + "purpose": "Declares whether a successful response is a singleton or a bounded collection." + }, + { + "schema": "integration", + "pointer": "/$defs/httpResponse/properties/shape/oneOf/1/properties/records", + "purpose": "Selects the canonical response location containing collection records." + }, + { + "schema": "integration", + "pointer": "/$defs/httpResponse/properties/shape/oneOf/1/properties/cardinality", + "purpose": "Requires two-record probing so collection results distinguish one match from ambiguity." + }, + { + "schema": "integration", + "pointer": "/$defs/capability/oneOf/0/properties/http", + "purpose": "Selects the single-request declarative HTTP capability and its expected response semantics." + }, + { + "schema": "integration", + "pointer": "/$defs/capability/oneOf/1/properties/script", + "purpose": "Selects the reviewed project-relative script capability and its optional modules." + }, + { + "schema": "integration", + "pointer": "/$defs/capability/oneOf/1/properties/script/properties/modules", + "purpose": "Lists the reviewed project-relative modules available to the integration script." + }, + { + "schema": "integration", + "pointer": "/$defs/capability/oneOf/2/properties/snapshot", + "purpose": "Selects an offline entity snapshot capability with exact input matching and freshness control." + }, + { + "schema": "integration", + "pointer": "/$defs/capability/oneOf/2/properties/snapshot/properties/exact", + "purpose": "Maps entity fields to integration inputs that must match exactly in the snapshot lookup." + }, + { + "schema": "integration", + "pointer": "/$defs/capability/oneOf/2/properties/snapshot/properties/freshness", + "purpose": "Sets the maximum accepted age of the materialized entity snapshot." + }, + { + "schema": "integration", + "pointer": "/$defs/output/properties/format", + "purpose": "Applies the full-date semantic format to a string-valued integration output." + }, + { + "schema": "integration", + "pointer": "/$defs/output/properties/maxLength", + "purpose": "Caps the character length produced for a string-valued integration output." + }, + { + "schema": "integration", + "pointer": "/$defs/output/properties/minimum", + "purpose": "Sets the inclusive lower bound produced for an integer-valued integration output." + }, + { + "schema": "integration", + "pointer": "/$defs/output/properties/maximum", + "purpose": "Sets the inclusive upper bound produced for an integer-valued integration output." + }, + { + "schema": "integration", + "pointer": "/$defs/output/properties/x-registry-source", + "purpose": "Selects the canonical source-response location from which the HTTP output is extracted." + }, + { + "schema": "integration", + "pointer": "/$defs/limits/properties/calls", + "purpose": "Caps the number of high-level source calls available to a script integration." + }, + { + "schema": "integration", + "pointer": "/$defs/limits/properties/deadline", + "purpose": "Caps total integration execution time with a positive duration no greater than sixty seconds." + }, + { + "schema": "fixture", + "pointer": "/$defs/request/properties/query", + "purpose": "States the synthetic query parameters expected from one offline fixture interaction." + }, + { + "schema": "fixture", + "pointer": "/$defs/request/properties/headers", + "purpose": "States the synthetic request headers expected from one offline fixture interaction." + }, + { + "schema": "fixture", + "pointer": "/$defs/response/oneOf/0/properties/status", + "purpose": "Selects the synthetic HTTP status returned by the offline fixture harness." + }, + { + "schema": "fixture", + "pointer": "/$defs/response/oneOf/0/properties/headers", + "purpose": "Defines the synthetic HTTP response headers returned by the offline fixture harness." + }, + { + "schema": "fixture", + "pointer": "/$defs/response/oneOf/1/properties/timeout", + "purpose": "Selects the synthetic timeout duration returned instead of an HTTP response." + }, + { + "schema": "fixture", + "pointer": "/$defs/fixtureBody/oneOf/0/properties/file", + "purpose": "Selects a fixture-local synthetic body file beneath the reserved bodies directory." + }, + { + "schema": "fixture", + "pointer": "/$defs/expectation/properties/outcome", + "purpose": "States whether the offline fixture is expected to match, find no match, or remain ambiguous." + }, + { + "schema": "fixture", + "pointer": "/$defs/expectation/properties/outputs", + "purpose": "Maps integration output names to the synthetic values expected after fixture execution." + }, + { + "schema": "fixture", + "pointer": "/$defs/expectation/properties/error", + "purpose": "States the bounded error identifier expected from a failing offline fixture." + }, + { + "schema": "entity", + "pointer": "/$defs/fieldSchema/properties/enum", + "purpose": "Restricts one entity field to the unique authored values listed by this schema constraint." + }, + { + "schema": "entity", + "pointer": "/$defs/fieldSchema/properties/const", + "purpose": "Requires one entity field to equal the single authored value supplied by this schema constraint." + }, + { + "schema": "entity", + "pointer": "/$defs/fieldSchema/properties/minLength", + "purpose": "Sets the minimum character length accepted for one string-valued entity field." + }, + { + "schema": "entity", + "pointer": "/$defs/fieldSchema/properties/maxLength", + "purpose": "Caps the character length accepted for one string-valued entity field." + }, + { + "schema": "entity", + "pointer": "/$defs/fieldSchema/properties/minimum", + "purpose": "Sets the inclusive lower numeric bound accepted for one entity field." + }, + { + "schema": "entity", + "pointer": "/$defs/fieldSchema/properties/maximum", + "purpose": "Sets the inclusive upper numeric bound accepted for one entity field." + }, + { + "schema": "entity", + "pointer": "/$defs/fieldSchema/properties/pattern", + "purpose": "Constrains a string-valued entity field with the authored regular expression." + }, + { + "schema": "entity", + "pointer": "/$defs/objectSchema/properties/type", + "purpose": "Declares the materialized entity record schema as an object." + }, + { + "schema": "entity", + "pointer": "/$defs/objectSchema/properties/properties", + "purpose": "Maps every declared entity property name to its closed field schema." + } + ] +} diff --git a/crates/registryctl/schemas/project-authoring/documentation-intent.schema.json b/crates/registryctl/schemas/project-authoring/documentation-intent.schema.json new file mode 100644 index 000000000..468eb345b --- /dev/null +++ b/crates/registryctl/schemas/project-authoring/documentation-intent.schema.json @@ -0,0 +1,284 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "https://id.registrystack.org/schemas/registryctl/project-authoring/documentation-intent.v1.schema.json", + "title": "Registry Stack project-authoring documentation intent v1", + "type": "object", + "additionalProperties": false, + "required": [ + "format_version", + "policy", + "structural_intents", + "structural_reviews", + "domains", + "overrides" + ], + "properties": { + "$schema": { + "type": "string", + "const": "https://id.registrystack.org/schemas/registryctl/project-authoring/documentation-intent.v1.schema.json" + }, + "format_version": { + "type": "string", + "const": "1.0" + }, + "policy": { + "type": "object", + "additionalProperties": false, + "required": [ + "human_sources", + "prohibited_sources", + "prose_required_for" + ], + "properties": { + "human_sources": { + "type": "array", + "minItems": 3, + "maxItems": 3, + "uniqueItems": true, + "items": { + "enum": [ + "schema_description", + "reviewed_override", + "structural_taxonomy" + ] + } + }, + "prohibited_sources": { + "type": "array", + "minItems": 4, + "maxItems": 4, + "uniqueItems": true, + "items": { + "enum": [ + "country_workspace", + "country_value", + "runtime_configuration", + "derived_field_label" + ] + } + }, + "prose_required_for": { + "type": "array", + "minItems": 6, + "maxItems": 6, + "uniqueItems": true, + "items": { + "$ref": "#/$defs/pathKind" + } + } + } + }, + "structural_intents": { + "type": "object", + "additionalProperties": false, + "required": [ + "map_key", + "map_value", + "array_item", + "branch" + ], + "properties": { + "map_key": { + "$ref": "#/$defs/structuralIntent" + }, + "map_value": { + "$ref": "#/$defs/structuralIntent" + }, + "array_item": { + "$ref": "#/$defs/structuralIntent" + }, + "branch": { + "$ref": "#/$defs/structuralIntent" + } + } + }, + "structural_reviews": { + "type": "array", + "uniqueItems": true, + "items": { + "$ref": "#/$defs/structuralReview" + } + }, + "domains": { + "type": "array", + "minItems": 5, + "maxItems": 5, + "items": { + "$ref": "#/$defs/domain" + } + }, + "overrides": { + "type": "array", + "items": { + "$ref": "#/$defs/override" + } + } + }, + "$defs": { + "nonPlaceholderProse": { + "type": "string", + "minLength": 24, + "pattern": "^(?![\\s\\S]*(?:TODO|TBD))[\\s\\S]*\\S$" + }, + "pathKind": { + "enum": [ + "root", + "property", + "map_key", + "map_value", + "array_item", + "branch" + ] + }, + "schemaKind": { + "enum": [ + "project", + "environment", + "integration", + "fixture", + "entity" + ] + }, + "configurationState": { + "enum": [ + "authored", + "environment_bound" + ] + }, + "environmentBehavior": { + "enum": [ + "environment_independent", + "bound_by_environment", + "narrows_reviewed_authority" + ] + }, + "validationStage": { + "enum": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build", + "operator_preflight" + ] + }, + "structuralIntent": { + "type": "object", + "additionalProperties": false, + "required": [ + "purpose" + ], + "properties": { + "purpose": { + "$ref": "#/$defs/nonPlaceholderProse" + } + } + }, + "structuralReview": { + "type": "object", + "additionalProperties": false, + "required": [ + "schema", + "pointer", + "path_kind" + ], + "properties": { + "schema": { + "$ref": "#/$defs/schemaKind" + }, + "pointer": { + "type": "string", + "pattern": "^/" + }, + "path_kind": { + "enum": [ + "map_key", + "map_value", + "array_item", + "branch" + ] + } + } + }, + "domain": { + "type": "object", + "additionalProperties": false, + "required": [ + "schema", + "scope", + "state", + "environment_behavior", + "validation_stages", + "diagnostic", + "migration_note", + "example_guidance" + ], + "properties": { + "schema": { + "$ref": "#/$defs/schemaKind" + }, + "scope": { + "$ref": "#/$defs/nonPlaceholderProse" + }, + "state": { + "$ref": "#/$defs/configurationState" + }, + "environment_behavior": { + "$ref": "#/$defs/environmentBehavior" + }, + "validation_stages": { + "type": "array", + "minItems": 1, + "uniqueItems": true, + "items": { + "$ref": "#/$defs/validationStage" + } + }, + "diagnostic": { + "type": "string", + "pattern": "^registryctl\\.authoring\\.[a-z0-9_.]+$" + }, + "migration_note": { + "$ref": "#/$defs/nonPlaceholderProse" + }, + "example_guidance": { + "$ref": "#/$defs/nonPlaceholderProse" + } + } + }, + "override": { + "type": "object", + "additionalProperties": false, + "required": [ + "schema", + "pointer", + "purpose" + ], + "properties": { + "schema": { + "$ref": "#/$defs/schemaKind" + }, + "pointer": { + "type": "string", + "pattern": "^/" + }, + "purpose": { + "$ref": "#/$defs/nonPlaceholderProse" + }, + "environment_behavior": { + "$ref": "#/$defs/environmentBehavior" + }, + "diagnostic": { + "type": "string", + "pattern": "^registryctl\\.authoring\\.[a-z0-9_.]+$" + }, + "migration_note": { + "$ref": "#/$defs/nonPlaceholderProse" + }, + "example_guidance": { + "$ref": "#/$defs/nonPlaceholderProse" + } + } + } + } +} diff --git a/crates/registryctl/schemas/project-authoring/dto-shape-contract.v1.json b/crates/registryctl/schemas/project-authoring/dto-shape-contract.v1.json new file mode 100644 index 000000000..0c48a9354 --- /dev/null +++ b/crates/registryctl/schemas/project-authoring/dto-shape-contract.v1.json @@ -0,0 +1,3897 @@ +{ + "contract": "registryctl.dto-shape-contract", + "generator": { + "draft": "https://json-schema.org/draft/2020-12/schema", + "name": "schemars", + "version": "1.2.1" + }, + "roots": [ + { + "kind": "project", + "rust_type": "RegistryProject", + "schema": { + "$defs": { + "AccessDeclaration": { + "additionalProperties": false, + "properties": { + "scopes": { + "default": [], + "items": { + "type": "string" + }, + "type": "array" + } + }, + "type": "object" + }, + "ClaimDeclaration": { + "additionalProperties": false, + "properties": { + "cel": { + "default": null, + "type": [ + "string", + "null" + ] + }, + "disclosure": { + "$ref": "#/$defs/DisclosureDeclaration" + }, + "output": { + "default": null, + "type": [ + "string", + "null" + ] + }, + "value": { + "anyOf": [ + { + "$ref": "#/$defs/ClaimValueDeclaration" + }, + { + "type": "null" + } + ], + "default": null + } + }, + "required": [ + "disclosure" + ], + "type": "object" + }, + "ClaimValueDeclaration": { + "additionalProperties": false, + "properties": { + "max_bytes": { + "default": null, + "format": "uint32", + "minimum": 0, + "type": [ + "integer", + "null" + ] + }, + "nullable": { + "default": false, + "type": "boolean" + }, + "type": { + "$ref": "#/$defs/OutputType" + } + }, + "required": [ + "type" + ], + "type": "object" + }, + "ConsentDeclaration": { + "enum": [ + "not_required", + "required" + ], + "type": "string" + }, + "ConsultationDeclaration": { + "additionalProperties": false, + "properties": { + "input": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + }, + "integration": { + "type": "string" + } + }, + "required": [ + "integration", + "input" + ], + "type": "object" + }, + "CredentialProfileDeclaration": { + "additionalProperties": false, + "properties": { + "claims": { + "items": { + "type": "string" + }, + "type": "array" + }, + "format": { + "type": "string" + }, + "type": { + "type": "string" + }, + "validity": { + "type": "string" + } + }, + "required": [ + "format", + "type", + "validity", + "claims" + ], + "type": "object" + }, + "DisclosureDeclaration": { + "anyOf": [ + { + "$ref": "#/$defs/DisclosureMode" + }, + { + "properties": { + "allowed": { + "items": { + "$ref": "#/$defs/DisclosureMode" + }, + "type": "array" + }, + "default": { + "$ref": "#/$defs/DisclosureMode" + } + }, + "required": [ + "default", + "allowed" + ], + "type": "object" + } + ] + }, + "DisclosureMode": { + "enum": [ + "value", + "predicate", + "redacted" + ], + "type": "string" + }, + "EntityReference": { + "additionalProperties": false, + "properties": { + "file": { + "type": "string" + } + }, + "required": [ + "file" + ], + "type": "object" + }, + "IntegrationReference": { + "additionalProperties": false, + "properties": { + "file": { + "type": "string" + } + }, + "required": [ + "file" + ], + "type": "object" + }, + "OutputType": { + "enum": [ + "boolean", + "integer", + "string", + "date", + "presence" + ], + "type": "string" + }, + "RecordAccessRights": { + "enum": [ + "public", + "restricted", + "non_public" + ], + "type": "string" + }, + "RecordAggregate": { + "additionalProperties": false, + "properties": { + "access": { + "anyOf": [ + { + "$ref": "#/$defs/RecordAggregateAccess" + }, + { + "type": "null" + } + ], + "default": null + }, + "allowed_filters": { + "additionalProperties": { + "items": { + "$ref": "#/$defs/RecordFilterOperator" + }, + "type": "array" + }, + "default": {}, + "type": "object" + }, + "default_group_by": { + "default": [], + "items": { + "type": "string" + }, + "type": "array" + }, + "description": { + "type": "string" + }, + "dimensions": { + "default": [], + "items": { + "$ref": "#/$defs/RecordAggregateDimension" + }, + "type": "array" + }, + "disclosure_control": { + "$ref": "#/$defs/RecordDisclosureControl" + }, + "group_by": { + "default": [], + "items": { + "type": "string" + }, + "type": "array" + }, + "indicators": { + "default": [], + "items": { + "$ref": "#/$defs/RecordAggregateIndicator" + }, + "type": "array" + }, + "joins": { + "default": [], + "items": { + "type": "string" + }, + "type": "array" + }, + "measures": { + "default": [], + "items": { + "$ref": "#/$defs/RecordAggregateMeasure" + }, + "type": "array" + }, + "required_principal_filters": { + "default": [], + "items": { + "type": "string" + }, + "type": "array" + }, + "spatial": { + "anyOf": [ + { + "$ref": "#/$defs/RecordAggregateSpatial" + }, + { + "type": "null" + } + ], + "default": null + }, + "temporal_field": { + "default": null, + "type": [ + "string", + "null" + ] + }, + "title": { + "default": null, + "type": [ + "string", + "null" + ] + } + }, + "required": [ + "description", + "disclosure_control" + ], + "type": "object" + }, + "RecordAggregateAccess": { + "additionalProperties": false, + "properties": { + "aggregate_only_execution": { + "default": false, + "type": "boolean" + }, + "aggregate_scope": { + "default": null, + "type": [ + "string", + "null" + ] + }, + "metadata_scope": { + "default": null, + "type": [ + "string", + "null" + ] + } + }, + "type": "object" + }, + "RecordAggregateDimension": { + "additionalProperties": false, + "properties": { + "codelist": { + "default": null, + "type": [ + "string", + "null" + ] + }, + "field": { + "type": "string" + }, + "id": { + "type": "string" + }, + "label": { + "type": "string" + } + }, + "required": [ + "id", + "label", + "field" + ], + "type": "object" + }, + "RecordAggregateFunction": { + "enum": [ + "count", + "sum", + "avg", + "min", + "max", + "median", + "count_distinct", + "stddev" + ], + "type": "string" + }, + "RecordAggregateIndicator": { + "additionalProperties": false, + "properties": { + "column": { + "type": "string" + }, + "decimals": { + "default": null, + "format": "uint32", + "minimum": 0, + "type": [ + "integer", + "null" + ] + }, + "definition_uri": { + "default": null, + "type": [ + "string", + "null" + ] + }, + "frequency": { + "default": null, + "type": [ + "string", + "null" + ] + }, + "function": { + "$ref": "#/$defs/RecordAggregateFunction" + }, + "id": { + "type": "string" + }, + "label": { + "type": "string" + }, + "unit_measure": { + "type": "string" + }, + "unit_mult": { + "default": null, + "format": "int32", + "type": [ + "integer", + "null" + ] + } + }, + "required": [ + "id", + "label", + "function", + "column", + "unit_measure" + ], + "type": "object" + }, + "RecordAggregateMeasure": { + "additionalProperties": false, + "properties": { + "column": { + "type": "string" + }, + "function": { + "$ref": "#/$defs/RecordAggregateFunction" + }, + "name": { + "type": "string" + } + }, + "required": [ + "name", + "function", + "column" + ], + "type": "object" + }, + "RecordAggregateSpatial": { + "oneOf": [ + { + "additionalProperties": false, + "properties": { + "bbox_fields": { + "anyOf": [ + { + "$ref": "#/$defs/RecordSpatialBbox" + }, + { + "type": "null" + } + ], + "default": null + }, + "collection_id": { + "default": null, + "type": [ + "string", + "null" + ] + }, + "dimension": { + "type": "string" + }, + "geometry_entity": { + "type": "string" + }, + "geometry_field": { + "type": "string" + }, + "geometry_id_field": { + "type": "string" + }, + "max_geometry_vertices": { + "default": 10000, + "format": "uint32", + "minimum": 0, + "type": "integer" + }, + "mode": { + "const": "admin_area", + "type": "string" + } + }, + "required": [ + "mode", + "dimension", + "geometry_entity", + "geometry_id_field", + "geometry_field" + ], + "type": "object" + } + ] + }, + "RecordAttributeReleaseClaim": { + "additionalProperties": false, + "properties": { + "expression": { + "anyOf": [ + { + "$ref": "#/$defs/RecordAttributeReleaseExpression" + }, + { + "type": "null" + } + ], + "default": null + }, + "required": { + "type": "boolean" + }, + "sensitivity": { + "$ref": "#/$defs/RecordAttributeReleaseSensitivity" + }, + "source_field": { + "default": null, + "type": [ + "string", + "null" + ] + } + }, + "required": [ + "required", + "sensitivity" + ], + "type": "object" + }, + "RecordAttributeReleaseConditions": { + "additionalProperties": false, + "properties": { + "expression": { + "$ref": "#/$defs/RecordAttributeReleaseExpression" + } + }, + "required": [ + "expression" + ], + "type": "object" + }, + "RecordAttributeReleaseExpression": { + "additionalProperties": false, + "properties": { + "cel": { + "type": "string" + } + }, + "required": [ + "cel" + ], + "type": "object" + }, + "RecordAttributeReleaseProfile": { + "additionalProperties": false, + "description": "A project-authored, entity-bound identity release. The project compiler\ndeliberately exposes only the minimizing subset used by Registry Relay:\nexact-one subject resolution, purpose binding, and typed claim selection.\nSource metadata disclosure and response caching are not authoring options.", + "properties": { + "claims": { + "additionalProperties": { + "$ref": "#/$defs/RecordAttributeReleaseClaim" + }, + "type": "object" + }, + "description": { + "default": null, + "type": [ + "string", + "null" + ] + }, + "purpose": { + "type": "string" + }, + "release_conditions": { + "$ref": "#/$defs/RecordAttributeReleaseConditions" + }, + "release_scope": { + "type": "string" + }, + "subject": { + "$ref": "#/$defs/RecordAttributeReleaseSubject" + }, + "title": { + "default": null, + "type": [ + "string", + "null" + ] + }, + "version": { + "type": "string" + } + }, + "required": [ + "version", + "purpose", + "release_scope", + "subject", + "release_conditions", + "claims" + ], + "type": "object" + }, + "RecordAttributeReleaseSensitivity": { + "enum": [ + "direct_identifier", + "personal", + "public", + "pseudonymous" + ], + "type": "string" + }, + "RecordAttributeReleaseSubject": { + "additionalProperties": false, + "properties": { + "id_type": { + "type": "string" + }, + "source_field": { + "type": "string" + } + }, + "required": [ + "source_field", + "id_type" + ], + "type": "object" + }, + "RecordDisclosureControl": { + "additionalProperties": false, + "properties": { + "min_group_size": { + "default": 5, + "format": "uint32", + "minimum": 0, + "type": "integer" + }, + "suppression": { + "$ref": "#/$defs/RecordSuppression", + "default": "omit" + } + }, + "type": "object" + }, + "RecordFilterOperator": { + "enum": [ + "eq", + "in", + "gte", + "lte", + "between" + ], + "type": "string" + }, + "RecordPagination": { + "additionalProperties": false, + "properties": { + "default_limit": { + "format": "uint32", + "minimum": 0, + "type": "integer" + }, + "max_limit": { + "format": "uint32", + "minimum": 0, + "type": "integer" + } + }, + "required": [ + "default_limit", + "max_limit" + ], + "type": "object" + }, + "RecordRelationship": { + "additionalProperties": false, + "properties": { + "concept_uri": { + "default": null, + "type": [ + "string", + "null" + ] + }, + "foreign_key": { + "type": "string" + }, + "kind": { + "$ref": "#/$defs/RecordRelationshipKind" + }, + "target": { + "type": "string" + } + }, + "required": [ + "kind", + "target", + "foreign_key" + ], + "type": "object" + }, + "RecordRelationshipKind": { + "enum": [ + "belongs_to", + "has_many", + "has_one" + ], + "type": "string" + }, + "RecordScopes": { + "additionalProperties": false, + "properties": { + "aggregate": { + "default": null, + "type": [ + "string", + "null" + ] + }, + "evidence_verification": { + "default": null, + "type": [ + "string", + "null" + ] + }, + "metadata": { + "type": "string" + }, + "rows": { + "type": "string" + } + }, + "required": [ + "metadata", + "rows" + ], + "type": "object" + }, + "RecordSensitivity": { + "enum": [ + "public", + "internal", + "personal", + "confidential", + "secret" + ], + "type": "string" + }, + "RecordSpatial": { + "additionalProperties": false, + "properties": { + "bbox_fields": { + "anyOf": [ + { + "$ref": "#/$defs/RecordSpatialBbox" + }, + { + "type": "null" + } + ], + "default": null + }, + "collection_id": { + "default": null, + "type": [ + "string", + "null" + ] + }, + "datetime_field": { + "default": null, + "type": [ + "string", + "null" + ] + }, + "description": { + "default": null, + "type": [ + "string", + "null" + ] + }, + "geometry": { + "$ref": "#/$defs/RecordSpatialGeometry" + }, + "max_bbox_degrees": { + "default": 5.0, + "format": "double", + "type": "number" + }, + "max_geometry_vertices": { + "default": 10000, + "format": "uint32", + "minimum": 0, + "type": "integer" + }, + "title": { + "default": null, + "type": [ + "string", + "null" + ] + } + }, + "required": [ + "geometry" + ], + "type": "object" + }, + "RecordSpatialBbox": { + "additionalProperties": false, + "properties": { + "max_x": { + "type": "string" + }, + "max_y": { + "type": "string" + }, + "min_x": { + "type": "string" + }, + "min_y": { + "type": "string" + } + }, + "required": [ + "min_x", + "min_y", + "max_x", + "max_y" + ], + "type": "object" + }, + "RecordSpatialGeometry": { + "oneOf": [ + { + "additionalProperties": false, + "properties": { + "crs": { + "type": "string" + }, + "kind": { + "const": "point", + "type": "string" + }, + "latitude_field": { + "type": "string" + }, + "longitude_field": { + "type": "string" + } + }, + "required": [ + "kind", + "longitude_field", + "latitude_field", + "crs" + ], + "type": "object" + }, + { + "additionalProperties": false, + "properties": { + "crs": { + "type": "string" + }, + "field": { + "type": "string" + }, + "kind": { + "const": "geojson", + "type": "string" + } + }, + "required": [ + "kind", + "field", + "crs" + ], + "type": "object" + }, + { + "additionalProperties": false, + "properties": { + "crs": { + "type": "string" + }, + "field": { + "type": "string" + }, + "kind": { + "const": "wkt", + "type": "string" + } + }, + "required": [ + "kind", + "field", + "crs" + ], + "type": "object" + }, + { + "additionalProperties": false, + "properties": { + "crs": { + "type": "string" + }, + "field": { + "type": "string" + }, + "kind": { + "const": "wkb", + "type": "string" + } + }, + "required": [ + "kind", + "field", + "crs" + ], + "type": "object" + } + ] + }, + "RecordSpdci": { + "additionalProperties": false, + "properties": { + "expression_fields": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + }, + "identifiers": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + }, + "record_type": { + "type": "string" + }, + "registry": { + "type": "string" + }, + "registry_type": { + "type": "string" + }, + "response_fields": { + "additionalProperties": { + "type": "string" + }, + "default": {}, + "type": "object" + } + }, + "required": [ + "registry", + "registry_type", + "record_type", + "identifiers", + "expression_fields" + ], + "type": "object" + }, + "RecordStandard": { + "anyOf": [ + { + "$ref": "#/$defs/RecordSpatial" + }, + { + "type": "boolean" + } + ] + }, + "RecordStandard2": { + "anyOf": [ + { + "$ref": "#/$defs/RecordSpdci" + }, + { + "type": "boolean" + } + ] + }, + "RecordStandards": { + "additionalProperties": false, + "properties": { + "ogc_features": { + "$ref": "#/$defs/RecordStandard" + }, + "sp_dci": { + "$ref": "#/$defs/RecordStandard2" + } + }, + "required": [ + "ogc_features", + "sp_dci" + ], + "type": "object" + }, + "RecordSuppression": { + "enum": [ + "omit", + "mask", + "null" + ], + "type": "string" + }, + "RecordUpdateFrequency": { + "enum": [ + "continuous", + "daily", + "weekly", + "termly", + "monthly", + "quarterly", + "annual", + "irregular", + "as_needed", + "unknown" + ], + "type": "string" + }, + "RecordsApiDeclaration": { + "additionalProperties": false, + "properties": { + "aggregates": { + "additionalProperties": { + "$ref": "#/$defs/RecordAggregate" + }, + "default": {}, + "type": "object" + }, + "attribute_release_profiles": { + "additionalProperties": { + "$ref": "#/$defs/RecordAttributeReleaseProfile" + }, + "default": {}, + "type": "object" + }, + "filters": { + "additionalProperties": { + "items": { + "$ref": "#/$defs/RecordFilterOperator" + }, + "type": "array" + }, + "default": {}, + "type": "object" + }, + "pagination": { + "$ref": "#/$defs/RecordPagination" + }, + "projection": { + "items": { + "type": "string" + }, + "type": "array" + }, + "purposes": { + "default": [], + "items": { + "type": "string" + }, + "type": "array" + }, + "relationships": { + "additionalProperties": { + "$ref": "#/$defs/RecordRelationship" + }, + "default": {}, + "type": "object" + }, + "required_principal_filters": { + "default": [], + "items": { + "type": "string" + }, + "type": "array" + }, + "scopes": { + "$ref": "#/$defs/RecordScopes" + }, + "standards": { + "$ref": "#/$defs/RecordStandards" + } + }, + "required": [ + "scopes", + "projection", + "pagination", + "standards" + ], + "type": "object" + }, + "RegistryDeclaration": { + "additionalProperties": false, + "properties": { + "id": { + "type": "string" + } + }, + "required": [ + "id" + ], + "type": "object" + }, + "RequestVariable": { + "additionalProperties": false, + "properties": { + "from": { + "type": "string" + }, + "type": { + "$ref": "#/$defs/OutputType" + } + }, + "required": [ + "from", + "type" + ], + "type": "object" + }, + "ServiceDeclaration": { + "additionalProperties": false, + "properties": { + "access": { + "$ref": "#/$defs/AccessDeclaration", + "default": { + "scopes": [] + } + }, + "access_rights": { + "anyOf": [ + { + "$ref": "#/$defs/RecordAccessRights" + }, + { + "type": "null" + } + ], + "default": null + }, + "api": { + "anyOf": [ + { + "$ref": "#/$defs/RecordsApiDeclaration" + }, + { + "type": "null" + } + ], + "default": null + }, + "claims": { + "additionalProperties": { + "$ref": "#/$defs/ClaimDeclaration" + }, + "default": {}, + "type": "object" + }, + "conforms_to": { + "default": [], + "items": { + "type": "string" + }, + "type": "array" + }, + "consent": { + "$ref": "#/$defs/ConsentDeclaration", + "default": "not_required" + }, + "consultations": { + "additionalProperties": { + "$ref": "#/$defs/ConsultationDeclaration" + }, + "default": {}, + "type": "object" + }, + "credential_profiles": { + "additionalProperties": { + "$ref": "#/$defs/CredentialProfileDeclaration" + }, + "default": {}, + "type": "object" + }, + "description": { + "default": null, + "type": [ + "string", + "null" + ] + }, + "entity": { + "default": null, + "type": [ + "string", + "null" + ] + }, + "kind": { + "$ref": "#/$defs/ServiceKind" + }, + "legal_basis": { + "default": "", + "type": "string" + }, + "owner": { + "default": null, + "type": [ + "string", + "null" + ] + }, + "purpose": { + "default": "", + "type": "string" + }, + "sensitivity": { + "anyOf": [ + { + "$ref": "#/$defs/RecordSensitivity" + }, + { + "type": "null" + } + ], + "default": null + }, + "title": { + "default": null, + "type": [ + "string", + "null" + ] + }, + "update_frequency": { + "anyOf": [ + { + "$ref": "#/$defs/RecordUpdateFrequency" + }, + { + "type": "null" + } + ], + "default": null + }, + "variables": { + "additionalProperties": { + "$ref": "#/$defs/RequestVariable" + }, + "default": {}, + "type": "object" + }, + "version": { + "default": 0, + "format": "uint32", + "minimum": 0, + "type": "integer" + } + }, + "required": [ + "kind" + ], + "type": "object" + }, + "ServiceKind": { + "enum": [ + "evidence", + "records_api" + ], + "type": "string" + }, + "StarterProvenance": { + "additionalProperties": false, + "properties": { + "content_digest": { + "type": "string" + }, + "id": { + "type": "string" + }, + "release": { + "type": "string" + } + }, + "required": [ + "id", + "release", + "content_digest" + ], + "type": "object" + } + }, + "$schema": "https://json-schema.org/draft/2020-12/schema", + "additionalProperties": false, + "properties": { + "entities": { + "additionalProperties": { + "$ref": "#/$defs/EntityReference" + }, + "default": {}, + "type": "object" + }, + "integrations": { + "additionalProperties": { + "$ref": "#/$defs/IntegrationReference" + }, + "default": {}, + "type": "object" + }, + "registry": { + "$ref": "#/$defs/RegistryDeclaration" + }, + "services": { + "additionalProperties": { + "$ref": "#/$defs/ServiceDeclaration" + }, + "type": "object" + }, + "starter": { + "anyOf": [ + { + "$ref": "#/$defs/StarterProvenance" + }, + { + "type": "null" + } + ], + "default": null + }, + "version": { + "format": "uint8", + "maximum": 255, + "minimum": 0, + "type": "integer" + } + }, + "required": [ + "version", + "registry", + "services" + ], + "title": "RegistryProject", + "type": "object" + } + }, + { + "kind": "environment", + "rust_type": "EnvironmentDocument", + "schema": { + "$defs": { + "CallerBinding": { + "additionalProperties": false, + "properties": { + "api_key_fingerprint": { + "$ref": "#/$defs/SecretReference" + }, + "scopes": { + "items": { + "type": "string" + }, + "type": "array" + } + }, + "required": [ + "api_key_fingerprint", + "scopes" + ], + "type": "object" + }, + "CertificateAuthorityBinding": { + "additionalProperties": false, + "properties": { + "file": { + "type": "string" + }, + "generation": { + "format": "uint64", + "minimum": 0, + "type": "integer" + } + }, + "required": [ + "file", + "generation" + ], + "type": "object" + }, + "DeploymentBinding": { + "additionalProperties": false, + "properties": { + "notary": { + "anyOf": [ + { + "$ref": "#/$defs/ServiceBinding" + }, + { + "type": "null" + } + ], + "default": null + }, + "profile": { + "$ref": "#/$defs/DeploymentProfile" + }, + "relay": { + "anyOf": [ + { + "$ref": "#/$defs/ServiceBinding" + }, + { + "type": "null" + } + ], + "default": null + } + }, + "required": [ + "profile" + ], + "type": "object" + }, + "DeploymentProfile": { + "enum": [ + "local", + "hosted_lab", + "production", + "evidence_grade" + ], + "type": "string" + }, + "EnvironmentCredential": { + "additionalProperties": false, + "properties": { + "client_id": { + "anyOf": [ + { + "$ref": "#/$defs/SecretReference" + }, + { + "type": "null" + } + ], + "default": null + }, + "client_secret": { + "anyOf": [ + { + "$ref": "#/$defs/SecretReference" + }, + { + "type": "null" + } + ], + "default": null + }, + "generation": { + "format": "uint64", + "minimum": 0, + "type": "integer" + }, + "password": { + "anyOf": [ + { + "$ref": "#/$defs/SecretReference" + }, + { + "type": "null" + } + ], + "default": null + }, + "token": { + "anyOf": [ + { + "$ref": "#/$defs/SecretReference" + }, + { + "type": "null" + } + ], + "default": null + }, + "username": { + "anyOf": [ + { + "$ref": "#/$defs/SecretReference" + }, + { + "type": "null" + } + ], + "default": null + }, + "value": { + "anyOf": [ + { + "$ref": "#/$defs/SecretReference" + }, + { + "type": "null" + } + ], + "default": null + } + }, + "required": [ + "generation" + ], + "type": "object" + }, + "EnvironmentEntityBinding": { + "additionalProperties": false, + "properties": { + "columns": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + }, + "generation": { + "type": "string" + }, + "provider": { + "$ref": "#/$defs/RecordProvider" + }, + "source_revision": { + "type": "string" + } + }, + "required": [ + "provider", + "columns", + "source_revision", + "generation" + ], + "type": "object" + }, + "EnvironmentIntegration": { + "additionalProperties": false, + "properties": { + "source": { + "$ref": "#/$defs/EnvironmentSourceBinding" + } + }, + "required": [ + "source" + ], + "type": "object" + }, + "EnvironmentSourceBinding": { + "additionalProperties": false, + "properties": { + "allowed_private_cidrs": { + "default": [], + "items": { + "type": "string" + }, + "type": "array" + }, + "ca": { + "anyOf": [ + { + "$ref": "#/$defs/CertificateAuthorityBinding" + }, + { + "type": "null" + } + ], + "default": null + }, + "concurrency": { + "default": null, + "format": "uint16", + "maximum": 65535, + "minimum": 0, + "type": [ + "integer", + "null" + ] + }, + "credential": { + "anyOf": [ + { + "$ref": "#/$defs/EnvironmentCredential" + }, + { + "type": "null" + } + ], + "default": null + }, + "jwks": { + "anyOf": [ + { + "$ref": "#/$defs/PrivateEndpointBinding" + }, + { + "type": "null" + } + ], + "default": null + }, + "mtls": { + "anyOf": [ + { + "$ref": "#/$defs/MutualTlsBinding" + }, + { + "type": "null" + } + ], + "default": null + }, + "oauth": { + "anyOf": [ + { + "$ref": "#/$defs/PrivateEndpointBinding" + }, + { + "type": "null" + } + ], + "default": null + }, + "origin": { + "type": "string" + }, + "rate": { + "anyOf": [ + { + "$ref": "#/$defs/SourceRateBinding" + }, + { + "type": "null" + } + ], + "default": null + }, + "timeout": { + "default": null, + "type": [ + "string", + "null" + ] + } + }, + "required": [ + "origin" + ], + "type": "object" + }, + "IssuanceBinding": { + "additionalProperties": false, + "properties": { + "algorithm": { + "$ref": "#/$defs/IssuanceSigningAlgorithm", + "default": "EdDSA" + }, + "generation": { + "format": "uint64", + "minimum": 0, + "type": "integer" + }, + "issuer": { + "type": "string" + }, + "signing_key": { + "$ref": "#/$defs/SecretReference" + }, + "signing_kid": { + "type": "string" + } + }, + "required": [ + "issuer", + "signing_key", + "signing_kid", + "generation" + ], + "type": "object" + }, + "IssuanceSigningAlgorithm": { + "enum": [ + "EdDSA", + "ES256" + ], + "type": "string" + }, + "MutualTlsBinding": { + "additionalProperties": false, + "properties": { + "certificate_file": { + "type": "string" + }, + "generation": { + "format": "uint64", + "minimum": 0, + "type": "integer" + }, + "private_key": { + "$ref": "#/$defs/SecretReference" + } + }, + "required": [ + "certificate_file", + "private_key", + "generation" + ], + "type": "object" + }, + "NotaryCelBinding": { + "additionalProperties": false, + "properties": { + "worker_memory_bytes": { + "format": "uint64", + "minimum": 0, + "type": "integer" + } + }, + "required": [ + "worker_memory_bytes" + ], + "type": "object" + }, + "NotaryPostgresqlBinding": { + "additionalProperties": false, + "properties": { + "root_certificate_path": { + "type": "string" + } + }, + "required": [ + "root_certificate_path" + ], + "type": "object" + }, + "NotaryRelayBinding": { + "additionalProperties": false, + "properties": { + "base_url": { + "type": "string" + }, + "token_file": { + "type": "string" + }, + "workload_client_id": { + "type": "string" + } + }, + "required": [ + "base_url", + "workload_client_id", + "token_file" + ], + "type": "object" + }, + "NotaryStateBinding": { + "additionalProperties": false, + "properties": { + "postgresql": { + "$ref": "#/$defs/NotaryPostgresqlBinding" + } + }, + "required": [ + "postgresql" + ], + "type": "object" + }, + "Oid4vciAuthorizationServerBinding": { + "additionalProperties": false, + "properties": { + "authorize_url": { + "type": "string" + }, + "issuer": { + "type": "string" + }, + "jwks_url": { + "type": "string" + }, + "token_url": { + "type": "string" + }, + "userinfo_url": { + "type": "string" + } + }, + "required": [ + "issuer", + "jwks_url", + "userinfo_url", + "authorize_url", + "token_url" + ], + "type": "object" + }, + "Oid4vciBinding": { + "additionalProperties": false, + "properties": { + "access_token": { + "$ref": "#/$defs/Oid4vciSigningKeyBinding" + }, + "allowed_wallet_origins": { + "items": { + "type": "string" + }, + "type": "array" + }, + "authorization_server": { + "$ref": "#/$defs/Oid4vciAuthorizationServerBinding" + }, + "client": { + "$ref": "#/$defs/Oid4vciClientBinding" + }, + "credential": { + "$ref": "#/$defs/Oid4vciCredentialBinding" + }, + "public_base_url": { + "type": "string" + }, + "redirect_uri": { + "type": "string" + }, + "sensitive_state_key": { + "$ref": "#/$defs/SecretReference" + }, + "subject": { + "$ref": "#/$defs/Oid4vciSubjectBinding" + }, + "tx_code": { + "$ref": "#/$defs/Oid4vciTxCodeBinding", + "default": { + "required": true + } + } + }, + "required": [ + "public_base_url", + "credential", + "authorization_server", + "client", + "access_token", + "sensitive_state_key", + "subject", + "redirect_uri", + "allowed_wallet_origins" + ], + "type": "object" + }, + "Oid4vciClientBinding": { + "additionalProperties": false, + "properties": { + "id": { + "type": "string" + }, + "signing_key": { + "$ref": "#/$defs/SecretReference" + }, + "signing_kid": { + "type": "string" + } + }, + "required": [ + "id", + "signing_key", + "signing_kid" + ], + "type": "object" + }, + "Oid4vciCredentialBinding": { + "additionalProperties": false, + "properties": { + "profile": { + "type": "string" + }, + "service": { + "type": "string" + } + }, + "required": [ + "service", + "profile" + ], + "type": "object" + }, + "Oid4vciSigningKeyBinding": { + "additionalProperties": false, + "properties": { + "signing_key": { + "$ref": "#/$defs/SecretReference" + }, + "signing_kid": { + "type": "string" + } + }, + "required": [ + "signing_key", + "signing_kid" + ], + "type": "object" + }, + "Oid4vciSubjectBinding": { + "additionalProperties": false, + "properties": { + "id_type": { + "type": "string" + }, + "token_claim": { + "type": "string" + } + }, + "required": [ + "token_claim", + "id_type" + ], + "type": "object" + }, + "Oid4vciTxCodeBinding": { + "additionalProperties": false, + "properties": { + "required": { + "default": true, + "type": "boolean" + } + }, + "type": "object" + }, + "PrivateEndpointBinding": { + "additionalProperties": false, + "properties": { + "allowed_private_cidrs": { + "default": [], + "items": { + "type": "string" + }, + "type": "array" + }, + "ca": { + "anyOf": [ + { + "$ref": "#/$defs/CertificateAuthorityBinding" + }, + { + "type": "null" + } + ], + "default": null + }, + "generation": { + "format": "uint64", + "minimum": 0, + "type": "integer" + }, + "mtls": { + "anyOf": [ + { + "$ref": "#/$defs/MutualTlsBinding" + }, + { + "type": "null" + } + ], + "default": null + }, + "origin": { + "type": "string" + }, + "path": { + "type": "string" + } + }, + "required": [ + "origin", + "path", + "generation" + ], + "type": "object" + }, + "RecordProvider": { + "oneOf": [ + { + "additionalProperties": false, + "properties": { + "delimiter": { + "default": null, + "format": "uint8", + "maximum": 255, + "minimum": 0, + "type": [ + "integer", + "null" + ] + }, + "header_row": { + "default": null, + "format": "uint32", + "minimum": 0, + "type": [ + "integer", + "null" + ] + }, + "path": { + "type": "string" + }, + "quote": { + "default": null, + "format": "uint8", + "maximum": 255, + "minimum": 0, + "type": [ + "integer", + "null" + ] + }, + "type": { + "const": "csv", + "type": "string" + } + }, + "required": [ + "type", + "path" + ], + "type": "object" + }, + { + "additionalProperties": false, + "properties": { + "data_range": { + "default": null, + "type": [ + "string", + "null" + ] + }, + "header_row": { + "default": null, + "format": "uint32", + "minimum": 0, + "type": [ + "integer", + "null" + ] + }, + "path": { + "type": "string" + }, + "sheet": { + "type": "string" + }, + "type": { + "const": "xlsx", + "type": "string" + } + }, + "required": [ + "type", + "path", + "sheet" + ], + "type": "object" + }, + { + "additionalProperties": false, + "properties": { + "path": { + "type": "string" + }, + "type": { + "const": "parquet", + "type": "string" + } + }, + "required": [ + "type", + "path" + ], + "type": "object" + }, + { + "additionalProperties": false, + "properties": { + "connection": { + "$ref": "#/$defs/SecretReference" + }, + "schema": { + "type": "string" + }, + "table": { + "type": "string" + }, + "type": { + "const": "postgres", + "type": "string" + } + }, + "required": [ + "type", + "connection", + "schema", + "table" + ], + "type": "object" + } + ] + }, + "RelayBinding": { + "additionalProperties": false, + "properties": { + "allowed_clients": { + "items": { + "type": "string" + }, + "type": "array" + }, + "audience": { + "type": "string" + }, + "issuer": { + "type": "string" + }, + "jwks_url": { + "type": "string" + }, + "origin": { + "type": "string" + } + }, + "required": [ + "origin", + "issuer", + "jwks_url", + "audience", + "allowed_clients" + ], + "type": "object" + }, + "RelayPostgresqlBinding": { + "additionalProperties": false, + "properties": { + "root_certificate_path": { + "type": "string" + } + }, + "required": [ + "root_certificate_path" + ], + "type": "object" + }, + "RelayStateBinding": { + "additionalProperties": false, + "properties": { + "postgresql": { + "$ref": "#/$defs/RelayPostgresqlBinding" + } + }, + "required": [ + "postgresql" + ], + "type": "object" + }, + "SecretReference": { + "additionalProperties": false, + "properties": { + "secret": { + "type": "string" + } + }, + "required": [ + "secret" + ], + "type": "object" + }, + "ServiceBinding": { + "additionalProperties": false, + "properties": { + "service": { + "type": "string" + } + }, + "required": [ + "service" + ], + "type": "object" + }, + "SourceRateBinding": { + "additionalProperties": false, + "properties": { + "burst": { + "format": "uint16", + "maximum": 65535, + "minimum": 0, + "type": "integer" + }, + "per_minute": { + "format": "uint32", + "minimum": 0, + "type": "integer" + } + }, + "required": [ + "per_minute", + "burst" + ], + "type": "object" + } + }, + "$schema": "https://json-schema.org/draft/2020-12/schema", + "additionalProperties": false, + "properties": { + "callers": { + "additionalProperties": { + "$ref": "#/$defs/CallerBinding" + }, + "default": {}, + "type": "object" + }, + "deployment": { + "$ref": "#/$defs/DeploymentBinding" + }, + "entities": { + "additionalProperties": { + "$ref": "#/$defs/EnvironmentEntityBinding" + }, + "default": {}, + "type": "object" + }, + "integrations": { + "additionalProperties": { + "$ref": "#/$defs/EnvironmentIntegration" + }, + "default": {}, + "type": "object" + }, + "issuance": { + "anyOf": [ + { + "$ref": "#/$defs/IssuanceBinding" + }, + { + "type": "null" + } + ], + "default": null + }, + "notary_cel": { + "anyOf": [ + { + "$ref": "#/$defs/NotaryCelBinding" + }, + { + "type": "null" + } + ], + "default": null + }, + "notary_relay": { + "anyOf": [ + { + "$ref": "#/$defs/NotaryRelayBinding" + }, + { + "type": "null" + } + ], + "default": null + }, + "notary_state": { + "anyOf": [ + { + "$ref": "#/$defs/NotaryStateBinding" + }, + { + "type": "null" + } + ], + "default": null + }, + "oid4vci": { + "anyOf": [ + { + "$ref": "#/$defs/Oid4vciBinding" + }, + { + "type": "null" + } + ], + "default": null + }, + "relay": { + "anyOf": [ + { + "$ref": "#/$defs/RelayBinding" + }, + { + "type": "null" + } + ], + "default": null + }, + "relay_state": { + "anyOf": [ + { + "$ref": "#/$defs/RelayStateBinding" + }, + { + "type": "null" + } + ], + "default": null + }, + "version": { + "format": "uint8", + "maximum": 255, + "minimum": 0, + "type": "integer" + } + }, + "required": [ + "version", + "deployment" + ], + "title": "EnvironmentDocument", + "type": "object" + } + }, + { + "kind": "integration", + "rust_type": "AuthoredIntegrationDocument", + "schema": { + "$defs": { + "AuthoredByteSize": { + "anyOf": [ + { + "format": "uint64", + "minimum": 0, + "type": "integer" + }, + { + "type": "string" + } + ] + }, + "AuthoredCapabilityDeclaration": { + "anyOf": [ + { + "$ref": "#/$defs/AuthoredHttpCapability" + }, + { + "$ref": "#/$defs/AuthoredScriptCapability" + }, + { + "$ref": "#/$defs/AuthoredSnapshotCapability" + } + ] + }, + "AuthoredDciSelectorBinding": { + "additionalProperties": false, + "properties": { + "field": { + "type": "string" + }, + "response_pointer": { + "type": "string" + } + }, + "required": [ + "field", + "response_pointer" + ], + "type": "object" + }, + "AuthoredHttpCapability": { + "additionalProperties": false, + "properties": { + "http": { + "$ref": "#/$defs/AuthoredHttpDeclaration" + } + }, + "required": [ + "http" + ], + "type": "object" + }, + "AuthoredHttpDeclaration": { + "additionalProperties": false, + "properties": { + "request": { + "$ref": "#/$defs/AuthoredHttpRequest" + }, + "response": { + "$ref": "#/$defs/AuthoredHttpResponse", + "default": { + "ambiguous": [], + "no_match": [], + "shape": null + } + } + }, + "required": [ + "request" + ], + "type": "object" + }, + "AuthoredHttpRequest": { + "additionalProperties": false, + "properties": { + "body": { + "default": null + }, + "headers": { + "additionalProperties": true, + "default": {}, + "type": "object" + }, + "method": { + "$ref": "#/$defs/ReadMethod" + }, + "path": { + "type": "string" + }, + "query": { + "additionalProperties": true, + "default": {}, + "type": "object" + }, + "semantics": { + "anyOf": [ + { + "$ref": "#/$defs/AuthoredRequestSemantics" + }, + { + "type": "null" + } + ], + "default": null + } + }, + "required": [ + "method", + "path" + ], + "type": "object" + }, + "AuthoredHttpResponse": { + "additionalProperties": false, + "properties": { + "ambiguous": { + "default": [], + "items": { + "format": "uint16", + "maximum": 65535, + "minimum": 0, + "type": "integer" + }, + "type": "array" + }, + "no_match": { + "default": [], + "items": { + "format": "uint16", + "maximum": 65535, + "minimum": 0, + "type": "integer" + }, + "type": "array" + }, + "shape": { + "anyOf": [ + { + "$ref": "#/$defs/AuthoredHttpShape" + }, + { + "type": "null" + } + ], + "default": null + } + }, + "type": "object" + }, + "AuthoredHttpShape": { + "anyOf": [ + { + "$ref": "#/$defs/AuthoredSingletonShape" + }, + { + "properties": { + "cardinality": { + "$ref": "#/$defs/CardinalityMode" + }, + "records": { + "type": "string" + } + }, + "required": [ + "records", + "cardinality" + ], + "type": "object" + } + ] + }, + "AuthoredInputDeclaration": { + "additionalProperties": false, + "properties": { + "canonicalization": { + "anyOf": [ + { + "$ref": "#/$defs/Canonicalization" + }, + { + "type": "null" + } + ], + "default": null + }, + "const": { + "default": null + }, + "enum": { + "default": null, + "items": true, + "type": [ + "array", + "null" + ] + }, + "format": { + "anyOf": [ + { + "$ref": "#/$defs/AuthoredStringFormat" + }, + { + "type": "null" + } + ], + "default": null + }, + "maxLength": { + "default": null, + "format": "uint32", + "minimum": 0, + "type": [ + "integer", + "null" + ] + }, + "maximum": { + "default": null, + "format": "int64", + "type": [ + "integer", + "null" + ] + }, + "minLength": { + "default": null, + "format": "uint32", + "minimum": 0, + "type": [ + "integer", + "null" + ] + }, + "minimum": { + "default": null, + "format": "int64", + "type": [ + "integer", + "null" + ] + }, + "pattern": { + "default": null, + "type": [ + "string", + "null" + ] + }, + "role": { + "$ref": "#/$defs/AuthoredInputRole" + }, + "type": { + "$ref": "#/$defs/AuthoredSchemaType" + } + }, + "required": [ + "role", + "type" + ], + "type": "object" + }, + "AuthoredInputReference": { + "additionalProperties": false, + "properties": { + "input": { + "type": "string" + } + }, + "required": [ + "input" + ], + "type": "object" + }, + "AuthoredInputRole": { + "enum": [ + "selector", + "parameter" + ], + "type": "string" + }, + "AuthoredLimitsDeclaration": { + "additionalProperties": false, + "properties": { + "calls": { + "default": null, + "format": "uint8", + "maximum": 255, + "minimum": 0, + "type": [ + "integer", + "null" + ] + }, + "deadline": { + "default": null, + "type": [ + "string", + "null" + ] + }, + "request_bytes": { + "anyOf": [ + { + "$ref": "#/$defs/AuthoredByteSize" + }, + { + "type": "null" + } + ], + "default": null + }, + "source_bytes": { + "anyOf": [ + { + "$ref": "#/$defs/AuthoredByteSize" + }, + { + "type": "null" + } + ], + "default": null + } + }, + "type": "object" + }, + "AuthoredNotApplicableDeclaration": { + "additionalProperties": false, + "properties": { + "ambiguity": { + "anyOf": [ + { + "$ref": "#/$defs/AuthoredNotApplicableReason" + }, + { + "type": "null" + } + ], + "default": null + }, + "subject_mismatch": { + "anyOf": [ + { + "$ref": "#/$defs/AuthoredNotApplicableReason" + }, + { + "type": "null" + } + ], + "default": null + } + }, + "type": "object" + }, + "AuthoredNotApplicableReason": { + "additionalProperties": false, + "properties": { + "rationale": { + "type": "string" + }, + "request_fixture": { + "type": "string" + } + }, + "required": [ + "rationale", + "request_fixture" + ], + "type": "object" + }, + "AuthoredOutputDeclaration": { + "additionalProperties": false, + "properties": { + "format": { + "anyOf": [ + { + "$ref": "#/$defs/AuthoredStringFormat" + }, + { + "type": "null" + } + ], + "default": null + }, + "maxLength": { + "default": null, + "format": "uint32", + "minimum": 0, + "type": [ + "integer", + "null" + ] + }, + "maximum": { + "default": null, + "format": "int64", + "type": [ + "integer", + "null" + ] + }, + "minimum": { + "default": null, + "format": "int64", + "type": [ + "integer", + "null" + ] + }, + "type": { + "$ref": "#/$defs/AuthoredSchemaType" + }, + "x-registry-source": { + "default": null, + "type": [ + "string", + "null" + ] + } + }, + "required": [ + "type" + ], + "type": "object" + }, + "AuthoredOutputsDeclaration": { + "anyOf": [ + { + "additionalProperties": { + "$ref": "#/$defs/AuthoredOutputDeclaration" + }, + "type": "object" + }, + { + "items": { + "type": "string" + }, + "type": "array" + } + ] + }, + "AuthoredProtocolDeclaration": { + "additionalProperties": false, + "properties": { + "signed_dci": { + "anyOf": [ + { + "$ref": "#/$defs/AuthoredSignedDciDeclaration" + }, + { + "type": "null" + } + ], + "default": null + } + }, + "type": "object" + }, + "AuthoredRequestSemantics": { + "enum": [ + "read_only" + ], + "type": "string" + }, + "AuthoredResponseFormat": { + "enum": [ + "json", + "text" + ], + "type": "string" + }, + "AuthoredScalarType": { + "enum": [ + "string", + "boolean", + "integer", + "null" + ], + "type": "string" + }, + "AuthoredSchemaType": { + "anyOf": [ + { + "$ref": "#/$defs/AuthoredScalarType" + }, + { + "items": { + "$ref": "#/$defs/AuthoredScalarType" + }, + "type": "array" + } + ] + }, + "AuthoredScriptCapability": { + "additionalProperties": false, + "properties": { + "script": { + "$ref": "#/$defs/AuthoredScriptDeclaration" + } + }, + "required": [ + "script" + ], + "type": "object" + }, + "AuthoredScriptDeclaration": { + "additionalProperties": false, + "properties": { + "file": { + "type": "string" + }, + "modules": { + "default": [], + "items": { + "type": "string" + }, + "type": "array" + } + }, + "required": [ + "file" + ], + "type": "object" + }, + "AuthoredSignedDciDeclaration": { + "additionalProperties": false, + "properties": { + "jwks_profile": { + "type": "string" + }, + "locale": { + "type": "string" + }, + "path": { + "type": "string" + }, + "profile": { + "type": "string" + }, + "receiver": { + "type": "string" + }, + "record_type": { + "type": "string" + }, + "registry_type": { + "type": "string" + }, + "selectors": { + "additionalProperties": { + "$ref": "#/$defs/AuthoredDciSelectorBinding" + }, + "type": "object" + }, + "sender": { + "type": "string" + } + }, + "required": [ + "profile", + "path", + "jwks_profile", + "sender", + "receiver", + "registry_type", + "record_type", + "locale", + "selectors" + ], + "type": "object" + }, + "AuthoredSingletonShape": { + "enum": [ + "singleton" + ], + "type": "string" + }, + "AuthoredSnapshotCapability": { + "additionalProperties": false, + "properties": { + "snapshot": { + "$ref": "#/$defs/AuthoredSnapshotDeclaration" + } + }, + "required": [ + "snapshot" + ], + "type": "object" + }, + "AuthoredSnapshotDeclaration": { + "additionalProperties": false, + "properties": { + "entity": { + "type": "string" + }, + "exact": { + "additionalProperties": { + "$ref": "#/$defs/AuthoredInputReference" + }, + "type": "object" + }, + "freshness": { + "type": "string" + } + }, + "required": [ + "entity", + "exact", + "freshness" + ], + "type": "object" + }, + "AuthoredSourceAllowRule": { + "additionalProperties": false, + "properties": { + "method": { + "$ref": "#/$defs/ReadMethod" + }, + "path": { + "type": "string" + }, + "semantics": { + "anyOf": [ + { + "$ref": "#/$defs/AuthoredRequestSemantics" + }, + { + "type": "null" + } + ], + "default": null + } + }, + "required": [ + "method", + "path" + ], + "type": "object" + }, + "AuthoredSourceDeclaration": { + "additionalProperties": false, + "properties": { + "allow": { + "default": [], + "items": { + "$ref": "#/$defs/AuthoredSourceAllowRule" + }, + "type": "array" + }, + "auth": { + "$ref": "#/$defs/CredentialInterface" + }, + "product": { + "default": null, + "type": [ + "string", + "null" + ] + }, + "protocol": { + "anyOf": [ + { + "$ref": "#/$defs/AuthoredProtocolDeclaration" + }, + { + "type": "null" + } + ], + "default": null + }, + "request_headers": { + "default": [], + "items": { + "type": "string" + }, + "type": "array" + }, + "response": { + "anyOf": [ + { + "$ref": "#/$defs/AuthoredSourceResponse" + }, + { + "type": "null" + } + ], + "default": null + }, + "response_headers": { + "default": [], + "items": { + "type": "string" + }, + "type": "array" + }, + "versions": { + "$ref": "#/$defs/AuthoredSourceVersions", + "default": { + "tested": [], + "unverified": [] + } + } + }, + "required": [ + "auth" + ], + "type": "object" + }, + "AuthoredSourceResponse": { + "additionalProperties": false, + "properties": { + "format": { + "$ref": "#/$defs/AuthoredResponseFormat", + "default": "json" + }, + "max_bytes": { + "anyOf": [ + { + "$ref": "#/$defs/AuthoredByteSize" + }, + { + "type": "null" + } + ], + "default": null + } + }, + "type": "object" + }, + "AuthoredSourceVersions": { + "additionalProperties": false, + "properties": { + "tested": { + "default": [], + "items": { + "type": "string" + }, + "type": "array" + }, + "unverified": { + "default": [], + "items": { + "type": "string" + }, + "type": "array" + } + }, + "type": "object" + }, + "AuthoredStringFormat": { + "enum": [ + "date" + ], + "type": "string" + }, + "Canonicalization": { + "enum": [ + "identity", + "ascii_lowercase" + ], + "type": "string" + }, + "CardinalityMode": { + "enum": [ + "singleton", + "probe_two" + ], + "type": "string" + }, + "CredentialInterface": { + "additionalProperties": false, + "properties": { + "audience": { + "default": null, + "type": [ + "string", + "null" + ] + }, + "max_value_bytes": { + "default": null, + "format": "uint16", + "maximum": 65535, + "minimum": 0, + "type": [ + "integer", + "null" + ] + }, + "name": { + "default": null, + "type": [ + "string", + "null" + ] + }, + "refresh_skew": { + "default": null, + "type": [ + "string", + "null" + ] + }, + "request": { + "anyOf": [ + { + "$ref": "#/$defs/OAuthRequestFormat" + }, + { + "type": "null" + } + ], + "default": null + }, + "response_profile": { + "anyOf": [ + { + "$ref": "#/$defs/OAuthResponseProfile" + }, + { + "type": "null" + } + ], + "default": null + }, + "scope": { + "default": null, + "type": [ + "string", + "null" + ] + }, + "type": { + "$ref": "#/$defs/CredentialType" + } + }, + "required": [ + "type" + ], + "type": "object" + }, + "CredentialType": { + "enum": [ + "none", + "basic", + "static_bearer", + "oauth2_client_credentials", + "api_key_header", + "api_key_query" + ], + "type": "string" + }, + "OAuthRequestFormat": { + "enum": [ + "form", + "json" + ], + "type": "string" + }, + "OAuthResponseProfile": { + "enum": [ + "oauth2_bearer" + ], + "type": "string" + }, + "ReadMethod": { + "enum": [ + "GET", + "POST" + ], + "type": "string" + } + }, + "$schema": "https://json-schema.org/draft/2020-12/schema", + "additionalProperties": false, + "description": "The pre-1.0 project authoring contract. Runtime artifacts may still lower\nthis concise model into product-owned structures, but authored files never\nexpose those structures.", + "properties": { + "capability": { + "$ref": "#/$defs/AuthoredCapabilityDeclaration" + }, + "id": { + "type": "string" + }, + "input": { + "additionalProperties": { + "$ref": "#/$defs/AuthoredInputDeclaration" + }, + "type": "object" + }, + "limits": { + "anyOf": [ + { + "$ref": "#/$defs/AuthoredLimitsDeclaration" + }, + { + "type": "null" + } + ], + "default": null + }, + "not_applicable": { + "$ref": "#/$defs/AuthoredNotApplicableDeclaration", + "default": { + "ambiguity": null, + "subject_mismatch": null + } + }, + "outputs": { + "$ref": "#/$defs/AuthoredOutputsDeclaration" + }, + "revision": { + "format": "uint32", + "minimum": 0, + "type": "integer" + }, + "source": { + "anyOf": [ + { + "$ref": "#/$defs/AuthoredSourceDeclaration" + }, + { + "type": "null" + } + ], + "default": null + }, + "version": { + "format": "uint8", + "maximum": 255, + "minimum": 0, + "type": "integer" + } + }, + "required": [ + "version", + "id", + "revision", + "input", + "capability", + "outputs" + ], + "title": "AuthoredIntegrationDocument", + "type": "object" + } + }, + { + "kind": "fixture", + "rust_type": "AuthoredFixtureDocument", + "schema": { + "$defs": { + "AuthoredFixtureBody": { + "oneOf": [ + { + "$ref": "#/$defs/AuthoredFixtureBodyFile" + }, + { + "not": { + "required": [ + "file" + ], + "type": "object" + } + } + ] + }, + "AuthoredFixtureBodyFile": { + "additionalProperties": false, + "properties": { + "file": { + "type": "string" + } + }, + "required": [ + "file" + ], + "type": "object" + }, + "AuthoredFixtureClassification": { + "enum": [ + "synthetic" + ], + "type": "string" + }, + "AuthoredFixtureHttpResponse": { + "additionalProperties": false, + "properties": { + "body": { + "anyOf": [ + { + "$ref": "#/$defs/AuthoredFixtureBody" + }, + { + "type": "null" + } + ], + "default": null + }, + "headers": { + "additionalProperties": { + "type": "string" + }, + "default": {}, + "type": "object" + }, + "status": { + "format": "uint16", + "maximum": 65535, + "minimum": 0, + "type": "integer" + } + }, + "required": [ + "status" + ], + "type": "object" + }, + "AuthoredFixtureInteraction": { + "additionalProperties": false, + "properties": { + "expect": { + "$ref": "#/$defs/AuthoredFixtureRequest" + }, + "respond": { + "$ref": "#/$defs/AuthoredFixtureResponse" + } + }, + "required": [ + "expect", + "respond" + ], + "type": "object" + }, + "AuthoredFixtureRequest": { + "additionalProperties": false, + "properties": { + "body": { + "anyOf": [ + { + "$ref": "#/$defs/AuthoredFixtureBody" + }, + { + "type": "null" + } + ], + "default": null + }, + "headers": { + "additionalProperties": { + "type": "string" + }, + "default": {}, + "type": "object" + }, + "method": { + "$ref": "#/$defs/ReadMethod" + }, + "path": { + "type": "string" + }, + "query": { + "additionalProperties": true, + "default": {}, + "type": "object" + } + }, + "required": [ + "method", + "path" + ], + "type": "object" + }, + "AuthoredFixtureResponse": { + "anyOf": [ + { + "$ref": "#/$defs/AuthoredFixtureHttpResponse" + }, + { + "$ref": "#/$defs/AuthoredFixtureTimeoutResponse" + } + ] + }, + "AuthoredFixtureTimeoutResponse": { + "additionalProperties": false, + "properties": { + "timeout": { + "type": "string" + } + }, + "required": [ + "timeout" + ], + "type": "object" + }, + "ClaimRef": { + "$ref": "#/$defs/WireClaimRef" + }, + "ClaimRefObject": { + "additionalProperties": false, + "properties": { + "id": { + "type": "string" + }, + "version": { + "default": null, + "type": [ + "string", + "null" + ] + } + }, + "required": [ + "id" + ], + "type": "object" + }, + "FixtureExpectation": { + "additionalProperties": false, + "properties": { + "claims": { + "additionalProperties": true, + "default": {}, + "type": "object" + }, + "error": { + "default": null, + "type": [ + "string", + "null" + ] + }, + "outcome": { + "default": null, + "type": [ + "string", + "null" + ] + }, + "outputs": { + "additionalProperties": true, + "default": {}, + "type": "object" + } + }, + "type": "object" + }, + "GovernedLiveIdentifier": { + "additionalProperties": false, + "properties": { + "scheme": { + "type": "string" + }, + "value": { + "type": "string" + } + }, + "required": [ + "scheme", + "value" + ], + "type": "object" + }, + "GovernedLiveRequest": { + "additionalProperties": false, + "description": "The closed governed request accepted by both `project test --live` and an\nindependently authored synthetic fixture witness.\n\nKeeping one internal request type prevents fixture authoring from drifting\ninto a looser contract than the live Notary boundary.", + "properties": { + "claims": { + "items": { + "$ref": "#/$defs/ClaimRef" + }, + "type": "array" + }, + "disclosure": { + "type": [ + "string", + "null" + ] + }, + "format": { + "type": [ + "string", + "null" + ] + }, + "purpose": { + "type": "string" + }, + "target": { + "$ref": "#/$defs/GovernedLiveTarget" + }, + "variables": { + "additionalProperties": { + "type": "string" + }, + "type": "object" + } + }, + "required": [ + "target", + "claims", + "purpose" + ], + "type": "object" + }, + "GovernedLiveTarget": { + "additionalProperties": false, + "properties": { + "attributes": { + "additionalProperties": true, + "type": "object" + }, + "id": { + "type": [ + "string", + "null" + ] + }, + "identifiers": { + "items": { + "$ref": "#/$defs/GovernedLiveIdentifier" + }, + "type": "array" + }, + "type": { + "type": "string" + } + }, + "required": [ + "type" + ], + "type": "object" + }, + "ReadMethod": { + "enum": [ + "GET", + "POST" + ], + "type": "string" + }, + "WireClaimRef": { + "anyOf": [ + { + "type": "string" + }, + { + "$ref": "#/$defs/ClaimRefObject" + } + ] + } + }, + "$schema": "https://json-schema.org/draft/2020-12/schema", + "additionalProperties": false, + "properties": { + "classification": { + "$ref": "#/$defs/AuthoredFixtureClassification" + }, + "expect": { + "$ref": "#/$defs/FixtureExpectation" + }, + "input": { + "additionalProperties": true, + "type": "object" + }, + "interactions": { + "default": [], + "items": { + "$ref": "#/$defs/AuthoredFixtureInteraction" + }, + "type": "array" + }, + "name": { + "type": "string" + }, + "request": { + "anyOf": [ + { + "$ref": "#/$defs/GovernedLiveRequest" + }, + { + "type": "null" + } + ], + "default": null + }, + "variables": { + "additionalProperties": true, + "default": {}, + "type": "object" + } + }, + "required": [ + "name", + "classification", + "input", + "expect" + ], + "title": "AuthoredFixtureDocument", + "type": "object" + } + }, + { + "kind": "entity", + "rust_type": "EntityDefinition", + "schema": { + "$defs": { + "AuthoredByteSize": { + "anyOf": [ + { + "format": "uint64", + "minimum": 0, + "type": "integer" + }, + { + "type": "string" + } + ] + }, + "AuthoredScalarType": { + "enum": [ + "string", + "boolean", + "integer", + "null" + ], + "type": "string" + }, + "AuthoredSchemaType": { + "anyOf": [ + { + "$ref": "#/$defs/AuthoredScalarType" + }, + { + "items": { + "$ref": "#/$defs/AuthoredScalarType" + }, + "type": "array" + } + ] + }, + "AuthoredStringFormat": { + "enum": [ + "date" + ], + "type": "string" + }, + "EntityFieldSchema": { + "additionalProperties": false, + "properties": { + "const": { + "default": null + }, + "enum": { + "default": null, + "items": true, + "type": [ + "array", + "null" + ] + }, + "format": { + "anyOf": [ + { + "$ref": "#/$defs/AuthoredStringFormat" + }, + { + "type": "null" + } + ], + "default": null + }, + "maxLength": { + "default": null, + "format": "uint32", + "minimum": 0, + "type": [ + "integer", + "null" + ] + }, + "maximum": { + "default": null, + "format": "int64", + "type": [ + "integer", + "null" + ] + }, + "minLength": { + "default": null, + "format": "uint32", + "minimum": 0, + "type": [ + "integer", + "null" + ] + }, + "minimum": { + "default": null, + "format": "int64", + "type": [ + "integer", + "null" + ] + }, + "pattern": { + "default": null, + "type": [ + "string", + "null" + ] + }, + "type": { + "$ref": "#/$defs/AuthoredSchemaType" + } + }, + "required": [ + "type" + ], + "type": "object" + }, + "EntityMaterialization": { + "additionalProperties": false, + "properties": { + "max_bytes": { + "$ref": "#/$defs/AuthoredByteSize" + }, + "max_records": { + "format": "uint64", + "minimum": 0, + "type": "integer" + }, + "refresh": { + "type": "string" + }, + "retain_generations": { + "format": "uint8", + "maximum": 255, + "minimum": 0, + "type": "integer" + } + }, + "required": [ + "max_records", + "max_bytes", + "refresh", + "retain_generations" + ], + "type": "object" + }, + "EntityObjectSchema": { + "additionalProperties": false, + "properties": { + "additionalProperties": { + "type": "boolean" + }, + "properties": { + "additionalProperties": { + "$ref": "#/$defs/EntityFieldSchema" + }, + "type": "object" + }, + "required": { + "items": { + "type": "string" + }, + "type": "array" + }, + "type": { + "$ref": "#/$defs/EntityObjectType" + } + }, + "required": [ + "type", + "additionalProperties", + "required", + "properties" + ], + "type": "object" + }, + "EntityObjectType": { + "enum": [ + "object" + ], + "type": "string" + } + }, + "$schema": "https://json-schema.org/draft/2020-12/schema", + "additionalProperties": false, + "properties": { + "id": { + "type": "string" + }, + "materialization": { + "$ref": "#/$defs/EntityMaterialization" + }, + "primary_key": { + "type": "string" + }, + "revision": { + "format": "uint32", + "minimum": 0, + "type": "integer" + }, + "schema": { + "$ref": "#/$defs/EntityObjectSchema" + }, + "version": { + "format": "uint8", + "maximum": 255, + "minimum": 0, + "type": "integer" + } + }, + "required": [ + "version", + "id", + "revision", + "primary_key", + "schema", + "materialization" + ], + "title": "EntityDefinition", + "type": "object" + } + } + ], + "version": 1 +} diff --git a/crates/registryctl/schemas/project-authoring/entity.schema.json b/crates/registryctl/schemas/project-authoring/entity.schema.json index 74833ac1a..c9d877208 100644 --- a/crates/registryctl/schemas/project-authoring/entity.schema.json +++ b/crates/registryctl/schemas/project-authoring/entity.schema.json @@ -1,4 +1,5 @@ { + "x-registry-field": "root", "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "https://registrystack.example/schemas/project-authoring/entity.v1.json", "title": "Registry Stack project entity v1", @@ -7,35 +8,38 @@ "additionalProperties": false, "required": ["version", "id", "revision", "primary_key", "schema", "materialization"], "properties": { - "version": { "const": 1, "default": 1, "description": "Entity authoring format version." }, - "id": { "$ref": "#/$defs/stableId", "description": "Stable project-local identifier for the entity." }, - "revision": { "type": "integer", "minimum": 1, "description": "Monotonically increasing revision of this entity definition.", "examples": [1] }, - "primary_key": { "$ref": "#/$defs/stableId", "description": "Field whose value uniquely identifies each materialized record.", "examples": ["person_id"] }, - "schema": { "$ref": "#/$defs/objectSchema", "description": "Closed JSON object schema for materialized records." }, + "version": {"x-registry-field": "public_property", "const": 1, "description": "Entity authoring format version." }, + "id": {"x-registry-field": "property", "$ref": "#/$defs/stableId", "description": "Stable project-local identifier for the entity." }, + "revision": {"x-registry-field": "property", "type": "integer", "minimum": 1, "maximum": 4294967295, "description": "Monotonically increasing revision of this entity definition.", "examples": [1] }, + "primary_key": {"x-registry-field": "property", "$ref": "#/$defs/stableId", "description": "Field whose value uniquely identifies each materialized record.", "examples": ["person_id"] }, + "schema": {"x-registry-field": "property", "$ref": "#/$defs/objectSchema", "description": "Closed JSON object schema for materialized records." }, "materialization": { - "description": "Resource and refresh bounds applied while building entity generations.", + "x-registry-field": "property", + "description": "Authored resource, refresh, and bounded recovery-set retention applied while building entity generations.", "type": "object", "additionalProperties": false, "required": ["max_records", "max_bytes", "refresh", "retain_generations"], "properties": { - "max_records": { "type": "integer", "minimum": 1, "description": "Maximum number of records allowed in one generation.", "examples": [10000] }, + "max_records": {"x-registry-field": "property", "type": "integer", "minimum": 1, "maximum": 18446744073709551615, "description": "Maximum number of records allowed in one generation.", "examples": [10000] }, "max_bytes": { + "x-registry-field": "property", "description": "Maximum encoded size of one generation, as bytes or a KiB/MiB quantity.", "examples": ["16MiB"], "oneOf": [ - { "type": "integer", "minimum": 1 }, - { "type": "string", "pattern": "^[1-9][0-9]*(?:KiB|MiB)$" } + {"x-registry-field": "branch", "type": "integer", "minimum": 1, "maximum": 18446744073709551615 }, + {"x-registry-field": "branch", "type": "string", "pattern": "^[1-9][0-9]*(?:KiB|MiB)$" } ] }, "refresh": { + "x-registry-field": "property", "description": "Refresh cadence, or manual when an operator initiates every refresh.", "examples": ["1h"], "oneOf": [ - { "const": "manual" }, - { "type": "string", "pattern": "^[1-9][0-9]*(?:ms|s|m|h|d)$" } + {"x-registry-field": "branch", "const": "manual" }, + {"x-registry-field": "branch", "type": "string", "pattern": "^[1-9][0-9]*(?:ms|s|m|h|d)$" } ] }, - "retain_generations": { "type": "integer", "minimum": 1, "maximum": 16, "description": "Number of completed generations retained for rollback and readers.", "examples": [2] } + "retain_generations": {"x-registry-field": "property", "type": "integer", "minimum": 1, "maximum": 16, "description": "Number of completed cache generations, including the active generation, retained as a bounded recovery set after successful publication. This does not make arbitrary retained generations selectable for rollback.", "examples": [2] } } } }, @@ -65,12 +69,13 @@ "scalarType": { "description": "Supported scalar type, optionally paired with null for a nullable field.", "oneOf": [ - { "enum": ["string", "boolean", "integer"] }, + {"x-registry-field": "branch", "enum": ["string", "boolean", "integer"] }, { + "x-registry-field": "branch", "type": "array", "prefixItems": [ - { "enum": ["string", "boolean", "integer"] }, - { "const": "null" } + {"x-registry-field": "array_item", "enum": ["string", "boolean", "integer"] }, + {"x-registry-field": "array_item", "const": "null" } ], "items": false, "minItems": 2, @@ -85,15 +90,15 @@ "additionalProperties": false, "required": ["type"], "properties": { - "type": { "$ref": "#/$defs/scalarType" }, - "format": { "const": "date" }, - "enum": { "type": "array", "minItems": 1, "uniqueItems": true }, - "const": {}, - "minLength": { "type": "integer", "minimum": 0, "maximum": 65536 }, - "maxLength": { "type": "integer", "minimum": 1, "maximum": 65536 }, - "minimum": { "type": "number" }, - "maximum": { "type": "number" }, - "pattern": { "type": "string", "minLength": 1, "maxLength": 1024 } + "type": {"x-registry-field": "property", "$ref": "#/$defs/scalarType" }, + "format": {"x-registry-field": "property", "const": "date" }, + "enum": {"x-registry-field": "property", "type": "array", "minItems": 1, "uniqueItems": true }, + "const": {"x-registry-field": "property"}, + "minLength": {"x-registry-field": "property", "type": "integer", "minimum": 0, "maximum": 65536 }, + "maxLength": {"x-registry-field": "property", "type": "integer", "minimum": 1, "maximum": 65536 }, + "minimum": {"x-registry-field": "property", "type": "integer", "minimum": -9223372036854775808, "maximum": 9223372036854775807 }, + "maximum": {"x-registry-field": "property", "type": "integer", "minimum": -9223372036854775808, "maximum": 9223372036854775807 }, + "pattern": {"x-registry-field": "property", "type": "string", "minLength": 1, "maxLength": 1024 } } }, "objectSchema": { @@ -102,21 +107,23 @@ "additionalProperties": false, "required": ["type", "additionalProperties", "required", "properties"], "properties": { - "type": { "const": "object" }, - "additionalProperties": { "const": false }, + "type": {"x-registry-field": "property", "const": "object" }, + "additionalProperties": {"x-registry-field": "property", "const": false }, "required": { + "x-registry-field": "property", "type": "array", "minItems": 1, "maxItems": 256, "uniqueItems": true, - "items": { "$ref": "#/$defs/propertyName" } + "items": {"x-registry-field": "array_item", "$ref": "#/$defs/propertyName" } }, "properties": { + "x-registry-field": "property", "type": "object", "minProperties": 1, "maxProperties": 256, - "propertyNames": { "$ref": "#/$defs/propertyName" }, - "additionalProperties": { "$ref": "#/$defs/fieldSchema" } + "propertyNames": {"x-registry-field": "property", "$ref": "#/$defs/propertyName" }, + "additionalProperties": {"x-registry-field": "property", "$ref": "#/$defs/fieldSchema" } } } } diff --git a/crates/registryctl/schemas/project-authoring/environment.schema.json b/crates/registryctl/schemas/project-authoring/environment.schema.json index 33aa6de9d..a5085c89f 100644 --- a/crates/registryctl/schemas/project-authoring/environment.schema.json +++ b/crates/registryctl/schemas/project-authoring/environment.schema.json @@ -1,4 +1,5 @@ { + "x-registry-field": "root", "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "https://registrystack.example/schemas/project-authoring/environment.v1.json", "title": "Registry Stack project environment v1", @@ -7,125 +8,149 @@ "additionalProperties": false, "required": ["version", "deployment"], "properties": { - "version": { "const": 1, "default": 1, "description": "Environment authoring format version." }, - "integrations": { "type": "object", "maxProperties": 16, "description": "Environment bindings keyed by authored integration identifier.", "propertyNames": { "$ref": "#/$defs/stableId" }, "additionalProperties": { "$ref": "#/$defs/integration" } }, - "entities": { "type": "object", "maxProperties": 32, "description": "Environment-specific source bindings keyed by entity identifier.", "propertyNames": { "$ref": "#/$defs/stableId" }, "additionalProperties": { "$ref": "#/$defs/entity" } }, + "version": {"x-registry-field": "public_property", "const": 1, "description": "Environment authoring format version." }, + "integrations": {"x-registry-field": "property", "type": "object", "maxProperties": 16, "description": "Environment bindings keyed by authored integration identifier.", "propertyNames": {"x-registry-field": "map_key", "$ref": "#/$defs/stableId" }, "additionalProperties": {"x-registry-field": "map_value", "$ref": "#/$defs/integration" } }, + "entities": {"x-registry-field": "property", "type": "object", "maxProperties": 32, "description": "Environment-specific source bindings keyed by entity identifier.", "propertyNames": {"x-registry-field": "map_key", "$ref": "#/$defs/stableId" }, "additionalProperties": {"x-registry-field": "map_value", "$ref": "#/$defs/entity" } }, "issuance": { + "x-registry-field": "property", "description": "Notary issuer and signing-key bindings for credential issuance.", "type": "object", "additionalProperties": false, "required": ["issuer", "signing_key", "signing_kid", "generation"], - "properties": { "issuer": { "type": "string", "minLength": 1 }, "signing_key": { "$ref": "#/$defs/secret" }, "signing_kid": { "$ref": "#/$defs/token2048" }, "algorithm": { "enum": ["EdDSA", "ES256"], "default": "EdDSA", "description": "Credential issuer signing algorithm. Holder proof remains EdDSA with did:jwk." }, "generation": { "type": "integer", "minimum": 1 } } + "properties": { "issuer": {"x-registry-field": "sensitive_property", "type": "string", "minLength": 1 }, "signing_key": {"x-registry-field": "secret_reference_property", "$ref": "#/$defs/secret" }, "signing_kid": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/token2048" }, "algorithm": {"x-registry-field": "property", "enum": ["EdDSA", "ES256"], "default": "EdDSA", "description": "Credential issuer signing algorithm. Holder proof remains EdDSA with did:jwk." }, "generation": {"x-registry-field": "sensitive_property", "type": "integer", "minimum": 1, "maximum": 18446744073709551615 } } }, "callers": { + "x-registry-field": "property", "description": "Notary API-key caller identities and the scopes each identity receives.", - "type": "object", "maxProperties": 64, "propertyNames": { "$ref": "#/$defs/stableId" }, + "type": "object", "maxProperties": 64, "propertyNames": {"x-registry-field": "map_key", "$ref": "#/$defs/stableId" }, "additionalProperties": { + "x-registry-field": "map_value", "type": "object", "additionalProperties": false, "required": ["api_key_fingerprint", "scopes"], - "properties": { "api_key_fingerprint": { "$ref": "#/$defs/secret" }, "scopes": { "type": "array", "minItems": 1, "maxItems": 16, "uniqueItems": true, "items": { "type": "string", "minLength": 1, "maxLength": 128 } } } + "properties": { "api_key_fingerprint": {"x-registry-field": "secret_reference_property", "$ref": "#/$defs/secret" }, "scopes": {"x-registry-field": "property", "type": "array", "minItems": 1, "maxItems": 16, "uniqueItems": true, "items": {"x-registry-field": "array_item", "type": "string", "minLength": 1, "maxLength": 128 } } } } }, "relay": { + "x-registry-field": "property", "description": "Public Relay identity and token-validation settings for a Relay deployment.", "type": "object", "additionalProperties": false, "required": ["origin", "issuer", "jwks_url", "audience", "allowed_clients"], - "properties": { "origin": { "$ref": "#/$defs/relayOrigin" }, "issuer": { "$ref": "#/$defs/relayOrigin" }, "jwks_url": { "$ref": "#/$defs/relayResource" }, "audience": { "type": "string", "minLength": 1, "maxLength": 256 }, "allowed_clients": { "type": "array", "maxItems": 64, "uniqueItems": true, "items": { "type": "string", "minLength": 1, "maxLength": 256 } } } + "properties": { "origin": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/relayOrigin" }, "issuer": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/relayOrigin" }, "jwks_url": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/relayResource" }, "audience": {"x-registry-field": "sensitive_property", "type": "string", "minLength": 1, "maxLength": 256 }, "allowed_clients": {"x-registry-field": "sensitive_property", "type": "array", "maxItems": 64, "uniqueItems": true, "items": {"x-registry-field": "array_item", "type": "string", "minLength": 1, "maxLength": 256 } } } }, "notary_relay": { + "x-registry-field": "property", "description": "Deployment-internal Relay connection, Notary workload identity, and token file used only when Notary consults Relay.", "type": "object", "additionalProperties": false, "required": ["base_url", "workload_client_id", "token_file"], - "properties": { "base_url": { "$ref": "#/$defs/internalOrigin" }, "workload_client_id": { "type": "string", "minLength": 1, "maxLength": 256 }, "token_file": { "type": "string", "minLength": 2, "maxLength": 4096, "pattern": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$" } } + "properties": { "base_url": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/internalOrigin" }, "workload_client_id": {"x-registry-field": "sensitive_property", "type": "string", "minLength": 1, "maxLength": 256 }, "token_file": {"x-registry-field": "sensitive_property", "type": "string", "minLength": 2, "maxLength": 4096, "pattern": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$" } } }, "relay_state": { + "x-registry-field": "property", "description": "Optional deployment binding for Relay-owned consultation PostgreSQL state transport trust.", "type": "object", "additionalProperties": false, "required": ["postgresql"], "properties": { "postgresql": { + "x-registry-field": "property", "type": "object", "additionalProperties": false, "required": ["root_certificate_path"], - "properties": { "root_certificate_path": { "$ref": "#/$defs/absolutePath" } } + "properties": { "root_certificate_path": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/absolutePath" } } } } }, "notary_state": { + "x-registry-field": "property", "description": "Optional deployment binding for Notary-owned PostgreSQL state transport trust.", "type": "object", "additionalProperties": false, "required": ["postgresql"], "properties": { "postgresql": { + "x-registry-field": "property", "type": "object", "additionalProperties": false, "required": ["root_certificate_path"], - "properties": { "root_certificate_path": { "$ref": "#/$defs/absolutePath" } } + "properties": { "root_certificate_path": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/absolutePath" } } } } }, "notary_cel": { + "x-registry-field": "property", "description": "Optional per-worker data/address-space ceiling for dedicated Notary CEL processes. The Notary default is 134217728 bytes; 1073741824 is the maximum emulation-compatible exception and remains a limit, not an allocation.", "type": "object", "additionalProperties": false, "required": ["worker_memory_bytes"], "properties": { - "worker_memory_bytes": { "type": "integer", "minimum": 33554432, "maximum": 1073741824 } + "worker_memory_bytes": {"x-registry-field": "property", "type": "integer", "minimum": 33554432, "maximum": 1073741824 } } }, "oid4vci": { + "x-registry-field": "property", "description": "Explicit registry-backed holder-wallet OID4VCI binding for one authored Notary credential profile.", "$ref": "#/$defs/oid4vci" }, "deployment": { + "x-registry-field": "property", "description": "Products deployed in this environment and the operational profile they use.", "type": "object", "additionalProperties": false, "required": ["profile"], - "properties": { "profile": { "enum": ["local", "hosted_lab", "production", "evidence_grade"] }, "relay": { "$ref": "#/$defs/service" }, "notary": { "$ref": "#/$defs/service" } }, - "anyOf": [{ "required": ["relay"] }, { "required": ["notary"] }] + "properties": { "profile": {"x-registry-field": "property", "enum": ["local", "hosted_lab", "production", "evidence_grade"] }, "relay": {"x-registry-field": "property", "$ref": "#/$defs/service" }, "notary": {"x-registry-field": "property", "$ref": "#/$defs/service" } }, + "anyOf": [{"x-registry-field": "branch", "required": ["relay"] }, {"x-registry-field": "branch", "required": ["notary"] }] } }, "allOf": [ { - "if": { "required": ["deployment"], "properties": { "deployment": { "required": ["relay"] } } }, - "then": { "required": ["relay"] }, - "else": { "not": { "required": ["relay"] } } + "x-registry-field": "branch", + "if": {"x-registry-field": "branch", "required": ["deployment"], "properties": { "deployment": {"x-registry-field": "property", "required": ["relay"] } } }, + "then": {"x-registry-field": "branch", "required": ["relay"] }, + "else": {"x-registry-field": "branch", "not": {"x-registry-field": "branch", "required": ["relay"] } } }, { - "if": { "required": ["notary_relay"] }, - "then": { "properties": { "deployment": { "required": ["relay", "notary"] } } } + "x-registry-field": "branch", + "if": {"x-registry-field": "branch", "required": ["notary_relay"] }, + "then": {"x-registry-field": "branch", "properties": { "deployment": {"x-registry-field": "property", "required": ["relay", "notary"] } } } }, { - "if": { "required": ["relay_state"] }, - "then": { "properties": { "deployment": { "required": ["relay"] } } } + "x-registry-field": "branch", + "if": {"x-registry-field": "branch", "required": ["relay_state"] }, + "then": {"x-registry-field": "branch", "properties": { "deployment": {"x-registry-field": "property", "required": ["relay"] } } } }, { - "if": { "required": ["notary_state"] }, - "then": { "properties": { "deployment": { "required": ["notary"] } } } + "x-registry-field": "branch", + "if": {"x-registry-field": "branch", "required": ["notary_state"] }, + "then": {"x-registry-field": "branch", "properties": { "deployment": {"x-registry-field": "property", "required": ["notary"] } } } }, { - "if": { "required": ["notary_cel"] }, - "then": { "properties": { "deployment": { "required": ["notary"] } } } + "x-registry-field": "branch", + "if": {"x-registry-field": "branch", "required": ["notary_cel"] }, + "then": {"x-registry-field": "branch", "properties": { "deployment": {"x-registry-field": "property", "required": ["notary"] } } } }, { - "if": { "required": ["oid4vci"] }, + "x-registry-field": "branch", + "if": {"x-registry-field": "branch", "required": ["oid4vci"] }, "then": { + "x-registry-field": "branch", "required": ["notary_state"], "properties": { - "deployment": { "required": ["notary"] } + "deployment": {"x-registry-field": "property", "required": ["notary"] } } }, - "else": { "properties": { "callers": { "minProperties": 1 } } } + "else": {"x-registry-field": "branch", "properties": { "callers": {"x-registry-field": "property", "minProperties": 1 } } } }, { - "if": { "properties": { "deployment": { "required": ["profile"], "properties": { "profile": { "const": "local" } } } } }, + "x-registry-field": "branch", + "if": {"x-registry-field": "branch", "properties": { "deployment": {"x-registry-field": "property", "required": ["profile"], "properties": { "profile": {"x-registry-field": "property", "const": "local" } } } } }, "else": { + "x-registry-field": "branch", "properties": { "relay": { + "x-registry-field": "property", "properties": { - "origin": { "$ref": "#/$defs/origin" }, - "issuer": { "$ref": "#/$defs/origin" }, - "jwks_url": { "$ref": "#/$defs/httpsResource" } + "origin": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/origin" }, + "issuer": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/origin" }, + "jwks_url": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/httpsResource" } } }, "oid4vci": { + "x-registry-field": "property", "properties": { - "public_base_url": { "$ref": "#/$defs/origin" }, - "redirect_uri": { "$ref": "#/$defs/httpsResource" }, + "public_base_url": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/origin" }, + "redirect_uri": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/httpsResource" }, "authorization_server": { + "x-registry-field": "property", "properties": { - "issuer": { "$ref": "#/$defs/origin" }, - "jwks_url": { "$ref": "#/$defs/httpsResource" }, - "userinfo_url": { "$ref": "#/$defs/httpsResource" }, - "authorize_url": { "$ref": "#/$defs/httpsResource" }, - "token_url": { "$ref": "#/$defs/httpsResource" } + "issuer": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/origin" }, + "jwks_url": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/httpsResource" }, + "userinfo_url": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/httpsResource" }, + "authorize_url": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/httpsResource" }, + "token_url": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/httpsResource" } } } } @@ -146,151 +171,158 @@ "$defs": { "stableId": { "type": "string", "pattern": "^[a-z][a-z0-9._-]{0,95}$", "description": "Lowercase stable identifier used in project references." }, "token2048": { "type": "string", "minLength": 1, "maxLength": 2048, "pattern": "^[!-~]+$", "description": "Bounded visible-ASCII token, including full verification-method identifiers." }, - "secret": { "type": "object", "additionalProperties": false, "description": "Reference to a process-environment variable; secret values are never authored here.", "required": ["secret"], "properties": { "secret": { "type": "string", "pattern": "^[A-Z_][A-Z0-9_]{0,127}$" } } }, + "secret": { "type": "object", "additionalProperties": false, "description": "Reference to a process-environment variable; secret values are never authored here.", "required": ["secret"], "properties": { "secret": {"x-registry-field": "secret_reference_property", "type": "string", "pattern": "^[A-Z_][A-Z0-9_]{0,127}$" } } }, "origin": { "type": "string", "format": "uri", "pattern": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$", "description": "HTTPS origin without path, query, or fragment." }, "httpsResource": { "type": "string", "format": "uri", "pattern": "^[hH][tT][tT][pP][sS]://[^/?#]+/[^?#]+$", "description": "Exact HTTPS resource without query or fragment." }, "localLoopbackOrigin": { "type": "string", "format": "uri", "pattern": "^[hH][tT][tT][pP]://(?:127(?:\\.[0-9]{1,3}){3}|\\[::1\\])(?::[0-9]+)?/?$", "description": "HTTP IP-loopback origin; public Relay and issuer fields restrict it to the local profile, while internal Notary-to-Relay connections allow it in any profile." }, "localLoopbackResource": { "type": "string", "format": "uri", "pattern": "^[hH][tT][tT][pP]://(?:127(?:\\.[0-9]{1,3}){3}|\\[::1\\])(?::[0-9]+)?/[^?#]+$", "description": "HTTP IP-loopback resource accepted only with the local deployment profile." }, - "internalOrigin": { "description": "Deployment-internal HTTPS or HTTP IP-loopback origin.", "anyOf": [{ "$ref": "#/$defs/origin" }, { "$ref": "#/$defs/localLoopbackOrigin" }] }, - "relayOrigin": { "description": "Relay or issuer origin using HTTPS, or HTTP IP-loopback under the local profile.", "anyOf": [{ "$ref": "#/$defs/origin" }, { "$ref": "#/$defs/localLoopbackOrigin" }] }, - "relayResource": { "description": "Relay authentication resource using HTTPS, or HTTP IP-loopback under the local profile.", "anyOf": [{ "$ref": "#/$defs/httpsResource" }, { "$ref": "#/$defs/localLoopbackResource" }] }, + "internalOrigin": { "description": "Deployment-internal HTTPS or HTTP IP-loopback origin.", "anyOf": [{"x-registry-field": "branch", "$ref": "#/$defs/origin" }, {"x-registry-field": "branch", "$ref": "#/$defs/localLoopbackOrigin" }] }, + "relayOrigin": { "description": "Relay or issuer origin using HTTPS, or HTTP IP-loopback under the local profile.", "anyOf": [{"x-registry-field": "branch", "$ref": "#/$defs/origin" }, {"x-registry-field": "branch", "$ref": "#/$defs/localLoopbackOrigin" }] }, + "relayResource": { "description": "Relay authentication resource using HTTPS, or HTTP IP-loopback under the local profile.", "anyOf": [{"x-registry-field": "branch", "$ref": "#/$defs/httpsResource" }, {"x-registry-field": "branch", "$ref": "#/$defs/localLoopbackResource" }] }, "oid4vci": { "description": "Closed OID4VCI trust, key, subject, wallet, and credential-profile binding.", "type": "object", "additionalProperties": false, "required": ["public_base_url", "credential", "authorization_server", "client", "access_token", "sensitive_state_key", "subject", "redirect_uri", "allowed_wallet_origins"], "properties": { - "public_base_url": { "$ref": "#/$defs/relayOrigin" }, + "public_base_url": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/relayOrigin" }, "credential": { + "x-registry-field": "property", "description": "Existing project service and credential profile exposed through OID4VCI.", "type": "object", "additionalProperties": false, "required": ["service", "profile"], "properties": { - "service": { "$ref": "#/$defs/stableId" }, - "profile": { "$ref": "#/$defs/stableId" } + "service": {"x-registry-field": "property", "$ref": "#/$defs/stableId" }, + "profile": {"x-registry-field": "property", "$ref": "#/$defs/stableId" } } }, "authorization_server": { + "x-registry-field": "property", "description": "Pinned eSignet issuer and exact endpoints used for login and token validation.", "type": "object", "additionalProperties": false, "required": ["issuer", "jwks_url", "userinfo_url", "authorize_url", "token_url"], "properties": { - "issuer": { "$ref": "#/$defs/relayOrigin" }, - "jwks_url": { "$ref": "#/$defs/relayResource" }, - "userinfo_url": { "$ref": "#/$defs/relayResource" }, - "authorize_url": { "$ref": "#/$defs/relayResource" }, - "token_url": { "$ref": "#/$defs/relayResource" } + "issuer": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/relayOrigin" }, + "jwks_url": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/relayResource" }, + "userinfo_url": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/relayResource" }, + "authorize_url": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/relayResource" }, + "token_url": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/relayResource" } } }, "client": { + "x-registry-field": "property", "description": "eSignet relying-party identity and dedicated private-key reference.", "type": "object", "additionalProperties": false, "required": ["id", "signing_key", "signing_kid"], "properties": { - "id": { "$ref": "#/$defs/token256" }, - "signing_key": { "$ref": "#/$defs/secret" }, - "signing_kid": { "$ref": "#/$defs/token2048" } + "id": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/token256" }, + "signing_key": {"x-registry-field": "secret_reference_property", "$ref": "#/$defs/secret" }, + "signing_kid": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/token2048" } } }, "access_token": { + "x-registry-field": "property", "description": "Dedicated Notary access-token signing key and published key identifier.", "type": "object", "additionalProperties": false, "required": ["signing_key", "signing_kid"], "properties": { - "signing_key": { "$ref": "#/$defs/secret" }, - "signing_kid": { "$ref": "#/$defs/token2048" } + "signing_key": {"x-registry-field": "secret_reference_property", "$ref": "#/$defs/secret" }, + "signing_kid": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/token2048" } } }, - "sensitive_state_key": { "$ref": "#/$defs/secret" }, + "sensitive_state_key": {"x-registry-field": "secret_reference_property", "$ref": "#/$defs/secret" }, "subject": { + "x-registry-field": "property", "description": "Verified eSignet userinfo claim bound exactly to the credential subject identifier.", "type": "object", "additionalProperties": false, "required": ["token_claim", "id_type"], "properties": { - "token_claim": { "$ref": "#/$defs/token256" }, - "id_type": { "$ref": "#/$defs/token256" } + "token_claim": {"x-registry-field": "property", "$ref": "#/$defs/token256" }, + "id_type": {"x-registry-field": "property", "$ref": "#/$defs/token256" } } }, - "redirect_uri": { "$ref": "#/$defs/relayResource" }, + "redirect_uri": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/relayResource" }, "allowed_wallet_origins": { + "x-registry-field": "sensitive_property", "description": "Exact HTTPS browser origins admitted to the wallet-facing Notary routes.", "type": "array", "minItems": 1, "maxItems": 16, "uniqueItems": true, - "items": { "$ref": "#/$defs/origin" } + "items": {"x-registry-field": "sensitive_array_item", "$ref": "#/$defs/origin" } }, "tx_code": { + "x-registry-field": "property", "description": "Transaction-code policy. Omit for the secure required-PIN default. Set required=false only for a bounded bearer-offer interoperability profile; the compiler fixes the offer lifetime at 300 seconds.", "type": "object", "additionalProperties": false, - "properties": { "required": { "type": "boolean", "default": true } } + "properties": { "required": {"x-registry-field": "property", "type": "boolean", "default": true } } } } }, "privateCidrs": { "description": "Explicit private network ranges this source may resolve to.", "type": "array", "maxItems": 16, "uniqueItems": true, - "items": { "type": "string", "minLength": 3, "maxLength": 64 } + "items": {"x-registry-field": "sensitive_array_item", "type": "string", "minLength": 3, "maxLength": 64 } }, "ca": { "description": "Pinned certificate-authority file and its rotation generation.", "type": "object", "additionalProperties": false, "required": ["file", "generation"], - "properties": { "file": { "$ref": "#/$defs/absolutePath" }, "generation": { "type": "integer", "minimum": 1 } } + "properties": { "file": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/absolutePath" }, "generation": {"x-registry-field": "sensitive_property", "type": "integer", "minimum": 1, "maximum": 18446744073709551615 } } }, "mtls": { "description": "Client certificate and private-key reference for mutual TLS.", "type": "object", "additionalProperties": false, "required": ["certificate_file", "private_key", "generation"], - "properties": { "certificate_file": { "$ref": "#/$defs/absolutePath" }, "private_key": { "$ref": "#/$defs/secret" }, "generation": { "type": "integer", "minimum": 1 } } + "properties": { "certificate_file": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/absolutePath" }, "private_key": {"x-registry-field": "secret_reference_property", "$ref": "#/$defs/secret" }, "generation": {"x-registry-field": "sensitive_property", "type": "integer", "minimum": 1, "maximum": 18446744073709551615 } } }, "endpoint": { "description": "Security-bound HTTPS endpoint with optional private-network, CA, and mTLS policy.", "type": "object", "additionalProperties": false, "required": ["origin", "path", "generation"], "properties": { - "origin": { "$ref": "#/$defs/origin" }, - "path": { "type": "string", "minLength": 2, "maxLength": 4096, "pattern": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//)(?!.*[?#]).+$" }, - "allowed_private_cidrs": { "$ref": "#/$defs/privateCidrs" }, - "ca": { "$ref": "#/$defs/ca" }, - "mtls": { "$ref": "#/$defs/mtls" }, - "generation": { "type": "integer", "minimum": 1 } + "origin": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/origin" }, + "path": {"x-registry-field": "sensitive_property", "type": "string", "minLength": 2, "maxLength": 4096, "pattern": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//)(?!.*[?#]).+$" }, + "allowed_private_cidrs": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/privateCidrs" }, + "ca": {"x-registry-field": "property", "$ref": "#/$defs/ca" }, + "mtls": {"x-registry-field": "property", "$ref": "#/$defs/mtls" }, + "generation": {"x-registry-field": "sensitive_property", "type": "integer", "minimum": 1, "maximum": 18446744073709551615 } } }, "credential": { "description": "One supported source credential shape, containing references rather than values.", "oneOf": [ - { "type": "object", "additionalProperties": false, "required": ["username", "password", "generation"], "properties": { "username": { "$ref": "#/$defs/secret" }, "password": { "$ref": "#/$defs/secret" }, "generation": { "type": "integer", "minimum": 1 } } }, - { "type": "object", "additionalProperties": false, "required": ["token", "generation"], "properties": { "token": { "$ref": "#/$defs/secret" }, "generation": { "type": "integer", "minimum": 1 } } }, - { "type": "object", "additionalProperties": false, "required": ["client_id", "client_secret", "generation"], "properties": { "client_id": { "$ref": "#/$defs/secret" }, "client_secret": { "$ref": "#/$defs/secret" }, "generation": { "type": "integer", "minimum": 1 } } }, - { "type": "object", "additionalProperties": false, "required": ["value", "generation"], "properties": { "value": { "$ref": "#/$defs/secret" }, "generation": { "type": "integer", "minimum": 1 } } } + {"x-registry-field": "branch", "type": "object", "additionalProperties": false, "required": ["username", "password", "generation"], "properties": { "username": {"x-registry-field": "secret_reference_property", "$ref": "#/$defs/secret" }, "password": {"x-registry-field": "secret_reference_property", "$ref": "#/$defs/secret" }, "generation": {"x-registry-field": "sensitive_property", "type": "integer", "minimum": 1, "maximum": 18446744073709551615 } } }, + {"x-registry-field": "branch", "type": "object", "additionalProperties": false, "required": ["token", "generation"], "properties": { "token": {"x-registry-field": "secret_reference_property", "$ref": "#/$defs/secret" }, "generation": {"x-registry-field": "sensitive_property", "type": "integer", "minimum": 1, "maximum": 18446744073709551615 } } }, + {"x-registry-field": "branch", "type": "object", "additionalProperties": false, "required": ["client_id", "client_secret", "generation"], "properties": { "client_id": {"x-registry-field": "secret_reference_property", "$ref": "#/$defs/secret" }, "client_secret": {"x-registry-field": "secret_reference_property", "$ref": "#/$defs/secret" }, "generation": {"x-registry-field": "sensitive_property", "type": "integer", "minimum": 1, "maximum": 18446744073709551615 } } }, + {"x-registry-field": "branch", "type": "object", "additionalProperties": false, "required": ["value", "generation"], "properties": { "value": {"x-registry-field": "secret_reference_property", "$ref": "#/$defs/secret" }, "generation": {"x-registry-field": "sensitive_property", "type": "integer", "minimum": 1, "maximum": 18446744073709551615 } } } ] }, "provider": { "description": "Environment-specific physical provider for a materialized entity.", "oneOf": [ - { "type": "object", "additionalProperties": false, "required": ["type", "path"], "properties": { "type": { "const": "csv" }, "path": { "$ref": "#/$defs/absolutePath" }, "header_row": { "type": "integer", "minimum": 1 }, "delimiter": { "type": "integer", "minimum": 0, "maximum": 255 }, "quote": { "type": "integer", "minimum": 0, "maximum": 255 } } }, - { "type": "object", "additionalProperties": false, "required": ["type", "path", "sheet"], "properties": { "type": { "const": "xlsx" }, "path": { "$ref": "#/$defs/absolutePath" }, "sheet": { "type": "string", "minLength": 1, "maxLength": 256 }, "header_row": { "type": "integer", "minimum": 1 }, "data_range": { "type": "string", "minLength": 1, "maxLength": 256 } } }, - { "type": "object", "additionalProperties": false, "required": ["type", "path"], "properties": { "type": { "const": "parquet" }, "path": { "$ref": "#/$defs/absolutePath" } } }, - { "type": "object", "additionalProperties": false, "required": ["type", "connection", "schema", "table"], "properties": { "type": { "const": "postgres" }, "connection": { "$ref": "#/$defs/secret" }, "schema": { "$ref": "#/$defs/postgresIdentifier" }, "table": { "$ref": "#/$defs/postgresIdentifier" } } } + {"x-registry-field": "branch", "type": "object", "additionalProperties": false, "required": ["type", "path"], "properties": { "type": {"x-registry-field": "property", "const": "csv" }, "path": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/absolutePath" }, "header_row": {"x-registry-field": "property", "type": "integer", "minimum": 1, "maximum": 4294967295 }, "delimiter": {"x-registry-field": "property", "type": "integer", "minimum": 0, "maximum": 255 }, "quote": {"x-registry-field": "property", "type": "integer", "minimum": 0, "maximum": 255 } } }, + {"x-registry-field": "branch", "type": "object", "additionalProperties": false, "required": ["type", "path", "sheet"], "properties": { "type": {"x-registry-field": "property", "const": "xlsx" }, "path": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/absolutePath" }, "sheet": {"x-registry-field": "property", "type": "string", "minLength": 1, "maxLength": 256 }, "header_row": {"x-registry-field": "property", "type": "integer", "minimum": 1, "maximum": 4294967295 }, "data_range": {"x-registry-field": "property", "type": "string", "minLength": 1, "maxLength": 256 } } }, + {"x-registry-field": "branch", "type": "object", "additionalProperties": false, "required": ["type", "path"], "properties": { "type": {"x-registry-field": "property", "const": "parquet" }, "path": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/absolutePath" } } }, + {"x-registry-field": "branch", "type": "object", "additionalProperties": false, "required": ["type", "connection", "schema", "table"], "properties": { "type": {"x-registry-field": "property", "const": "postgres" }, "connection": {"x-registry-field": "secret_reference_property", "$ref": "#/$defs/secret" }, "schema": {"x-registry-field": "property", "$ref": "#/$defs/postgresIdentifier" }, "table": {"x-registry-field": "property", "$ref": "#/$defs/postgresIdentifier" } } } ] }, "entity": { "description": "Maps an authored entity to provider columns and immutable source-generation identifiers.", "type": "object", "additionalProperties": false, "required": ["provider", "columns", "source_revision", "generation"], - "properties": { "provider": { "$ref": "#/$defs/provider" }, "columns": { "type": "object", "minProperties": 1, "propertyNames": { "$ref": "#/$defs/stableId" }, "additionalProperties": { "$ref": "#/$defs/stableId" } }, "source_revision": { "type": "string", "minLength": 1, "maxLength": 256 }, "generation": { "type": "string", "minLength": 1, "maxLength": 256 } } + "properties": { "provider": {"x-registry-field": "property", "$ref": "#/$defs/provider" }, "columns": {"x-registry-field": "property", "type": "object", "minProperties": 1, "propertyNames": {"x-registry-field": "map_key", "$ref": "#/$defs/stableId" }, "additionalProperties": {"x-registry-field": "map_value", "$ref": "#/$defs/stableId" } }, "source_revision": {"x-registry-field": "sensitive_property", "type": "string", "minLength": 1, "maxLength": 256 }, "generation": {"x-registry-field": "sensitive_property", "type": "string", "minLength": 1, "maxLength": 256 } } }, "source": { "description": "Runtime source connection policy for one authored integration.", "type": "object", "additionalProperties": false, "required": ["origin"], "properties": { - "origin": { "$ref": "#/$defs/origin" }, - "allowed_private_cidrs": { "$ref": "#/$defs/privateCidrs" }, - "ca": { "$ref": "#/$defs/ca" }, - "mtls": { "$ref": "#/$defs/mtls" }, - "credential": { "$ref": "#/$defs/credential" }, - "oauth": { "$ref": "#/$defs/endpoint" }, - "jwks": { "$ref": "#/$defs/endpoint" }, - "rate": { "type": "object", "additionalProperties": false, "required": ["per_minute", "burst"], "properties": { "per_minute": { "type": "integer", "minimum": 1, "maximum": 60000 }, "burst": { "type": "integer", "minimum": 1, "maximum": 1024 } } }, - "concurrency": { "type": "integer", "minimum": 1, "maximum": 64 }, - "timeout": { "type": "string", "pattern": "^[1-9][0-9]*(?:ms|s)$" } + "origin": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/origin" }, + "allowed_private_cidrs": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/privateCidrs" }, + "ca": {"x-registry-field": "property", "$ref": "#/$defs/ca" }, + "mtls": {"x-registry-field": "property", "$ref": "#/$defs/mtls" }, + "credential": {"x-registry-field": "property", "$ref": "#/$defs/credential" }, + "oauth": {"x-registry-field": "property", "$ref": "#/$defs/endpoint" }, + "jwks": {"x-registry-field": "property", "$ref": "#/$defs/endpoint" }, + "rate": {"x-registry-field": "property", "type": "object", "additionalProperties": false, "required": ["per_minute", "burst"], "properties": { "per_minute": {"x-registry-field": "property", "type": "integer", "minimum": 1, "maximum": 60000 }, "burst": {"x-registry-field": "property", "type": "integer", "minimum": 1, "maximum": 1024 } } }, + "concurrency": {"x-registry-field": "property", "type": "integer", "minimum": 1, "maximum": 64 }, + "timeout": {"x-registry-field": "property", "type": "string", "pattern": "^[1-9][0-9]*(?:ms|s)$" } } }, "integration": { "description": "Environment binding for an authored source integration.", "type": "object", "additionalProperties": false, "required": ["source"], - "properties": { "source": { "$ref": "#/$defs/source" } } + "properties": { "source": {"x-registry-field": "property", "$ref": "#/$defs/source" } } }, - "service": { "type": "object", "additionalProperties": false, "description": "Binds an authored product role to a deployed service identifier.", "required": ["service"], "properties": { "service": { "$ref": "#/$defs/stableId" } } }, + "service": { "type": "object", "additionalProperties": false, "description": "Binds an authored product role to a deployed service identifier.", "required": ["service"], "properties": { "service": {"x-registry-field": "property", "$ref": "#/$defs/stableId" } } }, "token256": { "type": "string", "minLength": 1, "maxLength": 256, "pattern": "^[!-~]+$", "description": "Bounded visible-ASCII protocol token." }, "postgresIdentifier": { "type": "string", "pattern": "^[a-z][a-z0-9_]{0,62}$", "description": "Portable unquoted PostgreSQL schema or table identifier." }, "absolutePath": { "type": "string", "minLength": 2, "maxLength": 4096, "pattern": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$", "description": "Normalized absolute path without dot segments or duplicate separators." } diff --git a/crates/registryctl/schemas/project-authoring/fixture.schema.json b/crates/registryctl/schemas/project-authoring/fixture.schema.json index ca0df8fa6..441321e0a 100644 --- a/crates/registryctl/schemas/project-authoring/fixture.schema.json +++ b/crates/registryctl/schemas/project-authoring/fixture.schema.json @@ -1,4 +1,5 @@ { + "x-registry-field": "root", "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "https://registrystack.example/schemas/project-authoring/fixture.v1.json", "title": "Registry Stack project integration fixture v1", @@ -7,33 +8,42 @@ "additionalProperties": false, "required": ["name", "classification", "input", "interactions", "expect"], "properties": { - "name": { "type": "string", "minLength": 1, "maxLength": 256, "description": "Human-readable scenario name shown in test output.", "examples": ["existing household matches"] }, - "classification": { "const": "synthetic", "default": "synthetic", "description": "Declares that fixture data is synthetic and safe for offline testing." }, + "name": {"x-registry-field": "public_property", "type": "string", "minLength": 1, "maxLength": 256, "description": "Human-readable scenario name shown in test output.", "examples": ["existing household matches"] }, + "classification": {"x-registry-field": "public_property", "const": "synthetic", "description": "Declares that fixture data is synthetic and safe for offline testing." }, + "request": { + "x-registry-field": "redacted_fixture_property", + "$ref": "#/$defs/governedRequest", + "description": "Optional independently authored synthetic Notary request used to prove the request-to-consultation binding before Relay access." + }, "input": { + "x-registry-field": "redacted_fixture_property", "description": "Typed consultation inputs supplied to the adapter under test.", "type": "object", "minProperties": 1, "maxProperties": 16, - "propertyNames": { "pattern": "^[a-z][a-z0-9_]{0,63}$" }, + "propertyNames": {"x-registry-field": "redacted_fixture_map_key", "pattern": "^[a-z][a-z0-9_]{0,63}$" }, "additionalProperties": { + "x-registry-field": "redacted_fixture_map_value", "type": ["string", "boolean", "integer", "null"] } }, "variables": { + "x-registry-field": "redacted_fixture_property", "description": "Named date values available to deterministic fixture interpolation.", "type": "object", "maxProperties": 16, - "propertyNames": { "pattern": "^[a-z][a-z0-9._-]{0,95}$" }, - "additionalProperties": { "type": "string", "format": "date" } + "propertyNames": {"x-registry-field": "redacted_fixture_map_key", "pattern": "^[a-z][a-z0-9._-]{0,95}$" }, + "additionalProperties": {"x-registry-field": "redacted_fixture_map_value", "type": "string", "format": "date" } }, "interactions": { + "x-registry-field": "redacted_fixture_property", "description": "Ordered upstream request and response exchanges expected during execution.", "type": "array", "minItems": 1, "maxItems": 16, - "items": { "$ref": "#/$defs/interaction" } + "items": {"x-registry-field": "redacted_fixture_array_item", "$ref": "#/$defs/interaction" } }, - "expect": { "$ref": "#/$defs/expectation", "description": "Observable adapter result required for the scenario to pass." } + "expect": {"x-registry-field": "redacted_fixture_property", "$ref": "#/$defs/expectation", "description": "Observable adapter result required for the scenario to pass." } }, "examples": [ { @@ -50,14 +60,92 @@ } ], "$defs": { + "governedRequest": { + "description": "The same closed governed request shape accepted by project test --live.", + "type": "object", + "additionalProperties": false, + "required": ["target", "claims", "purpose"], + "properties": { + "target": {"x-registry-field": "redacted_fixture_property", "$ref": "#/$defs/governedTarget" }, + "variables": { + "x-registry-field": "redacted_fixture_property", + "description": "Supplies synthetic date variables to the governed evaluation request.", + "type": "object", + "maxProperties": 16, + "propertyNames": {"x-registry-field": "redacted_fixture_map_key", "pattern": "^[a-z][a-z0-9._-]{0,95}$" }, + "additionalProperties": {"x-registry-field": "redacted_fixture_map_value", "type": "string", "format": "date" } + }, + "claims": { + "x-registry-field": "redacted_fixture_property", + "description": "Lists the authored claims evaluated by this synthetic request witness.", + "type": "array", + "minItems": 1, + "maxItems": 64, + "items": {"x-registry-field": "redacted_fixture_array_item", "$ref": "#/$defs/governedClaimRef" } + }, + "disclosure": {"x-registry-field": "redacted_fixture_property", "type": "string", "description": "Selects the disclosure mode requested from the authored claim policy." }, + "format": {"x-registry-field": "redacted_fixture_property", "type": "string", "description": "Selects the claim-result media type requested from the governed Notary path." }, + "purpose": {"x-registry-field": "redacted_fixture_property", "type": "string", "minLength": 1, "maxLength": 256, "description": "Names the authored service purpose exercised by this synthetic request witness." } + } + }, + "governedTarget": { + "description": "The synthetic subject target presented to the same governed request boundary as a live Notary evaluation.", + "type": "object", + "additionalProperties": false, + "required": ["type"], + "properties": { + "type": {"x-registry-field": "redacted_fixture_property", "type": "string", "minLength": 1, "maxLength": 64, "description": "Names the authored target entity type used for claim evaluation." }, + "id": {"x-registry-field": "redacted_fixture_property", "type": "string", "description": "Supplies an optional synthetic direct target identifier." }, + "identifiers": { + "x-registry-field": "redacted_fixture_property", + "description": "Supplies independently authored synthetic identifiers for consultation input mapping.", + "type": "array", + "maxItems": 16, + "items": {"x-registry-field": "redacted_fixture_array_item", "$ref": "#/$defs/governedIdentifier" } + }, + "attributes": { + "x-registry-field": "redacted_fixture_property", + "description": "Supplies independently authored typed target attributes for consultation input mapping.", + "type": "object", + "maxProperties": 16, + "additionalProperties": {"x-registry-field": "redacted_fixture_map_value", "type": ["string", "boolean", "integer", "null"] } + } + } + }, + "governedIdentifier": { + "description": "One synthetic target identifier with an authored scheme and string value.", + "type": "object", + "additionalProperties": false, + "required": ["scheme", "value"], + "properties": { + "scheme": {"x-registry-field": "redacted_fixture_property", "type": "string", "minLength": 1, "maxLength": 96, "description": "Names the authored identifier scheme selected by a consultation input mapping." }, + "value": {"x-registry-field": "redacted_fixture_property", "type": "string", "description": "Supplies the synthetic string value bound to this identifier scheme." } + } + }, + "governedClaimRef": { + "description": "A requested claim ID, optionally pinned to one authored claim version.", + "oneOf": [ + {"x-registry-field": "branch", "type": "string"}, + { + "x-registry-field": "branch", + "type": "object", + "additionalProperties": false, + "required": ["id"], + "properties": { + "id": {"x-registry-field": "redacted_fixture_property", "type": "string", "description": "Names one authored claim requested by this fixture witness."}, + "version": {"x-registry-field": "redacted_fixture_property", "type": "string", "description": "Pins the requested claim to one authored claim-policy version."} + } + } + ] + }, "interaction": { "description": "One expected upstream request paired with its synthetic response.", "type": "object", "additionalProperties": false, "required": ["expect", "respond"], "properties": { - "expect": { "$ref": "#/$defs/request" }, - "respond": { "$ref": "#/$defs/response" } + "expect": {"x-registry-field": "redacted_fixture_property", "$ref": "#/$defs/request" }, + "respond": {"x-registry-field": "redacted_fixture_property", "$ref": "#/$defs/response" } } }, "request": { @@ -66,54 +154,89 @@ "additionalProperties": false, "required": ["method", "path"], "properties": { - "method": { "enum": ["GET", "POST"] }, - "path": { "type": "string", "minLength": 1, "maxLength": 4096, "pattern": "^/[^?#]*$" }, + "method": {"x-registry-field": "redacted_fixture_property", "enum": ["GET", "POST"] }, + "path": {"x-registry-field": "redacted_fixture_property", "type": "string", "minLength": 1, "maxLength": 4096, "pattern": "^/[^?#]*$" }, "query": { + "x-registry-field": "redacted_fixture_property", "type": "object", "maxProperties": 64, "additionalProperties": { + "x-registry-field": "redacted_fixture_map_value", "oneOf": [ - { "type": ["string", "boolean", "integer", "null"] }, + {"x-registry-field": "branch", "type": ["string", "boolean", "integer", "null"] }, { + "x-registry-field": "branch", "type": "array", "maxItems": 64, - "items": { "type": ["string", "boolean", "integer", "null"] } + "items": {"x-registry-field": "redacted_fixture_array_item", "type": ["string", "boolean", "integer", "null"] } } ] } }, "headers": { + "x-registry-field": "redacted_fixture_property", "type": "object", "maxProperties": 32, - "propertyNames": { "pattern": "^[A-Za-z][A-Za-z0-9-]{0,63}$" }, - "additionalProperties": { "type": "string", "maxLength": 8192 } + "propertyNames": {"x-registry-field": "redacted_fixture_map_key", "pattern": "^[A-Za-z][A-Za-z0-9-]{0,63}$" }, + "additionalProperties": {"x-registry-field": "redacted_fixture_map_value", "type": "string", "maxLength": 8192 } }, - "body": true + "body": {"x-registry-field": "redacted_fixture_property", "$ref": "#/$defs/fixtureBody" } } }, "response": { "description": "Synthetic HTTP response or timeout returned to the adapter.", "oneOf": [ { + "x-registry-field": "branch", "type": "object", "additionalProperties": false, "required": ["status"], "properties": { - "status": { "type": "integer", "minimum": 100, "maximum": 599 }, + "status": {"x-registry-field": "redacted_fixture_property", "type": "integer", "minimum": 100, "maximum": 599 }, "headers": { + "x-registry-field": "redacted_fixture_property", "type": "object", "maxProperties": 32, - "additionalProperties": { "type": "string", "maxLength": 8192 } + "additionalProperties": {"x-registry-field": "redacted_fixture_map_value", "type": "string", "maxLength": 8192 } }, - "body": true + "body": {"x-registry-field": "redacted_fixture_property", "$ref": "#/$defs/fixtureBody" } } }, { + "x-registry-field": "branch", "type": "object", "additionalProperties": false, "required": ["timeout"], "properties": { - "timeout": { "type": "string", "pattern": "^[1-9][0-9]*(?:ms|s)$" } + "timeout": {"x-registry-field": "redacted_fixture_property", "type": "string", "pattern": "^[1-9][0-9]*(?:ms|s)$" } + } + } + ] + }, + "fixtureBody": { + "description": "Inline JSON, or an exact closed reference to a strict JSON file below the fixture bodies directory. The top-level file key is reserved for file references.", + "oneOf": [ + { + "x-registry-field": "branch", + "type": "object", + "additionalProperties": false, + "required": ["file"], + "properties": { + "file": { + "x-registry-field": "redacted_fixture_property", + "type": "string", + "minLength": 8, + "maxLength": 4096, + "pattern": "^bodies/(?!\\.\\.?/)(?!.*(?:/)\\.\\.?/)(?!.*//).+$" + } + } + }, + { + "x-registry-field": "branch", + "not": { + "x-registry-field": "branch", + "type": "object", + "required": ["file"] } } ] @@ -124,10 +247,10 @@ "additionalProperties": false, "minProperties": 1, "properties": { - "outcome": { "enum": ["match", "no_match", "ambiguous"] }, - "outputs": { "type": "object", "maxProperties": 64 }, - "claims": { "type": "object", "maxProperties": 64 }, - "error": { "type": "string", "minLength": 1, "maxLength": 256 } + "outcome": {"x-registry-field": "redacted_fixture_property", "enum": ["match", "no_match", "ambiguous"] }, + "outputs": {"x-registry-field": "redacted_fixture_property", "type": "object", "maxProperties": 64 }, + "claims": {"x-registry-field": "redacted_fixture_property", "type": "object", "maxProperties": 64 }, + "error": {"x-registry-field": "redacted_fixture_property", "type": "string", "minLength": 1, "maxLength": 256 } } } } diff --git a/crates/registryctl/schemas/project-authoring/integration.schema.json b/crates/registryctl/schemas/project-authoring/integration.schema.json index 0745a4733..1983635f6 100644 --- a/crates/registryctl/schemas/project-authoring/integration.schema.json +++ b/crates/registryctl/schemas/project-authoring/integration.schema.json @@ -1,4 +1,5 @@ { + "x-registry-field": "root", "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "https://registrystack.example/schemas/project-authoring/integration.v1.json", "title": "Registry Stack project integration v1", @@ -7,45 +8,50 @@ "additionalProperties": false, "required": ["version", "id", "revision", "input", "capability", "outputs"], "properties": { - "version": { "const": 1, "default": 1, "description": "Integration authoring format version." }, - "id": { "$ref": "#/$defs/stableId", "description": "Stable project-local identifier for the integration." }, - "revision": { "type": "integer", "minimum": 1, "description": "Monotonically increasing revision of this integration contract.", "examples": [1] }, - "source": { "$ref": "#/$defs/source", "description": "Optional source product metadata and transport policy; capabilities remain product-neutral." }, + "version": {"x-registry-field": "public_property", "const": 1, "description": "Integration authoring format version." }, + "id": {"x-registry-field": "property", "$ref": "#/$defs/stableId", "description": "Stable project-local identifier for the integration." }, + "revision": {"x-registry-field": "property", "type": "integer", "minimum": 1, "maximum": 4294967295, "description": "Monotonically increasing revision of this integration contract.", "examples": [1] }, + "source": {"x-registry-field": "property", "$ref": "#/$defs/source", "description": "Optional source product metadata and transport policy; capabilities remain product-neutral." }, "input": { + "x-registry-field": "property", "description": "Typed selector and parameter inputs accepted by this integration.", "type": "object", "minProperties": 1, "maxProperties": 16, - "propertyNames": { "$ref": "#/$defs/inputName" }, - "additionalProperties": { "$ref": "#/$defs/input" } + "propertyNames": {"x-registry-field": "map_key", "$ref": "#/$defs/inputName" }, + "additionalProperties": {"x-registry-field": "map_value", "$ref": "#/$defs/input" } }, - "capability": { "$ref": "#/$defs/capability", "description": "Exactly one bounded execution mechanism for the source adaptation." }, + "capability": {"x-registry-field": "property", "$ref": "#/$defs/capability", "description": "Exactly one bounded execution mechanism for the source adaptation." }, "outputs": { + "x-registry-field": "property", "description": "Named typed outputs, or a shorthand list of output names inferred by the authoring compiler.", "oneOf": [ { + "x-registry-field": "branch", "type": "object", "minProperties": 1, "maxProperties": 64, "propertyNames": { + "x-registry-field": "map_key", "allOf": [ - { "$ref": "#/$defs/inputName" }, - { "not": { "enum": ["matched", "outcome"] } } + {"x-registry-field": "branch", "$ref": "#/$defs/inputName" }, + {"x-registry-field": "branch", "not": {"x-registry-field": "branch", "enum": ["matched", "outcome"] } } ] }, - "additionalProperties": { "$ref": "#/$defs/output" } + "additionalProperties": {"x-registry-field": "map_value", "$ref": "#/$defs/output" } }, { + "x-registry-field": "branch", "type": "array", "minItems": 1, "maxItems": 64, "uniqueItems": true, - "items": { "$ref": "#/$defs/inputName" } + "items": {"x-registry-field": "array_item", "$ref": "#/$defs/inputName" } } ] }, - "limits": { "$ref": "#/$defs/limits", "description": "Optional tighter resource limits for one integration execution." }, - "not_applicable": { "$ref": "#/$defs/notApplicable", "description": "Explicit rationale and request-fixture evidence for a normally required outcome that the source contract cannot produce." } + "limits": {"x-registry-field": "property", "$ref": "#/$defs/limits", "description": "Optional tighter resource limits for one integration execution." }, + "not_applicable": {"x-registry-field": "property", "$ref": "#/$defs/notApplicable", "description": "Explicit rationale and request-fixture evidence for a normally required outcome that the source contract cannot produce." } }, "examples": [ { @@ -70,8 +76,8 @@ "additionalProperties": false, "minProperties": 1, "properties": { - "ambiguity": { "$ref": "#/$defs/notApplicableReason", "description": "Why the reviewed source contract cannot produce more than one matching record." }, - "subject_mismatch": { "$ref": "#/$defs/notApplicableReason", "description": "Why the reviewed response contract contains no identifier comparable with a requested selector." } + "ambiguity": {"x-registry-field": "property", "$ref": "#/$defs/notApplicableReason", "description": "Why the reviewed source contract cannot produce more than one matching record." }, + "subject_mismatch": {"x-registry-field": "property", "$ref": "#/$defs/notApplicableReason", "description": "Why the reviewed response contract contains no identifier comparable with a requested selector." } } }, "notApplicableReason": { @@ -80,8 +86,8 @@ "additionalProperties": false, "required": ["rationale", "request_fixture"], "properties": { - "rationale": { "type": "string", "minLength": 24, "maxLength": 512, "description": "Why the named normally required outcome cannot occur for this source contract." }, - "request_fixture": { "$ref": "#/$defs/stableId", "description": "Fixture name containing the supporting bounded source request." } + "rationale": {"x-registry-field": "property", "type": "string", "minLength": 24, "maxLength": 512, "description": "Why the named normally required outcome cannot occur for this source contract." }, + "request_fixture": {"x-registry-field": "property", "$ref": "#/$defs/stableId", "description": "Fixture name containing the supporting bounded source request." } } }, "stableId": { @@ -104,19 +110,20 @@ "byteSize": { "description": "Positive byte count expressed as an integer or a KiB/MiB quantity.", "oneOf": [ - { "type": "integer", "minimum": 1 }, - { "type": "string", "pattern": "^[1-9][0-9]*(?:KiB|MiB)$" } + {"x-registry-field": "branch", "type": "integer", "minimum": 1, "maximum": 18446744073709551615 }, + {"x-registry-field": "branch", "type": "string", "pattern": "^[1-9][0-9]*(?:KiB|MiB)$" } ] }, "scalarType": { "description": "Supported scalar type, optionally paired with null for nullable values.", "oneOf": [ - { "enum": ["string", "boolean", "integer"] }, + {"x-registry-field": "branch", "enum": ["string", "boolean", "integer"] }, { + "x-registry-field": "branch", "type": "array", "prefixItems": [ - { "enum": ["string", "boolean", "integer"] }, - { "const": "null" } + {"x-registry-field": "array_item", "enum": ["string", "boolean", "integer"] }, + {"x-registry-field": "array_item", "const": "null" } ], "minItems": 2, "maxItems": 2, @@ -130,15 +137,15 @@ "additionalProperties": false, "required": ["role", "type"], "properties": { - "role": { "enum": ["selector", "parameter"] }, - "type": { "$ref": "#/$defs/scalarType" }, - "format": { "const": "date" }, - "maxLength": { "type": "integer", "minimum": 1, "maximum": 16384 }, - "minLength": { "type": "integer", "minimum": 0, "maximum": 16384 }, - "pattern": { "type": "string", "minLength": 1, "maxLength": 16384 }, - "minimum": { "type": "integer" }, - "maximum": { "type": "integer" }, - "canonicalization": { "enum": ["identity", "ascii_lowercase"] } + "role": {"x-registry-field": "property", "enum": ["selector", "parameter"] }, + "type": {"x-registry-field": "property", "$ref": "#/$defs/scalarType" }, + "format": {"x-registry-field": "property", "const": "date" }, + "maxLength": {"x-registry-field": "property", "type": "integer", "minimum": 1, "maximum": 16384 }, + "minLength": {"x-registry-field": "property", "type": "integer", "minimum": 0, "maximum": 16384 }, + "pattern": {"x-registry-field": "property", "type": "string", "minLength": 1, "maxLength": 16384 }, + "minimum": {"x-registry-field": "property", "type": "integer", "minimum": -9223372036854775808, "maximum": 9223372036854775807 }, + "maximum": {"x-registry-field": "property", "type": "integer", "minimum": -9223372036854775808, "maximum": 9223372036854775807 }, + "canonicalization": {"x-registry-field": "property", "enum": ["identity", "ascii_lowercase"] } } }, "versions": { @@ -146,12 +153,12 @@ "type": "object", "additionalProperties": false, "properties": { - "tested": { "$ref": "#/$defs/versionList" }, - "unverified": { "$ref": "#/$defs/versionList" } + "tested": {"x-registry-field": "property", "$ref": "#/$defs/versionList" }, + "unverified": {"x-registry-field": "property", "$ref": "#/$defs/versionList" } }, "anyOf": [ - { "required": ["tested"], "properties": { "tested": { "minItems": 1 } } }, - { "required": ["unverified"], "properties": { "unverified": { "minItems": 1 } } } + {"x-registry-field": "branch", "required": ["tested"], "properties": { "tested": {"x-registry-field": "property", "minItems": 1 } } }, + {"x-registry-field": "branch", "required": ["unverified"], "properties": { "unverified": {"x-registry-field": "property", "minItems": 1 } } } ] }, "versionList": { @@ -159,50 +166,54 @@ "type": "array", "maxItems": 32, "uniqueItems": true, - "items": { "type": "string", "minLength": 1, "maxLength": 256 } + "items": {"x-registry-field": "array_item", "type": "string", "minLength": 1, "maxLength": 256 } }, "credential": { "description": "Authentication mechanism expected by the source adapter, without environment secret values.", "oneOf": [ { + "x-registry-field": "branch", "type": "object", "additionalProperties": false, "required": ["type"], "properties": { - "type": { "enum": ["none", "basic", "static_bearer"] } + "type": {"x-registry-field": "property", "enum": ["none", "basic", "static_bearer"] } } }, { + "x-registry-field": "branch", "type": "object", "additionalProperties": false, "required": ["type", "name", "max_value_bytes"], "properties": { - "type": { "const": "api_key_header" }, - "name": { "type": "string", "pattern": "^[A-Za-z][A-Za-z0-9_-]{0,63}$" }, - "max_value_bytes": { "type": "integer", "minimum": 1, "maximum": 4096 } + "type": {"x-registry-field": "property", "const": "api_key_header" }, + "name": {"x-registry-field": "property", "type": "string", "pattern": "^[A-Za-z][A-Za-z0-9_-]{0,63}$" }, + "max_value_bytes": {"x-registry-field": "property", "type": "integer", "minimum": 1, "maximum": 4096 } } }, { + "x-registry-field": "branch", "type": "object", "additionalProperties": false, "required": ["type", "name", "max_value_bytes"], "properties": { - "type": { "const": "api_key_query" }, - "name": { "type": "string", "pattern": "^[A-Za-z_][A-Za-z0-9._:~-]{0,95}$" }, - "max_value_bytes": { "type": "integer", "minimum": 1, "maximum": 4096 } + "type": {"x-registry-field": "property", "const": "api_key_query" }, + "name": {"x-registry-field": "property", "type": "string", "pattern": "^[A-Za-z_][A-Za-z0-9._:~-]{0,95}$" }, + "max_value_bytes": {"x-registry-field": "property", "type": "integer", "minimum": 1, "maximum": 4096 } } }, { + "x-registry-field": "branch", "type": "object", "additionalProperties": false, "required": ["type", "request", "response_profile"], "properties": { - "type": { "const": "oauth2_client_credentials" }, - "request": { "enum": ["form", "json"] }, - "response_profile": { "const": "oauth2_bearer" }, - "scope": { "type": "string", "minLength": 1, "maxLength": 1024 }, - "audience": { "type": "string", "minLength": 1, "maxLength": 2048 }, - "refresh_skew": { "type": "string", "pattern": "^[1-9][0-9]*(?:ms|s)$" } + "type": {"x-registry-field": "property", "const": "oauth2_client_credentials" }, + "request": {"x-registry-field": "property", "enum": ["form", "json"] }, + "response_profile": {"x-registry-field": "property", "const": "oauth2_bearer" }, + "scope": {"x-registry-field": "property", "type": "string", "minLength": 1, "maxLength": 1024 }, + "audience": {"x-registry-field": "sensitive_property", "type": "string", "minLength": 1, "maxLength": 2048 }, + "refresh_skew": {"x-registry-field": "property", "type": "string", "pattern": "^[1-9][0-9]*(?:ms|s)$" } } } ] @@ -213,14 +224,15 @@ "additionalProperties": false, "required": ["method", "path"], "properties": { - "method": { "enum": ["GET", "POST"] }, + "method": {"x-registry-field": "property", "enum": ["GET", "POST"] }, "path": { + "x-registry-field": "sensitive_property", "type": "string", "minLength": 1, "maxLength": 4096, "pattern": "^/[^?#]*$" }, - "semantics": { "const": "read_only" } + "semantics": {"x-registry-field": "property", "const": "read_only" } } }, "source": { @@ -229,36 +241,40 @@ "additionalProperties": false, "required": ["auth"], "properties": { - "product": { "type": "string", "minLength": 1, "maxLength": 256 }, - "versions": { "$ref": "#/$defs/versions" }, - "auth": { "$ref": "#/$defs/credential" }, + "product": {"x-registry-field": "property", "type": "string", "minLength": 1, "maxLength": 256 }, + "versions": {"x-registry-field": "property", "$ref": "#/$defs/versions" }, + "auth": {"x-registry-field": "property", "$ref": "#/$defs/credential" }, "allow": { + "x-registry-field": "property", "type": "array", "minItems": 1, "maxItems": 16, - "items": { "$ref": "#/$defs/allowRule" } + "items": {"x-registry-field": "array_item", "$ref": "#/$defs/allowRule" } }, "request_headers": { + "x-registry-field": "property", "type": "array", "maxItems": 32, "uniqueItems": true, - "items": { "type": "string", "pattern": "^[A-Za-z][A-Za-z0-9-]{0,63}$" } + "items": {"x-registry-field": "array_item", "type": "string", "pattern": "^[A-Za-z][A-Za-z0-9-]{0,63}$" } }, "response_headers": { + "x-registry-field": "property", "type": "array", "maxItems": 32, "uniqueItems": true, - "items": { "type": "string", "pattern": "^[A-Za-z][A-Za-z0-9-]{0,63}$" } + "items": {"x-registry-field": "array_item", "type": "string", "pattern": "^[A-Za-z][A-Za-z0-9-]{0,63}$" } }, "response": { + "x-registry-field": "property", "type": "object", "additionalProperties": false, "properties": { - "format": { "enum": ["json", "text"] }, - "max_bytes": { "$ref": "#/$defs/byteSize" } + "format": {"x-registry-field": "property", "enum": ["json", "text"] }, + "max_bytes": {"x-registry-field": "property", "$ref": "#/$defs/byteSize" } } }, - "protocol": { "$ref": "#/$defs/protocol" } + "protocol": {"x-registry-field": "property", "$ref": "#/$defs/protocol" } } }, "protocol": { @@ -267,26 +283,29 @@ "additionalProperties": false, "properties": { "signed_dci": { + "x-registry-field": "property", "type": "object", "additionalProperties": false, "required": ["profile", "path", "jwks_profile", "sender", "receiver", "registry_type", "record_type", "locale", "selectors"], "properties": { - "profile": { "const": "dci-search-v1" }, - "path": { "type": "string", "pattern": "^/[^?#]*$" }, - "jwks_profile": { "const": "rsa-signing-jwks-v1" }, - "sender": { "type": "string", "minLength": 1, "maxLength": 256 }, - "receiver": { "type": "string", "minLength": 1, "maxLength": 256 }, - "registry_type": { "type": "string", "minLength": 1, "maxLength": 128 }, - "record_type": { "type": "string", "minLength": 1, "maxLength": 128 }, - "locale": { "type": "string", "pattern": "^[A-Za-z]{2,8}(?:-[A-Za-z0-9]{1,8})*$" }, + "profile": {"x-registry-field": "property", "const": "dci-search-v1" }, + "path": {"x-registry-field": "sensitive_property", "type": "string", "pattern": "^/[^?#]*$" }, + "jwks_profile": {"x-registry-field": "property", "const": "rsa-signing-jwks-v1" }, + "sender": {"x-registry-field": "property", "type": "string", "minLength": 1, "maxLength": 256 }, + "receiver": {"x-registry-field": "property", "type": "string", "minLength": 1, "maxLength": 256 }, + "registry_type": {"x-registry-field": "property", "type": "string", "minLength": 1, "maxLength": 128 }, + "record_type": {"x-registry-field": "property", "type": "string", "minLength": 1, "maxLength": 128 }, + "locale": {"x-registry-field": "property", "type": "string", "pattern": "^[A-Za-z]{2,8}(?:-[A-Za-z0-9]{1,8})*$" }, "selectors": { + "x-registry-field": "property", "type": "object", "minProperties": 1, "maxProperties": 8, - "propertyNames": { "$ref": "#/$defs/inputName" }, + "propertyNames": {"x-registry-field": "map_key", "$ref": "#/$defs/inputName" }, "additionalProperties": { + "x-registry-field": "map_value", "type": "object", "additionalProperties": false, "required": ["field", "response_pointer"], "properties": { - "field": { "type": "string", "minLength": 1, "maxLength": 160 }, - "response_pointer": { "type": "string", "pattern": "^/(?:[^/~]|~[01])+(?:/(?:[^/~]|~[01])+)*$" } + "field": {"x-registry-field": "property", "type": "string", "minLength": 1, "maxLength": 160 }, + "response_pointer": {"x-registry-field": "property", "type": "string", "pattern": "^/(?:[^/~]|~[01])+(?:/(?:[^/~]|~[01])+)*$" } } } } @@ -300,13 +319,13 @@ "type": "object", "additionalProperties": false, "required": ["input"], - "properties": { "input": { "$ref": "#/$defs/inputName" } } + "properties": { "input": {"x-registry-field": "property", "$ref": "#/$defs/inputName" } } }, "inputOrLiteral": { "description": "Request value supplied from a declared input or an authored scalar literal.", "oneOf": [ - { "$ref": "#/$defs/inputReference" }, - { "type": ["string", "boolean", "integer"] } + {"x-registry-field": "branch", "$ref": "#/$defs/inputReference" }, + {"x-registry-field": "branch", "type": ["string", "boolean", "integer"] } ] }, "httpRequest": { @@ -315,12 +334,12 @@ "additionalProperties": false, "required": ["method", "path"], "properties": { - "method": { "enum": ["GET", "POST"] }, - "path": { "type": "string", "minLength": 1, "maxLength": 4096, "pattern": "^/[^?#]*$" }, - "semantics": { "const": "read_only" }, - "query": { "type": "object", "maxProperties": 64, "additionalProperties": { "$ref": "#/$defs/inputOrLiteral" } }, - "headers": { "type": "object", "maxProperties": 32, "additionalProperties": { "$ref": "#/$defs/inputOrLiteral" } }, - "body": true + "method": {"x-registry-field": "property", "enum": ["GET", "POST"] }, + "path": {"x-registry-field": "sensitive_property", "type": "string", "minLength": 1, "maxLength": 4096, "pattern": "^/[^?#]*$" }, + "semantics": {"x-registry-field": "property", "const": "read_only" }, + "query": {"x-registry-field": "property", "type": "object", "maxProperties": 64, "additionalProperties": {"x-registry-field": "map_value", "$ref": "#/$defs/inputOrLiteral" } }, + "headers": {"x-registry-field": "property", "type": "object", "maxProperties": 32, "additionalProperties": {"x-registry-field": "map_value", "$ref": "#/$defs/inputOrLiteral" } }, + "body": { "x-registry-field": "property" } } }, "httpResponse": { @@ -329,25 +348,29 @@ "additionalProperties": false, "properties": { "no_match": { + "x-registry-field": "property", "type": "array", "uniqueItems": true, - "items": { "type": "integer", "minimum": 100, "maximum": 599 } + "items": {"x-registry-field": "array_item", "type": "integer", "minimum": 100, "maximum": 599 } }, "ambiguous": { + "x-registry-field": "property", "type": "array", "uniqueItems": true, - "items": { "type": "integer", "minimum": 100, "maximum": 599 } + "items": {"x-registry-field": "array_item", "type": "integer", "minimum": 100, "maximum": 599 } }, "shape": { + "x-registry-field": "property", "oneOf": [ - { "const": "singleton" }, + {"x-registry-field": "branch", "const": "singleton" }, { + "x-registry-field": "branch", "type": "object", "additionalProperties": false, "required": ["records", "cardinality"], "properties": { - "records": { "type": "string", "pattern": "^/(?:[^/~]|~[01])+(?:/(?:[^/~]|~[01])+)*$" }, - "cardinality": { "const": "probe_two" } + "records": {"x-registry-field": "property", "type": "string", "pattern": "^/(?:[^/~]|~[01])+(?:/(?:[^/~]|~[01])+)*$" }, + "cardinality": {"x-registry-field": "property", "const": "probe_two" } } } ] @@ -358,60 +381,68 @@ "description": "Closed choice among direct HTTP, Rhai script, and exact snapshot execution.", "oneOf": [ { + "x-registry-field": "branch", "type": "object", "additionalProperties": false, "required": ["http"], "properties": { "http": { + "x-registry-field": "property", "type": "object", "additionalProperties": false, "required": ["request"], "properties": { - "request": { "$ref": "#/$defs/httpRequest" }, - "response": { "$ref": "#/$defs/httpResponse" } + "request": {"x-registry-field": "property", "$ref": "#/$defs/httpRequest" }, + "response": {"x-registry-field": "property", "$ref": "#/$defs/httpResponse" } } } } }, { + "x-registry-field": "branch", "type": "object", "additionalProperties": false, "required": ["script"], "properties": { "script": { + "x-registry-field": "property", "type": "object", "additionalProperties": false, "required": ["file"], "properties": { - "file": { "$ref": "#/$defs/relativePath" }, + "file": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/relativePath" }, "modules": { + "x-registry-field": "sensitive_property", "type": "array", "maxItems": 32, "uniqueItems": true, - "items": { "$ref": "#/$defs/relativePath" } + "items": {"x-registry-field": "array_item", "$ref": "#/$defs/relativePath" } } } } } }, { + "x-registry-field": "branch", "type": "object", "additionalProperties": false, "required": ["snapshot"], "properties": { "snapshot": { + "x-registry-field": "property", "type": "object", "additionalProperties": false, "required": ["entity", "exact", "freshness"], "properties": { - "entity": { "$ref": "#/$defs/stableId" }, + "entity": {"x-registry-field": "property", "$ref": "#/$defs/stableId" }, "exact": { + "x-registry-field": "property", "type": "object", "minProperties": 1, "maxProperties": 8, - "additionalProperties": { "$ref": "#/$defs/inputReference" } + "additionalProperties": {"x-registry-field": "map_value", "$ref": "#/$defs/inputReference" } }, - "freshness": { "type": "string", "pattern": "^[1-9][0-9]*(?:ms|s|m|h|d)$" } + "freshness": {"x-registry-field": "property", "type": "string", "pattern": "^[1-9][0-9]*(?:ms|s|m|h|d)$" } } } } @@ -424,12 +455,13 @@ "additionalProperties": false, "required": ["type"], "properties": { - "type": { "$ref": "#/$defs/scalarType" }, - "format": { "const": "date" }, - "maxLength": { "type": "integer", "minimum": 1, "maximum": 16384 }, - "minimum": { "type": "integer" }, - "maximum": { "type": "integer" }, + "type": {"x-registry-field": "property", "$ref": "#/$defs/scalarType" }, + "format": {"x-registry-field": "property", "const": "date" }, + "maxLength": {"x-registry-field": "property", "type": "integer", "minimum": 1, "maximum": 16384 }, + "minimum": {"x-registry-field": "property", "type": "integer", "minimum": -9223372036854775808, "maximum": 9223372036854775807 }, + "maximum": {"x-registry-field": "property", "type": "integer", "minimum": -9223372036854775808, "maximum": 9223372036854775807 }, "x-registry-source": { + "x-registry-field": "property", "type": "string", "pattern": "^/(?:[^/~]|~[01])+(?:/(?:[^/~]|~[01])+)*$" } @@ -440,10 +472,10 @@ "type": "object", "additionalProperties": false, "properties": { - "calls": { "type": "integer", "minimum": 1, "maximum": 16 }, - "request_bytes": { "$ref": "#/$defs/byteSize" }, - "source_bytes": { "$ref": "#/$defs/byteSize" }, - "deadline": { "type": "string", "pattern": "^[1-9][0-9]*(?:ms|s)$" } + "calls": {"x-registry-field": "property", "type": "integer", "minimum": 1, "maximum": 16 }, + "request_bytes": {"x-registry-field": "property", "$ref": "#/$defs/byteSize" }, + "source_bytes": {"x-registry-field": "property", "$ref": "#/$defs/byteSize" }, + "deadline": {"x-registry-field": "property", "type": "string", "pattern": "^[1-9][0-9]*(?:ms|s)$" } } } } diff --git a/crates/registryctl/schemas/project-authoring/parity-coverage.json b/crates/registryctl/schemas/project-authoring/parity-coverage.json new file mode 100644 index 000000000..734e511a6 --- /dev/null +++ b/crates/registryctl/schemas/project-authoring/parity-coverage.json @@ -0,0 +1,839 @@ +{ + "version": 1, + "schemas": [ + { + "kind": "project", + "file": "project.schema.json" + }, + { + "kind": "environment", + "file": "environment.schema.json" + }, + { + "kind": "integration", + "file": "integration.schema.json" + }, + { + "kind": "fixture", + "file": "fixture.schema.json" + }, + { + "kind": "entity", + "file": "entity.schema.json" + } + ], + "field_knowledge": { + "version": 1, + "defaults": { + "introduced_in": "0.13.0", + "availability": "published", + "stability": "experimental", + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ] + }, + "schema_domains": [ + { + "schema": "project", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "products": ["registryctl", "relay", "notary", "editor", "docs"], + "migration": "rebuild_project", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ] + }, + { + "schema": "environment", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "products": ["registryctl", "relay", "notary", "editor", "docs"], + "migration": "coordinate_deployment", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ] + }, + { + "schema": "integration", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "products": ["registryctl", "relay", "notary", "editor", "docs"], + "migration": "rebuild_project", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ] + }, + { + "schema": "fixture", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "products": ["registryctl", "editor", "docs"], + "migration": "update_fixtures", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ] + }, + { + "schema": "entity", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "products": ["registryctl", "relay", "editor", "docs"], + "migration": "rebuild_project", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ] + } + ], + "classifications": [ + { + "id": "root", + "path_kind": "root", + "sensitivity": "structural", + "review_classes": ["contract", "documentation"], + "semantic_rules": ["knowledge_only"] + }, + { + "id": "public_property", + "path_kind": "property", + "sensitivity": "public", + "review_classes": ["contract", "documentation"], + "semantic_rules": ["knowledge_only"] + }, + { + "id": "property", + "path_kind": "property", + "sensitivity": "internal", + "review_classes": ["contract", "documentation"], + "semantic_rules": ["knowledge_only"] + }, + { + "id": "sensitive_property", + "path_kind": "property", + "sensitivity": "sensitive", + "review_classes": ["security", "privacy"], + "semantic_rules": ["sensitive_operational_metadata"] + }, + { + "id": "secret_reference_property", + "path_kind": "property", + "sensitivity": "secret_reference", + "review_classes": ["security", "privacy"], + "semantic_rules": ["secret_never_reportable"] + }, + { + "id": "redacted_fixture_property", + "path_kind": "property", + "sensitivity": "redacted_fixture", + "review_classes": ["privacy", "testing"], + "semantic_rules": ["synthetic_fixture_value_redacted"] + }, + { + "id": "map_key", + "path_kind": "map_key", + "sensitivity": "internal", + "review_classes": ["contract", "documentation"], + "semantic_rules": ["arbitrary_map_keys_not_fixed_properties"] + }, + { + "id": "redacted_fixture_map_key", + "path_kind": "map_key", + "sensitivity": "redacted_fixture", + "review_classes": ["privacy", "testing"], + "semantic_rules": [ + "arbitrary_map_keys_not_fixed_properties", + "synthetic_fixture_value_redacted" + ] + }, + { + "id": "map_value", + "path_kind": "map_value", + "sensitivity": "internal", + "review_classes": ["contract", "documentation"], + "semantic_rules": ["arbitrary_map_keys_not_fixed_properties"] + }, + { + "id": "redacted_fixture_map_value", + "path_kind": "map_value", + "sensitivity": "redacted_fixture", + "review_classes": ["privacy", "testing"], + "semantic_rules": [ + "arbitrary_map_keys_not_fixed_properties", + "synthetic_fixture_value_redacted" + ] + }, + { + "id": "array_item", + "path_kind": "array_item", + "sensitivity": "internal", + "review_classes": ["contract", "documentation"], + "semantic_rules": ["array_items_share_element_contract"] + }, + { + "id": "sensitive_array_item", + "path_kind": "array_item", + "sensitivity": "sensitive", + "review_classes": ["security", "privacy"], + "semantic_rules": [ + "array_items_share_element_contract", + "sensitive_operational_metadata" + ] + }, + { + "id": "redacted_fixture_array_item", + "path_kind": "array_item", + "sensitivity": "redacted_fixture", + "review_classes": ["privacy", "testing"], + "semantic_rules": [ + "array_items_share_element_contract", + "synthetic_fixture_value_redacted" + ] + }, + { + "id": "branch", + "path_kind": "branch", + "sensitivity": "structural", + "review_classes": ["contract", "compatibility"], + "semantic_rules": ["branch_has_no_authored_value"] + } + ] + }, + "open_object_exceptions": [ + { + "schema": "entity", + "pointer": "/$defs/objectSchema/properties/properties", + "kind": "typed_map", + "rationale": "Entity property names are author-defined and every value uses the closed fieldSchema." + }, + { + "schema": "environment", + "pointer": "/properties/integrations", + "kind": "typed_map", + "rationale": "Integration identifiers are project-defined and every value uses the closed integration binding." + }, + { + "schema": "environment", + "pointer": "/properties/entities", + "kind": "typed_map", + "rationale": "Entity identifiers are project-defined and every value uses the closed entity binding." + }, + { + "schema": "environment", + "pointer": "/properties/callers", + "kind": "typed_map", + "rationale": "Caller identifiers are deployment-defined and every value uses a closed caller binding." + }, + { + "schema": "environment", + "pointer": "/$defs/entity/properties/columns", + "kind": "typed_map", + "rationale": "Authored entity fields map to bounded provider column identifiers." + }, + { + "schema": "fixture", + "pointer": "/properties/input", + "kind": "typed_map", + "rationale": "Integration input names are authored and values are restricted to fixture scalar types." + }, + { + "schema": "fixture", + "pointer": "/properties/variables", + "kind": "typed_map", + "rationale": "Fixture variable names are authored and values are date strings." + }, + { + "schema": "fixture", + "pointer": "/$defs/governedRequest/properties/variables", + "kind": "typed_map", + "rationale": "Governed request variable names are project-defined and values use the closed bounded string contract." + }, + { + "schema": "fixture", + "pointer": "/$defs/governedTarget/properties/attributes", + "kind": "typed_map", + "rationale": "Governed target attribute names are project-defined and values use the closed bounded scalar contract." + }, + { + "schema": "fixture", + "pointer": "/$defs/request/properties/query", + "kind": "typed_map", + "rationale": "HTTP query parameter names are protocol-defined and values use the bounded query value schema." + }, + { + "schema": "fixture", + "pointer": "/$defs/request/properties/headers", + "kind": "typed_map", + "rationale": "HTTP header names are protocol-defined and values are bounded strings." + }, + { + "schema": "fixture", + "pointer": "/$defs/response/oneOf/0/properties/headers", + "kind": "typed_map", + "rationale": "Synthetic response header names are protocol-defined and values are bounded strings." + }, + { + "schema": "fixture", + "pointer": "/$defs/expectation/properties/outputs", + "kind": "extension_map", + "rationale": "Expected adapter outputs are integration-defined JSON values checked against the integration contract at runtime." + }, + { + "schema": "fixture", + "pointer": "/$defs/expectation/properties/claims", + "kind": "extension_map", + "rationale": "Expected claims are service-defined JSON values checked against the project claim contract at runtime." + }, + { + "schema": "fixture", + "pointer": "/$defs/fixtureBody/oneOf/1/not", + "kind": "extension_map", + "rationale": "This negative predicate identifies any JSON object containing the reserved top-level file key; it is not an authored object shape." + }, + { + "schema": "integration", + "pointer": "/properties/input", + "kind": "typed_map", + "rationale": "Integration input names are authored and every value uses the closed input declaration." + }, + { + "schema": "integration", + "pointer": "/properties/outputs/oneOf/0", + "kind": "typed_map", + "rationale": "Integration output names are authored and every value uses the closed output declaration." + }, + { + "schema": "integration", + "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors", + "kind": "typed_map", + "rationale": "Signed DCI selector names are authored and every value uses a closed selector binding." + }, + { + "schema": "integration", + "pointer": "/$defs/httpRequest/properties/query", + "kind": "typed_map", + "rationale": "HTTP query names are protocol-defined and every value is a bounded literal or input reference." + }, + { + "schema": "integration", + "pointer": "/$defs/httpRequest/properties/headers", + "kind": "typed_map", + "rationale": "HTTP header names are protocol-defined and every value is a bounded literal or input reference." + }, + { + "schema": "integration", + "pointer": "/$defs/capability/oneOf/2/properties/snapshot/properties/exact", + "kind": "typed_map", + "rationale": "Snapshot entity field names are authored and every value uses a closed input reference." + }, + { + "schema": "project", + "pointer": "/properties/integrations", + "kind": "typed_map", + "rationale": "Integration aliases are project-defined and every value uses a closed file reference." + }, + { + "schema": "project", + "pointer": "/properties/entities", + "kind": "typed_map", + "rationale": "Entity aliases are project-defined and every value uses a closed file reference." + }, + { + "schema": "project", + "pointer": "/properties/services", + "kind": "typed_map", + "rationale": "Service identifiers are project-defined and every value uses the closed service union." + }, + { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/filters", + "kind": "typed_map", + "rationale": "Entity field names map to bounded filter operator lists." + }, + { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/relationships", + "kind": "typed_map", + "rationale": "Relationship names are authored and every value uses a closed relationship declaration." + }, + { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/aggregates", + "kind": "typed_map", + "rationale": "Aggregate names are authored and every value uses the closed governed aggregate declaration." + }, + { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfiles", + "kind": "typed_map", + "rationale": "Attribute release profile identifiers are authored and every value uses a closed profile declaration." + }, + { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims", + "kind": "typed_map", + "rationale": "Released claim names are authored and every value uses a closed minimized claim declaration." + }, + { + "schema": "project", + "pointer": "/$defs/recordFieldMap", + "kind": "typed_map", + "rationale": "Record field aliases are authored and every value uses a bounded closed field declaration." + }, + { + "schema": "project", + "pointer": "/$defs/recordAggregate/properties/allowed_filters", + "kind": "typed_map", + "rationale": "Aggregate filter field names map to bounded filter operator lists." + }, + { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/claims", + "kind": "typed_map", + "rationale": "Claim identifiers are authored and every value uses a closed claim declaration." + }, + { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/credential_profiles", + "kind": "typed_map", + "rationale": "Credential profile identifiers are authored and every value uses a closed profile declaration." + }, + { + "schema": "project", + "pointer": "/$defs/variables", + "kind": "typed_map", + "rationale": "Request variable names are authored and every value uses a closed variable declaration." + }, + { + "schema": "project", + "pointer": "/$defs/consultations", + "kind": "typed_map", + "rationale": "Consultation aliases are authored and every value uses a closed consultation declaration." + }, + { + "schema": "project", + "pointer": "/$defs/consultations/additionalProperties/properties/input", + "kind": "typed_map", + "rationale": "Integration input names map to bounded target request mappings." + } + ], + "parity_cases": [ + { + "id": "project-unknown-field", + "dimension": "unknown_field", + "expected_failing_keywords": ["additionalProperties"], + "schema": "project", + "source": "crates/registryctl/tests/fixtures/project-authoring/custom-system", + "document": "registry-stack.yaml", + "mutation": { + "operation": "set", + "pointer": "/fc0_unknown", + "value": true + } + }, + { + "id": "environment-unknown-field", + "dimension": "unknown_field", + "expected_failing_keywords": ["additionalProperties"], + "schema": "environment", + "source": "crates/registryctl/tests/fixtures/project-authoring/custom-system", + "document": "environments/local.yaml", + "mutation": { + "operation": "set", + "pointer": "/fc0_unknown", + "value": true + } + }, + { + "id": "integration-unknown-field", + "dimension": "unknown_field", + "expected_failing_keywords": ["additionalProperties"], + "schema": "integration", + "source": "crates/registryctl/tests/fixtures/project-authoring/custom-system", + "document": "integrations/eligibility/integration.yaml", + "mutation": { + "operation": "set", + "pointer": "/fc0_unknown", + "value": true + } + }, + { + "id": "fixture-unknown-field", + "dimension": "unknown_field", + "expected_failing_keywords": ["additionalProperties"], + "schema": "fixture", + "source": "crates/registryctl/tests/fixtures/project-authoring/custom-system", + "document": "integrations/eligibility/fixtures/source-approved.yaml", + "mutation": { + "operation": "set", + "pointer": "/fc0_unknown", + "value": true + } + }, + { + "id": "entity-unknown-field", + "dimension": "unknown_field", + "expected_failing_keywords": ["additionalProperties"], + "schema": "entity", + "source": "crates/registryctl/tests/fixtures/project-authoring/nia-attribute-release", + "document": "entities/population.yaml", + "mutation": { + "operation": "set", + "pointer": "/fc0_unknown", + "value": true + } + }, + { + "id": "project-missing-required", + "dimension": "missing_required", + "expected_failing_keywords": ["required"], + "schema": "project", + "source": "crates/registryctl/tests/fixtures/project-authoring/custom-system", + "document": "registry-stack.yaml", + "mutation": { + "operation": "remove", + "pointer": "/registry" + } + }, + { + "id": "environment-missing-required", + "dimension": "missing_required", + "expected_failing_keywords": ["not", "required"], + "schema": "environment", + "source": "crates/registryctl/tests/fixtures/project-authoring/custom-system", + "document": "environments/local.yaml", + "mutation": { + "operation": "remove", + "pointer": "/deployment" + } + }, + { + "id": "integration-missing-required", + "dimension": "missing_required", + "expected_failing_keywords": ["required"], + "schema": "integration", + "source": "crates/registryctl/tests/fixtures/project-authoring/custom-system", + "document": "integrations/eligibility/integration.yaml", + "mutation": { + "operation": "remove", + "pointer": "/capability" + } + }, + { + "id": "fixture-missing-required", + "dimension": "missing_required", + "expected_failing_keywords": ["required"], + "schema": "fixture", + "source": "crates/registryctl/tests/fixtures/project-authoring/custom-system", + "document": "integrations/eligibility/fixtures/source-approved.yaml", + "mutation": { + "operation": "remove", + "pointer": "/expect" + } + }, + { + "id": "entity-missing-required", + "dimension": "missing_required", + "expected_failing_keywords": ["required"], + "schema": "entity", + "source": "crates/registryctl/tests/fixtures/project-authoring/nia-attribute-release", + "document": "entities/population.yaml", + "mutation": { + "operation": "remove", + "pointer": "/materialization" + } + }, + { + "id": "project-wrong-type", + "dimension": "type", + "expected_failing_keywords": ["const"], + "schema": "project", + "source": "crates/registryctl/tests/fixtures/project-authoring/custom-system", + "document": "registry-stack.yaml", + "mutation": { + "operation": "set", + "pointer": "/version", + "value": "1" + } + }, + { + "id": "environment-wrong-type", + "dimension": "type", + "expected_failing_keywords": ["const"], + "schema": "environment", + "source": "crates/registryctl/tests/fixtures/project-authoring/custom-system", + "document": "environments/local.yaml", + "mutation": { + "operation": "set", + "pointer": "/version", + "value": "1" + } + }, + { + "id": "integration-wrong-type", + "dimension": "type", + "expected_failing_keywords": ["type"], + "schema": "integration", + "source": "crates/registryctl/tests/fixtures/project-authoring/custom-system", + "document": "integrations/eligibility/integration.yaml", + "mutation": { + "operation": "set", + "pointer": "/revision", + "value": "1" + } + }, + { + "id": "fixture-wrong-type", + "dimension": "type", + "expected_failing_keywords": ["type"], + "schema": "fixture", + "source": "crates/registryctl/tests/fixtures/project-authoring/custom-system", + "document": "integrations/eligibility/fixtures/source-approved.yaml", + "mutation": { + "operation": "set", + "pointer": "/name", + "value": 1 + } + }, + { + "id": "entity-wrong-type", + "dimension": "type", + "expected_failing_keywords": ["type"], + "schema": "entity", + "source": "crates/registryctl/tests/fixtures/project-authoring/nia-attribute-release", + "document": "entities/population.yaml", + "mutation": { + "operation": "set", + "pointer": "/revision", + "value": "1" + } + }, + { + "id": "project-id-over-boundary", + "dimension": "boundary", + "expected_failing_keywords": ["pattern"], + "schema": "project", + "source": "crates/registryctl/tests/fixtures/project-authoring/custom-system", + "document": "registry-stack.yaml", + "mutation": { + "operation": "set", + "pointer": "/registry/id", + "value": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" + } + }, + { + "id": "environment-empty-caller-scopes", + "dimension": "boundary", + "expected_failing_keywords": ["minItems"], + "schema": "environment", + "source": "crates/registryctl/tests/fixtures/project-authoring/custom-system", + "document": "environments/local.yaml", + "mutation": { + "operation": "set", + "pointer": "/callers/benefits-service/scopes", + "value": [] + } + }, + { + "id": "integration-zero-max-length", + "dimension": "boundary", + "expected_failing_keywords": ["minimum"], + "schema": "integration", + "source": "crates/registryctl/tests/fixtures/project-authoring/custom-system", + "document": "integrations/eligibility/integration.yaml", + "mutation": { + "operation": "set", + "pointer": "/input/household_reference/maxLength", + "value": 0 + } + }, + { + "id": "fixture-status-below-http-range", + "dimension": "boundary", + "expected_failing_keywords": ["oneOf"], + "schema": "fixture", + "source": "crates/registryctl/tests/fixtures/project-authoring/custom-system", + "document": "integrations/eligibility/fixtures/source-approved.yaml", + "mutation": { + "operation": "set", + "pointer": "/interactions/0/respond/status", + "value": 99 + } + }, + { + "id": "entity-zero-max-records", + "dimension": "boundary", + "expected_failing_keywords": ["minimum"], + "schema": "entity", + "source": "crates/registryctl/tests/fixtures/project-authoring/nia-attribute-release", + "document": "entities/population.yaml", + "mutation": { + "operation": "set", + "pointer": "/materialization/max_records", + "value": 0 + } + }, + { + "id": "project-incoherent-service-union", + "dimension": "conditional", + "expected_failing_keywords": ["oneOf"], + "schema": "project", + "source": "crates/registryctl/tests/fixtures/project-authoring/custom-system", + "document": "registry-stack.yaml", + "mutation": { + "operation": "set", + "pointer": "/services/household-eligibility/kind", + "value": "records_api" + } + }, + { + "id": "environment-incoherent-deployment", + "dimension": "conditional", + "expected_failing_keywords": ["not", "required"], + "schema": "environment", + "source": "crates/registryctl/tests/fixtures/project-authoring/custom-system", + "document": "environments/local.yaml", + "mutation": { + "operation": "remove", + "pointer": "/deployment/relay" + } + }, + { + "id": "integration-incoherent-capability-union", + "dimension": "conditional", + "expected_failing_keywords": ["oneOf"], + "schema": "integration", + "source": "crates/registryctl/tests/fixtures/project-authoring/custom-system", + "document": "integrations/eligibility/integration.yaml", + "mutation": { + "operation": "set", + "pointer": "/capability/script", + "value": { + "file": "adapter.rhai" + } + } + }, + { + "id": "fixture-incoherent-response-union", + "dimension": "conditional", + "expected_failing_keywords": ["oneOf"], + "schema": "fixture", + "source": "crates/registryctl/tests/fixtures/project-authoring/custom-system", + "document": "integrations/eligibility/fixtures/source-approved.yaml", + "mutation": { + "operation": "set", + "pointer": "/interactions/0/respond/timeout", + "value": "1s" + } + }, + { + "id": "fixture-ambiguous-body-file-reference", + "dimension": "conditional", + "expected_failing_keywords": ["oneOf"], + "schema": "fixture", + "source": "crates/registryctl/tests/fixtures/project-authoring/custom-system", + "document": "integrations/eligibility/fixtures/source-approved.yaml", + "mutation": { + "operation": "set", + "pointer": "/interactions/0/respond/body", + "value": { + "file": "bodies/source-approved.json", + "ignored": true + } + }, + "expected_error_code": "registryctl.authoring.fixture.reserved_body_field", + "expected_remediation": "Use exactly `body: { file: bodies/.json }` for a file reference. For inline JSON, rename the reserved top-level `file` field." + } + ] +} diff --git a/crates/registryctl/schemas/project-authoring/project.schema.json b/crates/registryctl/schemas/project-authoring/project.schema.json index 7289e7144..420d32d04 100644 --- a/crates/registryctl/schemas/project-authoring/project.schema.json +++ b/crates/registryctl/schemas/project-authoring/project.schema.json @@ -1,4 +1,5 @@ { + "x-registry-field": "root", "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "https://registrystack.example/schemas/project-authoring/project.v1.json", "title": "Registry Stack project v1", @@ -7,61 +8,68 @@ "additionalProperties": false, "required": ["version", "registry", "services"], "properties": { - "version": { "const": 1, "default": 1, "description": "Project authoring format version." }, + "version": {"x-registry-field": "public_property", "const": 1, "description": "Project authoring format version." }, "starter": { + "x-registry-field": "property", "description": "Immutable provenance for a workspace initialized from a Registry Stack starter. The digest excludes this content_digest field and covers the starter's authored project files.", "type": "object", "additionalProperties": false, "required": ["id", "release", "content_digest"], "properties": { - "id": { "$ref": "#/$defs/stableId", "description": "Registry Stack starter identifier." }, - "release": { "$ref": "#/$defs/token", "description": "Registry Stack release that supplied the starter." }, - "content_digest": { "type": "string", "pattern": "^sha256:[0-9a-f]{64}$", "description": "Digest of the initialized starter authoring content, used to report later workspace divergence." } + "id": {"x-registry-field": "property", "$ref": "#/$defs/stableId", "description": "Registry Stack starter identifier." }, + "release": {"x-registry-field": "property", "$ref": "#/$defs/token", "description": "Registry Stack release that supplied the starter." }, + "content_digest": {"x-registry-field": "sensitive_property", "type": "string", "pattern": "^sha256:[0-9a-f]{64}$", "description": "Digest of the initialized starter authoring content, used to report later workspace divergence." } } }, "registry": { + "x-registry-field": "property", "description": "Stable identity of the Registry Stack project.", "type": "object", "additionalProperties": false, "required": ["id"], - "properties": { "id": { "$ref": "#/$defs/stableId" } } + "properties": { "id": {"x-registry-field": "property", "$ref": "#/$defs/stableId" } } }, "integrations": { + "x-registry-field": "property", "description": "Source adaptation definitions keyed by project-local integration identifier.", "type": "object", "maxProperties": 16, - "propertyNames": { "$ref": "#/$defs/stableId" }, + "propertyNames": {"x-registry-field": "map_key", "$ref": "#/$defs/stableId" }, "additionalProperties": { + "x-registry-field": "map_value", "type": "object", "additionalProperties": false, "required": ["file"], - "properties": { "file": { "$ref": "#/$defs/relativePath" } } + "properties": { "file": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/relativePath" } } } }, "entities": { + "x-registry-field": "property", "description": "Materialized entity definitions keyed by project-local entity identifier.", "type": "object", "maxProperties": 32, - "propertyNames": { "$ref": "#/$defs/stableId" }, + "propertyNames": {"x-registry-field": "map_key", "$ref": "#/$defs/stableId" }, "additionalProperties": { + "x-registry-field": "map_value", "type": "object", "additionalProperties": false, "required": ["file"], - "properties": { "file": { "$ref": "#/$defs/relativePath" } } + "properties": { "file": {"x-registry-field": "sensitive_property", "$ref": "#/$defs/relativePath" } } } }, "services": { + "x-registry-field": "property", "description": "Relay records APIs and Notary evidence services exposed by the project.", "type": "object", "maxProperties": 32, - "propertyNames": { "$ref": "#/$defs/stableId" }, - "additionalProperties": { "$ref": "#/$defs/service" } + "propertyNames": {"x-registry-field": "map_key", "$ref": "#/$defs/stableId" }, + "additionalProperties": {"x-registry-field": "map_value", "$ref": "#/$defs/service" } } }, "anyOf": [ - { "required": ["integrations"], "properties": { "integrations": { "minProperties": 1 } } }, - { "required": ["entities"], "properties": { "entities": { "minProperties": 1 } } }, - { "required": ["services"], "properties": { "services": { "minProperties": 1 } } } + {"x-registry-field": "branch", "required": ["integrations"], "properties": { "integrations": {"x-registry-field": "property", "minProperties": 1 } } }, + {"x-registry-field": "branch", "required": ["entities"], "properties": { "entities": {"x-registry-field": "property", "minProperties": 1 } } }, + {"x-registry-field": "branch", "required": ["services"], "properties": { "services": {"x-registry-field": "property", "minProperties": 1 } } } ], "examples": [ { @@ -86,64 +94,71 @@ "required": ["scopes", "projection", "pagination", "standards"], "properties": { "scopes": { + "x-registry-field": "property", "type": "object", "additionalProperties": false, "required": ["metadata", "rows"], "properties": { - "metadata": { "$ref": "#/$defs/scope" }, - "rows": { "$ref": "#/$defs/scope" }, - "aggregate": { "$ref": "#/$defs/scope" }, - "evidence_verification": { "$ref": "#/$defs/scope" } + "metadata": {"x-registry-field": "property", "$ref": "#/$defs/scope" }, + "rows": {"x-registry-field": "property", "$ref": "#/$defs/scope" }, + "aggregate": {"x-registry-field": "property", "$ref": "#/$defs/scope" }, + "evidence_verification": {"x-registry-field": "property", "$ref": "#/$defs/scope" } } }, - "purposes": { "type": "array", "maxItems": 32, "uniqueItems": true, "items": { "$ref": "#/$defs/token" } }, - "projection": { "type": "array", "minItems": 1, "maxItems": 256, "uniqueItems": true, "items": { "$ref": "#/$defs/stableId" } }, + "purposes": {"x-registry-field": "property", "type": "array", "maxItems": 32, "uniqueItems": true, "items": {"x-registry-field": "array_item", "$ref": "#/$defs/token" } }, + "projection": {"x-registry-field": "property", "type": "array", "minItems": 1, "maxItems": 256, "uniqueItems": true, "items": {"x-registry-field": "array_item", "$ref": "#/$defs/stableId" } }, "pagination": { + "x-registry-field": "property", "type": "object", "additionalProperties": false, "required": ["default_limit", "max_limit"], "properties": { - "default_limit": { "type": "integer", "minimum": 1, "maximum": 10000 }, - "max_limit": { "type": "integer", "minimum": 1, "maximum": 10000 } + "default_limit": {"x-registry-field": "property", "type": "integer", "minimum": 1, "maximum": 10000 }, + "max_limit": {"x-registry-field": "property", "type": "integer", "minimum": 1, "maximum": 10000 } } }, "filters": { + "x-registry-field": "property", "type": "object", "maxProperties": 256, - "propertyNames": { "$ref": "#/$defs/stableId" }, - "additionalProperties": { "$ref": "#/$defs/filterOperators" } + "propertyNames": {"x-registry-field": "map_key", "$ref": "#/$defs/stableId" }, + "additionalProperties": {"x-registry-field": "map_value", "$ref": "#/$defs/filterOperators" } }, - "required_principal_filters": { "$ref": "#/$defs/fieldList" }, + "required_principal_filters": {"x-registry-field": "property", "$ref": "#/$defs/fieldList" }, "relationships": { + "x-registry-field": "property", "type": "object", "maxProperties": 64, - "propertyNames": { "$ref": "#/$defs/stableId" }, + "propertyNames": {"x-registry-field": "map_key", "$ref": "#/$defs/stableId" }, "additionalProperties": { + "x-registry-field": "map_value", "type": "object", "additionalProperties": false, "required": ["kind", "target", "foreign_key"], "properties": { - "kind": { "enum": ["belongs_to", "has_many", "has_one"] }, - "target": { "$ref": "#/$defs/stableId" }, - "foreign_key": { "$ref": "#/$defs/stableId" }, - "concept_uri": { "$ref": "#/$defs/text" } + "kind": {"x-registry-field": "property", "enum": ["belongs_to", "has_many", "has_one"] }, + "target": {"x-registry-field": "property", "$ref": "#/$defs/stableId" }, + "foreign_key": {"x-registry-field": "property", "$ref": "#/$defs/stableId" }, + "concept_uri": {"x-registry-field": "property", "$ref": "#/$defs/text" } } } }, "aggregates": { + "x-registry-field": "property", "type": "object", "maxProperties": 64, - "propertyNames": { "$ref": "#/$defs/stableId" }, - "additionalProperties": { "$ref": "#/$defs/recordAggregate" } + "propertyNames": {"x-registry-field": "map_key", "$ref": "#/$defs/stableId" }, + "additionalProperties": {"x-registry-field": "map_value", "$ref": "#/$defs/recordAggregate" } }, - "attribute_release_profiles": { "$ref": "#/$defs/recordAttributeReleaseProfiles" }, + "attribute_release_profiles": {"x-registry-field": "property", "$ref": "#/$defs/recordAttributeReleaseProfiles" }, "standards": { + "x-registry-field": "property", "type": "object", "additionalProperties": false, "required": ["ogc_features", "sp_dci"], "properties": { - "ogc_features": { "oneOf": [{ "const": false }, { "type": "object" }] }, - "sp_dci": { "oneOf": [{ "const": false }, { "type": "object" }] } + "ogc_features": {"x-registry-field": "property", "oneOf": [{"x-registry-field": "branch", "const": false }, {"x-registry-field": "branch", "$ref": "#/$defs/recordSpatial" }] }, + "sp_dci": {"x-registry-field": "property", "oneOf": [{"x-registry-field": "branch", "const": false }, {"x-registry-field": "branch", "$ref": "#/$defs/recordSpdci" }] } } } } @@ -152,8 +167,8 @@ "description": "Purpose-bound, exact-one identity releases keyed by stable profile id. Generated Relay responses omit source metadata and are never cacheable.", "type": "object", "maxProperties": 16, - "propertyNames": { "type": "string", "pattern": "^[a-z][a-z0-9_-]{0,95}$" }, - "additionalProperties": { "$ref": "#/$defs/recordAttributeReleaseProfile" } + "propertyNames": {"x-registry-field": "map_key", "type": "string", "pattern": "^[a-z][a-z0-9_-]{0,95}$" }, + "additionalProperties": {"x-registry-field": "map_value", "$ref": "#/$defs/recordAttributeReleaseProfile" } }, "recordAttributeReleaseProfile": { "description": "One purpose-bound, minimized identity release compiled into the owning Relay entity.", @@ -161,44 +176,48 @@ "additionalProperties": false, "required": ["version", "purpose", "release_scope", "subject", "release_conditions", "claims"], "properties": { - "version": { "type": "string", "minLength": 1, "maxLength": 64, "pattern": "^[^,\\s\\u0000-\\u001F\\u007F]+$" }, - "title": { "$ref": "#/$defs/text" }, - "description": { "$ref": "#/$defs/text" }, - "purpose": { "$ref": "#/$defs/token" }, - "release_scope": { "$ref": "#/$defs/scope" }, + "version": {"x-registry-field": "property", "type": "string", "minLength": 1, "maxLength": 64, "pattern": "^[^,\\s\\u0000-\\u001F\\u007F]+$" }, + "title": {"x-registry-field": "property", "$ref": "#/$defs/text" }, + "description": {"x-registry-field": "property", "$ref": "#/$defs/text" }, + "purpose": {"x-registry-field": "property", "$ref": "#/$defs/token" }, + "release_scope": {"x-registry-field": "property", "$ref": "#/$defs/scope" }, "subject": { + "x-registry-field": "property", "type": "object", "additionalProperties": false, "required": ["source_field", "id_type"], "properties": { - "source_field": { "$ref": "#/$defs/stableId" }, - "id_type": { "type": "string", "minLength": 1, "maxLength": 64, "pattern": "^[^,\\s\\u0000-\\u001F\\u007F]+$" } + "source_field": {"x-registry-field": "property", "$ref": "#/$defs/stableId" }, + "id_type": {"x-registry-field": "property", "type": "string", "minLength": 1, "maxLength": 64, "pattern": "^[^,\\s\\u0000-\\u001F\\u007F]+$" } } }, "release_conditions": { + "x-registry-field": "property", "type": "object", "additionalProperties": false, "required": ["expression"], - "properties": { "expression": { "$ref": "#/$defs/recordAttributeReleaseExpression" } } + "properties": { "expression": {"x-registry-field": "property", "$ref": "#/$defs/recordAttributeReleaseExpression" } } }, "claims": { + "x-registry-field": "property", "type": "object", "minProperties": 1, "maxProperties": 32, - "propertyNames": { "type": "string", "pattern": "^[a-z][a-z0-9_]{0,63}$" }, + "propertyNames": {"x-registry-field": "map_key", "type": "string", "pattern": "^[a-z][a-z0-9_]{0,63}$" }, "additionalProperties": { + "x-registry-field": "map_value", "type": "object", "additionalProperties": false, "required": ["required", "sensitivity"], "properties": { - "source_field": { "$ref": "#/$defs/stableId" }, - "expression": { "$ref": "#/$defs/recordAttributeReleaseExpression" }, - "required": { "type": "boolean" }, - "sensitivity": { "enum": ["direct_identifier", "personal", "public", "pseudonymous"] } + "source_field": {"x-registry-field": "property", "$ref": "#/$defs/stableId" }, + "expression": {"x-registry-field": "property", "$ref": "#/$defs/recordAttributeReleaseExpression" }, + "required": {"x-registry-field": "property", "type": "boolean" }, + "sensitivity": {"x-registry-field": "property", "enum": ["direct_identifier", "personal", "public", "pseudonymous"] } }, "oneOf": [ - { "required": ["source_field"] }, - { "required": ["expression"] } + {"x-registry-field": "branch", "required": ["source_field"] }, + {"x-registry-field": "branch", "required": ["expression"] } ] } } @@ -209,52 +228,201 @@ "type": "object", "additionalProperties": false, "required": ["cel"], - "properties": { "cel": { "type": "string", "minLength": 1, "maxLength": 4096 } } + "properties": { "cel": {"x-registry-field": "property", "type": "string", "minLength": 1, "maxLength": 4096 } } }, - "filterOperators": { "type": "array", "minItems": 1, "uniqueItems": true, "description": "Allowed operators for one queryable field.", "items": { "enum": ["eq", "in", "gte", "lte", "between"] } }, - "fieldList": { "type": "array", "maxItems": 16, "uniqueItems": true, "description": "Bounded unique list of entity field identifiers.", "items": { "$ref": "#/$defs/stableId" } }, + "filterOperators": { "type": "array", "minItems": 1, "uniqueItems": true, "description": "Allowed operators for one queryable field.", "items": {"x-registry-field": "array_item", "enum": ["eq", "in", "gte", "lte", "between"] } }, + "fieldList": { "type": "array", "maxItems": 16, "uniqueItems": true, "description": "Bounded unique list of entity field identifiers.", "items": {"x-registry-field": "array_item", "$ref": "#/$defs/stableId" } }, "recordAggregate": { "description": "Governed aggregate definition with disclosure controls.", "type": "object", "additionalProperties": false, "required": ["description", "disclosure_control"], "properties": { - "title": { "$ref": "#/$defs/text" }, - "description": { "$ref": "#/$defs/text" }, - "default_group_by": { "$ref": "#/$defs/fieldList" }, - "dimensions": { "type": "array" }, - "indicators": { "type": "array" }, - "allowed_filters": { "type": "object", "additionalProperties": { "$ref": "#/$defs/filterOperators" } }, - "required_principal_filters": { "$ref": "#/$defs/fieldList" }, - "temporal_field": { "$ref": "#/$defs/stableId" }, - "access": { "type": "object" }, - "spatial": { "type": "object" }, - "joins": { "$ref": "#/$defs/fieldList" }, - "group_by": { "$ref": "#/$defs/fieldList" }, - "measures": { "type": "array", "minItems": 1 }, + "title": {"x-registry-field": "property", "$ref": "#/$defs/text" }, + "description": {"x-registry-field": "property", "$ref": "#/$defs/text" }, + "default_group_by": {"x-registry-field": "property", "$ref": "#/$defs/fieldList" }, + "dimensions": {"x-registry-field": "property", "type": "array", "items": {"x-registry-field": "array_item", "$ref": "#/$defs/recordAggregateDimension" } }, + "indicators": {"x-registry-field": "property", "type": "array", "items": {"x-registry-field": "array_item", "$ref": "#/$defs/recordAggregateIndicator" } }, + "allowed_filters": {"x-registry-field": "property", "type": "object", "additionalProperties": {"x-registry-field": "map_value", "$ref": "#/$defs/filterOperators" } }, + "required_principal_filters": {"x-registry-field": "property", "$ref": "#/$defs/fieldList" }, + "temporal_field": {"x-registry-field": "property", "$ref": "#/$defs/stableId" }, + "access": {"x-registry-field": "property", "$ref": "#/$defs/recordAggregateAccess" }, + "spatial": {"x-registry-field": "property", "$ref": "#/$defs/recordAggregateSpatial" }, + "joins": {"x-registry-field": "property", "$ref": "#/$defs/fieldList" }, + "group_by": {"x-registry-field": "property", "$ref": "#/$defs/fieldList" }, + "measures": {"x-registry-field": "property", "type": "array", "minItems": 1, "items": {"x-registry-field": "array_item", "$ref": "#/$defs/recordAggregateMeasure" } }, "disclosure_control": { + "x-registry-field": "property", "type": "object", "additionalProperties": false, "properties": { - "min_group_size": { "type": "integer", "minimum": 1 }, - "suppression": { "enum": ["omit", "mask", "null"] } + "min_group_size": {"x-registry-field": "property", "type": "integer", "minimum": 1, "maximum": 4294967295 }, + "suppression": {"x-registry-field": "property", "enum": ["omit", "mask", "null"] } } } }, - "anyOf": [{ "required": ["measures"] }, { "required": ["indicators"] }] + "anyOf": [{"x-registry-field": "branch", "required": ["measures"] }, {"x-registry-field": "branch", "required": ["indicators"] }] + }, + "recordAggregateAccess": { + "description": "Authorization scopes and execution policy for one governed aggregate.", + "type": "object", + "additionalProperties": false, + "properties": { + "metadata_scope": {"x-registry-field": "property", "$ref": "#/$defs/scope" }, + "aggregate_scope": {"x-registry-field": "property", "$ref": "#/$defs/scope" }, + "aggregate_only_execution": {"x-registry-field": "property", "type": "boolean" } + } + }, + "recordAggregateSpatial": { + "description": "Administrative-area geometry join used to spatially group aggregate results.", + "type": "object", + "additionalProperties": false, + "required": ["mode", "dimension", "geometry_entity", "geometry_id_field", "geometry_field"], + "properties": { + "mode": {"x-registry-field": "property", "const": "admin_area" }, + "collection_id": {"x-registry-field": "property", "$ref": "#/$defs/stableId" }, + "dimension": {"x-registry-field": "property", "$ref": "#/$defs/stableId" }, + "geometry_entity": {"x-registry-field": "property", "$ref": "#/$defs/stableId" }, + "geometry_id_field": {"x-registry-field": "property", "$ref": "#/$defs/stableId" }, + "geometry_field": {"x-registry-field": "property", "$ref": "#/$defs/stableId" }, + "bbox_fields": {"x-registry-field": "property", "$ref": "#/$defs/recordSpatialBbox" }, + "max_geometry_vertices": {"x-registry-field": "property", "type": "integer", "minimum": 1, "maximum": 4294967295 } + } + }, + "recordSpatial": { + "description": "OGC API Features collection metadata and bounded geometry mapping.", + "type": "object", + "additionalProperties": false, + "required": ["geometry"], + "properties": { + "collection_id": {"x-registry-field": "property", "$ref": "#/$defs/stableId" }, + "title": {"x-registry-field": "property", "$ref": "#/$defs/text" }, + "description": {"x-registry-field": "property", "$ref": "#/$defs/text" }, + "geometry": {"x-registry-field": "property", "$ref": "#/$defs/recordSpatialGeometry" }, + "bbox_fields": {"x-registry-field": "property", "$ref": "#/$defs/recordSpatialBbox" }, + "datetime_field": {"x-registry-field": "property", "$ref": "#/$defs/stableId" }, + "max_bbox_degrees": {"x-registry-field": "property", "type": "number", "exclusiveMinimum": 0 }, + "max_geometry_vertices": {"x-registry-field": "property", "type": "integer", "minimum": 1, "maximum": 4294967295 } + } + }, + "recordSpatialGeometry": { + "description": "Supported point or encoded-geometry field mapping for spatial records.", + "oneOf": [ + { + "x-registry-field": "branch", + "type": "object", + "additionalProperties": false, + "required": ["kind", "longitude_field", "latitude_field", "crs"], + "properties": { + "kind": {"x-registry-field": "property", "const": "point" }, + "longitude_field": {"x-registry-field": "property", "$ref": "#/$defs/stableId" }, + "latitude_field": {"x-registry-field": "property", "$ref": "#/$defs/stableId" }, + "crs": {"x-registry-field": "property", "$ref": "#/$defs/token" } + } + }, + { + "x-registry-field": "branch", + "type": "object", + "additionalProperties": false, + "required": ["kind", "field", "crs"], + "properties": { + "kind": {"x-registry-field": "property", "enum": ["geojson", "wkt", "wkb"] }, + "field": {"x-registry-field": "property", "$ref": "#/$defs/stableId" }, + "crs": {"x-registry-field": "property", "$ref": "#/$defs/token" } + } + } + ] + }, + "recordSpatialBbox": { + "description": "Record fields carrying the four coordinates of a bounding box.", + "type": "object", + "additionalProperties": false, + "required": ["min_x", "min_y", "max_x", "max_y"], + "properties": { + "min_x": {"x-registry-field": "property", "$ref": "#/$defs/stableId" }, + "min_y": {"x-registry-field": "property", "$ref": "#/$defs/stableId" }, + "max_x": {"x-registry-field": "property", "$ref": "#/$defs/stableId" }, + "max_y": {"x-registry-field": "property", "$ref": "#/$defs/stableId" } + } + }, + "recordSpdci": { + "description": "SP-DCI registry identity and field mappings for a records service.", + "type": "object", + "additionalProperties": false, + "required": ["registry", "registry_type", "record_type", "identifiers", "expression_fields"], + "properties": { + "registry": {"x-registry-field": "property", "$ref": "#/$defs/stableId" }, + "registry_type": {"x-registry-field": "property", "$ref": "#/$defs/token" }, + "record_type": {"x-registry-field": "property", "$ref": "#/$defs/token" }, + "identifiers": {"x-registry-field": "property", "$ref": "#/$defs/recordFieldMap" }, + "expression_fields": {"x-registry-field": "property", "$ref": "#/$defs/recordFieldMap" }, + "response_fields": {"x-registry-field": "property", "$ref": "#/$defs/recordFieldMap" } + } + }, + "recordFieldMap": { + "description": "Bounded mapping from standard field names to entity field identifiers.", + "type": "object", + "maxProperties": 64, + "propertyNames": {"x-registry-field": "map_key", "$ref": "#/$defs/stableId" }, + "additionalProperties": {"x-registry-field": "map_value", "$ref": "#/$defs/stableId" } + }, + "recordAggregateDimension": { + "description": "Named grouping dimension backed by one entity field.", + "type": "object", + "additionalProperties": false, + "required": ["id", "label", "field"], + "properties": { + "id": {"x-registry-field": "property", "$ref": "#/$defs/stableId" }, + "label": {"x-registry-field": "property", "$ref": "#/$defs/text" }, + "field": {"x-registry-field": "property", "$ref": "#/$defs/stableId" }, + "codelist": {"x-registry-field": "property", "$ref": "#/$defs/text" } + } + }, + "recordAggregateIndicator": { + "description": "SDMX-style aggregate indicator with units and display metadata.", + "type": "object", + "additionalProperties": false, + "required": ["id", "label", "function", "column", "unit_measure"], + "properties": { + "id": {"x-registry-field": "property", "$ref": "#/$defs/stableId" }, + "label": {"x-registry-field": "property", "$ref": "#/$defs/text" }, + "function": {"x-registry-field": "property", "$ref": "#/$defs/recordAggregateFunction" }, + "column": {"x-registry-field": "property", "$ref": "#/$defs/stableId" }, + "unit_measure": {"x-registry-field": "property", "$ref": "#/$defs/text" }, + "unit_mult": {"x-registry-field": "property", "type": "integer", "minimum": -2147483648, "maximum": 2147483647 }, + "decimals": {"x-registry-field": "property", "type": "integer", "minimum": 0, "maximum": 4294967295 }, + "frequency": {"x-registry-field": "property", "$ref": "#/$defs/text" }, + "definition_uri": {"x-registry-field": "property", "$ref": "#/$defs/text" } + } + }, + "recordAggregateMeasure": { + "description": "Named aggregate calculation over one entity column.", + "type": "object", + "additionalProperties": false, + "required": ["name", "function", "column"], + "properties": { + "name": {"x-registry-field": "property", "$ref": "#/$defs/stableId" }, + "function": {"x-registry-field": "property", "$ref": "#/$defs/recordAggregateFunction" }, + "column": {"x-registry-field": "property", "$ref": "#/$defs/stableId" } + } + }, + "recordAggregateFunction": { + "description": "Supported aggregate calculation function.", + "enum": ["count", "sum", "avg", "min", "max", "median", "count_distinct", "stddev"] }, "disclosureMode": { "enum": ["value", "predicate", "redacted"], "description": "Maximum detail a claim may disclose." }, "disclosure": { "description": "Fixed disclosure mode or a default constrained by explicitly allowed alternatives.", "oneOf": [ - { "$ref": "#/$defs/disclosureMode" }, + {"x-registry-field": "branch", "$ref": "#/$defs/disclosureMode" }, { + "x-registry-field": "branch", "type": "object", "additionalProperties": false, "required": ["default", "allowed"], "properties": { - "default": { "$ref": "#/$defs/disclosureMode" }, - "allowed": { "type": "array", "minItems": 1, "uniqueItems": true, "items": { "$ref": "#/$defs/disclosureMode" } } + "default": {"x-registry-field": "property", "$ref": "#/$defs/disclosureMode" }, + "allowed": {"x-registry-field": "property", "type": "array", "minItems": 1, "uniqueItems": true, "items": {"x-registry-field": "array_item", "$ref": "#/$defs/disclosureMode" } } } } ] @@ -262,8 +430,8 @@ "service": { "description": "Closed choice between a Notary evidence service and a Relay records service.", "oneOf": [ - { "$ref": "#/$defs/evidenceService" }, - { "$ref": "#/$defs/recordsService" } + {"x-registry-field": "branch", "$ref": "#/$defs/evidenceService" }, + {"x-registry-field": "branch", "$ref": "#/$defs/recordsService" } ] }, "recordsService": { @@ -272,16 +440,16 @@ "additionalProperties": false, "required": ["kind", "entity", "api"], "properties": { - "kind": { "const": "records_api" }, - "entity": { "$ref": "#/$defs/stableId" }, - "title": { "$ref": "#/$defs/text" }, - "description": { "$ref": "#/$defs/text" }, - "owner": { "$ref": "#/$defs/text" }, - "sensitivity": { "enum": ["public", "internal", "personal", "confidential", "secret"] }, - "access_rights": { "enum": ["public", "restricted", "non_public"] }, - "update_frequency": { "enum": ["continuous", "daily", "weekly", "termly", "monthly", "quarterly", "annual", "irregular", "as_needed", "unknown"] }, - "conforms_to": { "type": "array", "maxItems": 32, "uniqueItems": true, "items": { "$ref": "#/$defs/text" } }, - "api": { "$ref": "#/$defs/recordsApi" } + "kind": {"x-registry-field": "property", "const": "records_api" }, + "entity": {"x-registry-field": "property", "$ref": "#/$defs/stableId" }, + "title": {"x-registry-field": "property", "$ref": "#/$defs/text" }, + "description": {"x-registry-field": "property", "$ref": "#/$defs/text" }, + "owner": {"x-registry-field": "property", "$ref": "#/$defs/text" }, + "sensitivity": {"x-registry-field": "property", "enum": ["public", "internal", "personal", "confidential", "secret"] }, + "access_rights": {"x-registry-field": "property", "enum": ["public", "restricted", "non_public"] }, + "update_frequency": {"x-registry-field": "property", "enum": ["continuous", "daily", "weekly", "termly", "monthly", "quarterly", "annual", "irregular", "as_needed", "unknown"] }, + "conforms_to": {"x-registry-field": "property", "type": "array", "maxItems": 32, "uniqueItems": true, "items": {"x-registry-field": "array_item", "$ref": "#/$defs/text" } }, + "api": {"x-registry-field": "property", "$ref": "#/$defs/recordsApi" } } }, "evidenceService": { @@ -290,41 +458,45 @@ "additionalProperties": false, "required": ["kind", "version", "purpose", "legal_basis", "consent", "access", "claims"], "properties": { - "kind": { "const": "evidence" }, - "version": { "type": "integer", "minimum": 1, "maximum": 4294967295 }, - "purpose": { "$ref": "#/$defs/token" }, - "legal_basis": { "$ref": "#/$defs/token" }, - "consent": { "enum": ["not_required", "required"] }, - "access": { "$ref": "#/$defs/access" }, - "variables": { "$ref": "#/$defs/variables" }, - "consultations": { "$ref": "#/$defs/consultations" }, + "kind": {"x-registry-field": "property", "const": "evidence" }, + "version": {"x-registry-field": "property", "type": "integer", "minimum": 1, "maximum": 4294967295 }, + "purpose": {"x-registry-field": "property", "$ref": "#/$defs/token" }, + "legal_basis": {"x-registry-field": "property", "$ref": "#/$defs/token" }, + "consent": {"x-registry-field": "property", "enum": ["not_required", "required"] }, + "access": {"x-registry-field": "property", "$ref": "#/$defs/access" }, + "variables": {"x-registry-field": "property", "$ref": "#/$defs/variables" }, + "consultations": {"x-registry-field": "property", "$ref": "#/$defs/consultations" }, "claims": { + "x-registry-field": "property", "type": "object", "minProperties": 1, "maxProperties": 64, - "propertyNames": { "$ref": "#/$defs/stableId" }, + "propertyNames": {"x-registry-field": "map_key", "$ref": "#/$defs/stableId" }, "additionalProperties": { + "x-registry-field": "map_value", "type": "object", "additionalProperties": false, "required": ["disclosure"], - "properties": { "output": { "type": "string" }, "cel": { "type": "string", "minLength": 1 }, "value": { "$ref": "#/$defs/claimValue" }, "disclosure": { "$ref": "#/$defs/disclosure" } }, - "oneOf": [{ "required": ["output"] }, { "required": ["cel"] }] + "properties": { "output": {"x-registry-field": "property", "type": "string" }, "cel": {"x-registry-field": "property", "type": "string", "minLength": 1 }, "value": {"x-registry-field": "property", "$ref": "#/$defs/claimValue" }, "disclosure": {"x-registry-field": "property", "$ref": "#/$defs/disclosure" } }, + "oneOf": [{"x-registry-field": "branch", "required": ["output"] }, {"x-registry-field": "branch", "required": ["cel"] }] } }, "credential_profiles": { + "x-registry-field": "property", "description": "Credential profiles may select only claims backed by an exact Relay consultation. Source-free claim evaluation cannot be exposed as credential capability.", "type": "object", "maxProperties": 32, - "propertyNames": { "$ref": "#/$defs/stableId" }, + "propertyNames": {"x-registry-field": "map_key", "$ref": "#/$defs/stableId" }, "additionalProperties": { + "x-registry-field": "map_value", "type": "object", "additionalProperties": false, "required": ["format", "type", "validity", "claims"], "properties": { - "format": { "$ref": "#/$defs/token" }, - "type": { "type": "string", "minLength": 1, "maxLength": 2048 }, - "validity": { "type": "string", "pattern": "^[1-9][0-9]*(?:s|m|h)$" }, - "claims": { "type": "array", "minItems": 1, "uniqueItems": true, "items": { "$ref": "#/$defs/stableId" } } + "format": {"x-registry-field": "property", "$ref": "#/$defs/token" }, + "type": {"x-registry-field": "property", "type": "string", "minLength": 1, "maxLength": 2048 }, + "validity": {"x-registry-field": "property", "type": "string", "pattern": "^[1-9][0-9]*(?:s|m|h)$" }, + "claims": {"x-registry-field": "property", "type": "array", "minItems": 1, "uniqueItems": true, "items": {"x-registry-field": "array_item", "$ref": "#/$defs/stableId" } } } } } @@ -333,17 +505,17 @@ "access": { "description": "Scopes a caller must hold to use an evidence service.", "type": "object", "additionalProperties": false, "required": ["scopes"], - "properties": { "scopes": { "type": "array", "minItems": 1, "maxItems": 16, "uniqueItems": true, "items": { "$ref": "#/$defs/token" } } } + "properties": { "scopes": {"x-registry-field": "property", "type": "array", "minItems": 1, "maxItems": 16, "uniqueItems": true, "items": {"x-registry-field": "array_item", "$ref": "#/$defs/token" } } } }, "variables": { "description": "Typed request variables exposed to evidence evaluation.", - "type": "object", "maxProperties": 16, "propertyNames": { "$ref": "#/$defs/stableId" }, - "additionalProperties": { "type": "object", "additionalProperties": false, "required": ["from", "type"], "properties": { "from": { "type": "string", "pattern": "^request\\.variables\\.[a-z][a-z0-9._-]{0,95}$" }, "type": { "const": "date" } } } + "type": "object", "maxProperties": 16, "propertyNames": {"x-registry-field": "map_key", "$ref": "#/$defs/stableId" }, + "additionalProperties": {"x-registry-field": "map_value", "type": "object", "additionalProperties": false, "required": ["from", "type"], "properties": { "from": {"x-registry-field": "property", "type": "string", "pattern": "^request\\.variables\\.[a-z][a-z0-9._-]{0,95}$" }, "type": {"x-registry-field": "property", "const": "date" } } } }, "consultations": { "description": "Relay consultations and their closed bindings to target request identifiers or caller-supplied target attributes.", - "type": "object", "minProperties": 1, "maxProperties": 16, "propertyNames": { "$ref": "#/$defs/stableId" }, - "additionalProperties": { "type": "object", "additionalProperties": false, "required": ["integration", "input"], "properties": { "integration": { "$ref": "#/$defs/stableId" }, "input": { "type": "object", "minProperties": 1, "maxProperties": 16, "propertyNames": { "$ref": "#/$defs/stableId" }, "additionalProperties": { "$ref": "#/$defs/targetRequestMapping" } } } } + "type": "object", "minProperties": 1, "maxProperties": 16, "propertyNames": {"x-registry-field": "map_key", "$ref": "#/$defs/stableId" }, + "additionalProperties": {"x-registry-field": "map_value", "type": "object", "additionalProperties": false, "required": ["integration", "input"], "properties": { "integration": {"x-registry-field": "property", "$ref": "#/$defs/stableId" }, "input": {"x-registry-field": "property", "type": "object", "minProperties": 1, "maxProperties": 16, "propertyNames": {"x-registry-field": "map_key", "$ref": "#/$defs/stableId" }, "additionalProperties": {"x-registry-field": "map_value", "$ref": "#/$defs/targetRequestMapping" } } } } }, "targetRequestMapping": { "description": "Closed target request binding. Attribute values are bounded typed caller-supplied context, not authenticated identifiers.", @@ -354,7 +526,7 @@ "claimValue": { "description": "Explicit claim value type, nullability, and encoded-size bound for source-free evaluation. A source-free claim cannot be selected by a credential profile.", "type": "object", "additionalProperties": false, "required": ["type"], - "properties": { "type": { "enum": ["boolean", "integer", "string", "date"] }, "nullable": { "type": "boolean" }, "max_bytes": { "type": "integer", "minimum": 1, "maximum": 65536 } } + "properties": { "type": {"x-registry-field": "property", "enum": ["boolean", "integer", "string", "date"] }, "nullable": {"x-registry-field": "property", "type": "boolean" }, "max_bytes": {"x-registry-field": "property", "type": "integer", "minimum": 1, "maximum": 65536 } } } } } diff --git a/crates/registryctl/schemas/project-documentation/registry.project.configuration_reference.v1.schema.json b/crates/registryctl/schemas/project-documentation/registry.project.configuration_reference.v1.schema.json new file mode 100644 index 000000000..a018c70e4 --- /dev/null +++ b/crates/registryctl/schemas/project-documentation/registry.project.configuration_reference.v1.schema.json @@ -0,0 +1,883 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "https://id.registrystack.org/schemas/registryctl/project-documentation/registry.project.configuration_reference.v1.schema.json", + "title": "Registry Stack configuration reference v1", + "type": "object", + "additionalProperties": false, + "required": [ + "schema_id", + "format_version", + "reference_baseline", + "source_contract", + "coverage", + "fields" + ], + "properties": { + "schema_id": { + "const": "https://id.registrystack.org/schemas/registryctl/project-documentation/registry.project.configuration_reference.v1.schema.json" + }, + "format_version": { + "const": "1.0" + }, + "reference_baseline": { + "$ref": "#/$defs/referenceBaseline" + }, + "source_contract": { + "$ref": "#/$defs/sourceContract" + }, + "coverage": { + "$ref": "#/$defs/coverage" + }, + "fields": { + "type": "array", + "minItems": 1, + "items": { + "$ref": "#/$defs/field" + } + } + }, + "$defs": { + "schemaKind": { + "enum": [ + "project", + "environment", + "integration", + "fixture", + "entity", + "relay", + "notary" + ] + }, + "pathKind": { + "enum": [ + "root", + "property", + "map_key", + "map_value", + "array_item", + "branch" + ] + }, + "address": { + "type": "object", + "additionalProperties": false, + "required": [ + "schema", + "pointer", + "path_kind" + ], + "properties": { + "schema": { + "$ref": "#/$defs/schemaKind" + }, + "pointer": { + "type": "string" + }, + "key_path": { + "type": "string" + }, + "path_kind": { + "$ref": "#/$defs/pathKind" + } + }, + "allOf": [ + { + "if": { + "properties": { + "schema": { + "enum": [ + "relay", + "notary" + ] + } + } + }, + "then": { + "type": "object", + "properties": { + "key_path": {} + }, + "required": [ + "key_path" + ] + }, + "else": { + "not": { + "type": "object", + "properties": { + "key_path": {} + }, + "required": [ + "key_path" + ] + } + } + } + ] + }, + "schemaAddress": { + "type": "object", + "additionalProperties": false, + "required": [ + "schema", + "pointer" + ], + "properties": { + "schema": { + "$ref": "#/$defs/schemaKind" + }, + "pointer": { + "type": "string" + } + } + }, + "referenceBaseline": { + "type": "object", + "additionalProperties": false, + "required": [ + "generator_lifecycle", + "published_release", + "field_history_status", + "history_verification_method", + "compared_releases" + ], + "properties": { + "generator_lifecycle": { + "const": "unreleased" + }, + "published_release": { + "type": "null" + }, + "field_history_status": { + "const": "not_verified" + }, + "history_verification_method": { + "type": "null" + }, + "compared_releases": { + "type": "array", + "maxItems": 0 + } + } + }, + "sourceContract": { + "type": "object", + "additionalProperties": false, + "required": [ + "schemas", + "schema_sources", + "field_knowledge", + "human_intent", + "runtime_intent", + "reads_country_workspaces", + "reads_runtime_configuration" + ], + "properties": { + "schemas": { + "type": "array", + "minItems": 1, + "uniqueItems": true, + "items": { + "$ref": "#/$defs/schemaKind" + } + }, + "schema_sources": { + "type": "array", + "minItems": 1, + "uniqueItems": true, + "items": { + "type": "string", + "pattern": "^[a-z0-9.-]+\\.schema\\.json$" + } + }, + "field_knowledge": { + "const": "schemas/project-authoring/parity-coverage.json#field_knowledge" + }, + "human_intent": { + "const": "schemas/project-authoring/documentation-intent.json" + }, + "runtime_intent": { + "type": "array", + "minItems": 0, + "maxItems": 2, + "uniqueItems": true, + "items": { + "enum": [ + "crates/registry-relay/config/documentation-intent.json", + "crates/registry-notary-core/config/documentation-intent.json" + ] + } + }, + "reads_country_workspaces": { + "const": false + }, + "reads_runtime_configuration": { + "const": false + } + } + }, + "coverage": { + "type": "object", + "additionalProperties": false, + "required": [ + "schema_count", + "path_count", + "reference_count", + "by_schema", + "by_path_kind", + "by_sensitivity" + ,"by_intent_source" + ,"by_intent_profile" + ], + "properties": { + "schema_count": { + "type": "integer", + "minimum": 1 + }, + "path_count": { + "type": "integer", + "minimum": 1 + }, + "reference_count": { + "type": "integer", + "minimum": 0 + }, + "by_schema": { + "type": "object", + "propertyNames": { + "$ref": "#/$defs/schemaKind" + }, + "additionalProperties": { + "type": "integer", + "minimum": 0 + } + }, + "by_path_kind": { + "type": "object", + "propertyNames": { + "$ref": "#/$defs/pathKind" + }, + "additionalProperties": { + "type": "integer", + "minimum": 0 + } + }, + "by_sensitivity": { + "type": "object", + "propertyNames": { + "enum": [ + "public", + "internal", + "sensitive", + "secret_reference", + "secret_value", + "redacted_fixture", + "structural" + ] + }, + "additionalProperties": { + "type": "integer", + "minimum": 0 + } + }, + "by_intent_source": { + "type": "object", + "propertyNames": { + "enum": [ + "schema_description", + "reviewed_override", + "structural_taxonomy", + "reviewed_profile" + ] + }, + "additionalProperties": { + "type": "integer", + "minimum": 0 + } + }, + "by_intent_profile": { + "type": "object", + "additionalProperties": { + "type": "integer", + "minimum": 0 + } + } + } + }, + "field": { + "type": "object", + "additionalProperties": false, + "required": [ + "address", + "purpose", + "purpose_source", + "semantic_owner", + "human_owner", + "scope", + "field_type", + "requiredness", + "null_behavior", + "empty_behavior", + "default", + "environment_behavior", + "sensitivity", + "state", + "products", + "availability", + "stability", + "validation_stages", + "diagnostic", + "history_status", + "introduced_in", + "version_history", + "example", + "migration", + "migration_note", + "consumers", + "generated_artifacts", + "review_classes", + "semantic_rules", + "constraints" + ], + "properties": { + "address": { + "$ref": "#/$defs/address" + }, + "purpose": { + "$ref": "#/$defs/prose" + }, + "purpose_source": { + "enum": [ + "schema_description", + "reviewed_override", + "structural_taxonomy", + "reviewed_profile" + ] + }, + "intent_profile": { + "type": "string", + "pattern": "^[a-z0-9_]+$" + }, + "semantic_owner": { + "enum": [ + "authoring_contract", + "deployment_security", + "integration_contract", + "fixture_harness", + "entity_contract", + "relay_runtime", + "notary_runtime" + ] + }, + "human_owner": { + "enum": [ + "registry_maintainers", + "security_maintainers", + "integration_maintainers", + "test_maintainers", + "data_model_maintainers", + "relay_maintainers", + "notary_maintainers" + ] + }, + "scope": { + "$ref": "#/$defs/prose" + }, + "field_type": { + "type": "object", + "additionalProperties": false, + "required": [ + "schema_types", + "composed" + ], + "properties": { + "schema_types": { + "type": "array", + "uniqueItems": true, + "items": { + "enum": [ + "array", + "boolean", + "integer", + "null", + "number", + "object", + "string" + ] + } + }, + "local_reference": { + "type": "string", + "pattern": "^#/" + }, + "composed": { + "type": "boolean" + } + } + }, + "requiredness": { + "enum": [ + "required", + "optional", + "conditional", + "not_applicable" + ] + }, + "null_behavior": { + "enum": [ + "allowed", + "rejected", + "conditional", + "not_applicable" + ] + }, + "empty_behavior": { + "enum": [ + "allowed", + "rejected", + "conditional", + "not_applicable" + ] + }, + "default": { + "type": "object", + "additionalProperties": false, + "required": [ + "behavior" + ], + "properties": { + "behavior": { + "enum": [ + "no_schema_default", + "schema_default", + "reviewed_runtime_default", + "not_applicable" + ] + }, + "schema_value": true, + "source_version": { + "type": "string", + "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$" + }, + "reviewed_behavior": { + "$ref": "#/$defs/prose" + } + } + }, + "environment_behavior": { + "enum": [ + "environment_independent", + "bound_by_environment", + "narrows_reviewed_authority" + ] + }, + "sensitivity": { + "enum": [ + "public", + "internal", + "sensitive", + "secret_reference", + "secret_value", + "redacted_fixture", + "structural" + ] + }, + "state": { + "enum": [ + "authored", + "environment_bound", + "runtime" + ] + }, + "products": { + "$ref": "#/$defs/products" + }, + "availability": { + "const": "published" + }, + "stability": { + "enum": [ + "experimental", + "stable" + ] + }, + "validation_stages": { + "$ref": "#/$defs/validationStages" + }, + "diagnostic": { + "anyOf": [ + { + "type": "string", + "pattern": "^(registryctl\\.authoring|registry\\.(relay|notary)\\.config|config)\\.[a-z0-9_.]+$" + }, + { + "$ref": "#/$defs/prose" + } + ] + }, + "history_status": { + "const": "not_verified" + }, + "introduced_in": { + "type": "null" + }, + "version_history": { + "type": "array", + "maxItems": 0, + "items": { + "type": "object", + "additionalProperties": false, + "required": [ + "version", + "change" + ], + "properties": { + "version": { + "type": "string", + "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$" + }, + "change": { + "const": "introduced" + } + } + } + }, + "example": { + "type": "object", + "additionalProperties": false, + "required": [ + "guidance", + "schema_examples_available", + "contains_country_values" + ], + "properties": { + "guidance": { + "$ref": "#/$defs/prose" + }, + "schema_examples_available": { + "type": "boolean" + }, + "contains_country_values": { + "const": false + } + } + }, + "migration": { + "enum": [ + "regenerate_editor_schemas", + "rebuild_project", + "coordinate_deployment", + "update_fixtures" + ] + }, + "migration_note": { + "$ref": "#/$defs/prose" + }, + "consumers": { + "$ref": "#/$defs/consumers" + }, + "generated_artifacts": { + "$ref": "#/$defs/generatedArtifacts" + }, + "review_classes": { + "$ref": "#/$defs/reviewClasses" + }, + "semantic_rules": { + "$ref": "#/$defs/semanticRules" + }, + "constraints": { + "type": "array", + "items": { + "type": "object", + "additionalProperties": false, + "required": [ + "keyword", + "value" + ], + "properties": { + "keyword": { + "type": "string" + }, + "value": true + } + } + }, + "local_reference": { + "$ref": "#/$defs/schemaAddress" + } + }, + "allOf": [ + { + "if": { + "properties": { + "address": { + "type": "object", + "properties": { + "schema": { + "enum": [ + "relay", + "notary" + ] + } + } + } + } + }, + "then": { + "type": "object", + "required": [ + "intent_profile" + ], + "properties": { + "intent_profile": {}, + "purpose_source": { + "enum": [ + "schema_description", + "reviewed_override", + "reviewed_profile" + ] + }, + "state": { + "const": "runtime" + }, + "default": { + "not": { + "type": "object", + "properties": { + "schema_value": {} + }, + "required": [ + "schema_value" + ] + } + } + } + }, + "else": { + "not": { + "type": "object", + "properties": { + "intent_profile": {} + }, + "required": [ + "intent_profile" + ] + } + } + }, + { + "if": { + "properties": { + "address": { + "type": "object", + "properties": { + "schema": { + "const": "relay" + } + } + } + } + }, + "then": { + "properties": { + "semantic_owner": { + "const": "relay_runtime" + }, + "human_owner": { + "const": "relay_maintainers" + }, + "products": { + "const": [ + "relay", + "docs" + ] + }, + "consumers": { + "const": [ + "registry_relay", + "docs_generator" + ] + }, + "generated_artifacts": { + "const": [ + "relay_config", + "field_reference" + ] + }, + "diagnostic": { + "anyOf": [ + { + "type": "string", + "pattern": "^(registry\\.relay\\.config|config)\\.[a-z0-9_.]+$" + }, + { + "$ref": "#/$defs/prose" + } + ] + } + } + } + }, + { + "if": { + "properties": { + "address": { + "type": "object", + "properties": { + "schema": { + "const": "notary" + } + } + } + } + }, + "then": { + "properties": { + "semantic_owner": { + "const": "notary_runtime" + }, + "human_owner": { + "const": "notary_maintainers" + }, + "products": { + "const": [ + "notary", + "docs" + ] + }, + "consumers": { + "const": [ + "registry_notary", + "docs_generator" + ] + }, + "generated_artifacts": { + "const": [ + "notary_config", + "field_reference" + ] + }, + "diagnostic": { + "anyOf": [ + { + "type": "string", + "pattern": "^(registry\\.notary\\.config|config)\\.[a-z0-9_.]+$" + }, + { + "$ref": "#/$defs/prose" + } + ] + } + } + } + } + ] + }, + "prose": { + "type": "string", + "minLength": 24, + "pattern": "^(?![\\s\\S]*(?:TODO|TBD))[\\s\\S]*\\S$" + }, + "nonEmptyUniqueStrings": { + "type": "array", + "minItems": 1, + "uniqueItems": true, + "items": { + "type": "string", + "minLength": 1 + } + }, + "products": { + "type": "array", + "minItems": 1, + "uniqueItems": true, + "items": { + "enum": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ] + } + }, + "validationStages": { + "type": "array", + "minItems": 1, + "uniqueItems": true, + "items": { + "enum": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build", + "operator_preflight" + ] + } + }, + "consumers": { + "type": "array", + "minItems": 1, + "uniqueItems": true, + "items": { + "enum": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ] + } + }, + "generatedArtifacts": { + "type": "array", + "minItems": 1, + "uniqueItems": true, + "items": { + "enum": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ] + } + }, + "reviewClasses": { + "type": "array", + "minItems": 1, + "uniqueItems": true, + "items": { + "enum": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ] + } + }, + "semanticRules": { + "type": "array", + "minItems": 1, + "uniqueItems": true, + "items": { + "enum": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable", + "synthetic_fixture_value_redacted", + "sensitive_operational_metadata", + "arbitrary_map_keys_not_fixed_properties", + "array_items_share_element_contract", + "branch_has_no_authored_value" + ] + } + } + } +} diff --git a/crates/registryctl/schemas/project-documentation/registry.project.configuration_reference_coverage.v1.schema.json b/crates/registryctl/schemas/project-documentation/registry.project.configuration_reference_coverage.v1.schema.json new file mode 100644 index 000000000..97d013638 --- /dev/null +++ b/crates/registryctl/schemas/project-documentation/registry.project.configuration_reference_coverage.v1.schema.json @@ -0,0 +1,323 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "https://id.registrystack.org/schemas/registryctl/project-documentation/registry.project.configuration_reference_coverage.v1.schema.json", + "title": "Registry Stack configuration reference coverage v1", + "type": "object", + "additionalProperties": false, + "required": [ + "schema_id", + "format_version", + "status", + "reference_baseline", + "source_contract", + "coverage", + "reviewed_intent_assignment_required_count", + "reviewed_intent_assignment_covered_count", + "distinct_reviewed_intent_count", + "distinct_reviewed_intents_reused_count", + "reviewed_intent_assignments_using_reused_intent_count", + "missing_intent" + ], + "properties": { + "schema_id": { + "const": "https://id.registrystack.org/schemas/registryctl/project-documentation/registry.project.configuration_reference_coverage.v1.schema.json" + }, + "format_version": { + "const": "1.0" + }, + "status": { + "enum": [ + "complete", + "incomplete" + ] + }, + "reference_baseline": { + "$ref": "#/$defs/referenceBaseline" + }, + "source_contract": { + "$ref": "#/$defs/sourceContract" + }, + "coverage": { + "$ref": "#/$defs/coverage" + }, + "reviewed_intent_assignment_required_count": { + "type": "integer", + "minimum": 0 + }, + "reviewed_intent_assignment_covered_count": { + "type": "integer", + "minimum": 0 + }, + "distinct_reviewed_intent_count": { + "type": "integer", + "minimum": 0 + }, + "distinct_reviewed_intents_reused_count": { + "type": "integer", + "minimum": 0 + }, + "reviewed_intent_assignments_using_reused_intent_count": { + "type": "integer", + "minimum": 0 + }, + "missing_intent": { + "type": "array", + "items": { + "$ref": "#/$defs/address" + } + } + }, + "$defs": { + "schemaKind": { + "enum": [ + "project", + "environment", + "integration", + "fixture", + "entity", + "relay", + "notary" + ] + }, + "pathKind": { + "enum": [ + "root", + "property", + "map_key", + "map_value", + "array_item", + "branch" + ] + }, + "referenceBaseline": { + "type": "object", + "additionalProperties": false, + "required": [ + "generator_lifecycle", + "published_release", + "field_history_status", + "history_verification_method", + "compared_releases" + ], + "properties": { + "generator_lifecycle": { + "const": "unreleased" + }, + "published_release": { + "type": "null" + }, + "field_history_status": { + "const": "not_verified" + }, + "history_verification_method": { + "type": "null" + }, + "compared_releases": { + "type": "array", + "maxItems": 0 + } + } + }, + "sourceContract": { + "type": "object", + "additionalProperties": false, + "required": [ + "schemas", + "schema_sources", + "field_knowledge", + "human_intent", + "runtime_intent", + "reads_country_workspaces", + "reads_runtime_configuration" + ], + "properties": { + "schemas": { + "type": "array", + "minItems": 1, + "uniqueItems": true, + "items": { + "$ref": "#/$defs/schemaKind" + } + }, + "schema_sources": { + "type": "array", + "minItems": 1, + "uniqueItems": true, + "items": { + "type": "string", + "pattern": "^[a-z0-9.-]+\\.schema\\.json$" + } + }, + "field_knowledge": { + "const": "schemas/project-authoring/parity-coverage.json#field_knowledge" + }, + "human_intent": { + "const": "schemas/project-authoring/documentation-intent.json" + }, + "runtime_intent": { + "type": "array", + "minItems": 0, + "maxItems": 2, + "uniqueItems": true, + "items": { + "enum": [ + "crates/registry-relay/config/documentation-intent.json", + "crates/registry-notary-core/config/documentation-intent.json" + ] + } + }, + "reads_country_workspaces": { + "const": false + }, + "reads_runtime_configuration": { + "const": false + } + } + }, + "coverage": { + "type": "object", + "additionalProperties": false, + "required": [ + "schema_count", + "path_count", + "reference_count", + "by_schema", + "by_path_kind", + "by_sensitivity" + ,"by_intent_source" + ,"by_intent_profile" + ], + "properties": { + "schema_count": { + "type": "integer", + "minimum": 1 + }, + "path_count": { + "type": "integer", + "minimum": 1 + }, + "reference_count": { + "type": "integer", + "minimum": 0 + }, + "by_schema": { + "type": "object", + "propertyNames": { + "$ref": "#/$defs/schemaKind" + }, + "additionalProperties": { + "type": "integer", + "minimum": 0 + } + }, + "by_path_kind": { + "type": "object", + "propertyNames": { + "$ref": "#/$defs/pathKind" + }, + "additionalProperties": { + "type": "integer", + "minimum": 0 + } + }, + "by_sensitivity": { + "type": "object", + "propertyNames": { + "enum": [ + "public", + "internal", + "sensitive", + "secret_reference", + "secret_value", + "redacted_fixture", + "structural" + ] + }, + "additionalProperties": { + "type": "integer", + "minimum": 0 + } + }, + "by_intent_source": { + "type": "object", + "propertyNames": { + "enum": [ + "schema_description", + "reviewed_override", + "structural_taxonomy", + "reviewed_profile" + ] + }, + "additionalProperties": { + "type": "integer", + "minimum": 0 + } + }, + "by_intent_profile": { + "type": "object", + "additionalProperties": { + "type": "integer", + "minimum": 0 + } + } + } + }, + "address": { + "type": "object", + "additionalProperties": false, + "required": [ + "schema", + "pointer", + "path_kind" + ], + "properties": { + "schema": { + "$ref": "#/$defs/schemaKind" + }, + "pointer": { + "type": "string" + }, + "key_path": { + "type": "string" + }, + "path_kind": { + "$ref": "#/$defs/pathKind" + } + }, + "allOf": [ + { + "if": { + "properties": { + "schema": { + "enum": [ + "relay", + "notary" + ] + } + } + }, + "then": { + "type": "object", + "properties": { + "key_path": {} + }, + "required": [ + "key_path" + ] + }, + "else": { + "not": { + "type": "object", + "properties": { + "key_path": {} + }, + "required": [ + "key_path" + ] + } + } + } + ] + } + } +} diff --git a/crates/registryctl/schemas/project-documentation/registry.runtime.configuration_intent.v1.schema.json b/crates/registryctl/schemas/project-documentation/registry.runtime.configuration_intent.v1.schema.json new file mode 100644 index 000000000..111c2df50 --- /dev/null +++ b/crates/registryctl/schemas/project-documentation/registry.runtime.configuration_intent.v1.schema.json @@ -0,0 +1,491 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "https://id.registrystack.org/schemas/registryctl/project-documentation/registry.runtime.configuration_intent.v1.schema.json", + "title": "Registry Stack product-owned runtime configuration intent v1", + "type": "object", + "additionalProperties": false, + "required": [ + "$schema", + "format_version", + "runtime_schema", + "schema_id", + "schema_source", + "profiles", + "assignments", + "overrides" + ], + "properties": { + "$schema": { + "const": "https://id.registrystack.org/schemas/registryctl/project-documentation/registry.runtime.configuration_intent.v1.schema.json" + }, + "format_version": { + "const": "1.0" + }, + "runtime_schema": { + "$ref": "#/$defs/runtimeSchema" + }, + "schema_id": { + "type": "string", + "format": "uri" + }, + "schema_source": { + "type": "string", + "pattern": "^[a-z0-9.-]+\\.schema\\.json$" + }, + "profiles": { + "type": "array", + "minItems": 1, + "items": { + "$ref": "#/$defs/profile" + } + }, + "assignments": { + "type": "array", + "minItems": 1, + "uniqueItems": true, + "items": { + "$ref": "#/$defs/assignment" + } + }, + "overrides": { + "type": "array", + "uniqueItems": true, + "items": { + "$ref": "#/$defs/override" + } + } + }, + "allOf": [ + { + "if": { + "properties": { + "runtime_schema": { + "const": "relay" + } + } + }, + "then": { + "properties": { + "profiles": { + "type": "array", + "items": { + "allOf": [ + { + "$ref": "#/$defs/profile" + }, + { + "type": "object", + "properties": { + "semantic_owner": { + "const": "relay_runtime" + }, + "human_owner": { + "const": "relay_maintainers" + }, + "products": { + "const": [ + "relay", + "docs" + ] + }, + "consumers": { + "const": [ + "registry_relay", + "docs_generator" + ] + }, + "generated_artifacts": { + "const": [ + "relay_config", + "field_reference" + ] + }, + "diagnostic": { + "anyOf": [ + { + "type": "string", + "pattern": "^(registry\\.relay\\.config|config)\\.[a-z0-9_.]+$" + }, + { + "$ref": "#/$defs/prose" + } + ] + } + } + } + ] + } + } + } + } + }, + { + "if": { + "properties": { + "runtime_schema": { + "const": "notary" + } + } + }, + "then": { + "properties": { + "profiles": { + "type": "array", + "items": { + "allOf": [ + { + "$ref": "#/$defs/profile" + }, + { + "type": "object", + "properties": { + "semantic_owner": { + "const": "notary_runtime" + }, + "human_owner": { + "const": "notary_maintainers" + }, + "products": { + "const": [ + "notary", + "docs" + ] + }, + "consumers": { + "const": [ + "registry_notary", + "docs_generator" + ] + }, + "generated_artifacts": { + "const": [ + "notary_config", + "field_reference" + ] + }, + "diagnostic": { + "anyOf": [ + { + "type": "string", + "pattern": "^(registry\\.notary\\.config|config)\\.[a-z0-9_.]+$" + }, + { + "$ref": "#/$defs/prose" + } + ] + } + } + } + ] + } + } + } + } + } + ], + "$defs": { + "runtimeSchema": { + "enum": [ + "relay", + "notary" + ] + }, + "pathKind": { + "enum": [ + "root", + "property", + "map_value", + "array_item" + ] + }, + "prose": { + "type": "string", + "minLength": 24, + "pattern": "^(?![\\s\\S]*(?:TODO|TBD))[\\s\\S]*\\S$" + }, + "profile": { + "type": "object", + "additionalProperties": false, + "required": [ + "id", + "purpose", + "semantic_owner", + "human_owner", + "scope", + "environment_behavior", + "sensitivity", + "state", + "products", + "availability", + "stability", + "validation_stages", + "diagnostic", + "introduced_in", + "migration", + "migration_note", + "example_guidance", + "consumers", + "generated_artifacts", + "review_classes", + "semantic_rules" + ], + "properties": { + "id": { + "type": "string", + "pattern": "^[a-z0-9_]+$" + }, + "purpose": { + "$ref": "#/$defs/prose" + }, + "semantic_owner": { + "enum": [ + "relay_runtime", + "notary_runtime" + ] + }, + "human_owner": { + "enum": [ + "relay_maintainers", + "notary_maintainers" + ] + }, + "scope": { + "$ref": "#/$defs/prose" + }, + "environment_behavior": { + "enum": [ + "bound_by_environment", + "narrows_reviewed_authority" + ] + }, + "sensitivity": { + "enum": [ + "public", + "internal", + "sensitive", + "secret_reference", + "structural" + ] + }, + "state": { + "const": "runtime" + }, + "products": { + "type": "array", + "minItems": 2, + "uniqueItems": true, + "items": { + "enum": [ + "relay", + "notary", + "docs" + ] + } + }, + "availability": { + "const": "published" + }, + "stability": { + "enum": [ + "experimental", + "stable" + ] + }, + "validation_stages": { + "type": "array", + "minItems": 2, + "uniqueItems": true, + "items": { + "enum": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ] + } + }, + "diagnostic": { + "anyOf": [ + { + "type": "string", + "pattern": "^(registry\\.(relay|notary)\\.config|config)\\.[a-z0-9_.]+$" + }, + { + "$ref": "#/$defs/prose" + } + ] + }, + "introduced_in": { + "type": "string", + "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+$" + }, + "migration": { + "const": "coordinate_deployment" + }, + "migration_note": { + "$ref": "#/$defs/prose" + }, + "example_guidance": { + "$ref": "#/$defs/prose" + }, + "consumers": { + "type": "array", + "minItems": 2, + "uniqueItems": true, + "items": { + "enum": [ + "registry_relay", + "registry_notary", + "docs_generator" + ] + } + }, + "generated_artifacts": { + "type": "array", + "minItems": 1, + "uniqueItems": true, + "items": { + "enum": [ + "relay_config", + "notary_config", + "field_reference" + ] + } + }, + "review_classes": { + "type": "array", + "minItems": 1, + "uniqueItems": true, + "items": { + "enum": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ] + } + }, + "semantic_rules": { + "type": "array", + "minItems": 2, + "uniqueItems": true, + "items": { + "enum": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable", + "sensitive_operational_metadata", + "arbitrary_map_keys_not_fixed_properties", + "array_items_share_element_contract" + ] + } + }, + "open_map_semantics": { + "$ref": "#/$defs/prose" + } + } + }, + "assignment": { + "type": "object", + "additionalProperties": false, + "required": [ + "schema", + "pointer", + "key_path", + "path_kind", + "profile", + "purpose_source", + "default_source", + "schema_facts_reviewed" + ], + "properties": { + "schema": { + "$ref": "#/$defs/runtimeSchema" + }, + "pointer": { + "type": "string" + }, + "key_path": { + "type": "string" + }, + "path_kind": { + "$ref": "#/$defs/pathKind" + }, + "profile": { + "type": "string", + "pattern": "^[a-z0-9_]+$" + }, + "purpose_source": { + "enum": [ + "schema_description", + "profile", + "override" + ] + }, + "default_source": { + "enum": [ + "schema_default", + "no_schema_default", + "reviewed_runtime_default", + "not_applicable" + ] + }, + "schema_facts_reviewed": { + "const": true + } + } + }, + "override": { + "type": "object", + "additionalProperties": false, + "required": [ + "schema", + "pointer", + "key_path", + "path_kind" + ], + "properties": { + "schema": { + "$ref": "#/$defs/runtimeSchema" + }, + "pointer": { + "type": "string" + }, + "key_path": { + "type": "string" + }, + "path_kind": { + "$ref": "#/$defs/pathKind" + }, + "purpose": { + "$ref": "#/$defs/prose" + }, + "runtime_default_note": { + "$ref": "#/$defs/prose" + } + }, + "anyOf": [ + { + "type": "object", + "properties": { + "purpose": {} + }, + "required": [ + "purpose" + ] + }, + { + "type": "object", + "properties": { + "runtime_default_note": {} + }, + "required": [ + "runtime_default_note" + ] + } + ] + } + } +} diff --git a/crates/registryctl/schemas/project-reports/registry.project.artifact_manifest.v1.schema.json b/crates/registryctl/schemas/project-reports/registry.project.artifact_manifest.v1.schema.json new file mode 100644 index 000000000..ed7225389 --- /dev/null +++ b/crates/registryctl/schemas/project-reports/registry.project.artifact_manifest.v1.schema.json @@ -0,0 +1,187 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "https://id.registrystack.org/schemas/registryctl/project-reports/registry.project.artifact_manifest.v1.schema.json", + "title": "Registry Project Artifact Manifest v1", + "type": "object", + "required": [ + "schema_version", + "format_version", + "project", + "environment", + "generator", + "inputs", + "artifacts" + ], + "additionalProperties": false, + "properties": { + "schema_version": { + "const": "registry.project.artifact_manifest.v1" + }, + "format_version": { + "const": "registry.project.artifact_manifest.format.v1" + }, + "project": { + "$ref": "#/$defs/identifier" + }, + "environment": { + "$ref": "#/$defs/identifier" + }, + "generator": { + "$ref": "#/$defs/generator" + }, + "inputs": { + "type": "array", + "items": { + "$ref": "#/$defs/input_digest" + } + }, + "artifacts": { + "type": "array", + "items": { + "$ref": "#/$defs/artifact" + } + } + }, + "$defs": { + "identifier": { + "type": "string", + "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]*$" + }, + "non_empty_string": { + "type": "string", + "minLength": 1 + }, + "project_relative_path": { + "type": "string", + "pattern": "^([A-Za-z0-9_-][A-Za-z0-9._-]*|\\.[A-Za-z0-9_-][A-Za-z0-9._-]*)(/([A-Za-z0-9_-][A-Za-z0-9._-]*|\\.[A-Za-z0-9_-][A-Za-z0-9._-]*))*$" + }, + "sha256_digest": { + "type": "string", + "pattern": "^sha256:[0-9a-f]{64}$" + }, + "generator": { + "type": "object", + "required": ["name", "version"], + "additionalProperties": false, + "properties": { + "name": { + "const": "registryctl" + }, + "version": { + "$ref": "#/$defs/non_empty_string" + } + } + }, + "input_digest": { + "type": "object", + "required": ["path", "digest"], + "additionalProperties": false, + "properties": { + "path": { + "$ref": "#/$defs/project_relative_path" + }, + "digest": { + "$ref": "#/$defs/sha256_digest" + } + } + }, + "artifact": { + "type": "object", + "required": [ + "path", + "format_version", + "digest", + "classes", + "sensitivity", + "publication", + "edit", + "version_control", + "review", + "lifecycle", + "actions", + "consumers" + ], + "additionalProperties": false, + "properties": { + "path": { + "$ref": "#/$defs/project_relative_path" + }, + "format_version": { + "$ref": "#/$defs/non_empty_string" + }, + "digest": { + "$ref": "#/$defs/sha256_digest" + }, + "classes": { + "type": "array", + "minItems": 1, + "items": { + "enum": [ + "runtime_config", + "consultation_contract", + "source_plan", + "claim_configuration", + "deployment_input", + "review_record", + "documentation" + ] + } + }, + "sensitivity": { + "enum": ["public", "internal", "topology_sensitive"] + }, + "publication": { + "enum": ["public", "operator_only", "never_publish"] + }, + "edit": { + "enum": [ + "generated_do_not_edit", + "generated_review_before_edit", + "hand_maintained" + ] + }, + "version_control": { + "enum": ["commit", "ignore", "project_decision"] + }, + "review": { + "enum": [ + "generated_candidate", + "needs_review", + "reviewed", + "ready_candidate", + "released", + "deprecated" + ] + }, + "lifecycle": { + "enum": [ + "unsigned_non_deployable", + "signed_candidate", + "verified_deployable", + "review_evidence", + "publication_output" + ] + }, + "actions": { + "type": "array", + "items": { + "enum": ["regenerate", "compare", "validate", "sign", "verify", "discard"] + } + }, + "consumers": { + "type": "array", + "items": { + "enum": [ + "registry_relay", + "registry_notary", + "bundle_signer", + "deployment_tooling", + "project_documentation", + "operator" + ] + } + } + } + } + } +} diff --git a/crates/registryctl/schemas/project-reports/registry.project.capability_inventory.v1.schema.json b/crates/registryctl/schemas/project-reports/registry.project.capability_inventory.v1.schema.json new file mode 100644 index 000000000..1b7a422cd --- /dev/null +++ b/crates/registryctl/schemas/project-reports/registry.project.capability_inventory.v1.schema.json @@ -0,0 +1,574 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "https://id.registrystack.org/schemas/registryctl/project-reports/registry.project.capability_inventory.v1.schema.json", + "title": "Registry Stack project capability inventory v1", + "description": "Value-free offline inventory of installed, declared, enabled, used, missing, and inactive project capabilities.", + "type": "object", + "additionalProperties": false, + "required": [ + "schema_version", + "evidence_grade", + "runtime_activation", + "capabilities", + "support", + "missing_support", + "inactive_or_unused" + ], + "properties": { + "schema_version": { + "const": "registry.project.capability_inventory.v1" + }, + "evidence_grade": { + "const": "offline_static" + }, + "runtime_activation": { + "const": "not_evaluated" + }, + "capabilities": { + "type": "array", + "minItems": 12, + "maxItems": 12, + "items": { + "$ref": "#/$defs/capability_record" + }, + "allOf": [ + {"contains": {"properties": {"capability": {"const": "source_http"}}, "required": ["capability"]}, "minContains": 1, "maxContains": 1}, + {"contains": {"properties": {"capability": {"const": "source_script"}}, "required": ["capability"]}, "minContains": 1, "maxContains": 1}, + {"contains": {"properties": {"capability": {"const": "source_snapshot"}}, "required": ["capability"]}, "minContains": 1, "maxContains": 1}, + {"contains": {"properties": {"capability": {"const": "rhai_runtime"}}, "required": ["capability"]}, "minContains": 1, "maxContains": 1}, + {"contains": {"properties": {"capability": {"const": "rhai_abi"}}, "required": ["capability"]}, "minContains": 1, "maxContains": 1}, + {"contains": {"properties": {"capability": {"const": "registry_relay_product"}}, "required": ["capability"]}, "minContains": 1, "maxContains": 1}, + {"contains": {"properties": {"capability": {"const": "registry_notary_product"}}, "required": ["capability"]}, "minContains": 1, "maxContains": 1}, + {"contains": {"properties": {"capability": {"const": "registry_relay_validator"}}, "required": ["capability"]}, "minContains": 1, "maxContains": 1}, + {"contains": {"properties": {"capability": {"const": "registry_notary_validator"}}, "required": ["capability"]}, "minContains": 1, "maxContains": 1}, + {"contains": {"properties": {"capability": {"const": "project_authoring_schemas"}}, "required": ["capability"]}, "minContains": 1, "maxContains": 1}, + {"contains": {"properties": {"capability": {"const": "registry_relay_config_schema"}}, "required": ["capability"]}, "minContains": 1, "maxContains": 1}, + {"contains": {"properties": {"capability": {"const": "registry_notary_config_schema"}}, "required": ["capability"]}, "minContains": 1, "maxContains": 1} + ] + }, + "support": { + "type": "array", + "minItems": 14, + "maxItems": 14, + "items": { + "$ref": "#/$defs/support_assessment" + }, + "allOf": [ + {"contains": {"properties": {"component": {"const": "http_source_worker"}}, "required": ["component"]}, "minContains": 1, "maxContains": 1}, + {"contains": {"properties": {"component": {"const": "rhai_script_worker"}}, "required": ["component"]}, "minContains": 1, "maxContains": 1}, + {"contains": {"properties": {"component": {"const": "snapshot_materialization_worker"}}, "required": ["component"]}, "minContains": 1, "maxContains": 1}, + {"contains": {"properties": {"component": {"const": "rhai_xw_protocol_helper"}}, "required": ["component"]}, "minContains": 1, "maxContains": 1}, + {"contains": {"properties": {"component": {"const": "registry_relay_product"}}, "required": ["component"]}, "minContains": 1, "maxContains": 1}, + {"contains": {"properties": {"component": {"const": "registry_notary_product"}}, "required": ["component"]}, "minContains": 1, "maxContains": 1}, + {"contains": {"properties": {"component": {"const": "registry_relay_validator"}}, "required": ["component"]}, "minContains": 1, "maxContains": 1}, + {"contains": {"properties": {"component": {"const": "registry_notary_validator"}}, "required": ["component"]}, "minContains": 1, "maxContains": 1}, + {"contains": {"properties": {"component": {"const": "project_authoring_schema"}}, "required": ["component"]}, "minContains": 1, "maxContains": 1}, + {"contains": {"properties": {"component": {"const": "registry_relay_config_schema"}}, "required": ["component"]}, "minContains": 1, "maxContains": 1}, + {"contains": {"properties": {"component": {"const": "registry_notary_config_schema"}}, "required": ["component"]}, "minContains": 1, "maxContains": 1}, + {"contains": {"properties": {"component": {"const": "registryctl_distribution"}}, "required": ["component"]}, "minContains": 1, "maxContains": 1}, + {"contains": {"properties": {"component": {"const": "registry_relay_image"}}, "required": ["component"]}, "minContains": 1, "maxContains": 1}, + {"contains": {"properties": {"component": {"const": "registry_notary_image"}}, "required": ["component"]}, "minContains": 1, "maxContains": 1} + ] + }, + "missing_support": { + "type": "array", + "maxItems": 14, + "uniqueItems": true, + "items": { + "$ref": "#/$defs/missing_support" + } + }, + "inactive_or_unused": { + "type": "array", + "maxItems": 5, + "uniqueItems": true, + "items": { + "$ref": "#/$defs/inactive_or_unused" + } + } + }, + "$defs": { + "capability_id": { + "enum": [ + "source_http", + "source_script", + "source_snapshot", + "rhai_runtime", + "rhai_abi", + "registry_relay_product", + "registry_notary_product", + "registry_relay_validator", + "registry_notary_validator", + "project_authoring_schemas", + "registry_relay_config_schema", + "registry_notary_config_schema" + ] + }, + "capability_version": { + "enum": [ + "project_authoring_v1", + "relay_integration_pack_v1", + "rhai_language_v1", + "rhai_xw_v1", + "registry_relay_config_v1", + "registry_notary_config_v1" + ] + }, + "owner": { + "enum": [ + "registryctl", + "registry_relay", + "registry_notary", + "release_engineering" + ] + }, + "usage": { + "description": "Value-free usage counts. total is the bounded aggregate; strict typed ingress requires it to equal services + consultations + claims.", + "x-registry-aggregateMaximum": 1000000, + "type": "object", + "additionalProperties": false, + "required": [ + "services", + "consultations", + "claims", + "total" + ], + "properties": { + "services": { + "type": "integer", + "minimum": 0, + "maximum": 1000000 + }, + "consultations": { + "type": "integer", + "minimum": 0, + "maximum": 1000000 + }, + "claims": { + "type": "integer", + "minimum": 0, + "maximum": 1000000 + }, + "total": { + "type": "integer", + "minimum": 0, + "maximum": 1000000 + } + } + }, + "capability_record": { + "type": "object", + "additionalProperties": false, + "required": [ + "capability", + "kind", + "owner", + "maturity", + "supported_versions", + "installed_release", + "installed_evidence", + "project_declaration", + "environment_enablement", + "used_by", + "disposition" + ], + "properties": { + "capability": { + "$ref": "#/$defs/capability_id" + }, + "kind": { + "enum": [ + "source", + "runtime", + "abi", + "product", + "product_validator", + "schema" + ] + }, + "owner": { + "$ref": "#/$defs/owner" + }, + "maturity": { + "const": "release_gated" + }, + "supported_versions": { + "type": "array", + "minItems": 1, + "maxItems": 2, + "uniqueItems": true, + "items": { + "$ref": "#/$defs/capability_version" + } + }, + "installed_release": { + "enum": [ + "compiled", + "not_compiled", + "unsupported", + "not_evaluated" + ] + }, + "installed_evidence": { + "enum": [ + "linked_crate", + "embedded_compiler", + "embedded_schema", + "linked_product_validator", + "release_metadata", + "explicitly_unsupported", + "no_evidence" + ] + }, + "project_declaration": { + "enum": [ + "declared", + "not_declared", + "not_applicable" + ] + }, + "environment_enablement": { + "enum": [ + "enabled", + "not_enabled", + "not_applicable" + ] + }, + "used_by": { + "$ref": "#/$defs/usage" + }, + "disposition": { + "enum": [ + "used", + "used_but_not_enabled", + "used_with_missing_support", + "declared_enabled_unused", + "declared_inactive", + "installed_unused", + "unavailable_unused" + ] + } + }, + "allOf": [ + { + "if": { + "properties": { + "installed_release": { + "const": "compiled" + } + }, + "required": ["installed_release"] + }, + "then": { + "properties": { + "installed_evidence": { + "enum": [ + "linked_crate", + "embedded_compiler", + "embedded_schema", + "linked_product_validator", + "release_metadata" + ] + } + } + } + }, + { + "if": { + "properties": { + "installed_release": { + "const": "not_compiled" + } + }, + "required": ["installed_release"] + }, + "then": { + "properties": { + "installed_evidence": { + "const": "release_metadata" + } + } + } + }, + { + "if": { + "properties": { + "installed_release": { + "const": "unsupported" + } + }, + "required": ["installed_release"] + }, + "then": { + "properties": { + "installed_evidence": { + "const": "explicitly_unsupported" + } + } + } + }, + { + "if": { + "properties": { + "installed_release": { + "const": "not_evaluated" + } + }, + "required": ["installed_release"] + }, + "then": { + "properties": { + "installed_evidence": { + "const": "no_evidence" + } + } + } + } + ] + }, + "support_component": { + "enum": [ + "http_source_worker", + "rhai_script_worker", + "snapshot_materialization_worker", + "rhai_xw_protocol_helper", + "registry_relay_product", + "registry_notary_product", + "registry_relay_validator", + "registry_notary_validator", + "project_authoring_schema", + "registry_relay_config_schema", + "registry_notary_config_schema", + "registryctl_distribution", + "registry_relay_image", + "registry_notary_image" + ] + }, + "support_kind": { + "enum": [ + "worker", + "protocol_helper", + "product", + "product_validator", + "schema", + "distribution", + "image" + ] + }, + "support_state": { + "enum": [ + "available", + "missing", + "unsupported", + "not_evaluated" + ] + }, + "support_assessment": { + "type": "object", + "additionalProperties": false, + "required": [ + "component", + "kind", + "owner", + "state", + "evidence", + "required_by" + ], + "properties": { + "component": { + "$ref": "#/$defs/support_component" + }, + "kind": { + "$ref": "#/$defs/support_kind" + }, + "owner": { + "$ref": "#/$defs/owner" + }, + "state": { + "$ref": "#/$defs/support_state" + }, + "evidence": { + "enum": [ + "linked_crate", + "embedded_schema", + "linked_product_validator", + "release_metadata", + "explicitly_missing", + "explicitly_unsupported", + "no_evidence" + ] + }, + "required_by": { + "type": "array", + "minItems": 1, + "maxItems": 4, + "uniqueItems": true, + "items": { + "$ref": "#/$defs/capability_id" + } + } + }, + "allOf": [ + { + "if": { + "properties": { + "component": { + "enum": [ + "registry_relay_image", + "registry_notary_image" + ] + } + }, + "required": [ + "component" + ] + }, + "then": { + "properties": { + "kind": { + "const": "image" + }, + "state": { + "enum": [ + "unsupported", + "not_evaluated" + ] + } + } + } + }, + { + "if": { + "properties": { + "state": { + "const": "available" + } + }, + "required": ["state"] + }, + "then": { + "properties": { + "evidence": { + "enum": [ + "linked_crate", + "embedded_schema", + "linked_product_validator", + "release_metadata" + ] + } + } + } + }, + { + "if": { + "properties": { + "state": { + "const": "missing" + } + }, + "required": ["state"] + }, + "then": { + "properties": { + "evidence": { + "const": "explicitly_missing" + } + } + } + }, + { + "if": { + "properties": { + "state": { + "const": "unsupported" + } + }, + "required": ["state"] + }, + "then": { + "properties": { + "evidence": { + "const": "explicitly_unsupported" + } + } + } + }, + { + "if": { + "properties": { + "state": { + "const": "not_evaluated" + } + }, + "required": ["state"] + }, + "then": { + "properties": { + "evidence": { + "const": "no_evidence" + } + } + } + } + ] + }, + "missing_support": { + "type": "object", + "additionalProperties": false, + "required": [ + "component", + "kind", + "state", + "required_by" + ], + "properties": { + "component": { + "$ref": "#/$defs/support_component" + }, + "kind": { + "$ref": "#/$defs/support_kind" + }, + "state": { + "enum": [ + "missing", + "unsupported" + ] + }, + "required_by": { + "type": "array", + "minItems": 1, + "maxItems": 4, + "uniqueItems": true, + "items": { + "$ref": "#/$defs/capability_id" + } + } + } + }, + "inactive_or_unused": { + "type": "object", + "additionalProperties": false, + "required": [ + "capability", + "reason" + ], + "properties": { + "capability": { + "enum": [ + "source_http", + "source_script", + "source_snapshot", + "registry_relay_product", + "registry_notary_product" + ] + }, + "reason": { + "enum": [ + "declared_not_enabled", + "declared_enabled_not_used" + ] + } + } + } + } +} diff --git a/crates/registryctl/schemas/project-reports/registry.project.explanation.v1.schema.json b/crates/registryctl/schemas/project-reports/registry.project.explanation.v1.schema.json new file mode 100644 index 000000000..9e9b603df --- /dev/null +++ b/crates/registryctl/schemas/project-reports/registry.project.explanation.v1.schema.json @@ -0,0 +1,442 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "https://id.registrystack.org/schemas/registryctl/project-reports/registry.project.explanation.v1.schema.json", + "title": "Registry Project Explanation v1", + "type": "object", + "required": ["schema_version", "project", "environment", "fields"], + "additionalProperties": false, + "properties": { + "schema_version": { + "const": "registry.project.explanation.v1" + }, + "project": { + "$ref": "#/$defs/identifier" + }, + "environment": { + "$ref": "#/$defs/identifier" + }, + "fields": { + "type": "array", + "items": { + "$ref": "#/$defs/field_explanation" + } + } + }, + "$defs": { + "identifier": { + "type": "string", + "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]*$" + }, + "non_empty_string": { + "type": "string", + "minLength": 1 + }, + "json_pointer": { + "type": "string", + "pattern": "^(/([^~/]|~[01])*)*$" + }, + "field_address": { + "oneOf": [ + { + "type": "object", + "required": ["document", "path"], + "additionalProperties": false, + "properties": { + "document": { + "const": "project" + }, + "path": { + "$ref": "#/$defs/json_pointer" + } + } + }, + { + "type": "object", + "required": ["document", "integration", "path"], + "additionalProperties": false, + "properties": { + "document": { + "const": "integration" + }, + "integration": { + "$ref": "#/$defs/identifier" + }, + "path": { + "$ref": "#/$defs/json_pointer" + } + } + }, + { + "type": "object", + "required": ["document", "entity", "path"], + "additionalProperties": false, + "properties": { + "document": { + "const": "entity" + }, + "entity": { + "$ref": "#/$defs/identifier" + }, + "path": { + "$ref": "#/$defs/json_pointer" + } + } + }, + { + "type": "object", + "required": ["document", "environment", "path"], + "additionalProperties": false, + "properties": { + "document": { + "const": "environment" + }, + "environment": { + "$ref": "#/$defs/identifier" + }, + "path": { + "$ref": "#/$defs/json_pointer" + } + } + }, + { + "type": "object", + "required": ["document", "integration", "fixture", "path"], + "additionalProperties": false, + "properties": { + "document": { + "const": "fixture" + }, + "integration": { + "$ref": "#/$defs/identifier" + }, + "fixture": { + "$ref": "#/$defs/identifier" + }, + "path": { + "$ref": "#/$defs/json_pointer" + } + } + } + ] + }, + "field_source": { + "type": "object", + "required": ["kind"], + "additionalProperties": false, + "properties": { + "kind": { + "enum": [ + "authored", + "defaulted", + "detected", + "derived", + "environment_bound", + "generated", + "runtime", + "absent" + ] + }, + "address": { + "$ref": "#/$defs/field_address" + }, + "semantic_rule_id": { + "$ref": "#/$defs/non_empty_string" + } + } + }, + "field_state": { + "type": "object", + "required": ["presence", "effect"], + "additionalProperties": false, + "properties": { + "presence": { + "enum": [ + "authored", + "defaulted", + "detected", + "derived", + "environment_bound", + "generated", + "runtime", + "absent" + ] + }, + "effect": { + "enum": ["effective", "shadowed", "inactive", "not_applicable"] + } + } + }, + "reported_value": { + "oneOf": [ + { + "type": "object", + "required": ["state", "value"], + "additionalProperties": false, + "properties": { + "state": { + "const": "public" + }, + "value": { + "type": ["object", "array", "string", "number", "boolean", "null"] + } + } + }, + { + "type": "object", + "required": ["state", "classification", "reason"], + "additionalProperties": false, + "properties": { + "state": { + "const": "redacted" + }, + "classification": { + "enum": [ + "public", + "internal", + "sensitive", + "secret_reference", + "secret_value", + "redacted_fixture", + "structural" + ] + }, + "reason": { + "enum": ["policy", "secret_material", "sensitive_metadata"] + } + } + }, + { + "type": "object", + "required": ["state"], + "additionalProperties": false, + "properties": { + "state": { + "const": "absent" + } + } + } + ] + }, + "field_default": { + "type": "object", + "required": ["source", "applied"], + "additionalProperties": false, + "properties": { + "source": { + "enum": ["authoring_schema", "semantic_rule", "compiler", "product"] + }, + "applied": { + "type": "boolean" + }, + "reported_value": { + "$ref": "#/$defs/reported_value" + } + } + }, + "schema_ref": { + "type": "object", + "required": ["schema", "path"], + "additionalProperties": false, + "properties": { + "schema": { + "enum": ["project", "integration", "entity", "environment", "fixture"] + }, + "path": { + "$ref": "#/$defs/json_pointer" + } + } + }, + "field_constraints": { + "type": "object", + "required": ["schema_refs", "semantic_rule_ids"], + "additionalProperties": false, + "properties": { + "schema_refs": { + "type": "array", + "items": { + "$ref": "#/$defs/schema_ref" + } + }, + "semantic_rule_ids": { + "type": "array", + "items": { + "$ref": "#/$defs/non_empty_string" + } + } + } + }, + "field_knowledge_consumer": { + "enum": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ] + }, + "field_knowledge_review_class": { + "enum": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ] + }, + "field_knowledge": { + "type": "object", + "required": [ + "path_kind", + "semantic_owner", + "human_owner", + "sensitivity", + "products", + "introduced_in", + "availability", + "stability", + "migration", + "consumers", + "generated_artifacts", + "review_classes", + "semantic_rules" + ], + "additionalProperties": false, + "properties": { + "path_kind": { + "enum": ["root", "property", "map_key", "map_value", "array_item", "branch"] + }, + "semantic_owner": { + "enum": [ + "authoring_contract", + "deployment_security", + "integration_contract", + "fixture_harness", + "entity_contract" + ] + }, + "human_owner": { + "enum": [ + "registry_maintainers", + "security_maintainers", + "integration_maintainers", + "test_maintainers", + "data_model_maintainers" + ] + }, + "sensitivity": { + "enum": [ + "public", + "internal", + "sensitive", + "secret_reference", + "secret_value", + "redacted_fixture", + "structural" + ] + }, + "products": { + "type": "array", + "items": { + "enum": ["registryctl", "relay", "notary", "editor", "docs"] + } + }, + "introduced_in": { + "type": "string", + "pattern": "^[0-9]+\\.[0-9]+\\.[0-9]+(?:[-+][0-9A-Za-z.-]+)?$" + }, + "availability": { + "const": "published" + }, + "stability": { + "enum": ["experimental", "stable"] + }, + "migration": { + "enum": [ + "regenerate_editor_schemas", + "rebuild_project", + "coordinate_deployment", + "update_fixtures" + ] + }, + "consumers": { + "type": "array", + "items": { + "$ref": "#/$defs/field_knowledge_consumer" + } + }, + "generated_artifacts": { + "type": "array", + "items": { + "enum": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ] + } + }, + "review_classes": { + "type": "array", + "items": { + "$ref": "#/$defs/field_knowledge_review_class" + } + }, + "semantic_rules": { + "type": "array", + "items": { + "enum": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable", + "synthetic_fixture_value_redacted", + "sensitive_operational_metadata", + "arbitrary_map_keys_not_fixed_properties", + "array_items_share_element_contract", + "branch_has_no_authored_value" + ] + } + } + } + }, + "field_explanation": { + "type": "object", + "required": [ + "address", + "source", + "state", + "constraints", + "knowledge", + "reported_value" + ], + "additionalProperties": false, + "properties": { + "address": { + "$ref": "#/$defs/field_address" + }, + "source": { + "$ref": "#/$defs/field_source" + }, + "state": { + "$ref": "#/$defs/field_state" + }, + "default": { + "$ref": "#/$defs/field_default" + }, + "constraints": { + "$ref": "#/$defs/field_constraints" + }, + "knowledge": { + "$ref": "#/$defs/field_knowledge" + }, + "reported_value": { + "$ref": "#/$defs/reported_value" + } + } + } + } +} diff --git a/crates/registryctl/schemas/project-reports/registry.project.fixture_coverage.v1.schema.json b/crates/registryctl/schemas/project-reports/registry.project.fixture_coverage.v1.schema.json new file mode 100644 index 000000000..919f67f31 --- /dev/null +++ b/crates/registryctl/schemas/project-reports/registry.project.fixture_coverage.v1.schema.json @@ -0,0 +1,1137 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "https://id.registrystack.org/schemas/registryctl/project-reports/registry.project.fixture_coverage.v1.schema.json", + "title": "Registry project fixture coverage report v1", + "description": "Strict deterministic per-integration evidence from offline synthetic fixtures. The report contains no paths, country values, secrets, or live-source compatibility claims.", + "type": "object", + "additionalProperties": false, + "required": [ + "schema_version", + "project", + "environment", + "evidence_scope", + "compatibility_claim", + "live_compatibility", + "governed_request_evidence", + "targets", + "summary" + ], + "properties": { + "schema_version": { + "const": "registry.project.fixture_coverage.v1" + }, + "project": { + "$ref": "#/$defs/identifier" + }, + "environment": { + "oneOf": [ + { + "type": "null" + }, + { + "$ref": "#/$defs/identifier" + } + ] + }, + "evidence_scope": { + "const": "offline_synthetic" + }, + "compatibility_claim": { + "const": "none" + }, + "live_compatibility": { + "const": "not_evaluated" + }, + "governed_request_evidence": { + "const": "per_consultation_authored_request_witness_evaluation" + }, + "targets": { + "type": "array", + "maxItems": 256, + "items": { + "$ref": "#/$defs/target" + } + }, + "summary": { + "$ref": "#/$defs/summary" + } + }, + "$defs": { + "identifier": { + "type": "string", + "minLength": 1, + "maxLength": 256, + "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]*$" + }, + "evidence_id": { + "type": "string", + "minLength": 1, + "maxLength": 800, + "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/-]*$" + }, + "sha256_digest": { + "type": "string", + "pattern": "^sha256:[0-9a-f]{64}$" + }, + "identifier_list": { + "type": "array", + "maxItems": 1024, + "uniqueItems": true, + "items": { + "$ref": "#/$defs/identifier" + } + }, + "consultation_identity": { + "type": "object", + "additionalProperties": false, + "required": ["service_id", "consultation_id"], + "properties": { + "service_id": { + "$ref": "#/$defs/identifier" + }, + "consultation_id": { + "$ref": "#/$defs/identifier" + } + } + }, + "consultation_identity_list": { + "type": "array", + "maxItems": 512, + "uniqueItems": true, + "items": { + "$ref": "#/$defs/consultation_identity" + } + }, + "safe_code": { + "enum": [ + "authorization.denied", + "failure.subject_mismatch", + "fixture.execution_contract_invalid", + "fixture.profile_not_found", + "fixture.request_mismatch", + "fixture.source_operation_unknown", + "input.pattern_mismatch", + "source.cardinality_violation", + "source.deadline_exceeded", + "source.response_malformed", + "source.response_too_large", + "source.call_budget_exceeded", + "source.status_rejected", + "source.unavailable", + "source_unavailable", + "redacted_unclassified_error" + ] + }, + "nullable_safe_code": { + "oneOf": [ + { + "type": "null" + }, + { + "$ref": "#/$defs/safe_code" + } + ] + }, + "pass_state": { + "enum": [ + "passed", + "failed", + "not_executed" + ] + }, + "evidence": { + "type": "object", + "additionalProperties": false, + "required": [ + "kind", + "id", + "digest" + ], + "properties": { + "kind": { + "enum": [ + "authored_fixture", + "generated_case", + "platform_case", + "compiled_contract", + "semantic_comparison" + ] + }, + "id": { + "$ref": "#/$defs/evidence_id" + }, + "digest": { + "$ref": "#/$defs/sha256_digest" + } + } + }, + "semantic_expectation": { + "oneOf": [ + { + "type": "object", + "additionalProperties": false, + "required": [ + "kind", + "outcome" + ], + "properties": { + "kind": { + "const": "outcome" + }, + "outcome": { + "enum": [ + "match", + "no_match", + "ambiguous", + "successful" + ] + } + } + }, + { + "type": "object", + "additionalProperties": false, + "required": [ + "kind", + "code" + ], + "properties": { + "kind": { + "const": "safe_error_code" + }, + "code": { + "$ref": "#/$defs/safe_code" + } + } + } + ] + }, + "authored_fixture": { + "type": "object", + "additionalProperties": false, + "required": [ + "evidence", + "fixture_id", + "fixture_digest", + "expectation", + "semantic_null", + "interaction_count", + "input_ids", + "output_ids", + "claim_ids", + "exercised_status_mappings", + "classification", + "pass_state", + "request_to_consultation_binding" + ], + "properties": { + "evidence": { + "$ref": "#/$defs/evidence" + }, + "fixture_id": { + "$ref": "#/$defs/identifier" + }, + "fixture_digest": { + "$ref": "#/$defs/sha256_digest" + }, + "expectation": { + "$ref": "#/$defs/semantic_expectation" + }, + "semantic_null": { + "type": "boolean" + }, + "interaction_count": { + "type": "integer", + "minimum": 1, + "maximum": 16 + }, + "input_ids": { + "$ref": "#/$defs/identifier_list" + }, + "output_ids": { + "$ref": "#/$defs/identifier_list" + }, + "claim_ids": { + "$ref": "#/$defs/identifier_list" + }, + "exercised_status_mappings": { + "type": "array", + "maxItems": 2, + "uniqueItems": true, + "items": { + "$ref": "#/$defs/status_mapping" + } + }, + "classification": { + "const": "synthetic" + }, + "pass_state": { + "$ref": "#/$defs/pass_state" + }, + "request_to_consultation_binding": { + "$ref": "#/$defs/request_binding" + } + } + }, + "source_fixture": { + "type": "object", + "additionalProperties": false, + "required": [ + "fixture_id", + "fixture_digest" + ], + "properties": { + "fixture_id": { + "$ref": "#/$defs/identifier" + }, + "fixture_digest": { + "$ref": "#/$defs/sha256_digest" + } + } + }, + "recipe": { + "type": "object", + "additionalProperties": false, + "required": [ + "id", + "version" + ], + "properties": { + "id": { + "enum": [ + "request_authority", + "request_order", + "status_rejection", + "malformed_decode", + "byte_ceiling", + "timeout", + "protocol_verification", + "authorization_before_source", + "output_minimization" + ] + }, + "version": { + "const": "v1" + } + } + }, + "applicability": { + "oneOf": [ + { + "type": "object", + "additionalProperties": false, + "required": [ + "state" + ], + "properties": { + "state": { + "const": "applicable" + } + } + }, + { + "type": "object", + "additionalProperties": false, + "required": [ + "state", + "reason", + "invariant" + ], + "properties": { + "state": { + "const": "not_applicable" + }, + "reason": { + "enum": [ + "no_remote_source_capability", + "no_source_interaction", + "single_source_interaction", + "no_distinguishable_request_pair", + "no_generated_request_matcher", + "final_response_is_not_json_object", + "integration_has_no_product_claims", + "snapshot_uses_closed_materialization", + "protocol_matcher_owns_response_mutation" + ] + }, + "invariant": { + "enum": [ + "remote_mutation_requires_remote_source_capability", + "mutation_requires_source_interaction", + "order_mutation_requires_multiple_source_interactions", + "order_mutation_requires_distinguishable_source_interactions", + "protocol_mutation_requires_generated_request_matcher", + "mutation_requires_final_json_object_response", + "authorization_check_requires_product_claim_evaluation", + "snapshot_output_uses_closed_materialization_projection", + "protocol_matcher_fixture_uses_protocol_verification_instead" + ] + } + } + } + ] + }, + "source_access_assertion": { + "type": "object", + "additionalProperties": false, + "required": [ + "expected_source_calls", + "actual_source_calls", + "passed" + ], + "properties": { + "expected_source_calls": { + "const": "zero" + }, + "actual_source_calls": { + "oneOf": [ + { + "type": "null" + }, + { + "type": "integer", + "minimum": 0, + "maximum": 16 + } + ] + }, + "passed": { + "type": "boolean" + } + } + }, + "nullable_source_access_assertion": { + "oneOf": [ + { + "type": "null" + }, + { + "$ref": "#/$defs/source_access_assertion" + } + ] + }, + "generated_case": { + "type": "object", + "additionalProperties": false, + "required": [ + "evidence", + "recipe", + "source_fixture", + "applicability", + "mutation_target_class", + "expected_safe_code", + "actual_safe_code", + "pass_state", + "source_access_assertion" + ], + "properties": { + "evidence": { + "$ref": "#/$defs/evidence" + }, + "recipe": { + "$ref": "#/$defs/recipe" + }, + "source_fixture": { + "$ref": "#/$defs/source_fixture" + }, + "applicability": { + "$ref": "#/$defs/applicability" + }, + "mutation_target_class": { + "enum": [ + "request_path_authority", + "request_interaction_order", + "source_status", + "response_body_decoding", + "declared_response_byte_count", + "source_deadline", + "protocol_response_envelope", + "authorization_gate", + "unselected_response_member" + ] + }, + "expected_safe_code": { + "$ref": "#/$defs/nullable_safe_code" + }, + "actual_safe_code": { + "$ref": "#/$defs/nullable_safe_code" + }, + "pass_state": { + "$ref": "#/$defs/pass_state" + }, + "source_access_assertion": { + "$ref": "#/$defs/nullable_source_access_assertion" + } + } + }, + "platform_case": { + "type": "object", + "additionalProperties": false, + "required": [ + "evidence", + "case_id", + "version", + "component", + "mutation_target_class", + "expected_safe_code", + "actual_safe_code", + "pass_state" + ], + "properties": { + "evidence": { + "$ref": "#/$defs/evidence" + }, + "case_id": { + "const": "relay_script_call_budget" + }, + "version": { + "const": "v1" + }, + "component": { + "const": "relay_script_worker" + }, + "mutation_target_class": { + "const": "source_call_budget" + }, + "expected_safe_code": { + "const": "source.call_budget_exceeded" + }, + "actual_safe_code": { + "$ref": "#/$defs/safe_code" + }, + "pass_state": { + "$ref": "#/$defs/pass_state" + } + } + }, + "status_mapping": { + "type": "object", + "additionalProperties": false, + "required": [ + "outcome", + "statuses" + ], + "properties": { + "outcome": { + "enum": [ + "ambiguous", + "no_match" + ] + }, + "statuses": { + "type": "array", + "minItems": 1, + "maxItems": 64, + "uniqueItems": true, + "items": { + "type": "integer", + "minimum": 100, + "maximum": 599 + } + } + } + }, + "dimensions": { + "type": "object", + "additionalProperties": false, + "required": [ + "input_ids", + "output_ids", + "claim_ids", + "disclosure_modes", + "status_mappings", + "protocol_helpers", + "limits", + "script_branch_ids" + ], + "properties": { + "input_ids": { + "$ref": "#/$defs/identifier_list" + }, + "output_ids": { + "$ref": "#/$defs/identifier_list" + }, + "claim_ids": { + "$ref": "#/$defs/identifier_list" + }, + "disclosure_modes": { + "type": "array", + "maxItems": 3, + "uniqueItems": true, + "items": { + "enum": [ + "predicate", + "redacted", + "value" + ] + } + }, + "status_mappings": { + "type": "array", + "maxItems": 2, + "uniqueItems": true, + "items": { + "$ref": "#/$defs/status_mapping" + } + }, + "protocol_helpers": { + "type": "array", + "maxItems": 4, + "uniqueItems": true, + "items": { + "enum": [ + "request_primitive", + "response_codec", + "signed_dci", + "verification" + ] + } + }, + "limits": { + "type": "array", + "maxItems": 6, + "uniqueItems": true, + "items": { + "enum": [ + "aggregate_source_bytes", + "call_count", + "deadline", + "output_bytes", + "request_bytes", + "response_bytes" + ] + } + }, + "script_branch_ids": { + "$ref": "#/$defs/identifier_list" + } + } + }, + "change_impact": { + "type": "object", + "additionalProperties": false, + "required": [ + "kind", + "changed_member_ids", + "affected_fixture_ids", + "evidence" + ], + "properties": { + "kind": { + "enum": [ + "changed_input", + "changed_output", + "changed_claim", + "changed_source_contract" + ] + }, + "changed_member_ids": { + "$ref": "#/$defs/identifier_list" + }, + "affected_fixture_ids": { + "$ref": "#/$defs/identifier_list" + }, + "evidence": { + "$ref": "#/$defs/evidence" + } + } + }, + "semantic_comparison": { + "type": "object", + "additionalProperties": false, + "required": [ + "baseline_digest", + "candidate_digest", + "impacts" + ], + "properties": { + "baseline_digest": { + "$ref": "#/$defs/sha256_digest" + }, + "candidate_digest": { + "$ref": "#/$defs/sha256_digest" + }, + "impacts": { + "type": "array", + "minItems": 4, + "maxItems": 4, + "items": { + "$ref": "#/$defs/change_impact" + } + } + } + }, + "nullable_comparison": { + "oneOf": [ + { + "type": "null" + }, + { + "$ref": "#/$defs/semantic_comparison" + } + ] + }, + "request_binding": { + "type": "object", + "additionalProperties": false, + "required": ["state", "consultations", "actual_relay_consultations", "safe_error_code"], + "properties": { + "state": { + "enum": ["not_authored", "not_executed", "passed", "failed"] + }, + "consultations": { + "$ref": "#/$defs/consultation_identity_list" + }, + "actual_relay_consultations": { + "type": ["integer", "null"], + "minimum": 0, + "maximum": 4294967295 + }, + "safe_error_code": { + "$ref": "#/$defs/nullable_safe_code" + } + }, + "oneOf": [ + { + "properties": { + "state": { "enum": ["not_authored", "not_executed"] }, + "consultations": { "maxItems": 0 }, + "actual_relay_consultations": { "type": "null" }, + "safe_error_code": { "type": "null" } + } + }, + { + "properties": { + "state": { "const": "passed" }, + "consultations": { "minItems": 1 }, + "actual_relay_consultations": { + "type": "integer", + "minimum": 1, + "maximum": 4294967295 + }, + "safe_error_code": { "type": "null" } + } + }, + { + "properties": { + "state": { "const": "failed" }, + "consultations": { "maxItems": 0 }, + "actual_relay_consultations": { + "type": "integer", + "minimum": 0, + "maximum": 4294967295 + }, + "safe_error_code": { "$ref": "#/$defs/safe_code" } + } + } + ] + }, + "requirement_name": { + "enum": [ + "semantic_match", + "semantic_no_match", + "semantic_ambiguity", + "subject_mismatch", + "semantic_null", + "authorization_denial", + "source_failure", + "request_rendering", + "request_to_consultation_binding", + "expected_source_interactions", + "source_interaction_order", + "output_fields", + "claims", + "declared_disclosure_modes", + "exercised_disclosure_modes", + "script_branches", + "pagination_and_continuation", + "status_mappings", + "protocol_helpers", + "protocol_verification", + "authorization_before_source", + "malformed_decoding", + "structural_limits", + "request_bytes", + "response_bytes", + "aggregate_source_bytes", + "output_bytes", + "call_limits", + "timeout_classification", + "numeric_deadline_enforcement", + "output_minimization", + "changed_input_affected_fixtures", + "changed_output_affected_fixtures", + "changed_claim_affected_fixtures", + "changed_source_contract_affected_fixtures" + ] + }, + "evidence_list": { + "type": "array", + "maxItems": 1024, + "uniqueItems": true, + "items": { + "$ref": "#/$defs/evidence" + } + }, + "requirement_coverage": { + "oneOf": [ + { + "type": "object", + "additionalProperties": false, + "required": [ + "state", + "requirement", + "evidence" + ], + "properties": { + "state": { + "const": "covered" + }, + "requirement": { + "$ref": "#/$defs/requirement_name" + }, + "evidence": { + "allOf": [ + { + "$ref": "#/$defs/evidence_list" + }, + { + "minItems": 1 + } + ] + } + } + }, + { + "type": "object", + "additionalProperties": false, + "required": [ + "state", + "requirement", + "reason", + "evidence" + ], + "properties": { + "state": { + "const": "missing" + }, + "requirement": { + "$ref": "#/$defs/requirement_name" + }, + "reason": { + "enum": [ + "required_evidence_missing", + "target_has_no_fixtures", + "runtime_dimension_not_observed", + "numeric_boundary_not_exercised", + "script_branch_contract_not_declared" + ] + }, + "evidence": { + "$ref": "#/$defs/evidence_list" + } + } + }, + { + "type": "object", + "additionalProperties": false, + "required": [ + "state", + "requirement", + "reason", + "evidence" + ], + "properties": { + "state": { + "const": "not_applicable" + }, + "requirement": { + "$ref": "#/$defs/requirement_name" + }, + "reason": { + "enum": [ + "no_product_claims_declared", + "no_protocol_helpers_declared", + "no_verification_protocol_declared", + "no_continuation_protocol_declared", + "no_remote_source_capability", + "no_script_capability", + "no_status_mappings_declared", + "no_dynamic_source_calls_capability", + "single_compiled_source_operation", + "protocol_matcher_owns_output_validation", + "reviewed_ambiguity_not_applicable", + "reviewed_subject_mismatch_not_applicable" + ] + }, + "evidence": { + "$ref": "#/$defs/evidence_list" + } + } + }, + { + "type": "object", + "additionalProperties": false, + "required": [ + "state", + "requirement", + "reason", + "evidence" + ], + "properties": { + "state": { + "const": "not_evaluated" + }, + "requirement": { + "$ref": "#/$defs/requirement_name" + }, + "reason": { + "enum": [ + "comparison_input_absent", + "target_comparison_absent" + ] + }, + "evidence": { + "type": "array", + "maxItems": 0 + } + } + } + ] + }, + "requirements": { + "type": "array", + "minItems": 35, + "maxItems": 35, + "uniqueItems": true, + "prefixItems": [ + { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "semantic_match" } } }, + { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "semantic_no_match" } } }, + { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "semantic_ambiguity" } } }, + { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "subject_mismatch" } } }, + { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "semantic_null" } } }, + { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "authorization_denial" } } }, + { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "source_failure" } } }, + { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "request_rendering" } } }, + { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "request_to_consultation_binding" } } }, + { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "expected_source_interactions" } } }, + { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "source_interaction_order" } } }, + { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "output_fields" } } }, + { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "claims" } } }, + { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "declared_disclosure_modes" } } }, + { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "exercised_disclosure_modes" } } }, + { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "script_branches" } } }, + { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "pagination_and_continuation" } } }, + { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "status_mappings" } } }, + { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "protocol_helpers" } } }, + { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "protocol_verification" } } }, + { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "authorization_before_source" } } }, + { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "malformed_decoding" } } }, + { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "structural_limits" } } }, + { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "request_bytes" } } }, + { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "response_bytes" } } }, + { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "aggregate_source_bytes" } } }, + { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "output_bytes" } } }, + { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "call_limits" } } }, + { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "timeout_classification" } } }, + { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "numeric_deadline_enforcement" } } }, + { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "output_minimization" } } }, + { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "changed_input_affected_fixtures" } } }, + { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "changed_output_affected_fixtures" } } }, + { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "changed_claim_affected_fixtures" } } }, + { "$ref": "#/$defs/requirement_coverage", "properties": { "requirement": { "const": "changed_source_contract_affected_fixtures" } } } + ], + "items": false + }, + "target": { + "type": "object", + "additionalProperties": false, + "required": [ + "identity", + "contract", + "fixture_set_state", + "compiled_contract", + "fixture_inventory", + "generated_cases", + "platform_cases", + "declared", + "exercised", + "comparison", + "requirements" + ], + "properties": { + "identity": { + "type": "object", + "additionalProperties": false, + "required": [ + "integration", + "capability" + ], + "properties": { + "integration": { + "$ref": "#/$defs/identifier" + }, + "capability": { + "enum": [ + "declarative_http", + "script", + "snapshot" + ] + } + } + }, + "contract": { + "type": "object", + "additionalProperties": false, + "required": [ + "source_operation_count", + "reviewed_not_applicable", + "registry_backed_consultations" + ], + "properties": { + "source_operation_count": { + "oneOf": [ + { + "type": "null" + }, + { + "type": "integer", + "minimum": 0, + "maximum": 16 + } + ] + }, + "reviewed_not_applicable": { + "type": "array", + "maxItems": 2, + "uniqueItems": true, + "items": { + "enum": [ + "semantic_ambiguity", + "subject_mismatch" + ] + } + }, + "registry_backed_consultations": { + "$ref": "#/$defs/consultation_identity_list" + } + } + }, + "fixture_set_state": { + "enum": [ + "fixture_bearing", + "fixtureless" + ] + }, + "compiled_contract": { + "$ref": "#/$defs/evidence" + }, + "fixture_inventory": { + "type": "array", + "maxItems": 1024, + "items": { + "$ref": "#/$defs/authored_fixture" + } + }, + "generated_cases": { + "type": "array", + "maxItems": 9216, + "items": { + "$ref": "#/$defs/generated_case" + } + }, + "platform_cases": { + "type": "array", + "maxItems": 1, + "items": { + "$ref": "#/$defs/platform_case" + } + }, + "declared": { + "$ref": "#/$defs/dimensions" + }, + "exercised": { + "$ref": "#/$defs/dimensions" + }, + "comparison": { + "$ref": "#/$defs/nullable_comparison" + }, + "requirements": { + "$ref": "#/$defs/requirements" + } + } + }, + "summary": { + "type": "object", + "additionalProperties": false, + "required": [ + "target_set_state", + "target_count", + "fixture_bearing_target_count", + "fixtureless_target_count", + "requirements" + ], + "properties": { + "target_set_state": { + "enum": [ + "no_targets", + "targets_present" + ] + }, + "target_count": { + "type": "integer", + "minimum": 0, + "maximum": 256 + }, + "fixture_bearing_target_count": { + "type": "integer", + "minimum": 0, + "maximum": 256 + }, + "fixtureless_target_count": { + "type": "integer", + "minimum": 0, + "maximum": 256 + }, + "requirements": { + "type": "object", + "additionalProperties": false, + "required": [ + "covered", + "missing", + "not_applicable", + "not_evaluated", + "total" + ], + "properties": { + "covered": { + "type": "integer", + "minimum": 0, + "maximum": 8704 + }, + "missing": { + "type": "integer", + "minimum": 0, + "maximum": 8704 + }, + "not_applicable": { + "type": "integer", + "minimum": 0, + "maximum": 8704 + }, + "not_evaluated": { + "type": "integer", + "minimum": 0, + "maximum": 8704 + }, + "total": { + "type": "integer", + "minimum": 0, + "maximum": 8704 + } + } + } + } + } + } +} diff --git a/crates/registryctl/schemas/project-reports/registry.project.migration.v1.schema.json b/crates/registryctl/schemas/project-reports/registry.project.migration.v1.schema.json new file mode 100644 index 000000000..bf6358e36 --- /dev/null +++ b/crates/registryctl/schemas/project-reports/registry.project.migration.v1.schema.json @@ -0,0 +1,1092 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "https://id.registrystack.org/schemas/registryctl/project-reports/registry.project.migration.v1.schema.json", + "title": "Registry Stack project authoring migration report v1", + "description": "Strict, deterministic, value-free evidence for a checked project authoring migration. This report never performs a migration or overwrites authored files.", + "type": "object", + "additionalProperties": false, + "required": [ + "schema_version", + "evidence_grade", + "migration_execution", + "disposition", + "version_support", + "version_transitions", + "compatibility", + "compatible_normalizations", + "semantic_changes", + "affected", + "reviews", + "output", + "rerun_gates", + "diagnostics", + "unresolved_decisions", + "blocking_reasons", + "evidence_limitations" + ], + "properties": { + "schema_version": { + "const": "registry.project.migration.v1" + }, + "evidence_grade": { + "const": "offline_static" + }, + "migration_execution": { + "const": "not_performed" + }, + "disposition": { + "enum": [ + "no_migration_required", + "review_required", + "checked_safe", + "ready_for_explicit_write", + "blocked" + ] + }, + "version_support": { + "$ref": "#/$defs/version_support_assessment" + }, + "version_transitions": { + "type": "array", + "minItems": 5, + "maxItems": 5, + "prefixItems": [ + { + "allOf": [ + { + "$ref": "#/$defs/version_transition" + }, + { + "properties": { + "contract": { + "const": "project" + }, + "source_version": { + "$ref": "#/$defs/optional_authoring_version" + }, + "target_version": { + "$ref": "#/$defs/optional_authoring_version" + } + } + } + ] + }, + { + "allOf": [ + { + "$ref": "#/$defs/version_transition" + }, + { + "properties": { + "contract": { + "const": "integration" + } + } + } + ] + }, + { + "allOf": [ + { + "$ref": "#/$defs/version_transition" + }, + { + "properties": { + "contract": { + "const": "entity" + } + } + } + ] + }, + { + "allOf": [ + { + "$ref": "#/$defs/version_transition" + }, + { + "properties": { + "contract": { + "const": "fixture" + } + } + } + ] + }, + { + "allOf": [ + { + "$ref": "#/$defs/version_transition" + }, + { + "properties": { + "contract": { + "const": "environment" + } + } + } + ] + } + ], + "items": false + }, + "compatibility": { + "enum": [ + "no_migration_required", + "compatible_normalization_only", + "semantic_review_required", + "unsafe_or_unresolved", + "unsupported_transition", + "catalog_incomplete" + ] + }, + "compatible_normalizations": { + "type": "array", + "maxItems": 256, + "uniqueItems": true, + "items": { + "$ref": "#/$defs/change" + } + }, + "semantic_changes": { + "type": "array", + "maxItems": 256, + "uniqueItems": true, + "items": { + "$ref": "#/$defs/change" + } + }, + "affected": { + "$ref": "#/$defs/affected" + }, + "reviews": { + "type": "array", + "maxItems": 13, + "uniqueItems": true, + "items": { + "$ref": "#/$defs/review" + } + }, + "output": { + "$ref": "#/$defs/output" + }, + "rerun_gates": { + "type": "array", + "minItems": 5, + "maxItems": 5, + "prefixItems": [ + { + "allOf": [ + { + "$ref": "#/$defs/gate" + }, + { + "properties": { + "gate": { + "const": "schema" + } + } + } + ] + }, + { + "allOf": [ + { + "$ref": "#/$defs/gate" + }, + { + "properties": { + "gate": { + "const": "fixture" + } + } + } + ] + }, + { + "allOf": [ + { + "$ref": "#/$defs/gate" + }, + { + "properties": { + "gate": { + "const": "check" + } + } + } + ] + }, + { + "allOf": [ + { + "$ref": "#/$defs/gate" + }, + { + "properties": { + "gate": { + "const": "build" + } + } + } + ] + }, + { + "allOf": [ + { + "$ref": "#/$defs/gate" + }, + { + "properties": { + "gate": { + "const": "generated_reference" + } + } + } + ] + } + ], + "items": false + }, + "diagnostics": { + "description": "Closed, value-free source-inspection and gate-failure evidence. The Rust DTO additionally enforces diagnostic-to-version-support and diagnostic-to-gate-status coherence that JSON Schema cannot correlate across arrays.", + "type": "array", + "maxItems": 32, + "uniqueItems": true, + "items": { + "$ref": "#/$defs/diagnostic" + } + }, + "unresolved_decisions": { + "type": "array", + "maxItems": 64, + "uniqueItems": true, + "items": { + "$ref": "#/$defs/decision" + } + }, + "blocking_reasons": { + "type": "array", + "maxItems": 15, + "uniqueItems": true, + "items": { + "$ref": "#/$defs/blocking_reason" + } + }, + "evidence_limitations": { + "type": "array", + "minItems": 9, + "maxItems": 9, + "prefixItems": [ + { + "const": "offline_static_only" + }, + { + "const": "migration_not_performed" + }, + { + "const": "candidate_does_not_apply_migration" + }, + { + "const": "authored_files_never_overwritten" + }, + { + "const": "secret_material_not_inspected" + }, + { + "const": "raw_authored_values_omitted" + }, + { + "const": "runtime_not_evaluated" + }, + { + "const": "deployment_not_performed" + }, + { + "const": "country_approval_not_inferred" + } + ], + "items": false + } + }, + "allOf": [ + { + "if": { + "properties": { + "version_support": { + "properties": { + "target": { + "const": "unsupported" + } + }, + "required": [ + "target" + ] + } + }, + "required": [ + "version_support" + ] + }, + "then": { + "properties": { + "disposition": { + "const": "blocked" + }, + "version_transitions": { + "items": { + "properties": { + "target_version": { + "type": "null" + }, + "direction": { + "const": "unsupported_target" + } + }, + "required": [ + "target_version", + "direction" + ] + } + }, + "rerun_gates": { + "items": { + "properties": { + "status": { + "const": "not_applicable" + } + }, + "required": [ + "status" + ] + } + } + }, + "allOf": [ + { + "if": { + "properties": { + "version_support": { + "properties": { + "source": { + "const": "supported" + } + }, + "required": [ + "source" + ] + } + } + }, + "then": { + "properties": { + "blocking_reasons": { + "const": [ + "target_version_unsupported" + ] + } + } + } + } + ] + }, + "else": { + "properties": { + "version_transitions": { + "prefixItems": [ + { + "properties": { + "target_version": { + "$ref": "#/$defs/authoring_version" + }, + "direction": { + "not": { + "const": "unsupported_target" + } + } + }, + "required": [ + "target_version", + "direction" + ] + } + ], + "items": { + "oneOf": [ + { + "properties": { + "target_version": { + "$ref": "#/$defs/authoring_version" + }, + "direction": { + "not": { + "const": "unsupported_target" + } + } + }, + "required": [ + "target_version", + "direction" + ] + }, + { + "properties": { + "source_version": { + "type": "null" + }, + "target_version": { + "type": "null" + }, + "direction": { + "const": "absent" + } + }, + "required": [ + "source_version", + "target_version", + "direction" + ] + }, + { + "properties": { + "source_version": { + "$ref": "#/$defs/authoring_version" + }, + "target_version": { + "type": "null" + }, + "direction": { + "const": "removed_contract" + } + }, + "required": [ + "source_version", + "target_version", + "direction" + ] + } + ] + } + } + } + } + } + ], + "$defs": { + "authoring_version": { + "type": "integer", + "minimum": 1, + "maximum": 65535 + }, + "optional_authoring_version": { + "oneOf": [ + { + "$ref": "#/$defs/authoring_version" + }, + { + "type": "null" + } + ] + }, + "version_support": { + "enum": [ + "supported", + "unsupported", + "not_evaluated" + ] + }, + "version_support_assessment": { + "type": "object", + "additionalProperties": false, + "required": [ + "source", + "target" + ], + "properties": { + "source": { + "$ref": "#/$defs/version_support" + }, + "target": { + "$ref": "#/$defs/version_support" + } + } + }, + "authoring_contract": { + "enum": [ + "project", + "integration", + "entity", + "fixture", + "environment" + ] + }, + "version_direction": { + "enum": [ + "absent", + "same", + "upgrade", + "downgrade", + "added_contract", + "removed_contract", + "unsupported_target" + ] + }, + "version_transition": { + "type": "object", + "additionalProperties": false, + "required": [ + "contract", + "source_version", + "target_version", + "direction" + ], + "properties": { + "contract": { + "$ref": "#/$defs/authoring_contract" + }, + "source_version": { + "$ref": "#/$defs/optional_authoring_version" + }, + "target_version": { + "$ref": "#/$defs/optional_authoring_version" + }, + "direction": { + "$ref": "#/$defs/version_direction" + } + } + }, + "document": { + "enum": [ + "project", + "integration", + "entity", + "fixture", + "environment" + ] + }, + "field_path": { + "enum": [ + "", + "/version", + "/registry", + "/integrations/*", + "/entities/*", + "/services/*", + "/services/*/access", + "/services/*/consultations/*", + "/services/*/claims/*", + "/services/*/api/attribute_release_profiles/*/subject/input", + "/services/*/api/attribute_release_profiles/*/response", + "/services/*/api/attribute_release_profiles/*/response/max_age_seconds", + "/input", + "/capability", + "/outputs/*", + "/primary_key", + "/schema", + "/materialization", + "/classification", + "/interactions/*", + "/expect", + "/integrations/*/source/origin", + "/integrations/*/source/credential", + "/relay", + "/deployment", + "/notary_cel" + ] + }, + "address": { + "type": "object", + "additionalProperties": false, + "required": [ + "document", + "path" + ], + "properties": { + "document": { + "$ref": "#/$defs/document" + }, + "path": { + "$ref": "#/$defs/field_path" + } + } + }, + "operation": { + "enum": [ + "normalize_field", + "add_field", + "remove_field", + "rename_field", + "change_semantics" + ] + }, + "semantic_effect": { + "enum": [ + "preserved", + "changed", + "unresolved" + ] + }, + "safety": { + "enum": [ + "safe", + "unsafe", + "unresolved" + ] + }, + "replacement_disposition": { + "enum": [ + "not_applicable", + "field", + "no_replacement", + "unresolved" + ] + }, + "replacement": { + "type": "object", + "additionalProperties": false, + "required": [ + "disposition", + "address" + ], + "properties": { + "disposition": { + "$ref": "#/$defs/replacement_disposition" + }, + "address": { + "oneOf": [ + { + "$ref": "#/$defs/address" + }, + { + "type": "null" + } + ] + } + }, + "allOf": [ + { + "if": { + "properties": { + "disposition": { + "const": "field" + } + }, + "required": [ + "disposition" + ] + }, + "then": { + "properties": { + "address": { + "$ref": "#/$defs/address" + } + } + }, + "else": { + "properties": { + "address": { + "type": "null" + } + } + } + } + ] + }, + "owner": { + "enum": [ + "registryctl", + "country_author", + "operator" + ] + }, + "classification": { + "enum": [ + "public", + "structural", + "internal", + "sensitive", + "secret_reference", + "redacted_fixture" + ] + }, + "change": { + "type": "object", + "additionalProperties": false, + "required": [ + "address", + "operation", + "semantic_effect", + "safety", + "replacement", + "owner", + "classification" + ], + "properties": { + "address": { + "$ref": "#/$defs/address" + }, + "operation": { + "$ref": "#/$defs/operation" + }, + "semantic_effect": { + "$ref": "#/$defs/semantic_effect" + }, + "safety": { + "$ref": "#/$defs/safety" + }, + "replacement": { + "$ref": "#/$defs/replacement" + }, + "owner": { + "$ref": "#/$defs/owner" + }, + "classification": { + "$ref": "#/$defs/classification" + } + } + }, + "affected_count": { + "oneOf": [ + { + "type": "object", + "additionalProperties": false, + "required": [ + "state", + "count" + ], + "properties": { + "state": { + "const": "not_affected" + }, + "count": { + "const": 0 + } + } + }, + { + "type": "object", + "additionalProperties": false, + "required": [ + "state", + "count" + ], + "properties": { + "state": { + "const": "affected" + }, + "count": { + "type": "integer", + "minimum": 1, + "maximum": 1000000 + } + } + }, + { + "type": "object", + "additionalProperties": false, + "required": [ + "state", + "count" + ], + "properties": { + "state": { + "const": "unresolved" + }, + "count": { + "type": "null" + } + } + } + ] + }, + "artifact": { + "enum": [ + "relay_config", + "relay_environment_contract", + "notary_config", + "notary_environment_contract", + "project_explanation", + "project_semantic_impact", + "project_fixture_coverage", + "project_artifact_manifest", + "generated_configuration_reference", + "release_readiness_evidence" + ] + }, + "affected": { + "type": "object", + "additionalProperties": false, + "required": [ + "fixtures", + "services", + "consultations", + "claims", + "environments", + "generated_artifacts" + ], + "properties": { + "fixtures": { + "$ref": "#/$defs/affected_count" + }, + "services": { + "$ref": "#/$defs/affected_count" + }, + "consultations": { + "$ref": "#/$defs/affected_count" + }, + "claims": { + "$ref": "#/$defs/affected_count" + }, + "environments": { + "$ref": "#/$defs/affected_count" + }, + "generated_artifacts": { + "type": "array", + "maxItems": 10, + "uniqueItems": true, + "items": { + "$ref": "#/$defs/artifact" + } + } + } + }, + "review_class": { + "enum": [ + "authoring", + "compatibility", + "migration", + "fixtures", + "relay", + "notary", + "interoperability", + "privacy", + "security", + "operations", + "documentation", + "country_governance", + "release" + ] + }, + "review": { + "type": "object", + "additionalProperties": false, + "required": [ + "class", + "status" + ], + "properties": { + "class": { + "$ref": "#/$defs/review_class" + }, + "status": { + "enum": [ + "required_pending", + "approved" + ] + } + } + }, + "output": { + "type": "object", + "additionalProperties": false, + "required": [ + "mode", + "write_authority", + "candidate_artifact", + "candidate_eligibility", + "authored_file_policy", + "application_policy", + "candidate_emission" + ], + "properties": { + "mode": { + "enum": [ + "check_only", + "reviewable_patch", + "separate_output_directory" + ] + }, + "write_authority": { + "enum": [ + "not_granted", + "explicit_candidate_write_granted" + ] + }, + "candidate_artifact": { + "enum": [ + "none", + "reviewable_patch", + "separate_output_directory" + ] + }, + "candidate_eligibility": { + "enum": [ + "not_requested", + "eligible_to_emit", + "blocked" + ] + }, + "authored_file_policy": { + "const": "never_overwrite_authored_files" + }, + "application_policy": { + "const": "explicit_operator_apply_required" + }, + "candidate_emission": { + "enum": [ + "not_emitted", + "reviewable_patch_candidate_emitted", + "separate_output_candidate_emitted" + ] + } + } + }, + "gate": { + "type": "object", + "additionalProperties": false, + "required": [ + "gate", + "status" + ], + "properties": { + "gate": { + "enum": [ + "schema", + "fixture", + "check", + "build", + "generated_reference" + ] + }, + "status": { + "enum": [ + "passed", + "failed", + "not_run", + "not_required", + "not_applicable" + ] + } + } + }, + "decision": { + "type": "object", + "additionalProperties": false, + "required": [ + "owner", + "kind", + "scope" + ], + "properties": { + "owner": { + "enum": [ + "country_authority", + "project_operator" + ] + }, + "kind": { + "enum": [ + "country_semantic_intent", + "country_legal_basis", + "field_replacement", + "data_minimization", + "service_policy", + "claim_semantics", + "operator_trust", + "operator_secret_binding", + "operator_deployment" + ] + }, + "scope": { + "enum": [ + "project", + "service", + "consultation", + "claim", + "environment", + "generated_artifacts" + ] + } + } + }, + "blocking_reason": { + "enum": [ + "source_inspection_failed", + "source_version_unsupported", + "target_version_unsupported", + "version_support_not_evaluated", + "downgrade_or_contract_removal", + "migration_catalog_incomplete", + "unsafe_change", + "unresolved_change", + "removed_field_without_replacement", + "affected_surface_unresolved", + "unresolved_country_or_operator_decision", + "rerun_gate_failed", + "rerun_gate_not_run", + "explicit_write_authority_missing", + "write_authority_scope_mismatch" + ] + }, + "diagnostic": { + "type": "object", + "additionalProperties": false, + "required": [ + "code", + "phase", + "contract", + "remediation" + ], + "properties": { + "code": { + "enum": [ + "source_yaml_malformed", + "source_version_missing", + "source_version_malformed", + "source_version_zero", + "source_version_out_of_bounds", + "source_version_unsupported", + "source_versions_mixed", + "target_version_out_of_bounds", + "target_version_unsupported", + "rerun_gate_failed" + ] + }, + "phase": { + "enum": [ + "source_inspection", + "version_inspection", + "schema_gate", + "fixture_gate", + "check_gate", + "build_gate", + "generated_reference_gate" + ] + }, + "contract": { + "oneOf": [ + { + "$ref": "#/$defs/authoring_contract" + }, + { + "type": "null" + } + ] + }, + "remediation": { + "enum": [ + "correct_source_yaml", + "declare_supported_version", + "align_contract_versions", + "select_supported_target_version", + "inspect_candidate_schema", + "repair_fixtures", + "resolve_project_check", + "resolve_project_build", + "regenerate_configuration_reference" + ] + } + } + } + } +} diff --git a/crates/registryctl/schemas/project-reports/registry.project.promotion.v1.schema.json b/crates/registryctl/schemas/project-reports/registry.project.promotion.v1.schema.json new file mode 100644 index 000000000..c7296a9c4 --- /dev/null +++ b/crates/registryctl/schemas/project-reports/registry.project.promotion.v1.schema.json @@ -0,0 +1,874 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "https://id.registrystack.org/schemas/registryctl/project-reports/registry.project.promotion.v1.schema.json", + "title": "Registry Stack project promotion report v1", + "description": "Deterministic, value-free, offline comparison of two environments for a reviewed project revision. It does not claim deployment or runtime activation.", + "type": "object", + "additionalProperties": false, + "required": [ + "schema_version", + "evidence_grade", + "deployment", + "runtime_activation", + "disposition", + "reviewed_revision", + "changes", + "reviewed_ceiling", + "trust", + "compatibility", + "required_actions", + "blocking_reasons", + "evidence_limitations" + ], + "properties": { + "schema_version": { + "const": "registry.project.promotion.v1" + }, + "evidence_grade": { + "const": "offline_static" + }, + "deployment": { + "const": "not_performed" + }, + "runtime_activation": { + "const": "not_evaluated" + }, + "disposition": { + "enum": [ + "ready", + "ready_after_required_actions", + "blocked" + ] + }, + "reviewed_revision": { + "$ref": "#/$defs/reviewed_revision" + }, + "changes": { + "type": "array", + "maxItems": 256, + "uniqueItems": true, + "items": { + "$ref": "#/$defs/change" + } + }, + "reviewed_ceiling": { + "enum": [ + "within_reviewed_ceiling", + "narrowed", + "widened_blocked", + "unresolved_blocked" + ] + }, + "trust": { + "enum": [ + "resolved", + "unresolved_blocked" + ] + }, + "compatibility": { + "type": "array", + "minItems": 4, + "maxItems": 4, + "prefixItems": [ + { + "$ref": "#/$defs/product_compatibility" + }, + { + "$ref": "#/$defs/capability_compatibility" + }, + { + "$ref": "#/$defs/schema_compatibility" + }, + { + "$ref": "#/$defs/abi_compatibility" + } + ], + "items": false + }, + "required_actions": { + "$ref": "#/$defs/required_actions" + }, + "blocking_reasons": { + "type": "array", + "maxItems": 19, + "uniqueItems": true, + "items": { + "$ref": "#/$defs/blocking_reason" + } + }, + "evidence_limitations": { + "type": "array", + "minItems": 7, + "maxItems": 7, + "prefixItems": [ + { + "const": "offline_static_only" + }, + { + "const": "runtime_activation_not_evaluated" + }, + { + "const": "deployment_not_performed" + }, + { + "const": "live_endpoint_reachability_not_evaluated" + }, + { + "const": "secret_material_not_inspected" + }, + { + "const": "raw_authored_values_omitted" + }, + { + "const": "separate_relay_and_notary_bundle_lifecycle" + } + ], + "items": false + } + }, + "$defs": { + "reviewed_revision": { + "enum": [ + "same_reviewed_semantic_revision", + "different_reviewed_semantic_revision", + "not_proven" + ] + }, + "document": { + "enum": [ + "project", + "environment" + ] + }, + "field_path": { + "enum": [ + "/integrations/*/origin", + "/integrations/*/credentials", + "/integrations/*/trust", + "/notary/callers/*", + "/operations", + "/purposes/*", + "/service_policy", + "/notary/claims/*", + "/notary/disclosures/*", + "/products/*", + "/integrations/*/capabilities/*", + "/integrations/*/limits" + ] + }, + "address": { + "type": "object", + "additionalProperties": false, + "required": [ + "document", + "path" + ], + "properties": { + "document": { + "$ref": "#/$defs/document" + }, + "path": { + "$ref": "#/$defs/field_path" + } + } + }, + "change_kind": { + "enum": [ + "origin", + "credential_binding", + "trust", + "caller", + "operational", + "purpose", + "service_policy", + "claim", + "disclosure", + "product_enablement", + "capability_enablement", + "integration_ceiling" + ] + }, + "classification": { + "enum": [ + "public", + "internal", + "sensitive", + "secret_reference", + "secret_value", + "redacted_fixture", + "structural", + "unclassified" + ] + }, + "ownership": { + "enum": [ + "environment_owned", + "reviewed_project_owned", + "unclassified" + ] + }, + "boundary": { + "enum": [ + "allowed_environment_owned", + "reviewed_project_revision_difference", + "violation", + "unclassified" + ] + }, + "effect": { + "enum": [ + "changed_within_reviewed_authority", + "narrowed", + "widened", + "unresolved" + ] + }, + "change": { + "type": "object", + "additionalProperties": false, + "required": [ + "address", + "kind", + "classification", + "ownership", + "boundary", + "effect" + ], + "properties": { + "address": { + "$ref": "#/$defs/address" + }, + "kind": { + "$ref": "#/$defs/change_kind" + }, + "classification": { + "$ref": "#/$defs/classification" + }, + "ownership": { + "$ref": "#/$defs/ownership" + }, + "boundary": { + "$ref": "#/$defs/boundary" + }, + "effect": { + "$ref": "#/$defs/effect" + } + }, + "allOf": [ + { + "if": { + "properties": { + "kind": { + "const": "origin" + } + }, + "required": [ + "kind" + ] + }, + "then": { + "properties": { + "address": { + "$ref": "#/$defs/address_origin" + } + } + } + }, + { + "if": { + "properties": { + "kind": { + "const": "credential_binding" + } + }, + "required": [ + "kind" + ] + }, + "then": { + "properties": { + "address": { + "$ref": "#/$defs/address_credentials" + } + } + } + }, + { + "if": { + "properties": { + "kind": { + "const": "trust" + } + }, + "required": [ + "kind" + ] + }, + "then": { + "properties": { + "address": { + "$ref": "#/$defs/address_trust" + } + } + } + }, + { + "if": { + "properties": { + "kind": { + "const": "caller" + } + }, + "required": [ + "kind" + ] + }, + "then": { + "properties": { + "address": { + "$ref": "#/$defs/address_caller" + } + } + } + }, + { + "if": { + "properties": { + "kind": { + "const": "operational" + } + }, + "required": [ + "kind" + ] + }, + "then": { + "properties": { + "address": { + "$ref": "#/$defs/address_operational" + } + } + } + }, + { + "if": { + "properties": { + "kind": { + "const": "purpose" + } + }, + "required": [ + "kind" + ] + }, + "then": { + "properties": { + "address": { + "$ref": "#/$defs/address_purpose" + } + } + } + }, + { + "if": { + "properties": { + "kind": { + "const": "service_policy" + } + }, + "required": [ + "kind" + ] + }, + "then": { + "properties": { + "address": { + "$ref": "#/$defs/address_service_policy" + } + } + } + }, + { + "if": { + "properties": { + "kind": { + "const": "claim" + } + }, + "required": [ + "kind" + ] + }, + "then": { + "properties": { + "address": { + "$ref": "#/$defs/address_claim" + } + } + } + }, + { + "if": { + "properties": { + "kind": { + "const": "disclosure" + } + }, + "required": [ + "kind" + ] + }, + "then": { + "properties": { + "address": { + "$ref": "#/$defs/address_disclosure" + } + } + } + }, + { + "if": { + "properties": { + "kind": { + "const": "product_enablement" + } + }, + "required": [ + "kind" + ] + }, + "then": { + "properties": { + "address": { + "$ref": "#/$defs/address_product" + } + } + } + }, + { + "if": { + "properties": { + "kind": { + "const": "capability_enablement" + } + }, + "required": [ + "kind" + ] + }, + "then": { + "properties": { + "address": { + "$ref": "#/$defs/address_capability" + } + } + } + }, + { + "if": { + "properties": { + "kind": { + "const": "integration_ceiling" + } + }, + "required": [ + "kind" + ] + }, + "then": { + "properties": { + "address": { + "$ref": "#/$defs/address_ceiling" + } + } + } + } + ] + }, + "address_origin": { + "$ref": "#/$defs/environment_address_origin" + }, + "address_credentials": { + "$ref": "#/$defs/environment_address_credentials" + }, + "address_trust": { + "$ref": "#/$defs/environment_address_trust" + }, + "address_caller": { + "$ref": "#/$defs/environment_address_caller" + }, + "address_operational": { + "$ref": "#/$defs/environment_address_operational" + }, + "address_product": { + "$ref": "#/$defs/environment_address_product" + }, + "address_capability": { + "$ref": "#/$defs/environment_address_capability" + }, + "address_purpose": { + "$ref": "#/$defs/project_address_purpose" + }, + "address_service_policy": { + "$ref": "#/$defs/project_address_service_policy" + }, + "address_claim": { + "$ref": "#/$defs/project_address_claim" + }, + "address_disclosure": { + "$ref": "#/$defs/project_address_disclosure" + }, + "address_ceiling": { + "$ref": "#/$defs/project_address_ceiling" + }, + "environment_address_origin": { + "type": "object", + "additionalProperties": false, + "required": [ + "document", + "path" + ], + "properties": { + "document": { + "const": "environment" + }, + "path": { + "const": "/integrations/*/origin" + } + } + }, + "environment_address_credentials": { + "type": "object", + "additionalProperties": false, + "required": [ + "document", + "path" + ], + "properties": { + "document": { + "const": "environment" + }, + "path": { + "const": "/integrations/*/credentials" + } + } + }, + "environment_address_trust": { + "type": "object", + "additionalProperties": false, + "required": [ + "document", + "path" + ], + "properties": { + "document": { + "const": "environment" + }, + "path": { + "const": "/integrations/*/trust" + } + } + }, + "environment_address_caller": { + "type": "object", + "additionalProperties": false, + "required": [ + "document", + "path" + ], + "properties": { + "document": { + "const": "environment" + }, + "path": { + "const": "/notary/callers/*" + } + } + }, + "environment_address_operational": { + "type": "object", + "additionalProperties": false, + "required": [ + "document", + "path" + ], + "properties": { + "document": { + "const": "environment" + }, + "path": { + "const": "/operations" + } + } + }, + "environment_address_product": { + "type": "object", + "additionalProperties": false, + "required": [ + "document", + "path" + ], + "properties": { + "document": { + "const": "environment" + }, + "path": { + "const": "/products/*" + } + } + }, + "environment_address_capability": { + "type": "object", + "additionalProperties": false, + "required": [ + "document", + "path" + ], + "properties": { + "document": { + "const": "environment" + }, + "path": { + "const": "/integrations/*/capabilities/*" + } + } + }, + "project_address_purpose": { + "type": "object", + "additionalProperties": false, + "required": [ + "document", + "path" + ], + "properties": { + "document": { + "const": "project" + }, + "path": { + "const": "/purposes/*" + } + } + }, + "project_address_service_policy": { + "type": "object", + "additionalProperties": false, + "required": [ + "document", + "path" + ], + "properties": { + "document": { + "const": "project" + }, + "path": { + "const": "/service_policy" + } + } + }, + "project_address_claim": { + "type": "object", + "additionalProperties": false, + "required": [ + "document", + "path" + ], + "properties": { + "document": { + "const": "project" + }, + "path": { + "const": "/notary/claims/*" + } + } + }, + "project_address_disclosure": { + "type": "object", + "additionalProperties": false, + "required": [ + "document", + "path" + ], + "properties": { + "document": { + "const": "project" + }, + "path": { + "const": "/notary/disclosures/*" + } + } + }, + "project_address_ceiling": { + "type": "object", + "additionalProperties": false, + "required": [ + "document", + "path" + ], + "properties": { + "document": { + "const": "project" + }, + "path": { + "const": "/integrations/*/limits" + } + } + }, + "compatibility_state": { + "enum": [ + "compatible", + "missing", + "incompatible", + "unresolved" + ] + }, + "product_compatibility": { + "$ref": "#/$defs/compatibility_product" + }, + "capability_compatibility": { + "$ref": "#/$defs/compatibility_capability" + }, + "schema_compatibility": { + "$ref": "#/$defs/compatibility_schema" + }, + "abi_compatibility": { + "$ref": "#/$defs/compatibility_abi" + }, + "compatibility_product": { + "type": "object", + "additionalProperties": false, + "required": [ + "component", + "state" + ], + "properties": { + "component": { + "const": "product" + }, + "state": { + "$ref": "#/$defs/compatibility_state" + } + } + }, + "compatibility_capability": { + "type": "object", + "additionalProperties": false, + "required": [ + "component", + "state" + ], + "properties": { + "component": { + "const": "capability" + }, + "state": { + "$ref": "#/$defs/compatibility_state" + } + } + }, + "compatibility_schema": { + "type": "object", + "additionalProperties": false, + "required": [ + "component", + "state" + ], + "properties": { + "component": { + "const": "schema" + }, + "state": { + "$ref": "#/$defs/compatibility_state" + } + } + }, + "compatibility_abi": { + "type": "object", + "additionalProperties": false, + "required": [ + "component", + "state" + ], + "properties": { + "component": { + "const": "abi" + }, + "state": { + "$ref": "#/$defs/compatibility_state" + } + } + }, + "review_class": { + "enum": [ + "authoring", + "contract", + "semantics", + "interoperability", + "privacy", + "security", + "compatibility", + "operations", + "release" + ] + }, + "product_action": { + "enum": [ + "none", + "relay", + "notary", + "relay_and_notary" + ] + }, + "required_actions": { + "type": "object", + "additionalProperties": false, + "required": [ + "review_classes", + "re_sign", + "reactivate", + "restart" + ], + "properties": { + "review_classes": { + "type": "array", + "maxItems": 9, + "uniqueItems": true, + "items": { + "$ref": "#/$defs/review_class" + } + }, + "re_sign": { + "$ref": "#/$defs/product_action" + }, + "reactivate": { + "$ref": "#/$defs/product_action" + }, + "restart": { + "$ref": "#/$defs/product_action" + } + } + }, + "blocking_reason": { + "enum": [ + "reviewed_revision_not_proven", + "comparison_evidence_incomplete", + "environment_ownership_violation", + "unclassified_change", + "unresolved_change", + "policy_widening", + "authority_widening", + "reviewed_ceiling_widening", + "reviewed_ceiling_unresolved", + "trust_unresolved", + "missing_product", + "missing_capability", + "missing_schema", + "missing_abi", + "incompatible_product", + "incompatible_capability", + "incompatible_schema", + "incompatible_abi", + "compatibility_unresolved" + ] + } + } +} diff --git a/crates/registryctl/schemas/project-reports/registry.project.semantic_comparison.v1.schema.json b/crates/registryctl/schemas/project-reports/registry.project.semantic_comparison.v1.schema.json new file mode 100644 index 000000000..f1cf853d0 --- /dev/null +++ b/crates/registryctl/schemas/project-reports/registry.project.semantic_comparison.v1.schema.json @@ -0,0 +1,437 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "https://id.registrystack.org/schemas/registryctl/project-reports/registry.project.semantic_comparison.v1.schema.json", + "title": "Registry Project Semantic Comparison v1", + "type": "object", + "required": [ + "schema_version", + "comparison", + "evidence_grade", + "assurance", + "external_approval", + "equivalence", + "comparison_precision", + "review_plan", + "changes", + "required_actions", + "evidence_limitations" + ], + "additionalProperties": false, + "properties": { + "schema_version": { + "const": "registry.project.semantic_comparison.v1" + }, + "comparison": { + "enum": [ + "local_project_to_project", + "same_project_environment_to_environment", + "embedded_starter_to_project" + ] + }, + "evidence_grade": { + "const": "offline_static" + }, + "assurance": { + "enum": ["local_unverified", "embedded_exact_release"] + }, + "external_approval": { + "const": "not_evaluated" + }, + "equivalence": { + "enum": ["equivalent", "different"] + }, + "comparison_precision": { + "const": "field_and_generated_projection" + }, + "review_plan": { + "$ref": "#/$defs/review_plan" + }, + "changes": { + "type": "array", + "maxItems": 1024, + "items": { + "$ref": "#/$defs/change" + } + }, + "required_actions": { + "type": "array", + "maxItems": 9, + "uniqueItems": true, + "items": { + "$ref": "#/$defs/required_action" + } + }, + "evidence_limitations": { + "type": "array", + "minItems": 5, + "maxItems": 5, + "uniqueItems": true, + "prefixItems": [ + { "const": "offline_inputs_only" }, + { "const": "runtime_not_observed" }, + { "const": "signed_bundle_authority_not_evaluated" }, + { "const": "external_approval_not_evaluated" }, + { "const": "fingerprints_not_published" } + ], + "items": false + } + }, + "allOf": [ + { + "if": { + "properties": { + "comparison": { "const": "embedded_starter_to_project" } + }, + "required": ["comparison"] + }, + "then": { + "properties": { + "assurance": { "const": "embedded_exact_release" } + } + }, + "else": { + "properties": { + "assurance": { "const": "local_unverified" } + } + } + }, + { + "if": { + "properties": { + "equivalence": { "const": "equivalent" } + }, + "required": ["equivalence"] + }, + "then": { + "properties": { + "changes": { "maxItems": 0 }, + "required_actions": { "maxItems": 0 }, + "review_plan": { + "properties": { + "state": { "const": "generated_no_changes" }, + "review_classes": { "maxItems": 0 } + } + } + } + }, + "else": { + "properties": { + "changes": { "minItems": 1 }, + "required_actions": { "minItems": 3 }, + "review_plan": { + "properties": { + "state": { "const": "generated_pending_review" }, + "review_classes": { "minItems": 1 } + } + } + } + } + } + ], + "$defs": { + "schema_field": { + "type": "string", + "minLength": 1, + "maxLength": 512, + "pattern": "^/(?:\\$defs|properties|additionalProperties|items|oneOf|anyOf|allOf|if|then|else|not|prefixItems|review_plan|approval_projection|[A-Za-z][A-Za-z0-9_-]*|[0-9]+)(?:/(?:\\$defs|properties|additionalProperties|items|oneOf|anyOf|allOf|if|then|else|not|prefixItems|[A-Za-z][A-Za-z0-9_-]*|[0-9]+))*$" + }, + "address": { + "type": "object", + "required": ["schema_family", "field"], + "additionalProperties": false, + "properties": { + "schema_family": { + "enum": [ + "project", + "environment", + "integration", + "fixture", + "entity", + "generated_review", + "generated_approval" + ] + }, + "field": { + "$ref": "#/$defs/schema_field" + } + } + }, + "change_source": { + "enum": [ + "authored", + "defaulted", + "derived", + "environment_bound", + "generated" + ] + }, + "dimension": { + "enum": [ + "project", + "integration", + "fixture", + "entity", + "service_policy", + "consultation", + "claim", + "disclosure", + "operator_security", + "generated_review", + "generated_approval" + ] + }, + "direction": { + "enum": ["added", "removed", "changed", "narrowed", "widened"] + }, + "sensitivity": { + "enum": [ + "public", + "internal", + "sensitive", + "secret_reference", + "secret_value", + "redacted_fixture", + "structural" + ] + }, + "semantic_owner": { + "enum": [ + "authoring_contract", + "deployment_security", + "integration_contract", + "fixture_harness", + "entity_contract", + "relay_runtime", + "notary_runtime" + ] + }, + "human_owner": { + "enum": [ + "registry_maintainers", + "security_maintainers", + "integration_maintainers", + "test_maintainers", + "data_model_maintainers", + "relay_maintainers", + "notary_maintainers" + ] + }, + "consumer": { + "enum": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator", + "bundle_signer", + "deployment_tooling", + "operator" + ] + }, + "generated_artifact": { + "enum": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference", + "review_plan", + "approval_projection" + ] + }, + "review_class": { + "enum": [ + "contract", + "authoring", + "semantics", + "interoperability", + "privacy", + "security", + "relay", + "notary", + "compatibility", + "documentation", + "testing", + "operations", + "release" + ] + }, + "affected_subject_kind": { + "enum": [ + "integration", + "fixture", + "entity", + "service_policy", + "consultation", + "claim", + "disclosure", + "product_input", + "generated_artifact" + ] + }, + "affected_subject": { + "type": "object", + "required": ["kind", "count"], + "additionalProperties": false, + "properties": { + "kind": { + "$ref": "#/$defs/affected_subject_kind" + }, + "count": { + "type": "integer", + "minimum": 1, + "maximum": 8192 + } + } + }, + "requirements": { + "type": "object", + "required": ["signing", "activation", "restart"], + "additionalProperties": false, + "properties": { + "signing": { + "enum": [ + "none", + "relay_bundle", + "notary_bundle", + "relay_and_notary_bundles" + ] + }, + "activation": { + "enum": [ + "none", + "apply_relay_config", + "apply_notary_config", + "apply_relay_and_notary_config" + ] + }, + "restart": { + "enum": [ + "none", + "registry_relay", + "registry_notary", + "registry_relay_and_notary" + ] + } + } + }, + "change": { + "type": "object", + "required": [ + "address", + "source", + "dimension", + "direction", + "sensitivity", + "semantic_owner", + "human_owner", + "consumers", + "generated_artifacts", + "review_classes", + "affected_subjects", + "occurrences", + "requirements" + ], + "additionalProperties": false, + "properties": { + "address": { + "$ref": "#/$defs/address" + }, + "source": { + "$ref": "#/$defs/change_source" + }, + "dimension": { + "$ref": "#/$defs/dimension" + }, + "direction": { + "$ref": "#/$defs/direction" + }, + "sensitivity": { + "$ref": "#/$defs/sensitivity" + }, + "semantic_owner": { + "$ref": "#/$defs/semantic_owner" + }, + "human_owner": { + "$ref": "#/$defs/human_owner" + }, + "consumers": { + "type": "array", + "minItems": 1, + "maxItems": 8, + "uniqueItems": true, + "items": { + "$ref": "#/$defs/consumer" + } + }, + "generated_artifacts": { + "type": "array", + "minItems": 1, + "maxItems": 8, + "uniqueItems": true, + "items": { + "$ref": "#/$defs/generated_artifact" + } + }, + "review_classes": { + "type": "array", + "minItems": 1, + "maxItems": 13, + "uniqueItems": true, + "items": { + "$ref": "#/$defs/review_class" + } + }, + "affected_subjects": { + "type": "array", + "minItems": 1, + "maxItems": 9, + "uniqueItems": true, + "items": { + "$ref": "#/$defs/affected_subject" + } + }, + "occurrences": { + "type": "integer", + "minimum": 1, + "maximum": 8192 + }, + "requirements": { + "$ref": "#/$defs/requirements" + } + } + }, + "review_plan": { + "type": "object", + "required": ["state", "review_classes"], + "additionalProperties": false, + "properties": { + "state": { + "enum": ["generated_no_changes", "generated_pending_review"] + }, + "review_classes": { + "type": "array", + "maxItems": 13, + "uniqueItems": true, + "items": { + "$ref": "#/$defs/review_class" + } + } + } + }, + "required_action": { + "enum": [ + "review_semantic_changes", + "run_affected_fixtures", + "regenerate_generated_artifacts", + "resign_relay_bundle", + "resign_notary_bundle", + "reactivate_relay_configuration", + "reactivate_notary_configuration", + "restart_registry_relay", + "restart_registry_notary" + ] + } + } +} diff --git a/crates/registryctl/schemas/project-reports/registry.project.semantic_impact.v1.schema.json b/crates/registryctl/schemas/project-reports/registry.project.semantic_impact.v1.schema.json new file mode 100644 index 000000000..76c5c8ea0 --- /dev/null +++ b/crates/registryctl/schemas/project-reports/registry.project.semantic_impact.v1.schema.json @@ -0,0 +1,316 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "https://id.registrystack.org/schemas/registryctl/project-reports/registry.project.semantic_impact.v1.schema.json", + "title": "Registry Project Semantic Impact v1", + "type": "object", + "required": ["schema_version", "baseline", "changes"], + "additionalProperties": false, + "properties": { + "schema_version": { + "const": "registry.project.semantic_impact.v1" + }, + "baseline": { + "$ref": "#/$defs/baseline" + }, + "changes": { + "type": "array", + "items": { + "$ref": "#/$defs/semantic_impact" + } + } + }, + "$defs": { + "identifier": { + "type": "string", + "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]*$" + }, + "json_pointer": { + "type": "string", + "pattern": "^(/([^~/]|~[01])*)*$" + }, + "baseline": { + "enum": ["initial_without_baseline", "verified_signed_bundle"] + }, + "dimension": { + "enum": [ + "claim", + "integration", + "service_policy", + "operator_security", + "disclosure", + "compiler" + ] + }, + "direction": { + "enum": [ + "added", + "removed", + "changed", + "narrowed", + "widened", + "default_changed", + "unbaselined" + ] + }, + "consumer": { + "enum": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator", + "bundle_signer", + "deployment_tooling", + "operator" + ] + }, + "review_class": { + "enum": [ + "contract", + "authoring", + "semantics", + "interoperability", + "privacy", + "security", + "relay", + "notary", + "compatibility", + "documentation", + "testing", + "operations", + "release" + ] + }, + "field_address": { + "oneOf": [ + { + "type": "object", + "required": ["document", "path"], + "additionalProperties": false, + "properties": { + "document": { + "const": "project" + }, + "path": { + "$ref": "#/$defs/json_pointer" + } + } + }, + { + "type": "object", + "required": ["document", "integration", "path"], + "additionalProperties": false, + "properties": { + "document": { + "const": "integration" + }, + "integration": { + "$ref": "#/$defs/identifier" + }, + "path": { + "$ref": "#/$defs/json_pointer" + } + } + }, + { + "type": "object", + "required": ["document", "entity", "path"], + "additionalProperties": false, + "properties": { + "document": { + "const": "entity" + }, + "entity": { + "$ref": "#/$defs/identifier" + }, + "path": { + "$ref": "#/$defs/json_pointer" + } + } + }, + { + "type": "object", + "required": ["document", "environment", "path"], + "additionalProperties": false, + "properties": { + "document": { + "const": "environment" + }, + "environment": { + "$ref": "#/$defs/identifier" + }, + "path": { + "$ref": "#/$defs/json_pointer" + } + } + }, + { + "type": "object", + "required": ["document", "integration", "fixture", "path"], + "additionalProperties": false, + "properties": { + "document": { + "const": "fixture" + }, + "integration": { + "$ref": "#/$defs/identifier" + }, + "fixture": { + "$ref": "#/$defs/identifier" + }, + "path": { + "$ref": "#/$defs/json_pointer" + } + } + } + ] + }, + "affected_subject": { + "type": "object", + "required": ["kind", "id"], + "additionalProperties": false, + "properties": { + "kind": { + "enum": [ + "integration", + "fixture", + "service_policy", + "consultation", + "claim", + "disclosure", + "product_input", + "generated_artifact" + ] + }, + "id": { + "$ref": "#/$defs/identifier" + } + } + }, + "product_impact": { + "type": "object", + "required": ["product", "impact"], + "additionalProperties": false, + "properties": { + "product": { + "enum": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ] + }, + "impact": { + "enum": ["regenerate", "revalidate", "reconfigure", "republish", "none"] + } + } + }, + "requirements": { + "type": "object", + "required": ["signing", "activation", "restart"], + "additionalProperties": false, + "properties": { + "signing": { + "enum": [ + "none", + "relay_bundle", + "notary_bundle", + "relay_and_notary_bundles" + ] + }, + "activation": { + "enum": [ + "none", + "republish_artifacts", + "apply_relay_config", + "apply_notary_config", + "apply_relay_and_notary_config" + ] + }, + "restart": { + "enum": [ + "none", + "registry_relay", + "registry_notary", + "registry_relay_and_notary" + ] + } + } + }, + "semantic_impact": { + "type": "object", + "required": [ + "precision", + "dimension", + "direction", + "affected_subjects", + "consumers", + "review_classes", + "product_impacts", + "requirements" + ], + "additionalProperties": false, + "properties": { + "precision": { + "enum": ["field", "dimension"] + }, + "field": { + "$ref": "#/$defs/field_address" + }, + "dimension": { + "$ref": "#/$defs/dimension" + }, + "direction": { + "$ref": "#/$defs/direction" + }, + "affected_subjects": { + "type": "array", + "items": { + "$ref": "#/$defs/affected_subject" + } + }, + "consumers": { + "type": "array", + "items": { + "$ref": "#/$defs/consumer" + } + }, + "review_classes": { + "type": "array", + "items": { + "$ref": "#/$defs/review_class" + } + }, + "product_impacts": { + "type": "array", + "items": { + "$ref": "#/$defs/product_impact" + } + }, + "requirements": { + "$ref": "#/$defs/requirements" + } + }, + "allOf": [ + { + "if": { + "properties": { + "precision": { + "const": "field" + } + } + }, + "then": { + "required": ["field"] + }, + "else": { + "properties": { + "field": false + } + } + } + ] + } + } +} diff --git a/crates/registryctl/schemas/project-reports/registryctl.authoring_error_reference.v1.schema.json b/crates/registryctl/schemas/project-reports/registryctl.authoring_error_reference.v1.schema.json new file mode 100644 index 000000000..c3535947e --- /dev/null +++ b/crates/registryctl/schemas/project-reports/registryctl.authoring_error_reference.v1.schema.json @@ -0,0 +1,167 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "https://id.registrystack.org/schemas/registryctl/project-reports/registryctl.authoring_error_reference.v1.schema.json", + "title": "Registryctl Authoring Error Reference v1", + "type": "object", + "required": ["schema_version", "entries"], + "additionalProperties": false, + "properties": { + "schema_version": { + "const": "registryctl.authoring_error_reference.v1" + }, + "entries": { + "type": "array", + "minItems": 17, + "maxItems": 17, + "uniqueItems": true, + "items": { + "$ref": "#/$defs/entry" + } + } + }, + "$defs": { + "code": { + "enum": [ + "registryctl.authoring.diagnostics.truncated", + "registryctl.authoring.entity.invalid", + "registryctl.authoring.environment.invalid", + "registryctl.authoring.file.too_large", + "registryctl.authoring.file.unreadable", + "registryctl.authoring.fixture.invalid", + "registryctl.authoring.fixture.reserved_body_field", + "registryctl.authoring.integration.invalid", + "registryctl.authoring.path.unsafe", + "registryctl.authoring.project.invalid", + "registryctl.authoring.project.scope_collision", + "registryctl.authoring.script.closed_contract_violation", + "registryctl.authoring.script.invalid_signature", + "registryctl.authoring.script.syntax_error", + "registryctl.authoring.script.unknown_function", + "registryctl.authoring.yaml.invalid_syntax", + "registryctl.authoring.yaml.unknown_field" + ] + }, + "entry": { + "type": "object", + "required": [ + "family", + "code", + "owner", + "product", + "phase", + "safe_meaning", + "rule", + "safe_remediation", + "field_address_pattern", + "evidence_scope", + "secret_sensitive_value_policy", + "docs_anchor", + "lifecycle", + "introduced_in", + "stability", + "evidence_limitation" + ], + "additionalProperties": false, + "properties": { + "family": { + "const": "authoring_validation" + }, + "code": { + "$ref": "#/$defs/code" + }, + "owner": { + "const": "registryctl" + }, + "product": { + "const": "registryctl" + }, + "phase": { + "enum": [ + "aggregation", + "safe_input", + "script_validation", + "semantic_validation", + "syntax" + ] + }, + "safe_meaning": { + "$ref": "#/$defs/safe_text" + }, + "rule": { + "$ref": "#/$defs/safe_text" + }, + "safe_remediation": { + "$ref": "#/$defs/safe_text" + }, + "field_address_pattern": { + "type": ["string", "null"], + "minLength": 1, + "maxLength": 512 + }, + "evidence_scope": { + "$ref": "#/$defs/safe_text" + }, + "secret_sensitive_value_policy": { + "enum": ["no_received_value", "received_type_only"] + }, + "docs_anchor": { + "type": "string", + "pattern": "^/reference/diagnostics/authoring/#registryctl--registryctl\\.authoring\\.[a-z0-9_]+(?:\\.[a-z0-9_]+)*$", + "maxLength": 512 + }, + "lifecycle": { + "$ref": "#/$defs/lifecycle" + }, + "introduced_in": { + "$ref": "#/$defs/introduced_in" + }, + "stability": { + "const": "pre1_stable_code" + }, + "evidence_limitation": { + "$ref": "#/$defs/safe_text" + } + }, + "allOf": [ + { + "$ref": "#/$defs/lifecycle_version" + } + ] + }, + "safe_text": { + "type": "string", + "minLength": 1, + "maxLength": 4096 + }, + "lifecycle": { + "enum": ["unreleased", "active", "deprecated", "released"] + }, + "introduced_in": { + "type": ["string", "null"], + "pattern": "^(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)$" + }, + "lifecycle_version": { + "if": { + "properties": { + "lifecycle": { + "const": "unreleased" + } + } + }, + "then": { + "properties": { + "introduced_in": { + "type": "null" + } + } + }, + "else": { + "properties": { + "introduced_in": { + "type": "string" + } + } + } + } + } +} diff --git a/crates/registryctl/schemas/project-reports/registryctl.fixture_error_reference.v1.schema.json b/crates/registryctl/schemas/project-reports/registryctl.fixture_error_reference.v1.schema.json new file mode 100644 index 000000000..64499435c --- /dev/null +++ b/crates/registryctl/schemas/project-reports/registryctl.fixture_error_reference.v1.schema.json @@ -0,0 +1,158 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "https://id.registrystack.org/schemas/registryctl/project-reports/registryctl.fixture_error_reference.v1.schema.json", + "title": "Registryctl Offline Fixture Error Reference v1", + "type": "object", + "required": ["schema_version", "entries"], + "additionalProperties": false, + "properties": { + "schema_version": { + "const": "registryctl.fixture_error_reference.v1" + }, + "entries": { + "type": "array", + "minItems": 16, + "maxItems": 16, + "uniqueItems": true, + "items": { + "$ref": "#/$defs/entry" + } + } + }, + "$defs": { + "code": { + "enum": [ + "authorization.denied", + "failure.subject_mismatch", + "fixture.execution_contract_invalid", + "fixture.profile_not_found", + "fixture.request_mismatch", + "fixture.source_operation_unknown", + "input.pattern_mismatch", + "redacted_unclassified_error", + "source.call_budget_exceeded", + "source.cardinality_violation", + "source.deadline_exceeded", + "source.response_malformed", + "source.response_too_large", + "source.status_rejected", + "source.unavailable", + "source_unavailable" + ] + }, + "entry": { + "type": "object", + "required": [ + "family", + "code", + "owner", + "product", + "phase", + "safe_meaning", + "rule", + "safe_remediation", + "field_address_pattern", + "evidence_scope", + "secret_sensitive_value_policy", + "docs_anchor", + "lifecycle", + "introduced_in", + "stability", + "evidence_limitation" + ], + "additionalProperties": false, + "properties": { + "family": { + "const": "fixture_execution" + }, + "code": { + "$ref": "#/$defs/code" + }, + "owner": { + "const": "registryctl" + }, + "product": { + "const": "registryctl_relay_offline_harness" + }, + "phase": { + "const": "offline_execution" + }, + "safe_meaning": { + "$ref": "#/$defs/safe_text" + }, + "rule": { + "$ref": "#/$defs/safe_text" + }, + "safe_remediation": { + "$ref": "#/$defs/safe_text" + }, + "field_address_pattern": { + "type": "null" + }, + "evidence_scope": { + "$ref": "#/$defs/safe_text" + }, + "secret_sensitive_value_policy": { + "const": "no_runtime_values" + }, + "docs_anchor": { + "type": "string", + "pattern": "^/reference/diagnostics/fixture/#registryctl_relay_offline_harness--[a-z][a-z0-9_]*(?:\\.[a-z0-9_]+)*$", + "maxLength": 512 + }, + "lifecycle": { + "$ref": "#/$defs/lifecycle" + }, + "introduced_in": { + "$ref": "#/$defs/introduced_in" + }, + "stability": { + "const": "pre1_stable_code" + }, + "evidence_limitation": { + "$ref": "#/$defs/safe_text" + } + }, + "allOf": [ + { + "$ref": "#/$defs/lifecycle_version" + } + ] + }, + "safe_text": { + "type": "string", + "minLength": 1, + "maxLength": 4096 + }, + "lifecycle": { + "enum": ["unreleased", "active", "deprecated", "released"] + }, + "introduced_in": { + "type": ["string", "null"], + "pattern": "^(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)$" + }, + "lifecycle_version": { + "if": { + "properties": { + "lifecycle": { + "const": "unreleased" + } + } + }, + "then": { + "properties": { + "introduced_in": { + "type": "null" + } + } + }, + "else": { + "properties": { + "introduced_in": { + "type": "string" + } + } + } + } + } +} diff --git a/crates/registryctl/schemas/project-reports/registryctl.operator_error_reference.v1.schema.json b/crates/registryctl/schemas/project-reports/registryctl.operator_error_reference.v1.schema.json new file mode 100644 index 000000000..e098c380f --- /dev/null +++ b/crates/registryctl/schemas/project-reports/registryctl.operator_error_reference.v1.schema.json @@ -0,0 +1,332 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "https://id.registrystack.org/schemas/registryctl/project-reports/registryctl.operator_error_reference.v1.schema.json", + "title": "Registryctl Operator Error Reference v1", + "type": "object", + "required": ["schema_version", "entries", "omissions"], + "additionalProperties": false, + "properties": { + "schema_version": { + "const": "registryctl.operator_error_reference.v1" + }, + "entries": { + "type": "array", + "minItems": 59, + "maxItems": 59, + "uniqueItems": true, + "items": { + "allOf": [ + { + "$ref": "#/$defs/entry" + }, + { + "$ref": "#/$defs/family_projection" + } + ] + } + }, + "omissions": { + "type": "array", + "maxItems": 0 + } + }, + "$defs": { + "entry": { + "type": "object", + "required": [ + "family", + "code", + "owner", + "product", + "phase", + "safe_meaning", + "rule", + "safe_remediation", + "field_address_pattern", + "evidence_scope", + "secret_sensitive_value_policy", + "docs_anchor", + "lifecycle", + "introduced_in", + "stability", + "evidence_limitation" + ], + "additionalProperties": false, + "properties": { + "family": { + "enum": [ + "bundle_verification", + "notary_activation", + "operator_preflight", + "relay_activation", + "relay_process_startup" + ] + }, + "code": { + "type": "string", + "minLength": 1, + "maxLength": 256 + }, + "owner": { + "enum": [ + "registry_notary", + "registry_platform_ops", + "registry_relay", + "registryctl" + ] + }, + "product": { + "enum": [ + "registry_notary", + "registry_platform_ops", + "registry_relay", + "registryctl" + ] + }, + "phase": { + "$ref": "#/$defs/safe_text" + }, + "safe_meaning": { + "$ref": "#/$defs/safe_text" + }, + "rule": { + "$ref": "#/$defs/safe_text" + }, + "safe_remediation": { + "$ref": "#/$defs/safe_text" + }, + "field_address_pattern": { + "type": ["string", "null"], + "minLength": 1, + "maxLength": 512 + }, + "evidence_scope": { + "$ref": "#/$defs/safe_text" + }, + "secret_sensitive_value_policy": { + "const": "no_runtime_values" + }, + "docs_anchor": { + "type": "string", + "minLength": 1, + "maxLength": 512 + }, + "lifecycle": { + "$ref": "#/$defs/lifecycle" + }, + "introduced_in": { + "$ref": "#/$defs/introduced_in" + }, + "stability": { + "const": "pre1_stable_code" + }, + "evidence_limitation": { + "$ref": "#/$defs/safe_text" + } + }, + "allOf": [ + { + "$ref": "#/$defs/lifecycle_version" + } + ] + }, + "family_projection": { + "oneOf": [ + { + "properties": { + "family": { + "const": "bundle_verification" + }, + "code": { + "enum": [ + "rejected_binding", + "rejected_rollback", + "rejected_signature", + "rejected_validation" + ] + }, + "owner": { + "const": "registry_platform_ops" + }, + "product": { + "const": "registry_platform_ops" + }, + "docs_anchor": { + "pattern": "^/reference/diagnostics/operator/#registry_platform_ops--[a-z0-9]+(?:-[a-z0-9]+)*$" + } + } + }, + { + "properties": { + "family": { + "const": "notary_activation" + }, + "code": { + "enum": [ + "notary.configuration.invalid", + "notary.deployment.gate_failed", + "notary.relay.activation_failed", + "notary.relay.configuration_invalid", + "notary.relay.credential_unavailable", + "notary.relay.credentials_rejected", + "notary.relay.profile_mismatch", + "notary.relay.profile_not_found", + "notary.relay.unavailable", + "notary.runtime.activation_failed", + "notary.runtime.activation_required", + "notary.state.postgresql.database_read_only", + "notary.state.postgresql.database_unavailable", + "notary.state.postgresql.database_unsupported", + "notary.state.postgresql.durability_unsafe", + "notary.state.postgresql.role_incompatible", + "notary.state.postgresql.schema_incompatible" + ] + }, + "owner": { + "const": "registry_notary" + }, + "product": { + "const": "registry_notary" + }, + "docs_anchor": { + "pattern": "^/reference/diagnostics/operator/#registry_notary--[a-z0-9]+(?:-[a-z0-9]+)*$" + } + } + }, + { + "properties": { + "family": { + "const": "operator_preflight" + }, + "code": { + "enum": [ + "registryctl.preflight.product_validator_not_checked", + "registryctl.preflight.report_capacity_exceeded", + "registryctl.preflight.runtime_file_empty", + "registryctl.preflight.runtime_file_missing", + "registryctl.preflight.runtime_file_not_checked", + "registryctl.preflight.runtime_file_not_regular", + "registryctl.preflight.runtime_file_unsafe_mode", + "registryctl.preflight.runtime_file_unsafe_owner", + "registryctl.preflight.secret_empty", + "registryctl.preflight.secret_missing", + "registryctl.preflight.static_validation_not_checked" + ] + }, + "owner": { + "const": "registryctl" + }, + "product": { + "const": "registryctl" + }, + "docs_anchor": { + "pattern": "^/reference/diagnostics/operator/#registryctl--registryctl\\.preflight\\.[a-z0-9_]+$" + } + } + }, + { + "properties": { + "family": { + "const": "relay_activation" + }, + "code": { + "enum": [ + "relay.consultation.activation.artifact_registry_invalid", + "relay.consultation.activation.configuration_missing", + "relay.consultation.activation.protected_metadata_invalid", + "relay.consultation.activation.pseudonym_material_unavailable", + "relay.consultation.activation.quota_limits_invalid", + "relay.consultation.activation.source_credentials_unavailable", + "relay.consultation.activation.state_plane_unavailable", + "relay.consultation.activation.unsupported_plan", + "relay.consultation.activation.workload_binding_invalid" + ] + }, + "owner": { + "const": "registry_relay" + }, + "product": { + "const": "registry_relay" + }, + "docs_anchor": { + "pattern": "^/reference/diagnostics/operator/#registry_relay--[a-z0-9]+(?:-[a-z0-9]+)*$" + } + } + }, + { + "properties": { + "family": { + "const": "relay_process_startup" + }, + "code": { + "enum": [ + "relay.startup.admin_listener_address_in_use", + "relay.startup.admin_listener_permission_denied", + "relay.startup.admin_listener_unavailable", + "relay.startup.bundle_binding_rejected", + "relay.startup.bundle_rollback_rejected", + "relay.startup.bundle_signature_rejected", + "relay.startup.bundle_validation_rejected", + "relay.startup.config_deprecated_field_rejected", + "relay.startup.config_document_invalid", + "relay.startup.config_environment_binding_rejected", + "relay.startup.config_source_unavailable", + "relay.startup.config_validation_rejected", + "relay.startup.consultation_artifacts_rejected", + "relay.startup.data_listener_address_in_use", + "relay.startup.data_listener_permission_denied", + "relay.startup.data_listener_unavailable", + "relay.startup.doctor_failed", + "relay.startup.runtime_initialization_failed" + ] + }, + "owner": { + "const": "registry_relay" + }, + "product": { + "const": "registry_relay" + }, + "docs_anchor": { + "pattern": "^/reference/diagnostics/operator/#registry_relay--[a-z0-9]+(?:-[a-z0-9]+)*$" + } + } + } + ] + }, + "safe_text": { + "type": "string", + "minLength": 1, + "maxLength": 4096 + }, + "lifecycle": { + "enum": ["unreleased", "active", "deprecated", "released"] + }, + "introduced_in": { + "type": ["string", "null"], + "pattern": "^(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)$" + }, + "lifecycle_version": { + "if": { + "properties": { + "lifecycle": { + "const": "unreleased" + } + } + }, + "then": { + "properties": { + "introduced_in": { + "type": "null" + } + } + }, + "else": { + "properties": { + "introduced_in": { + "type": "string" + } + } + } + } + } +} diff --git a/crates/registryctl/schemas/project-reports/registryctl.project_authoring_diagnostic_catalog.v1.schema.json b/crates/registryctl/schemas/project-reports/registryctl.project_authoring_diagnostic_catalog.v1.schema.json new file mode 100644 index 000000000..b49722c8a --- /dev/null +++ b/crates/registryctl/schemas/project-reports/registryctl.project_authoring_diagnostic_catalog.v1.schema.json @@ -0,0 +1,33 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "https://id.registrystack.org/schemas/registryctl/project-reports/registryctl.project_authoring_diagnostic_catalog.v1.schema.json", + "title": "Registryctl Project Authoring Diagnostic Catalog v1", + "type": "object", + "required": ["schema_version", "diagnostics"], + "additionalProperties": false, + "properties": { + "schema_version": { "const": "registryctl.project_authoring_diagnostic_catalog.v1" }, + "diagnostics": { + "type": "array", "minItems": 1, "maxItems": 256, "uniqueItems": true, + "items": { "$ref": "#/$defs/definition" } + } + }, + "$defs": { + "definition": { + "type": "object", + "required": ["code", "phase", "rule", "accepted", "safe_remediation", "safe_summary_policy", "documentation"], + "additionalProperties": false, + "properties": { + "code": { "type": "string", "pattern": "^registryctl\\.authoring\\.[a-z0-9_.-]+$", "maxLength": 128 }, + "phase": { "enum": ["aggregation", "safe_input", "script_validation", "semantic_validation", "syntax"] }, + "rule": { "type": "string", "minLength": 1, "maxLength": 128, "pattern": "^[a-z][a-z0-9_]*$" }, + "accepted": { "type": "string", "minLength": 1, "maxLength": 2048 }, + "safe_remediation": { "type": "string", "minLength": 1, "maxLength": 2048 }, + "safe_summary_policy": { "enum": ["no_received_value", "received_type_only"] }, + "documentation": { "type": "string", "pattern": "^/reference/diagnostics/authoring/#registryctl--registryctl\\.authoring\\.[a-z0-9_]+(?:\\.[a-z0-9_]+)*$", "maxLength": 512 }, + "replacement": { "type": "string", "minLength": 1, "maxLength": 2048 }, + "changed_behavior": { "type": "string", "minLength": 1, "maxLength": 2048 } + } + } + } +} diff --git a/crates/registryctl/schemas/project-reports/registryctl.project_command.v1.schema.json b/crates/registryctl/schemas/project-reports/registryctl.project_command.v1.schema.json new file mode 100644 index 000000000..261ebbf4d --- /dev/null +++ b/crates/registryctl/schemas/project-reports/registryctl.project_command.v1.schema.json @@ -0,0 +1,167 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "https://id.registrystack.org/schemas/registryctl/project-reports/registryctl.project_command.v1.schema.json", + "title": "Registryctl Project Command Report v1", + "type": "object", + "required": [ + "schema_version", + "status", + "project", + "environment", + "fixtures", + "baseline" + ], + "additionalProperties": false, + "properties": { + "schema_version": { + "const": "registryctl.project_command.v1" + }, + "status": { + "enum": ["passed", "valid", "built"] + }, + "project": { + "$ref": "#/$defs/identifier" + }, + "environment": { + "type": ["string", "null"], + "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]*$" + }, + "fixtures": { + "type": "array", + "items": { + "$ref": "#/$defs/fixture_report" + } + }, + "semantic_changes": { + "type": "array", + "items": { + "$ref": "#/$defs/dimension_only_change" + }, + "default": [] + }, + "baseline": { + "enum": ["initial_without_baseline", "verified_signed_bundle"] + }, + "output": { + "$ref": "#/$defs/project_relative_path" + }, + "semantic_impact": { + "$ref": "https://id.registrystack.org/schemas/registryctl/project-reports/registry.project.semantic_impact.v1.schema.json" + }, + "artifact_manifest": { + "$ref": "#/$defs/artifact_manifest_ref" + }, + "fixture_coverage": { + "$ref": "https://id.registrystack.org/schemas/registryctl/project-reports/registry.project.fixture_coverage.v1.schema.json" + }, + "explanation": { + "$ref": "https://id.registrystack.org/schemas/registryctl/project-reports/registry.project.explanation.v1.schema.json" + } + }, + "$defs": { + "identifier": { + "type": "string", + "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]*$" + }, + "non_empty_string": { + "type": "string", + "minLength": 1 + }, + "project_relative_path": { + "type": "string", + "pattern": "^([A-Za-z0-9_-][A-Za-z0-9._-]*|\\.[A-Za-z0-9_-][A-Za-z0-9._-]*)(/([A-Za-z0-9_-][A-Za-z0-9._-]*|\\.[A-Za-z0-9_-][A-Za-z0-9._-]*))*$" + }, + "sha256_digest": { + "type": "string", + "pattern": "^sha256:[0-9a-f]{64}$" + }, + "string_list": { + "type": "array", + "items": { + "$ref": "#/$defs/non_empty_string" + } + }, + "fixture_report": { + "type": "object", + "required": [ + "integration", + "fixture", + "inputs", + "calls", + "outputs", + "claims", + "passed" + ], + "additionalProperties": false, + "properties": { + "integration": { + "$ref": "#/$defs/identifier" + }, + "fixture": { + "$ref": "#/$defs/fixture_report_id" + }, + "inputs": { + "$ref": "#/$defs/string_list" + }, + "calls": { + "$ref": "#/$defs/string_list" + }, + "outputs": { + "$ref": "#/$defs/string_list" + }, + "claims": { + "$ref": "#/$defs/string_list" + }, + "outcome": { + "$ref": "#/$defs/non_empty_string" + }, + "expected_error": { + "$ref": "#/$defs/non_empty_string" + }, + "source_access": { + "type": "boolean" + }, + "passed": { + "type": "boolean" + }, + "failure": { + "$ref": "#/$defs/non_empty_string" + } + } + }, + "dimension_only_change": { + "type": "object", + "required": ["dimension"], + "additionalProperties": false, + "properties": { + "dimension": { + "enum": [ + "claim", + "integration", + "service_policy", + "operator_security", + "disclosure", + "compiler" + ] + } + } + }, + "fixture_report_id": { + "type": "string", + "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]*(::derived/[a-z][a-z0-9_]*)?$" + }, + "artifact_manifest_ref": { + "type": "object", + "required": ["path", "digest"], + "additionalProperties": false, + "properties": { + "path": { + "$ref": "#/$defs/project_relative_path" + }, + "digest": { + "$ref": "#/$defs/sha256_digest" + } + } + } + } +} diff --git a/crates/registryctl/schemas/project-reports/registryctl.project_diagnostics.v1.schema.json b/crates/registryctl/schemas/project-reports/registryctl.project_diagnostics.v1.schema.json new file mode 100644 index 000000000..e48083643 --- /dev/null +++ b/crates/registryctl/schemas/project-reports/registryctl.project_diagnostics.v1.schema.json @@ -0,0 +1,92 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "https://id.registrystack.org/schemas/registryctl/project-reports/registryctl.project_diagnostics.v1.schema.json", + "title": "Registryctl Project Authoring Diagnostics v1", + "type": "object", + "required": ["schema_version", "status", "diagnostics"], + "additionalProperties": false, + "properties": { + "schema_version": { "const": "registryctl.project_diagnostics.v1" }, + "status": { "const": "invalid" }, + "diagnostics": { + "type": "array", + "minItems": 1, + "maxItems": 64, + "items": { "$ref": "#/$defs/diagnostic" } + } + }, + "$defs": { + "project_relative_file": { + "type": "string", + "minLength": 1, + "maxLength": 4096, + "pattern": "^([A-Za-z0-9_-][A-Za-z0-9._-]*|\\.[A-Za-z0-9_-][A-Za-z0-9._-]*)(/([A-Za-z0-9_-][A-Za-z0-9._-]*|\\.[A-Za-z0-9_-][A-Za-z0-9._-]*))*$" + }, + "json_pointer": { + "type": "string", + "maxLength": 4096, + "pattern": "^(/([^~/]|~[01])*)*$" + }, + "address": { + "type": "object", + "required": ["file", "pointer"], + "additionalProperties": false, + "properties": { + "file": { "$ref": "#/$defs/project_relative_file" }, + "pointer": { "$ref": "#/$defs/json_pointer" } + } + }, + "diagnostic": { + "type": "object", + "required": [ + "code", "file", "addresses", "phase", "rule", "accepted", + "safe_summary_policy", "received_summary", "documentation", "cause", "remediation" + ], + "additionalProperties": false, + "properties": { + "code": { "$ref": "#/$defs/code" }, + "file": { "$ref": "#/$defs/project_relative_file" }, + "field": { "type": "string", "maxLength": 4096 }, + "line": { "type": "integer", "minimum": 1 }, + "column": { "type": "integer", "minimum": 1 }, + "schema_hint": { "type": "string", "maxLength": 4096 }, + "suggestion": { "type": "string", "maxLength": 4096 }, + "addresses": { + "type": "array", "minItems": 1, "maxItems": 8, + "uniqueItems": true, "items": { "$ref": "#/$defs/address" } + }, + "phase": { "enum": ["aggregation", "safe_input", "script_validation", "semantic_validation", "syntax"] }, + "rule": { "type": "string", "minLength": 1, "maxLength": 128, "pattern": "^[a-z][a-z0-9_]*$" }, + "accepted": { "type": "string", "minLength": 1, "maxLength": 2048 }, + "safe_summary_policy": { "enum": ["no_received_value", "received_type_only"] }, + "received_summary": { "enum": ["not_disclosed_by_policy", "invalid_type_or_shape"] }, + "documentation": { "type": "string", "pattern": "^/reference/diagnostics/authoring/#registryctl--registryctl\\.authoring\\.[a-z0-9_]+(?:\\.[a-z0-9_]+)*$", "maxLength": 512 }, + "replacement": { "type": "string", "minLength": 1, "maxLength": 2048 }, + "changed_behavior": { "type": "string", "minLength": 1, "maxLength": 2048 }, + "cause": { "type": "string", "minLength": 1, "maxLength": 2048 }, + "remediation": { "type": "string", "minLength": 1, "maxLength": 2048 } + } + }, + "code": { + "enum": [ + "registryctl.authoring.diagnostics.truncated", + "registryctl.authoring.entity.invalid", + "registryctl.authoring.environment.invalid", + "registryctl.authoring.file.too_large", + "registryctl.authoring.file.unreadable", + "registryctl.authoring.fixture.invalid", + "registryctl.authoring.fixture.reserved_body_field", + "registryctl.authoring.integration.invalid", + "registryctl.authoring.path.unsafe", + "registryctl.authoring.project.invalid", + "registryctl.authoring.project.scope_collision", + "registryctl.authoring.script.closed_contract_violation", + "registryctl.authoring.script.invalid_signature", + "registryctl.authoring.script.syntax_error", + "registryctl.authoring.script.unknown_function", + "registryctl.authoring.yaml.invalid_syntax", + "registryctl.authoring.yaml.unknown_field" + ] + } + } +} diff --git a/crates/registryctl/schemas/project-reports/registryctl.project_preflight.v1.schema.json b/crates/registryctl/schemas/project-reports/registryctl.project_preflight.v1.schema.json new file mode 100644 index 000000000..c3c00dd2d --- /dev/null +++ b/crates/registryctl/schemas/project-reports/registryctl.project_preflight.v1.schema.json @@ -0,0 +1,449 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "https://id.registrystack.org/schemas/registryctl/project-reports/registryctl.project_preflight.v1.schema.json", + "title": "Registryctl Project Preflight Report v1", + "type": "object", + "required": [ + "schema_version", + "status", + "project", + "environment", + "execution", + "runtime_boundary", + "static_checks", + "product_validators", + "secret_checks", + "runtime_files", + "diagnostics", + "limits" + ], + "additionalProperties": false, + "properties": { + "schema_version": { + "const": "registryctl.project_preflight.v1" + }, + "status": { + "enum": ["ready", "not_ready"] + }, + "project": { + "$ref": "#/$defs/identifier" + }, + "environment": { + "$ref": "#/$defs/identifier" + }, + "execution": { + "$ref": "#/$defs/execution" + }, + "runtime_boundary": { + "$ref": "#/$defs/runtime_boundary" + }, + "static_checks": { + "type": "array", + "maxItems": 4, + "uniqueItems": true, + "items": { + "$ref": "#/$defs/static_check" + } + }, + "product_validators": { + "type": "array", + "maxItems": 2, + "uniqueItems": true, + "items": { + "$ref": "#/$defs/product_validator" + } + }, + "secret_checks": { + "type": "array", + "maxItems": 256, + "uniqueItems": true, + "items": { + "$ref": "#/$defs/secret_check" + } + }, + "runtime_files": { + "type": "array", + "maxItems": 256, + "uniqueItems": true, + "items": { + "$ref": "#/$defs/runtime_file" + } + }, + "diagnostics": { + "type": "array", + "maxItems": 256, + "uniqueItems": true, + "items": { + "$ref": "#/$defs/diagnostic" + } + }, + "limits": { + "$ref": "#/$defs/limits" + } + }, + "$defs": { + "identifier": { + "type": "string", + "minLength": 1, + "maxLength": 96, + "pattern": "^[A-Za-z0-9][A-Za-z0-9._-]*$" + }, + "project_relative_file": { + "type": "string", + "minLength": 1, + "maxLength": 4096, + "pattern": "^([A-Za-z0-9_-][A-Za-z0-9._-]*|\\.[A-Za-z0-9_-][A-Za-z0-9._-]*)(/([A-Za-z0-9_-][A-Za-z0-9._-]*|\\.[A-Za-z0-9_-][A-Za-z0-9._-]*))*$" + }, + "json_pointer": { + "type": "string", + "maxLength": 4096, + "pattern": "^(/([^~/]|~[01])*)*$" + }, + "field_address": { + "type": "object", + "required": ["file", "pointer"], + "additionalProperties": false, + "properties": { + "file": { + "$ref": "#/$defs/project_relative_file" + }, + "pointer": { + "$ref": "#/$defs/json_pointer" + } + } + }, + "addresses": { + "type": "array", + "minItems": 1, + "maxItems": 256, + "uniqueItems": true, + "items": { + "$ref": "#/$defs/field_address" + } + }, + "check_state": { + "enum": [ + "available", + "missing", + "empty", + "not_regular", + "unsafe_owner", + "unsafe_mode", + "not_checked", + "static_valid", + "locally_available" + ] + }, + "execution": { + "type": "object", + "required": [ + "mode", + "contact", + "network", + "live_reachability", + "fixture_execution", + "external_processes", + "build_output" + ], + "additionalProperties": false, + "properties": { + "mode": { + "const": "offline" + }, + "contact": { + "const": "none" + }, + "network": { + "const": "not_attempted" + }, + "live_reachability": { + "const": "not_attempted" + }, + "fixture_execution": { + "const": "not_attempted" + }, + "external_processes": { + "const": "not_attempted" + }, + "build_output": { + "const": "not_written" + } + } + }, + "runtime_boundary": { + "type": "object", + "required": ["posture_scope", "permission_invariant"], + "additionalProperties": false, + "properties": { + "posture_scope": { + "const": "current_mount_namespace_and_effective_identity" + }, + "permission_invariant": { + "enum": ["unix_owner_and_mode_enforced", "not_checked_non_unix"] + } + } + }, + "static_check": { + "type": "object", + "required": ["capability", "addresses", "state"], + "additionalProperties": false, + "properties": { + "capability": { + "enum": [ + "project_model", + "environment_completeness", + "origin_relationships", + "non_widening_bounds" + ] + }, + "addresses": { + "$ref": "#/$defs/addresses" + }, + "state": { + "const": "static_valid" + } + } + }, + "product_validator": { + "type": "object", + "required": ["product", "capability", "state"], + "additionalProperties": false, + "properties": { + "product": { + "enum": ["registry_relay", "registry_notary"] + }, + "capability": { + "const": "configuration_validation" + }, + "state": { + "enum": ["locally_available", "not_checked"] + } + } + }, + "secret_consumer": { + "enum": [ + "source_basic_username", + "source_basic_password", + "source_bearer_token", + "source_oauth_client_id", + "source_oauth_client_secret", + "source_api_key_value", + "source_mtls_private_key", + "source_oauth_mtls_private_key", + "source_jwks_mtls_private_key", + "entity_postgres_connection", + "issuance_signing_key", + "caller_api_key_fingerprint", + "oid4vci_client_signing_key", + "oid4vci_access_token_signing_key", + "oid4vci_sensitive_state_key" + ] + }, + "secret_check": { + "type": "object", + "required": ["consumers", "addresses", "state"], + "additionalProperties": false, + "properties": { + "consumers": { + "type": "array", + "minItems": 1, + "maxItems": 15, + "uniqueItems": true, + "items": { + "$ref": "#/$defs/secret_consumer" + } + }, + "addresses": { + "$ref": "#/$defs/addresses" + }, + "state": { + "enum": ["available", "missing", "empty"] + } + } + }, + "runtime_file_kind": { + "enum": [ + "source_ca", + "source_mtls_certificate", + "source_oauth_ca", + "source_oauth_mtls_certificate", + "source_jwks_ca", + "source_jwks_mtls_certificate", + "entity_csv", + "entity_xlsx", + "entity_parquet", + "relay_state_root_certificate", + "notary_state_root_certificate", + "notary_to_relay_token" + ] + }, + "runtime_file": { + "type": "object", + "required": ["kind", "addresses", "generation", "state"], + "additionalProperties": false, + "properties": { + "kind": { + "$ref": "#/$defs/runtime_file_kind" + }, + "addresses": { + "$ref": "#/$defs/addresses" + }, + "generation": { + "enum": ["declared", "not_declared"] + }, + "state": { + "enum": [ + "available", + "missing", + "empty", + "not_regular", + "unsafe_owner", + "unsafe_mode", + "not_checked" + ] + } + }, + "allOf": [ + { + "if": { + "properties": { + "kind": { + "enum": [ + "relay_state_root_certificate", + "notary_state_root_certificate", + "notary_to_relay_token" + ] + } + } + }, + "then": { + "properties": { + "generation": { + "const": "not_declared" + } + } + }, + "else": { + "properties": { + "generation": { + "const": "declared" + } + } + } + } + ] + }, + "diagnostic_code": { + "enum": [ + "registryctl.preflight.static_validation_not_checked", + "registryctl.preflight.product_validator_not_checked", + "registryctl.preflight.secret_missing", + "registryctl.preflight.secret_empty", + "registryctl.preflight.runtime_file_missing", + "registryctl.preflight.runtime_file_empty", + "registryctl.preflight.runtime_file_not_regular", + "registryctl.preflight.runtime_file_unsafe_owner", + "registryctl.preflight.runtime_file_unsafe_mode", + "registryctl.preflight.runtime_file_not_checked", + "registryctl.preflight.report_capacity_exceeded" + ] + }, + "rule_id": { + "enum": [ + "registryctl.preflight.authoritative_static_validation", + "registryctl.preflight.product_validator_locally_available", + "registryctl.preflight.secret_reference_available", + "registryctl.preflight.runtime_file_bounded_regular", + "registryctl.preflight.runtime_file_safe_owner", + "registryctl.preflight.runtime_file_safe_mode", + "registryctl.preflight.runtime_file_posture_supported", + "registryctl.preflight.report_capacity" + ] + }, + "message": { + "enum": [ + "Required authoritative static validation was not completed.", + "A required linked product validator was not checked locally.", + "A required secret reference is unavailable to this process.", + "A required secret reference contains only whitespace.", + "A declared runtime file is missing.", + "A declared runtime file is empty.", + "A declared runtime file is not an acceptable bounded regular file.", + "A declared runtime file has an unsafe owner.", + "A declared runtime file has unsafe local access permissions.", + "Runtime file posture could not be checked with the required local invariant.", + "The preflight report reached its deterministic safety cap." + ] + }, + "remediation": { + "enum": [ + "complete_authoritative_static_validation", + "enable_linked_product_validator", + "provide_secret_to_process_environment", + "replace_runtime_file", + "set_runtime_file_owner", + "tighten_runtime_file_permissions", + "run_on_supported_unix", + "reduce_declared_preflight_inputs" + ] + }, + "diagnostic": { + "type": "object", + "required": [ + "code", + "severity", + "phase", + "addresses", + "rule_id", + "message", + "remediation" + ], + "additionalProperties": false, + "properties": { + "code": { + "$ref": "#/$defs/diagnostic_code" + }, + "severity": { + "enum": ["error", "warning", "information"] + }, + "phase": { + "enum": [ + "static_validation", + "secret_availability", + "runtime_file_posture", + "product_capability", + "report_boundary" + ] + }, + "addresses": { + "$ref": "#/$defs/addresses" + }, + "rule_id": { + "$ref": "#/$defs/rule_id" + }, + "message": { + "$ref": "#/$defs/message" + }, + "remediation": { + "$ref": "#/$defs/remediation" + } + } + }, + "limits": { + "type": "object", + "required": ["max_checks", "max_diagnostics", "truncated"], + "additionalProperties": false, + "properties": { + "max_checks": { + "const": 256 + }, + "max_diagnostics": { + "const": 256 + }, + "truncated": { + "type": "boolean" + } + } + } + } +} diff --git a/crates/registryctl/src/lib.rs b/crates/registryctl/src/lib.rs index 4b2c1b918..b95b1d887 100644 --- a/crates/registryctl/src/lib.rs +++ b/crates/registryctl/src/lib.rs @@ -37,12 +37,133 @@ use zeroize::Zeroizing; mod project_authoring; pub use project_authoring::{ - build_registry_project, check_registry_project, init_registry_project, - render_project_authoring_diagnostics, setup_registry_project_editor, test_registry_project, - test_registry_project_selected, ProjectAuthoringDiagnostic, ProjectAuthoringDiagnostics, - ProjectBuildOptions, ProjectCheckOptions, ProjectCommandReport, ProjectEditorSetupOptions, - ProjectEditorSetupReport, ProjectInitOptions, ProjectSchemaKind, ProjectStarter, - ProjectTestOptions, ProjectTestSelection, SemanticChange, + authoring_error_reference, fixture_error_reference, operator_error_reference, + validate_authoring_error_reference, validate_fixture_error_reference, + validate_operator_error_reference, AuthoringErrorReferenceV1, ErrorReferenceEntry, + ErrorReferenceFamily, ErrorReferenceLifecycle, ErrorReferenceOwner, ErrorReferenceProduct, + ErrorReferenceStability, ErrorReferenceValidationError, ErrorReferenceValuePolicy, + FixtureErrorReferenceV1, OperatorErrorOmission, OperatorErrorOmissionFamily, + OperatorErrorOmissionReason, OperatorErrorReferenceV1, + AUTHORING_ERROR_REFERENCE_SCHEMA_VERSION_V1, FIXTURE_ERROR_REFERENCE_SCHEMA_VERSION_V1, + OPERATOR_ERROR_REFERENCE_SCHEMA_VERSION_V1, +}; +pub use project_authoring::{ + build_project_migration_report, build_project_promotion_report, build_registry_project, + build_registry_project_with_baselines, build_registry_project_with_baselines_and_context, + build_registry_project_with_context, check_registry_project, + check_registry_project_with_context, check_registry_project_with_trusted_local_authored_values, + embedded_configuration_reference, embedded_configuration_reference_coverage, + init_registry_project, inspect_project_capabilities, migrate_registry_project, + migrate_registry_project_with_context, preflight_registry_project, promote_registry_project, + redacted_project_check_failure_diagnostics, render_project_authoring_diagnostics, + setup_registry_project_editor, test_registry_project, test_registry_project_selected, + test_registry_project_selected_with_context, test_registry_project_with_context, + AuthoredSemanticFixtureCoverage, AuthoringContract, AuthoringVersionSet, CapabilityDisposition, + CapabilityId, CapabilityInventoryEvidenceGrade, CapabilityInventoryRecord, CapabilityKind, + CapabilityMaturity, CapabilityOwner, CapabilityUsageCounts, ClassifierSafeReportedValue, + ConfigurationFieldReference, ConfigurationReferenceCoverageV1, ConfigurationReferenceV1, + ConfigurationState, CoverageInvariant, CoverageStatus, DefaultBehavior, DefaultDocumentation, + DocumentationDomainIntent, DocumentationError, DocumentationFieldAddress, + DocumentationIntentCatalog, DocumentationIntentPolicy, DocumentationSchema, + DocumentationSchemaAddress, EmptyBehavior, + EnvironmentBehavior as DocumentationEnvironmentBehavior, EnvironmentEnablementState, + ExampleDocumentation, FieldIntentOverride, FieldSensitivity, FieldSourceKind, + FieldTypeDocumentation, FixtureCapability, FixtureCompatibilityClaim, + FixtureCoverageChangeImpact, FixtureCoverageChangeKind, FixtureCoverageClassification, + FixtureCoverageComparisonInput, FixtureCoverageDimensions, FixtureCoverageEvidence, + FixtureCoverageEvidenceKind, FixtureCoverageGapReason, FixtureCoverageNotApplicableReason, + FixtureCoverageNotEvaluatedReason, FixtureCoverageRequirementCounts, + FixtureCoverageRequirementState, FixtureCoverageReviewedNotApplicable, + FixtureCoverageSemanticComparison, FixtureCoverageSummary, FixtureCoverageTarget, + FixtureCoverageTargetComparisonInput, FixtureCoverageTargetContract, + FixtureCoverageTargetIdentity, FixtureCoverageTargetSetState, FixtureDisclosureMode, + FixtureEvidenceScope, FixtureLimit, FixtureMutationTargetClass, FixturePassState, + FixtureProtocolHelper, FixtureRequestBindingCoverage, FixtureRequestBindingState, + FixtureRequirementCoverage, FixtureSafeCode, FixtureSemanticExpectation, + FixtureSemanticOutcome, FixtureSetState, FixtureStatusMapping, FixtureStatusOutcome, + GeneratedFixtureCoverage, GeneratedNotApplicableReason, GeneratedRecipeApplicability, + GeneratedSourceFixture, GeneratorRecipe, GeneratorRecipeId, GeneratorRecipeVersion, + GovernedRequestEvidence, HumanIntentSource, InactiveOrUnusedDeclaration, + InactiveOrUnusedReason, InstalledCapabilityEvidence, InstalledCapabilityState, + LiveCompatibilityEvaluation, MigrationAffectedCount, MigrationAffectedState, + MigrationAffectedSurfaces, MigrationApplicationPolicy, MigrationArtifact, + MigrationAuthoredFilePolicy, MigrationBlockingReason, MigrationCandidateArtifact, + MigrationCandidateEligibility, MigrationCandidateEmission, MigrationChange, + MigrationChangeInput, MigrationCompatibility, MigrationDecisionKind, MigrationDecisionOwner, + MigrationDecisionScope, MigrationDiagnostic, MigrationDiagnosticCode, MigrationDiagnosticPhase, + MigrationDiagnosticRemediation, MigrationDisposition, MigrationDocument, + MigrationEvidenceGrade, MigrationEvidenceLimitation, MigrationExecution, MigrationField, + MigrationFieldAddress, MigrationFieldClassification, MigrationFieldPath, + MigrationGateAssessment, MigrationGateResults, MigrationGateStatus, MigrationOperation, + MigrationOutputMode, MigrationOutputPlan, MigrationOutputRequest, MigrationOwner, + MigrationReplacement, MigrationReplacementDisposition, MigrationReplacementInput, + MigrationRerunGate, MigrationReviewAssessment, MigrationReviewClass, MigrationReviewStatus, + MigrationSafety, MigrationSemanticEffect, MigrationVersionDirection, MigrationVersionSupport, + MigrationVersionSupportAssessment, MigrationVersionTransition, MigrationWriteAuthority, + MissingSupport, NullBehavior, PlatformCoverageComponent, PlatformGeneratedCaseId, + PlatformGeneratedFixtureCoverage, PreflightAttemptState, PreflightCheckState, PreflightContact, + PreflightDiagnostic, PreflightDiagnosticCode, PreflightDiagnosticMessage, + PreflightExecutionBoundary, PreflightFieldAddress, PreflightGenerationState, + PreflightJsonPointer, PreflightMode, PreflightPermissionInvariant, PreflightPhase, + PreflightProduct, PreflightProductCapability, PreflightProductValidatorCheck, + PreflightProjectRelativeFile, PreflightRemediation, PreflightReportLimits, PreflightRuleId, + PreflightRuntimeBoundary, PreflightRuntimeFileCheck, PreflightRuntimeFileKind, + PreflightRuntimeScope, PreflightSecretCheck, PreflightSecretConsumer, PreflightSeverity, + PreflightStaticCapability, PreflightStaticCheck, PreflightStatus, PreflightWriteState, + ProhibitedIntentSource, ProjectArtifactManifestRef, ProjectArtifactManifestV1, + ProjectAuthoringDiagnostic, ProjectAuthoringDiagnostics, ProjectBuildBaselineSetOptions, + ProjectBuildOptions, ProjectCapabilityInventoryReportV1, + ProjectCapabilityInventorySchemaVersion, ProjectCapabilityOptions, ProjectCheckOptions, + ProjectCommandReport, ProjectCommandReportV1, ProjectDeclarationState, + ProjectEditorSetupOptions, ProjectEditorSetupReport, ProjectExecutionContext, + ProjectExplanationReportV1, ProjectFieldAddress, ProjectFieldExplanation, + ProjectFixtureCoverageReportV1, ProjectFixtureCoverageSchemaVersion, ProjectInitOptions, + ProjectMigrationBuildError, ProjectMigrationInput, ProjectMigrationOptions, + ProjectMigrationReportV1, ProjectMigrationSchemaVersion, ProjectPreflightOptions, + ProjectPreflightReportV1, ProjectPreflightSchemaVersion, ProjectPromotionBuildError, + ProjectPromotionInput, ProjectPromotionOptions, ProjectPromotionReportV1, + ProjectPromotionSchemaVersion, ProjectRelativePath, ProjectSchemaKind, + ProjectSemanticImpactReportV1, ProjectStarter, ProjectTestOptions, ProjectTestSelection, + ProjectTrustedLocalAuthoredValue, ProjectTrustedLocalCheck, PromotionActivationEvaluation, + PromotionBlockingReason, PromotionBoundaryAssessment, PromotionChange, PromotionChangeEffect, + PromotionChangeInput, PromotionChangeKind, PromotionCompatibilityAssessment, + PromotionCompatibilityComponent, PromotionCompatibilityInput, PromotionCompatibilityState, + PromotionDeploymentEvaluation, PromotionDisposition, PromotionDocument, PromotionEvidenceGrade, + PromotionEvidenceLimitation, PromotionFieldAddress, PromotionFieldClassification, + PromotionFieldOwnership, PromotionFieldPath, PromotionProductAction, PromotionRequiredActions, + PromotionReviewClass, RedactionReason, ReferenceCoverageSummary, ReferenceSourceContract, + RequiredFixtureCoverageRequirement, Requiredness, ReviewedCeilingAssessment, + ReviewedCeilingInput, ReviewedRevisionComparison, RuntimeActivationEvaluation, + SchemaConstraint, SemanticChange, Sha256Digest, SourceAccessAssertion, SourceCallExpectation, + StructuralIntent, SupportAssessment, SupportComponent, SupportEvidence, SupportKind, + SupportState, SupportedCapabilityVersion, TrustResolutionAssessment, TrustResolutionInput, + UnresolvedMigrationDecision, ValidationStage, VersionChange, VersionHistoryEntry, + CONFIGURATION_REFERENCE_COVERAGE_SCHEMA_ID, CONFIGURATION_REFERENCE_FORMAT_VERSION, + CONFIGURATION_REFERENCE_SCHEMA_ID, PROJECT_ARTIFACT_MANIFEST_FORMAT_VERSION_V1, + PROJECT_ARTIFACT_MANIFEST_SCHEMA_VERSION_V1, PROJECT_CAPABILITY_INVENTORY_SCHEMA_VERSION_V1, + PROJECT_COMMAND_REPORT_SCHEMA_VERSION_V1, PROJECT_EXPLANATION_SCHEMA_VERSION_V1, + PROJECT_FIXTURE_COVERAGE_SCHEMA_VERSION_V1, PROJECT_MIGRATION_SCHEMA_VERSION_V1, + PROJECT_PREFLIGHT_SCHEMA_VERSION_V1, PROJECT_PROMOTION_SCHEMA_VERSION_V1, + PROJECT_SEMANTIC_IMPACT_SCHEMA_VERSION_V1, +}; +pub use project_authoring::{ + compare_registry_project_environments_semantically, + compare_registry_project_to_embedded_starter_semantically, + compare_registry_projects_semantically, ProjectEnvironmentSemanticComparisonOptions, + ProjectSemanticComparisonChange, ProjectSemanticComparisonOptions, + ProjectSemanticComparisonReportV1, ProjectSemanticComparisonSchemaVersion, + ProjectStarterSemanticComparisonOptions, SemanticComparisonActivationRequirement, + SemanticComparisonAffectedSubject, SemanticComparisonAffectedSubjectKind, + SemanticComparisonAssurance, SemanticComparisonChangeSource, SemanticComparisonConsumer, + SemanticComparisonDimension, SemanticComparisonDirection, SemanticComparisonEquivalence, + SemanticComparisonEvidenceGrade, SemanticComparisonEvidenceLimitation, + SemanticComparisonExternalApproval, SemanticComparisonFieldAddress, + SemanticComparisonGeneratedArtifact, SemanticComparisonKind, SemanticComparisonPrecision, + SemanticComparisonRequiredAction, SemanticComparisonRequirements, + SemanticComparisonRestartRequirement, SemanticComparisonReviewClass, + SemanticComparisonReviewPlan, SemanticComparisonReviewPlanState, + SemanticComparisonSchemaFamily, SemanticComparisonSigningRequirement, + PROJECT_SEMANTIC_COMPARISON_SCHEMA_VERSION_V1, }; pub use crate::sample::Sample; @@ -1946,6 +2067,14 @@ pub struct AddNotaryReport { pub fn add_notary_to_project( project_dir: &Path, image_lock: &RegistryctlImageLock, +) -> Result { + add_notary_to_project_with_runtime_preparer(project_dir, image_lock, prepare_notary_runtime) +} + +fn add_notary_to_project_with_runtime_preparer( + project_dir: &Path, + image_lock: &RegistryctlImageLock, + prepare_runtime: fn(&Path) -> Result<()>, ) -> Result { let mut project = Project::load(project_dir)?; if project.relay.is_none() { @@ -1996,7 +2125,7 @@ pub fn add_notary_to_project( write_local_postgres_tls(project_dir)?; add_notary_local_secrets(project_dir)?; create_notary_state_dirs(project_dir)?; - prepare_notary_runtime(project_dir)?; + prepare_runtime(project_dir)?; merge_notary_compose(project_dir, image_lock)?; project.project.products.push("registry-notary".to_string()); @@ -2256,6 +2385,26 @@ fn prepare_notary_runtime(project_dir: &Path) -> Result<()> { refresh_notary_relay_token(project_dir, runtime_identity) } +/// Unit-test-only publication path that deliberately performs static product +/// validation but does not execute authored project fixtures. +#[cfg(test)] +fn prepare_notary_runtime_static_validation_only_for_unit_test(project_dir: &Path) -> Result<()> { + #[cfg(unix)] + let runtime_identity = Some(compose_runtime_identity_values(project_dir)?); + #[cfg(not(unix))] + let runtime_identity = None; + project_authoring::build_registry_project_static_validation_only_for_unit_test( + &ProjectBuildOptions { + project_directory: project_dir.join(NOTARY_PROJECT_DIR), + environment: "local".to_string(), + against: None, + anchor: None, + }, + runtime_identity, + )?; + refresh_notary_relay_token(project_dir, runtime_identity) +} + fn refresh_notary_relay_token( project_dir: &Path, runtime_identity: Option, @@ -4638,6 +4787,84 @@ mod tests { .contains("https://docs.registrystack.org/operate/single-node-compose-behind-proxy/")); } + #[test] + fn notary_addon_no_match_false_requires_a_positive_bounded_existence_claim() { + let project: Value = + serde_norway::from_str(include_str!("templates/notary_addon/registry-stack.yaml")) + .unwrap(); + let claims = project["services"]["registration-verification"]["claims"] + .as_mapping() + .unwrap(); + assert_eq!(claims.len(), 1); + let (claim_id, claim) = claims.iter().next().unwrap(); + let claim_id = claim_id.as_str().unwrap(); + + assert_eq!(claim_id, "active-registration-exists"); + assert!( + claim_id.ends_with("-exists"), + "a no-match false result must use an explicit positive existence predicate" + ); + for forbidden in [ + "accepted", + "absent", + "denied", + "does-not-exist", + "eligible", + "fraud", + "ineligible", + "missing", + "nonexistent", + "not-found", + "rejected", + ] { + assert!( + !claim_id.contains(forbidden), + "no-match false must not imply the broader fact {forbidden:?}: {claim_id}" + ); + } + assert_eq!( + claim["cel"], + r#"enrollment.matched && enrollment.registration_status == "active""# + ); + + for (fixture, expected) in [ + ( + include_str!( + "templates/notary_addon/integrations/person-demographics/fixtures/match.yaml" + ), + true, + ), + ( + include_str!( + "templates/notary_addon/integrations/person-demographics/fixtures/pending.yaml" + ), + false, + ), + ( + include_str!( + "templates/notary_addon/integrations/person-demographics/fixtures/no-match.yaml" + ), + false, + ), + ] { + let fixture: Value = serde_norway::from_str(fixture).unwrap(); + assert_eq!( + fixture["expect"]["claims"][claim_id].as_bool(), + Some(expected) + ); + } + let ambiguous: Value = serde_norway::from_str(include_str!( + "templates/notary_addon/integrations/person-demographics/fixtures/ambiguous.yaml" + )) + .unwrap(); + assert!( + ambiguous["expect"]["claims"] + .as_mapping() + .is_some_and(serde_norway::Mapping::is_empty), + "ambiguous consultation outcomes must not be converted into a false claim" + ); + } + #[test] fn add_notary_builds_an_editable_live_tutorial_addon() { let temp = TempDir::new().unwrap(); @@ -4645,7 +4872,12 @@ mod tests { let image_lock = test_image_lock(); init_spreadsheet_api(&project, Sample::Benefits, &image_lock).unwrap(); - let report = add_notary_to_project(&project, &image_lock).unwrap(); + let report = add_notary_to_project_with_runtime_preparer( + &project, + &image_lock, + prepare_notary_runtime_static_validation_only_for_unit_test, + ) + .unwrap(); assert_eq!(report.status, "added"); for path in [ @@ -4752,9 +4984,31 @@ mod tests { let claim_source = fs::read_to_string(project.join(NOTARY_CLAIM_FILE)).unwrap(); assert!(claim_source.contains("request.target.attributes.given_name")); assert!(claim_source.contains("request.target.attributes.date_of_birth")); - assert!(claim_source.contains("person-registration-accepted")); + assert!(claim_source.contains("active-registration-exists")); + assert!(!claim_source.contains("person-registration-accepted")); assert!(claim_source.contains("enrollment.registration_status == \"active\"")); assert!(!claim_source.contains("age_on")); + let explanation = project_authoring::generated_explanation_for_test( + &project.join("notary/project"), + "local", + ) + .unwrap(); + let claim_evidence = explanation + .fields + .iter() + .find(|field| { + matches!( + &field.address, + ProjectFieldAddress::Project { path } + if path.as_str() + == "/services/registration-verification/claims/active-registration-exists/evidence" + ) + }) + .expect("generated Notary claim evidence is explained"); + let ClassifierSafeReportedValue::Public { value } = &claim_evidence.reported_value else { + panic!("claim evidence classification is value-free and public"); + }; + assert_eq!(value.as_value(), &serde_json::json!("registry_backed")); let integration = fs::read_to_string( project.join("notary/project/integrations/person-demographics/integration.yaml"), ) @@ -4785,22 +5039,37 @@ mod tests { "registry:consult:registration-verification" ); let claim_path = project.join(NOTARY_CLAIM_FILE); - let claim = fs::read_to_string(&claim_path).unwrap().replace( - "enrollment.registration_status == \"active\"", - "(enrollment.registration_status == \"active\" || enrollment.registration_status == \"pending\")", - ); + let claim = fs::read_to_string(&claim_path) + .unwrap() + .replace( + "active-registration-exists", + "active-or-pending-registration-exists", + ) + .replace( + "enrollment.registration_status == \"active\"", + "(enrollment.registration_status == \"active\" || enrollment.registration_status == \"pending\")", + ); fs::write(&claim_path, claim).unwrap(); - let fixture_path = - project.join("notary/project/integrations/person-demographics/fixtures/pending.yaml"); - let fixture = fs::read_to_string(&fixture_path).unwrap().replace( - "claims: { person-registration-accepted: false }", - "claims: { person-registration-accepted: true }", - ); - fs::write(&fixture_path, fixture).unwrap(); - prepare_notary_runtime(&project).unwrap(); + for (fixture_name, expected_before, expected_after) in [ + ("match.yaml", "true", "true"), + ("pending.yaml", "false", "true"), + ("no-match.yaml", "false", "false"), + ] { + let fixture_path = project + .join("notary/project/integrations/person-demographics/fixtures") + .join(fixture_name); + let fixture = fs::read_to_string(&fixture_path).unwrap().replace( + &format!("claims: {{ active-registration-exists: {expected_before} }}"), + &format!("claims: {{ active-or-pending-registration-exists: {expected_after} }}"), + ); + fs::write(&fixture_path, fixture).unwrap(); + } + prepare_notary_runtime_static_validation_only_for_unit_test(&project).unwrap(); assert_notary_runtime_input_owners_match_project(&project); let notary_config_text = fs::read_to_string(project.join(NOTARY_CONFIG_PATH)).unwrap(); - assert!(notary_config_text.contains("person-registration-accepted")); + assert!(notary_config_text.contains("active-or-pending-registration-exists")); + assert!(!notary_config_text.contains("active-registration-exists")); + assert!(!notary_config_text.contains("person-registration-accepted")); assert!(notary_config_text.contains("pending")); let notary_config: Value = serde_norway::from_str(¬ary_config_text).unwrap(); assert_eq!(notary_config["server"]["bind"], "0.0.0.0:8081"); @@ -4828,7 +5097,12 @@ mod tests { .unwrap(); assert_eq!(consultation_relay_config["server"]["bind"], "0.0.0.0:8082"); - let error = add_notary_to_project(&project, &image_lock).unwrap_err(); + let error = add_notary_to_project_with_runtime_preparer( + &project, + &image_lock, + prepare_notary_runtime_static_validation_only_for_unit_test, + ) + .unwrap_err(); assert!(format!("{error:#}").contains("already has a Notary")); } @@ -4848,7 +5122,12 @@ mod tests { let original_secrets = fs::read_to_string(&secrets_path).unwrap(); let original_manifest = fs::read_to_string(&manifest_path).unwrap(); - let error = add_notary_to_project(&project, &image_lock).unwrap_err(); + let error = add_notary_to_project_with_runtime_preparer( + &project, + &image_lock, + prepare_notary_runtime_static_validation_only_for_unit_test, + ) + .unwrap_err(); assert!(format!("{error:#}").contains("already contains a generated Notary entry")); assert!(!project.join("notary").exists()); diff --git a/crates/registryctl/src/main.rs b/crates/registryctl/src/main.rs index 687efcfa7..a2f769d3b 100644 --- a/crates/registryctl/src/main.rs +++ b/crates/registryctl/src/main.rs @@ -5,10 +5,18 @@ use clap::{error::ErrorKind, CommandFactory, Parser, Subcommand, ValueEnum}; use registryctl::{ AddNotaryReport, AnchorReport, BundleInspectReport, BundleSignOptions, BundleSignReport, - BundleVerifyReport, DeploymentProfile, DoctorFormat, InitProjectKind, InitReport, InitSource, - ProjectBuildOptions, ProjectCheckOptions, ProjectCommandReport, ProjectEditorSetupOptions, - ProjectEditorSetupReport, ProjectInitOptions, ProjectSchemaKind, ProjectStarter, - ProjectTestOptions, ProjectTestSelection, Sample, + BundleVerifyReport, ClassifierSafeReportedValue, DeploymentProfile, DoctorFormat, + FieldSourceKind, FixtureRequestBindingState, InitProjectKind, InitReport, InitSource, + MigrationDisposition, ProjectBuildBaselineSetOptions, ProjectBuildOptions, + ProjectCapabilityInventoryReportV1, ProjectCapabilityOptions, ProjectCheckOptions, + ProjectCommandReport, ProjectEditorSetupOptions, ProjectEditorSetupReport, + ProjectEnvironmentSemanticComparisonOptions, ProjectExecutionContext, ProjectFieldAddress, + ProjectFieldExplanation, ProjectInitOptions, ProjectMigrationOptions, ProjectMigrationReportV1, + ProjectPreflightOptions, ProjectPreflightReportV1, ProjectPromotionOptions, + ProjectPromotionReportV1, ProjectSchemaKind, ProjectSemanticComparisonOptions, + ProjectSemanticComparisonReportV1, ProjectStarter, ProjectStarterSemanticComparisonOptions, + ProjectTestOptions, ProjectTestSelection, ProjectTrustedLocalAuthoredValue, + PromotionDisposition, RedactionReason, Sample, }; fn main() -> Result<()> { @@ -131,19 +139,30 @@ fn main() -> Result<()> { project_dir, environment, explain, + show_authored_values, format, against, anchor, } => { - let report = registryctl::check_registry_project(&ProjectCheckOptions { + let options = ProjectCheckOptions { project_directory: project_dir, environment, explain: explain || format == OutputFormat::Human, against, anchor, - }); - let report = match report { - Ok(report) => report, + }; + let checked = if show_authored_values && format != OutputFormat::Human { + Err(anyhow::anyhow!( + "--show-authored-values requires --format human" + )) + } else if show_authored_values { + registryctl::check_registry_project_with_trusted_local_authored_values(&options) + .map(|trusted| (trusted.report, Some(trusted.authored_values))) + } else { + registryctl::check_registry_project(&options).map(|report| (report, None)) + }; + let (report, authored_values) = match checked { + Ok(checked) => checked, Err(error) => { if let Some(report) = error.downcast_ref::() @@ -157,16 +176,204 @@ fn main() -> Result<()> { } std::process::exit(1); } + if format == OutputFormat::Json { + print_json(®istryctl::redacted_project_check_failure_diagnostics())?; + std::process::exit(1); + } return Err(error); } }; match format { - OutputFormat::Human => { - println!("{}", render_check_report(&report, explain)?) - } + OutputFormat::Human => println!( + "{}", + render_check_report(&report, explain, authored_values.as_deref())? + ), OutputFormat::Json => print_json(&report)?, } } + Commands::Preflight { + project_dir, + environment, + format, + } => { + let report = registryctl::preflight_registry_project(&ProjectPreflightOptions { + project_directory: project_dir, + environment, + })?; + let ready = report.status == registryctl::PreflightStatus::Ready; + match format { + OutputFormat::Human => println!("{}", render_preflight_report(&report)?), + OutputFormat::Json => print_json(&report)?, + } + if !ready { + std::process::exit(1); + } + } + Commands::Project { command } => match command { + ProjectCommand::Diagnostics { catalog, format } => match catalog { + DiagnosticCatalog::Authoring => { + let reference = registryctl::authoring_error_reference(); + registryctl::validate_authoring_error_reference(&reference).map_err( + |error| { + anyhow::anyhow!( + "authoring diagnostic reference failed closed validation: {error:?}" + ) + }, + )?; + match format { + OutputFormat::Human => println!( + "{}", + render_diagnostic_reference( + catalog, + &reference.schema_version, + &reference.entries, + &[], + )? + ), + OutputFormat::Json => print_json(&reference)?, + } + } + DiagnosticCatalog::Fixture => { + let reference = registryctl::fixture_error_reference(); + registryctl::validate_fixture_error_reference(&reference).map_err(|error| { + anyhow::anyhow!( + "fixture diagnostic reference failed closed validation: {error:?}" + ) + })?; + match format { + OutputFormat::Human => println!( + "{}", + render_diagnostic_reference( + catalog, + &reference.schema_version, + &reference.entries, + &[], + )? + ), + OutputFormat::Json => print_json(&reference)?, + } + } + DiagnosticCatalog::Operator => { + let reference = registryctl::operator_error_reference(); + registryctl::validate_operator_error_reference(&reference).map_err( + |error| { + anyhow::anyhow!( + "operator diagnostic reference failed closed validation: {error:?}" + ) + }, + )?; + match format { + OutputFormat::Human => println!( + "{}", + render_diagnostic_reference( + catalog, + &reference.schema_version, + &reference.entries, + &reference.omissions, + )? + ), + OutputFormat::Json => print_json(&reference)?, + } + } + }, + }, + Commands::Capabilities { + project_dir, + environment, + format, + } => { + let report = registryctl::inspect_project_capabilities(&ProjectCapabilityOptions { + project_directory: project_dir, + environment, + })?; + print_formatted_report(format, &report, render_capability_inventory)?; + } + Commands::Compare { + project_dir, + environment, + from_project_dir, + from_environment, + from_starter, + format, + } => { + let report = if let Some(starter) = from_starter { + registryctl::compare_registry_project_to_embedded_starter_semantically( + &ProjectStarterSemanticComparisonOptions { + project_directory: project_dir, + environment, + starter, + }, + )? + } else if let Some(baseline_environment) = from_environment { + if let Some(baseline_project_directory) = from_project_dir { + registryctl::compare_registry_projects_semantically( + &ProjectSemanticComparisonOptions { + current_project_directory: project_dir, + current_environment: environment, + baseline_project_directory, + baseline_environment, + }, + )? + } else { + registryctl::compare_registry_project_environments_semantically( + &ProjectEnvironmentSemanticComparisonOptions { + project_directory: project_dir, + current_environment: environment, + baseline_environment, + }, + )? + } + } else { + unreachable!("clap requires exactly one semantic comparison baseline") + }; + print_formatted_report(format, &report, render_semantic_comparison_report)?; + } + Commands::Promote { + project_dir, + environment, + against, + anchor, + relay_against, + relay_anchor, + notary_against, + notary_anchor, + format, + } => { + let report = registryctl::promote_registry_project(&ProjectPromotionOptions { + project_directory: project_dir, + environment, + against, + anchor, + relay_against, + relay_anchor, + notary_against, + notary_anchor, + })?; + let ready = !matches!(report.disposition, PromotionDisposition::Blocked); + print_formatted_report(format, &report, render_promotion_report)?; + if !ready { + std::process::exit(1); + } + } + Commands::Migrate { + project_dir, + target_version, + output, + write_candidate, + format, + } => { + let report = registryctl::migrate_registry_project(&ProjectMigrationOptions { + project_directory: project_dir, + target_version, + output_directory: output, + write_candidate, + })?; + let supported = !matches!(report.disposition, MigrationDisposition::Blocked); + print_formatted_report(format, &report, render_migration_report)?; + if !supported { + std::process::exit(1); + } + } Commands::Authoring { command } => match command { AuthoringCommand::Xw { format } => match format { XwFormat::Reference => print!( @@ -179,6 +386,18 @@ fn main() -> Result<()> { ), }, AuthoringCommand::Schema { kind } => print!("{}", kind.document()), + AuthoringCommand::Reference { coverage } => { + if coverage { + let report = registryctl::embedded_configuration_reference_coverage()?; + let complete = report.status == registryctl::CoverageStatus::Complete; + print_json(&report)?; + if !complete { + std::process::exit(1); + } + } else { + print_json(®istryctl::embedded_configuration_reference()?)?; + } + } AuthoringCommand::Editor { project_dir, format, @@ -201,14 +420,26 @@ fn main() -> Result<()> { environment, against, anchor, + relay_against, + relay_anchor, + notary_against, + notary_anchor, format, } => { - let report = registryctl::build_registry_project(&ProjectBuildOptions { - project_directory: project_dir, - environment, - against, - anchor, - })?; + let report = registryctl::build_registry_project_with_baselines( + &ProjectBuildOptions { + project_directory: project_dir, + environment, + against, + anchor, + }, + &ProjectBuildBaselineSetOptions { + relay_against, + relay_anchor, + notary_against, + notary_anchor, + }, + )?; print_formatted_report(format, &report, render_build_report)?; } Commands::Start => registryctl::start_project(&std::env::current_dir()?)?, @@ -315,11 +546,30 @@ fn watch_project_tests(options: ProjectTestOptions, selection: ProjectTestSelect fn watch_project_tests_until( options: ProjectTestOptions, selection: ProjectTestSelection, + should_stop_after_observation: impl FnMut(usize, &std::path::Path) -> Result, +) -> Result<()> { + let execution_context = ProjectExecutionContext::for_current_executable()?; + watch_project_tests_until_with_context( + options, + selection, + &execution_context, + should_stop_after_observation, + ) +} + +fn watch_project_tests_until_with_context( + options: ProjectTestOptions, + selection: ProjectTestSelection, + execution_context: &ProjectExecutionContext, mut should_stop_after_observation: impl FnMut(usize, &std::path::Path) -> Result, ) -> Result<()> { let mut completed_runs = 0; loop { - let report = registryctl::test_registry_project_selected(&options, &selection)?; + let report = registryctl::test_registry_project_selected_with_context( + &options, + &selection, + execution_context, + )?; println!("{}", render_test_summary(&report)); let observed = project_watch_fingerprint(&options.project_directory)?; completed_runs += 1; @@ -405,6 +655,39 @@ fn print_formatted_report( Ok(()) } +fn render_semantic_comparison_report(report: &ProjectSemanticComparisonReportV1) -> Result { + use std::fmt::Write as _; + + let mut output = String::new(); + writeln!(output, "{}", report.human_safe_summary())?; + if !report.changes.is_empty() { + writeln!(output, "Changes:")?; + for change in &report.changes { + writeln!( + output, + " - {:?} {:?} {:?} {} ({} occurrence{})", + change.dimension, + change.direction, + change.address.schema_family, + change.address.field, + change.occurrences, + if change.occurrences == 1 { "" } else { "s" }, + )?; + } + } + if !report.required_actions.is_empty() { + writeln!(output, "Required actions:")?; + for action in &report.required_actions { + writeln!(output, " - {action:?}")?; + } + } + writeln!( + output, + "External approval: not evaluated; runtime behavior: not observed." + )?; + Ok(output.trim_end().to_owned()) +} + fn render_add_notary_report(report: &AddNotaryReport) -> Result { use std::fmt::Write as _; @@ -535,6 +818,260 @@ fn render_editor_setup_report(report: &ProjectEditorSetupReport) -> Result Result { + use std::fmt::Write as _; + + let mut output = String::new(); + writeln!( + output, + "Registry Stack project {:?} is {} for environment {:?}.", + report.project, + if report.status == registryctl::PreflightStatus::Ready { + "locally ready" + } else { + "not locally ready" + }, + report.environment + )?; + writeln!( + output, + " Offline boundary: no network, source contact, fixture execution, external process, or build output." + )?; + writeln!( + output, + " Checks: {} static, {} product, {} secret, {} runtime file.", + report.static_checks.len(), + report.product_validators.len(), + report.secret_checks.len(), + report.runtime_files.len(), + )?; + for diagnostic in &report.diagnostics { + let code = serde_json::to_value(diagnostic.code)? + .as_str() + .unwrap_or("registryctl.preflight.unknown") + .to_owned(); + writeln!(output, " [{code}] {:?}", diagnostic.message)?; + for address in &diagnostic.addresses { + writeln!( + output, + " {}#{}", + address.file.as_str(), + address.pointer.as_str() + )?; + } + writeln!(output, " Fix: {:?}", diagnostic.remediation)?; + } + Ok(output.trim_end().to_owned()) +} + +fn render_diagnostic_reference( + catalog: DiagnosticCatalog, + schema_version: &str, + entries: &[registryctl::ErrorReferenceEntry], + omissions: &[registryctl::OperatorErrorOmission], +) -> Result { + use std::fmt::Write as _; + + let mut output = String::new(); + writeln!( + output, + "Registry Stack {} diagnostic reference.", + catalog.as_str() + )?; + writeln!(output, " Schema: {}", human_line(schema_version))?; + writeln!(output, " Entries: {}", entries.len())?; + for entry in entries { + writeln!( + output, + " [{}/{}/{}]", + entry.family.as_str(), + entry.product.as_str(), + human_line(&entry.code) + )?; + writeln!(output, " Meaning: {}", human_line(&entry.safe_meaning))?; + writeln!(output, " Rule: {}", human_line(&entry.rule))?; + writeln!( + output, + " Remediation: {}", + human_line(&entry.safe_remediation) + )?; + writeln!( + output, + " Lifecycle: {:?}; introduced: {}", + entry.lifecycle, + entry + .introduced_in + .as_deref() + .map_or_else(|| "not released".to_string(), human_line) + )?; + writeln!( + output, + " Evidence limitation: {}", + human_line(&entry.evidence_limitation) + )?; + writeln!( + output, + " Documentation: {}", + human_line(&entry.docs_anchor) + )?; + } + writeln!(output, " Omissions: {}", omissions.len())?; + for omission in omissions { + writeln!( + output, + " [omission/{:?}/{}] {}", + omission.family, + omission.product.as_str(), + human_line(&omission.evidence) + )?; + writeln!( + output, + " Required action: {}", + human_line(&omission.required_action) + )?; + } + Ok(output.trim_end().to_string()) +} + +fn render_promotion_report(report: &ProjectPromotionReportV1) -> Result { + use std::fmt::Write as _; + + let mut output = String::new(); + writeln!(output, "Promotion: {:?}", report.disposition)?; + writeln!(output, " Evidence: offline static comparison")?; + writeln!(output, " Classified changes: {}", report.changes.len())?; + for change in &report.changes { + writeln!( + output, + " - {:?}: {:?} ({:?})", + change.kind, change.effect, change.boundary + )?; + } + if report.blocking_reasons.is_empty() { + writeln!(output, " Blocking reasons: none")?; + } else { + writeln!(output, " Blocking reasons:")?; + for reason in &report.blocking_reasons { + writeln!(output, " - {reason:?}")?; + } + } + if report.required_actions.review_classes.is_empty() { + writeln!(output, " Required reviews: none")?; + } else { + writeln!( + output, + " Required reviews: {}", + report + .required_actions + .review_classes + .iter() + .map(|review| format!("{review:?}")) + .collect::>() + .join(", ") + )?; + } + writeln!( + output, + " Re-sign: {:?}; restart: {:?}; reactivate: {:?}", + report.required_actions.re_sign, + report.required_actions.restart, + report.required_actions.reactivate + )?; + Ok(output.trim_end().to_owned()) +} + +fn render_migration_report(report: &ProjectMigrationReportV1) -> Result { + use std::fmt::Write as _; + + let mut output = String::new(); + writeln!(output, "Project migration: {:?}", report.disposition)?; + writeln!(output, " Evidence: offline static validation")?; + if report.disposition == MigrationDisposition::ReviewRequired { + writeln!( + output, + " Result: candidate/check succeeded; pending reviews are not approval or completion" + )?; + } + writeln!( + output, + " Changes: {} compatible normalizations, {} semantic", + report.compatible_normalizations.len(), + report.semantic_changes.len() + )?; + writeln!( + output, + " Candidate: {:?}; emission: {:?}", + report.output.candidate_artifact, report.output.candidate_emission + )?; + writeln!(output, " Authored files overwritten: no")?; + if report.blocking_reasons.is_empty() { + writeln!(output, " Blocking reasons: none")?; + } else { + writeln!(output, " Blocking reasons:")?; + for reason in &report.blocking_reasons { + writeln!(output, " - {reason:?}")?; + } + } + let pending = report + .reviews + .iter() + .filter(|review| review.status == registryctl::MigrationReviewStatus::RequiredPending) + .map(|review| format!("{:?}", review.class)) + .collect::>(); + writeln!( + output, + " Required reviews: {}", + if pending.is_empty() { + "none".to_owned() + } else { + pending.join(", ") + } + )?; + for gate in &report.rerun_gates { + writeln!(output, " Gate {:?}: {:?}", gate.gate, gate.status)?; + } + for diagnostic in &report.diagnostics { + writeln!( + output, + " Diagnostic {:?}/{:?}: {:?}", + diagnostic.code, diagnostic.phase, diagnostic.remediation + )?; + } + Ok(output.trim_end().to_owned()) +} + +fn render_capability_inventory(report: &ProjectCapabilityInventoryReportV1) -> Result { + use std::fmt::Write as _; + + let mut output = String::from("Registry Stack offline capability inventory."); + writeln!(output, "\n Runtime activation: not evaluated")?; + for capability in &report.capabilities { + writeln!( + output, + " {:?}: installed={:?}, project={:?}, environment={:?}, disposition={:?}", + capability.capability, + capability.installed_release, + capability.project_declaration, + capability.environment_enablement, + capability.disposition, + )?; + } + if report.missing_support.is_empty() { + writeln!( + output, + " Missing support: none in evaluated local components" + )?; + } else { + writeln!( + output, + " Missing support: {} component(s)", + report.missing_support.len() + )?; + } + writeln!(output, " Image availability: not evaluated")?; + Ok(output.trim_end().to_owned()) +} + fn render_bundle_inspect_report(report: &BundleInspectReport) -> Result { use std::fmt::Write as _; @@ -769,23 +1306,96 @@ fn render_test_summary(report: &ProjectCommandReport) -> String { output } -fn render_limit(value: &serde_json::Value, unit: &str) -> String { - let value = value - .as_str() - .map(str::to_owned) - .unwrap_or_else(|| value.to_string()); - match unit { +fn classifier_public_value(field: &ProjectFieldExplanation) -> Option<&serde_json::Value> { + match &field.reported_value { + ClassifierSafeReportedValue::Public { value } => Some(value.as_value()), + ClassifierSafeReportedValue::Redacted { .. } | ClassifierSafeReportedValue::Absent => None, + } +} + +fn classifier_public_text(field: &ProjectFieldExplanation) -> Option<&str> { + classifier_public_value(field)?.as_str() +} + +fn classifier_public_count(field: &ProjectFieldExplanation) -> Option { + classifier_public_value(field)?.as_u64() +} + +fn render_field_source(source: FieldSourceKind) -> &'static str { + match source { + FieldSourceKind::Authored => "authored", + FieldSourceKind::Defaulted => "defaulted", + FieldSourceKind::Detected => "detected", + FieldSourceKind::Derived => "derived", + FieldSourceKind::EnvironmentBound => "environment-bound", + FieldSourceKind::Generated => "generated", + FieldSourceKind::Runtime => "runtime", + FieldSourceKind::Absent => "absent", + } +} + +fn render_limit(field: &ProjectFieldExplanation, unit: &str) -> Option { + let value = classifier_public_value(field)?; + let value = match value { + serde_json::Value::String(value) => value.clone(), + serde_json::Value::Number(value) => value.to_string(), + _ => return None, + }; + Some(match unit { "" | "duration" => value, "calls" if value == "1" => "1 call".to_string(), _ => format!("{value} {unit}"), - } + }) } fn render_count(count: u64, singular: &str, plural: &str) -> String { format!("{count} {}", if count == 1 { singular } else { plural }) } -fn render_check_report(report: &ProjectCommandReport, expanded: bool) -> Result { +fn explanation_pointer_segments(path: &str) -> Option> { + if !path.starts_with('/') { + return None; + } + path[1..] + .split('/') + .map(|segment| { + let mut decoded = String::with_capacity(segment.len()); + let mut chars = segment.chars(); + while let Some(character) = chars.next() { + if character != '~' { + decoded.push(character); + continue; + } + match chars.next()? { + '0' => decoded.push('~'), + '1' => decoded.push('/'), + _ => return None, + } + } + Some(decoded) + }) + .collect() +} + +fn rendered_claim_class( + has_direct_consultation_output: bool, + authoritative_evidence: Option<&str>, +) -> Option<&'static str> { + if has_direct_consultation_output { + return Some("consultation_output"); + } + match authoritative_evidence { + Some("registry_backed") => Some("registry_backed_evaluation"), + Some("self_attested") => Some("source_free_evaluation"), + _ => None, + } +} + +fn render_check_report( + report: &ProjectCommandReport, + expanded: bool, + trusted_local_values: Option<&[ProjectTrustedLocalAuthoredValue]>, +) -> Result { use std::fmt::Write as _; let explanation = report @@ -834,9 +1444,49 @@ fn render_check_report(report: &ProjectCommandReport, expanded: bool) -> Result< .count(); writeln!( output, - "Fixtures: {passed}/{} passed", + "Fixtures: {passed}/{} passed (offline synthetic)", report.fixtures.len() )?; + let fixture_coverage = report + .fixture_coverage + .as_ref() + .context("human check output requires fixture coverage")?; + let mut authored_requests = 0usize; + let mut passed_authored_requests = 0usize; + let mut mapping_derived_fixtures = 0usize; + for target in &fixture_coverage.targets { + for fixture in &target.fixture_inventory { + match fixture.request_to_consultation_binding.state { + FixtureRequestBindingState::NotAuthored => mapping_derived_fixtures += 1, + FixtureRequestBindingState::Passed => { + authored_requests += 1; + passed_authored_requests += 1; + } + FixtureRequestBindingState::NotExecuted | FixtureRequestBindingState::Failed => { + authored_requests += 1; + } + } + } + } + if authored_requests == 0 { + writeln!( + output, + "Fixture request witnesses: none authored; {mapping_derived_fixtures} fixture(s) use mapping-derived governed request inputs." + )?; + writeln!( + output, + "Fixture proof boundary: mapping-derived fixtures exercise consultation and source behavior only. Independent external/live caller compatibility is not evaluated." + )?; + } else { + writeln!( + output, + "Fixture request witnesses: {passed_authored_requests}/{authored_requests} independently authored offline request-to-consultation bindings passed; {mapping_derived_fixtures} fixture(s) remain mapping-derived." + )?; + writeln!( + output, + "Fixture proof boundary: independently authored fixture requests exercise offline request-to-consultation bindings; mapping-derived fixtures exercise consultation and source behavior only. External/live caller compatibility is not evaluated." + )?; + } let mut by_integration = std::collections::BTreeMap::<&str, (usize, usize)>::new(); for fixture in &report.fixtures { let totals = by_integration @@ -849,15 +1499,43 @@ fn render_check_report(report: &ProjectCommandReport, expanded: bool) -> Result< writeln!(output, " {integration}: {passed}/{total} passed")?; } + let mut project_fields = std::collections::BTreeMap::new(); + let mut integration_fields = + std::collections::BTreeMap::<&str, std::collections::BTreeMap<&str, _>>::new(); + let mut environment_fields = std::collections::BTreeMap::new(); + let mut redacted_sensitive_metadata = 0usize; + let mut redacted_secret_material = 0usize; + let mut redacted_by_policy = 0usize; + for field in &explanation.fields { + if let ClassifierSafeReportedValue::Redacted { reason, .. } = &field.reported_value { + match reason { + RedactionReason::SensitiveMetadata => redacted_sensitive_metadata += 1, + RedactionReason::SecretMaterial => redacted_secret_material += 1, + RedactionReason::Policy => redacted_by_policy += 1, + } + } + match &field.address { + ProjectFieldAddress::Project { path } => { + project_fields.insert(path.as_str(), field); + } + ProjectFieldAddress::Integration { integration, path } => { + integration_fields + .entry(integration) + .or_default() + .insert(path.as_str(), field); + } + ProjectFieldAddress::Environment { path, .. } => { + environment_fields.insert(path.as_str(), field); + } + ProjectFieldAddress::Entity { .. } | ProjectFieldAddress::Fixture { .. } => {} + } + } + writeln!(output, "Effective authority and limits:")?; - if let Some(topology) = explanation - .get("topology") - .and_then(serde_json::Value::as_object) - { - let deployment = topology - .get("deployment") - .and_then(serde_json::Value::as_str) - .unwrap_or("unknown"); + let deployment = project_fields + .get("/topology/deployment") + .and_then(|field| classifier_public_text(field)); + if let Some(deployment) = deployment { let topology_label = match deployment { "relay_only" => "Relay-only", "notary_only" => "Notary-only", @@ -865,210 +1543,322 @@ fn render_check_report(report: &ProjectCommandReport, expanded: bool) -> Result< _ => "unknown", }; writeln!(output, " topology: {topology_label}")?; - if let Some(relay) = topology.get("relay").and_then(serde_json::Value::as_object) { - if relay - .get("required") - .and_then(serde_json::Value::as_bool) - .unwrap_or(false) - { - let integrations = relay - .get("source_integrations") - .and_then(serde_json::Value::as_u64) - .unwrap_or(0); - let records_services = relay - .get("records_api_services") - .and_then(serde_json::Value::as_u64) - .unwrap_or(0); - let entities = relay - .get("materialized_entities") - .and_then(serde_json::Value::as_u64) - .unwrap_or(0); - writeln!( - output, - " Relay authority: {}, {}, {}", - render_count(integrations, "source integration", "source integrations"), - render_count( - records_services, - "records API service", - "records API services" - ), - render_count( - entities, - "materialized entity definition", - "materialized entity definitions" - ), - )?; - } else { - writeln!(output, " Relay source authority: not applicable")?; + if matches!(deployment, "relay_only" | "combined") { + let relay_counts = [ + ( + "/topology/source_integration_count", + "source integration", + "source integrations", + ), + ( + "/topology/records_api_service_count", + "records API service", + "records API services", + ), + ( + "/topology/materialized_entity_count", + "materialized entity definition", + "materialized entity definitions", + ), + ] + .into_iter() + .filter_map(|(path, singular, plural)| { + project_fields + .get(path) + .and_then(|field| classifier_public_count(field)) + .map(|count| render_count(count, singular, plural)) + }) + .collect::>(); + if !relay_counts.is_empty() { + writeln!(output, " Relay authority: {}", relay_counts.join(", "),)?; } + } else { + writeln!(output, " Relay source authority: not applicable")?; } - if let Some(notary) = topology - .get("notary") - .and_then(serde_json::Value::as_object) - { - if notary - .get("required") - .and_then(serde_json::Value::as_bool) - .unwrap_or(false) - { - let source_free_evaluation = notary - .get("source_free_evaluation_services") - .and_then(serde_json::Value::as_u64) - .unwrap_or(0); - let relay_backed = notary - .get("relay_backed_services") - .and_then(serde_json::Value::as_u64) - .unwrap_or(0); - writeln!( - output, - " Notary authority: {}, {}", - render_count( - source_free_evaluation, - "source-free evaluation service", - "source-free evaluation services" - ), - render_count( - relay_backed, - "compiler-pinned Relay-backed service", - "compiler-pinned Relay-backed services" - ), - )?; + + if matches!(deployment, "notary_only" | "combined") { + let mut service_ids = std::collections::BTreeSet::new(); + for (path, field) in &project_fields { + if classifier_public_value(field).is_none() { + continue; + } + let Some(parts) = explanation_pointer_segments(path) else { + continue; + }; + if parts.len() >= 3 && parts[0] == "services" { + service_ids.insert(parts[1].clone()); + } } + let mut source_free_evaluation = 0u64; + let mut relay_backed = 0u64; + for service_id in service_ids { + let kind_path = format!("/services/{service_id}/kind"); + let consultation_count_path = format!("/services/{service_id}/consultation_count"); + if project_fields + .get(kind_path.as_str()) + .and_then(|field| classifier_public_text(field)) + != Some("evidence") + { + continue; + } + match project_fields + .get(consultation_count_path.as_str()) + .and_then(|field| classifier_public_count(field)) + { + Some(0) => source_free_evaluation += 1, + Some(_) => relay_backed += 1, + None => {} + } + } + writeln!( + output, + " Notary authority: {}, {}", + render_count( + source_free_evaluation, + "source-free evaluation service", + "source-free evaluation services" + ), + render_count( + relay_backed, + "compiler-pinned Relay-backed service", + "compiler-pinned Relay-backed services" + ), + )?; } } - if let Some(integrations) = explanation - .get("integrations") - .and_then(serde_json::Value::as_object) - { - for (name, integration) in integrations { - let capability = integration - .get("capability") - .and_then(serde_json::Value::as_str) - .unwrap_or("unknown"); - writeln!(output, " {name}: capability={capability}")?; - if let Some(bounds) = integration - .get("bounds") - .and_then(serde_json::Value::as_object) - { - let rendered = bounds - .iter() - .map(|(name, bound)| { - let value = bound.get("value").unwrap_or(&serde_json::Value::Null); - let unit = bound - .get("unit") - .and_then(serde_json::Value::as_str) - .unwrap_or(""); - let source = bound - .get("source") - .and_then(serde_json::Value::as_str) - .unwrap_or("intrinsic"); - format!("{name}={} ({source})", render_limit(value, unit)) - }) - .collect::>() - .join(", "); - writeln!(output, " limits: {rendered}")?; - } - if let Some(operations) = integration - .get("operations") - .and_then(serde_json::Value::as_array) - { - writeln!( - output, - " authority: {} bounded operation(s)", - operations.len() - )?; + + for (name, fields) in integration_fields { + let Some(capability) = fields + .get("/capability/type") + .and_then(|field| classifier_public_text(field)) + else { + continue; + }; + writeln!(output, " {name}: capability={capability}")?; + let mut limits = Vec::new(); + for (path, label, unit) in [ + ("/limits/calls", "calls", "calls"), + ("/limits/deadline", "deadline", ""), + ("/limits/request_bytes", "request_bytes", "bytes"), + ("/limits/source_bytes", "source_bytes", "bytes"), + ("/source/response/max_bytes", "response_max_bytes", "bytes"), + ] { + let Some(field) = fields.get(path) else { + continue; + }; + let Some(value) = render_limit(field, unit) else { + continue; + }; + limits.push(format!( + "{label}={value} ({})", + render_field_source(field.source.kind) + )); + } + if !limits.is_empty() { + writeln!(output, " limits: {}", limits.join(", "))?; + } + match capability { + "http" => { + let operation_count = fields + .get("/capability/http/operation_count") + .and_then(|field| classifier_public_count(field)); + if let Some(operation_count) = operation_count { + writeln!( + output, + " authority: {} bounded operation(s)", + operation_count + )?; + } if expanded { - for operation in operations { - writeln!( - output, - " {} {} {}", - operation - .get("method") - .and_then(serde_json::Value::as_str) - .unwrap_or("READ"), - operation - .get("destination") - .and_then(serde_json::Value::as_str) - .unwrap_or("source"), - operation - .get("path") - .and_then(serde_json::Value::as_str) - .unwrap_or("/") - )?; + let mut roles = std::collections::BTreeMap::new(); + for (path, field) in &fields { + let Some(parts) = explanation_pointer_segments(path) else { + continue; + }; + if parts.len() == 5 + && parts[0] == "capability" + && parts[1] == "http" + && parts[2] == "operations" + && parts[4] == "role" + { + if let (Ok(index), Some(role)) = + (parts[3].parse::(), classifier_public_text(field)) + { + roles.insert(index, role); + } + } + } + for (index, role) in roles { + writeln!(output, " operation {}: class={role}", index + 1)?; } } - } else if let Some(authority) = integration.get("script_authority") { - let rules = authority - .get("allow") - .and_then(serde_json::Value::as_array) - .map_or(0, Vec::len); + } + "script" => { writeln!( output, - " authority: reviewed script with {rules} source allow rule(s)" + " authority: reviewed script with bounded source access" )?; - } else if capability == "snapshot" { + } + "snapshot" => { writeln!( output, " authority: exact local materialized snapshot read" )?; } - for (field, label) in [ - ("ambiguity", "ambiguity"), - ("subject_mismatch", "subject mismatch"), + _ => {} + } + if expanded { + let credential_path = format!( + "/integrations/{}/source/credential_class", + name.replace('~', "~0").replace('/', "~1") + ); + if let Some(credential_class) = environment_fields + .get(credential_path.as_str()) + .and_then(|field| classifier_public_text(field)) + { + writeln!(output, " credential class: {credential_class}")?; + } + } + } + + if expanded { + writeln!(output, "Services, claims, and disclosure:")?; + let mut service_ids = std::collections::BTreeSet::new(); + for (path, field) in &project_fields { + if classifier_public_value(field).is_none() { + continue; + } + let Some(parts) = explanation_pointer_segments(path) else { + continue; + }; + if parts.len() >= 3 && parts[0] == "services" { + service_ids.insert(parts[1].clone()); + } + } + for service_id in service_ids { + let prefix = format!("/services/{service_id}"); + let public_text = |suffix: &str| { + project_fields + .get(format!("{prefix}/{suffix}").as_str()) + .and_then(|field| classifier_public_text(field)) + }; + let kind = public_text("kind"); + writeln!( + output, + " {service_id}:{}", + kind.map_or_else(String::new, |kind| format!(" kind={kind}")) + )?; + for (path, label) in [ + ("purpose", "purpose"), + ("legal_basis", "legal basis"), + ("consent", "consent"), ] { - let Some(reason) = integration - .pointer(&format!("/not_applicable/{field}")) - .and_then(serde_json::Value::as_object) - else { + if let Some(value) = public_text(path) { + writeln!(output, " {label}: {value}")?; + } + } + let mut scopes = std::collections::BTreeMap::new(); + let mut claim_ids = std::collections::BTreeSet::new(); + for (path, field) in &project_fields { + let Some(parts) = explanation_pointer_segments(path) else { continue; }; + if parts.len() == 5 + && parts[0] == "services" + && parts[1] == service_id + && parts[2] == "access" + && parts[3] == "scopes" + { + if let (Ok(index), Some(scope)) = + (parts[4].parse::(), classifier_public_text(field)) + { + scopes.insert(index, scope); + } + } + if parts.len() >= 5 + && parts[0] == "services" + && parts[1] == service_id + && parts[2] == "claims" + && classifier_public_value(field).is_some() + { + claim_ids.insert(parts[3].clone()); + } + } + if !scopes.is_empty() { writeln!( output, - " {label} not applicable: {} [request fixture: {}]", - reason - .get("rationale") - .and_then(serde_json::Value::as_str) - .unwrap_or("missing rationale"), - reason - .get("request_fixture") - .and_then(serde_json::Value::as_str) - .unwrap_or("missing") + " scopes: {}", + scopes.into_values().collect::>().join(", ") )?; } - if expanded { - let outputs = integration - .get("outputs") - .and_then(serde_json::Value::as_object) - .map(|values| values.keys().cloned().collect::>().join(", ")) - .unwrap_or_else(|| "none".to_string()); - writeln!(output, " outputs: {outputs}")?; + for claim_id in claim_ids { + let claim_prefix = format!("{prefix}/claims/{claim_id}"); + let disclosure = project_fields + .get(format!("{claim_prefix}/disclosure").as_str()) + .or_else(|| { + project_fields.get(format!("{claim_prefix}/disclosure/default").as_str()) + }) + .and_then(|field| classifier_public_text(field)); + let evidence = project_fields + .get(format!("{claim_prefix}/evidence").as_str()) + .and_then(|field| classifier_public_text(field)); + let claim_class = rendered_claim_class( + project_fields.contains_key(format!("{claim_prefix}/output").as_str()), + evidence, + ); + let mut classes = Vec::new(); + if let Some(claim_class) = claim_class { + classes.push(format!("class={claim_class}")); + } + if let Some(disclosure) = disclosure { + classes.push(format!("disclosure={disclosure}")); + } + if !classes.is_empty() { + writeln!(output, " claim {claim_id}: {}", classes.join(", "))?; + } } } + let mut redactions = Vec::new(); + if redacted_sensitive_metadata > 0 { + redactions.push(render_count( + redacted_sensitive_metadata as u64, + "redacted sensitive metadata field", + "redacted sensitive metadata fields", + )); + } + if redacted_secret_material > 0 { + redactions.push(render_count( + redacted_secret_material as u64, + "redacted secret material field", + "redacted secret material fields", + )); + } + if redacted_by_policy > 0 { + redactions.push(render_count( + redacted_by_policy as u64, + "policy-redacted field", + "policy-redacted fields", + )); + } + if !redactions.is_empty() { + writeln!(output, "Redactions: {}", redactions.join(", "))?; + } } - if expanded { - writeln!(output, "Claims and disclosure:")?; - if let Some(services) = explanation - .get("services") - .and_then(serde_json::Value::as_object) - { - for (service, declaration) in services { - writeln!(output, " {service}:")?; - if let Some(claims) = declaration - .get("claims") - .and_then(serde_json::Value::as_object) - { - for (claim, value) in claims { - writeln!( - output, - " {claim}: disclosure={}", - value - .get("disclosure") - .map(serde_json::Value::to_string) - .unwrap_or_else(|| "null".to_string()) - )?; - } - } - } + if let Some(values) = trusted_local_values { + writeln!( + output, + "WARNING: trusted-local authored values follow. This output includes project-sensitive metadata and must not be shared." + )?; + writeln!( + output, + "Secret values, secret references and runtime secret-file locators, fixture data, raw parser text, defaulted values, and derived values remain hidden." + )?; + writeln!(output, "Trusted-local authored values:")?; + if values.is_empty() { + writeln!(output, " none")?; + } + for field in values { + writeln!(output, " {}", field.terminal_line()?)?; } } writeln!( @@ -1084,6 +1874,23 @@ enum OutputFormat { Json, } +#[derive(Debug, Clone, Copy, PartialEq, Eq, ValueEnum)] +enum DiagnosticCatalog { + Authoring, + Fixture, + Operator, +} + +impl DiagnosticCatalog { + const fn as_str(self) -> &'static str { + match self { + Self::Authoring => "authoring", + Self::Fixture => "fixture", + Self::Operator => "operator", + } + } +} + #[derive(Debug, Clone, Copy, ValueEnum)] enum XwFormat { Reference, @@ -1102,6 +1909,12 @@ enum AuthoringCommand { #[arg(long, value_enum)] kind: ProjectSchemaKind, }, + /// Print the deterministic project-configuration reference or its coverage audit. + Reference { + /// Print reviewed human-intent coverage and fail when any field is uncovered. + #[arg(long)] + coverage: bool, + }, /// Install deterministic local schema mappings for VS Code and Zed. Editor { /// Project workspace root containing registry-stack.yaml. @@ -1115,6 +1928,19 @@ enum AuthoringCommand { LanguageServer, } +#[derive(Debug, Subcommand)] +enum ProjectCommand { + /// Print a static diagnostic catalog without reading a project or runtime. + Diagnostics { + /// Authoring, offline-fixture, or operator diagnostic reference. + #[arg(long, value_enum)] + catalog: DiagnosticCatalog, + /// Human-readable reference, or machine-readable JSON. + #[arg(long, value_enum, default_value = "human")] + format: OutputFormat, + }, +} + #[derive(Debug, Parser)] #[command(name = "registryctl")] #[command(version)] @@ -1180,31 +2006,154 @@ enum Commands { #[arg(long, value_enum, default_value = "human")] format: OutputFormat, }, - /// Validate and explain generated Relay and Notary configuration. - Check { + /// Validate and explain generated Relay and Notary configuration. + Check { + /// Project workspace root. + #[arg(long, default_value = ".")] + project_dir: PathBuf, + /// Explicit environment binding. + #[arg(long)] + environment: String, + /// Print the complete redacted acquisition and disclosure plan. + #[arg(long)] + explain: bool, + /// Show directly authored non-secret values for trusted-local terminal review. + /// + /// This may expose project-sensitive metadata. Secret references, + /// secret values and runtime secret-file locators, fixture data, raw + /// parser text, defaulted values, and derived values remain hidden. + #[arg(long, requires = "explain")] + show_authored_values: bool, + /// Human-readable review report, or deliberate machine-readable JSON. + #[arg(long, value_enum, default_value = "human")] + format: OutputFormat, + /// Previously signed product Config Bundle with review and internal approval state. + #[arg(long)] + against: Option, + /// Trust anchor for --against. + #[arg(long)] + anchor: Option, + }, + /// Inspect project-authoring references and schemas. + Authoring { + #[command(subcommand)] + command: AuthoringCommand, + }, + /// Inspect pure Registry Stack project metadata without reading a workspace. + Project { + #[command(subcommand)] + command: ProjectCommand, + }, + /// Verify local environment, secret-reference, and runtime-file readiness without network access. + Preflight { + /// Project workspace root. + #[arg(long, default_value = ".")] + project_dir: PathBuf, + /// Explicit environment binding. + #[arg(long)] + environment: String, + /// Human-readable result, or machine-readable JSON. + #[arg(long, value_enum, default_value = "human")] + format: OutputFormat, + }, + /// Inspect compiled, declared, enabled, used, and missing local capabilities. + Capabilities { + /// Project workspace root. + #[arg(long, default_value = ".")] + project_dir: PathBuf, + /// Explicit environment binding. + #[arg(long)] + environment: String, + /// Human-readable result, or machine-readable JSON. + #[arg(long, value_enum, default_value = "human")] + format: OutputFormat, + }, + /// Compare normalized local project state without reading runtime or signed approval state. + Compare { + /// Current project workspace root. + #[arg(long, default_value = ".")] + project_dir: PathBuf, + /// Current project environment binding. + #[arg(long)] + environment: String, + /// Baseline project workspace root. Omit to compare two environments of this project. + #[arg(long, requires = "from_environment", conflicts_with = "from_starter")] + from_project_dir: Option, + /// Baseline environment binding for local project comparison. + #[arg( + long, + required_unless_present = "from_starter", + conflicts_with = "from_starter" + )] + from_environment: Option, + /// Compare against the recorded, exact starter embedded in this registryctl release. + /// + /// Optionally name a starter kind to assert that it matches the + /// project's recorded provenance. + #[arg( + long, + num_args = 0..=1, + required_unless_present = "from_environment", + conflicts_with_all = ["from_project_dir", "from_environment"] + )] + from_starter: Option>, + /// Human-readable value-free review plan, or strict machine-readable JSON. + #[arg(long, value_enum, default_value = "human")] + format: OutputFormat, + }, + /// Compare normalized authored state with a verified reviewed baseline without deployment. + Promote { /// Project workspace root. #[arg(long, default_value = ".")] project_dir: PathBuf, /// Explicit environment binding. #[arg(long)] environment: String, - /// Print the complete redacted acquisition and disclosure plan. - #[arg(long)] - explain: bool, - /// Human-readable review report, or deliberate machine-readable JSON. - #[arg(long, value_enum, default_value = "human")] - format: OutputFormat, /// Previously signed product Config Bundle with review and internal approval state. - #[arg(long)] + #[arg( + long, + conflicts_with_all = ["relay_against", "relay_anchor", "notary_against", "notary_anchor"] + )] against: Option, /// Trust anchor for --against. - #[arg(long)] + #[arg( + long, + conflicts_with_all = ["relay_against", "relay_anchor", "notary_against", "notary_anchor"] + )] anchor: Option, + /// Relay Config Bundle baseline for a combined Relay and Notary project. + #[arg(long, requires = "relay_anchor")] + relay_against: Option, + /// Relay trust anchor for --relay-against. + #[arg(long, requires = "relay_against")] + relay_anchor: Option, + /// Notary Config Bundle baseline for a combined Relay and Notary project. + #[arg(long, requires = "notary_anchor")] + notary_against: Option, + /// Notary trust anchor for --notary-against. + #[arg(long, requires = "notary_against")] + notary_anchor: Option, + /// Human-readable result, or machine-readable JSON. + #[arg(long, value_enum, default_value = "human")] + format: OutputFormat, }, - /// Inspect project-authoring references and schemas. - Authoring { - #[command(subcommand)] - command: AuthoringCommand, + /// Check a reviewed authoring migration and optionally emit a separate candidate. + Migrate { + /// Project workspace root. + #[arg(long, default_value = ".")] + project_dir: PathBuf, + /// Target authoring contract version. + #[arg(long, default_value_t = 1)] + target_version: u32, + /// Separate, absent destination for a reviewable candidate. + #[arg(long, requires = "write_candidate")] + output: Option, + /// Grant authority to write only the separate migration candidate. + #[arg(long, requires = "output")] + write_candidate: bool, + /// Human-readable result, or machine-readable JSON. + #[arg(long, value_enum, default_value = "human")] + format: OutputFormat, }, /// Emit deterministic unsigned Relay and Notary Config Bundle inputs. Build { @@ -1215,11 +2164,31 @@ enum Commands { #[arg(long)] environment: String, /// Previously signed product Config Bundle with review and internal approval state. - #[arg(long)] + #[arg( + long, + requires = "anchor", + conflicts_with_all = ["relay_against", "relay_anchor", "notary_against", "notary_anchor"] + )] against: Option, /// Trust anchor for --against. - #[arg(long)] + #[arg( + long, + requires = "against", + conflicts_with_all = ["relay_against", "relay_anchor", "notary_against", "notary_anchor"] + )] anchor: Option, + /// Relay Config Bundle approved baseline for a combined project comparison. + #[arg(long, requires = "relay_anchor")] + relay_against: Option, + /// Relay trust anchor for --relay-against. + #[arg(long, requires = "relay_against")] + relay_anchor: Option, + /// Notary Config Bundle approved baseline for a combined project comparison. + #[arg(long, requires = "notary_anchor")] + notary_against: Option, + /// Notary trust anchor for --notary-against. + #[arg(long, requires = "notary_against")] + notary_anchor: Option, /// Human-readable result, or machine-readable JSON. #[arg(long, value_enum, default_value = "human")] format: OutputFormat, @@ -1282,6 +2251,12 @@ impl Commands { self, Self::Doctor { .. } | Self::Authoring { .. } + | Self::Project { .. } + | Self::Preflight { .. } + | Self::Capabilities { .. } + | Self::Compare { .. } + | Self::Promote { .. } + | Self::Migrate { .. } | Self::Bundle { .. } | Self::Anchor { .. } | Self::UpdateCheck @@ -1296,6 +2271,30 @@ mod tests { use super::*; + #[test] + fn pure_project_diagnostic_catalog_cli_accepts_all_catalogs_and_formats() { + for catalog in ["authoring", "fixture", "operator"] { + for format in ["human", "json"] { + let parsed = Cli::try_parse_from([ + "registryctl", + "project", + "diagnostics", + "--catalog", + catalog, + "--format", + format, + ]) + .expect("pure diagnostic catalog command parses"); + assert!(matches!( + parsed.command, + Commands::Project { + command: ProjectCommand::Diagnostics { .. } + } + )); + } + } + } + #[test] fn project_authoring_cli_accepts_the_documented_commands() { let init = Cli::try_parse_from([ @@ -1419,6 +2418,7 @@ mod tests { project_dir, environment, explain: true, + show_authored_values: false, format: OutputFormat::Human, against: Some(against), anchor: Some(anchor), @@ -1444,9 +2444,127 @@ mod tests { Commands::Check { format: OutputFormat::Json, explain: false, + show_authored_values: false, + .. + } + )); + let trusted_local = Cli::try_parse_from([ + "registryctl", + "check", + "--environment", + "staging", + "--explain", + "--show-authored-values", + ]) + .expect("trusted-local explanation parses"); + assert!(matches!( + trusted_local.command, + Commands::Check { + explain: true, + show_authored_values: true, + format: OutputFormat::Human, .. } )); + assert!(Cli::try_parse_from([ + "registryctl", + "check", + "--environment", + "staging", + "--show-authored-values", + ]) + .is_err()); + + let preflight = Cli::try_parse_from([ + "registryctl", + "preflight", + "--project-dir", + "registry-project", + "--environment", + "staging", + "--format", + "json", + ]) + .unwrap(); + assert!(matches!( + preflight.command, + Commands::Preflight { + project_dir, + environment, + format: OutputFormat::Json, + } if project_dir == std::path::Path::new("registry-project") + && environment == "staging" + )); + + let capabilities = Cli::try_parse_from([ + "registryctl", + "capabilities", + "--project-dir", + "registry-project", + "--environment", + "staging", + "--format", + "json", + ]) + .unwrap(); + assert!(matches!( + capabilities.command, + Commands::Capabilities { + project_dir, + environment, + format: OutputFormat::Json, + } if project_dir == std::path::Path::new("registry-project") + && environment == "staging" + )); + + let promote = Cli::try_parse_from([ + "registryctl", + "promote", + "--project-dir", + "registry-project", + "--environment", + "staging", + "--relay-against", + "relay-bundle", + "--relay-anchor", + "relay-anchor.json", + "--notary-against", + "notary-bundle", + "--notary-anchor", + "notary-anchor.json", + "--format", + "json", + ]) + .unwrap(); + assert!(matches!( + promote.command, + Commands::Promote { + relay_against: Some(relay), + relay_anchor: Some(relay_anchor), + notary_against: Some(notary), + notary_anchor: Some(notary_anchor), + format: OutputFormat::Json, + .. + } if relay == std::path::Path::new("relay-bundle") + && relay_anchor == std::path::Path::new("relay-anchor.json") + && notary == std::path::Path::new("notary-bundle") + && notary_anchor == std::path::Path::new("notary-anchor.json") + )); + assert!(Cli::try_parse_from([ + "registryctl", + "promote", + "--environment", + "staging", + "--against", + "legacy-bundle", + "--anchor", + "legacy-anchor.json", + "--relay-against", + "relay-bundle", + "--relay-anchor", + "relay-anchor.json", + ]) + .is_err()); assert!(Cli::try_parse_from([ "registryctl", @@ -1492,6 +2610,15 @@ mod tests { "Registry Stack project integration v1" ); + let reference = + Cli::try_parse_from(["registryctl", "authoring", "reference", "--coverage"]).unwrap(); + assert!(matches!( + reference.command, + Commands::Authoring { + command: AuthoringCommand::Reference { coverage: true } + } + )); + let editor = Cli::try_parse_from([ "registryctl", "authoring", @@ -1545,9 +2672,65 @@ mod tests { environment, against: None, anchor: None, + relay_against: None, + relay_anchor: None, + notary_against: None, + notary_anchor: None, format: OutputFormat::Human, } if project_dir == std::path::Path::new("registry-project") && environment == "staging" )); + let build_with_product_baselines = Cli::try_parse_from([ + "registryctl", + "build", + "--environment", + "staging", + "--relay-against", + "relay-bundle", + "--relay-anchor", + "relay-anchor.json", + "--notary-against", + "notary-bundle", + "--notary-anchor", + "notary-anchor.json", + ]) + .unwrap(); + assert!(matches!( + build_with_product_baselines.command, + Commands::Build { + relay_against: Some(relay), + relay_anchor: Some(relay_anchor), + notary_against: Some(notary), + notary_anchor: Some(notary_anchor), + .. + } if relay == std::path::Path::new("relay-bundle") + && relay_anchor == std::path::Path::new("relay-anchor.json") + && notary == std::path::Path::new("notary-bundle") + && notary_anchor == std::path::Path::new("notary-anchor.json") + )); + assert!(Cli::try_parse_from([ + "registryctl", + "build", + "--environment", + "staging", + "--relay-against", + "relay-bundle", + ]) + .is_err()); + assert!(Cli::try_parse_from([ + "registryctl", + "build", + "--environment", + "staging", + "--against", + "legacy-bundle", + "--anchor", + "legacy-anchor.json", + "--relay-against", + "relay-bundle", + "--relay-anchor", + "relay-anchor.json", + ]) + .is_err()); } #[test] @@ -1571,43 +2754,20 @@ mod tests { } #[test] - fn human_check_report_is_concise_and_explain_adds_review_detail() { - let temporary = tempfile::tempdir().expect("temporary directory"); - let project_directory = temporary.path().join("registry-project"); - registryctl::init_registry_project(&ProjectInitOptions { - starter: ProjectStarter::Http, - directory: project_directory.clone(), - }) - .expect("starter initializes"); - let report = registryctl::check_registry_project(&ProjectCheckOptions { - project_directory, - environment: "local".to_string(), - explain: true, - against: None, - anchor: None, - }) - .expect("starter checks"); - let concise = render_check_report(&report, false).expect("concise report renders"); - for heading in [ - "Baseline:", - "Semantic changes:", - "Fixtures:", - "Effective authority and limits:", - "Rhai xw.v1 reference:", - ] { - assert!(concise.contains(heading), "missing {heading}: {concise}"); - } - assert!(!concise.contains("Claims and disclosure:")); - assert!(concise.contains("topology: Relay + Notary")); - assert!(concise.contains("calls=1 call")); - assert!(concise.contains("deadline=15s")); - assert!(!concise.contains("1calls")); - assert!(!concise.contains("\"15s\"duration")); - assert!(concise.contains("subject mismatch not applicable:")); - assert!(!concise.contains("ambiguity not applicable: missing rationale")); - let expanded = render_check_report(&report, true).expect("expanded report renders"); - assert!(expanded.contains("outputs:")); - assert!(expanded.contains("Claims and disclosure:")); + fn human_claim_class_uses_authoritative_evidence_dependency() { + assert_eq!( + rendered_claim_class(true, Some("registry_backed")), + Some("consultation_output") + ); + assert_eq!( + rendered_claim_class(false, Some("registry_backed")), + Some("registry_backed_evaluation") + ); + assert_eq!( + rendered_claim_class(false, Some("self_attested")), + Some("source_free_evaluation") + ); + assert_eq!(rendered_claim_class(false, None), None); } #[test] @@ -1622,7 +2782,8 @@ mod tests { anchor: None, }) .expect("Relay-only project checks"); - let relay_rendered = render_check_report(&relay_report, false).expect("report renders"); + let relay_rendered = + render_check_report(&relay_report, false, None).expect("report renders"); assert!(relay_rendered.contains("topology: Relay-only")); assert!(relay_rendered.contains( "Relay authority: 0 source integrations, 1 records API service, 1 materialized entity definition" @@ -1636,11 +2797,16 @@ mod tests { anchor: None, }) .expect("Notary-only evaluation project checks"); - let notary_rendered = render_check_report(¬ary_report, false).expect("report renders"); + let notary_rendered = + render_check_report(¬ary_report, true, None).expect("report renders"); assert!(notary_rendered.contains("topology: Notary-only")); assert!(notary_rendered.contains( "Notary authority: 1 source-free evaluation service, 0 compiler-pinned Relay-backed services" )); + assert!(notary_rendered.contains( + "claim application-complete: class=source_free_evaluation, disclosure=predicate" + )); + assert!(!notary_rendered.contains("class=registry_backed_evaluation")); assert!(notary_rendered.contains("Relay source authority: not applicable")); } @@ -1850,8 +3016,17 @@ mod tests { copy_directory(&source, &project_directory).expect("maintained non-starter copies"); } + let current = std::env::current_exe().expect("test executable path"); + let mut worker = current + .parent() + .and_then(std::path::Path::parent) + .expect("Cargo target directory") + .join("registryctl"); + worker.set_extension(std::env::consts::EXE_EXTENSION); + let execution_context = ProjectExecutionContext::new(worker) + .expect("Cargo-built registryctl worker is available"); let mut observed_runs = 0; - watch_project_tests_until( + watch_project_tests_until_with_context( ProjectTestOptions { project_directory: project_directory.clone(), environment: None, @@ -1862,6 +3037,7 @@ mod tests { fixture: Some(fixture), trace: false, }, + &execution_context, |completed_runs, root| { observed_runs = completed_runs; if completed_runs == 1 { @@ -2280,3 +3456,197 @@ enum BrunoCommand { /// Run the generated Bruno collection when the Bruno CLI is installed. Run, } + +#[cfg(test)] +mod migration_cli_tests { + use clap::Parser as _; + + use super::{Cli, Commands, OutputFormat}; + + #[test] + fn migration_cli_requires_explicit_separate_candidate_authority() { + let check = Cli::try_parse_from([ + "registryctl", + "migrate", + "--project-dir", + "registry-project", + "--target-version", + "1", + "--format", + "json", + ]) + .expect("check-only migration parses"); + assert!(matches!( + check.command, + Commands::Migrate { + output: None, + write_candidate: false, + format: OutputFormat::Json, + .. + } + )); + + let candidate = Cli::try_parse_from([ + "registryctl", + "migrate", + "--project-dir", + "registry-project", + "--output", + "registry-project-v1", + "--write-candidate", + ]) + .expect("explicit candidate migration parses"); + assert!(matches!( + candidate.command, + Commands::Migrate { + output: Some(path), + write_candidate: true, + .. + } if path == std::path::Path::new("registry-project-v1") + )); + + assert!( + Cli::try_parse_from(["registryctl", "migrate", "--output", "registry-project-v1"]) + .is_err() + ); + assert!(Cli::try_parse_from(["registryctl", "migrate", "--write-candidate"]).is_err()); + } +} + +#[cfg(test)] +mod semantic_comparison_cli_tests { + use clap::Parser as _; + + use super::{Cli, Commands, OutputFormat}; + use registryctl::ProjectStarter; + + #[test] + fn compare_cli_requires_exactly_one_local_or_embedded_baseline() { + let starter = Cli::try_parse_from([ + "registryctl", + "compare", + "--project-dir", + "candidate", + "--environment", + "local", + "--from-starter", + "--format", + "json", + ]) + .expect("embedded starter comparison parses"); + assert!(matches!( + starter.command, + Commands::Compare { + project_dir, + environment, + from_starter: Some(None), + from_project_dir: None, + from_environment: None, + format: OutputFormat::Json, + } if project_dir == std::path::Path::new("candidate") && environment == "local" + )); + + for (value, expected) in [ + ("http", ProjectStarter::Http), + ("dhis2-tracker", ProjectStarter::Dhis2Tracker), + ("opencrvs-dci", ProjectStarter::OpencrvsDci), + ("fhir-r4", ProjectStarter::FhirR4), + ("snapshot", ProjectStarter::Snapshot), + ] { + let selected = Cli::try_parse_from([ + "registryctl", + "compare", + "--environment", + "local", + "--from-starter", + value, + ]) + .unwrap_or_else(|error| panic!("{value} starter selection parses: {error}")); + assert!(matches!( + selected.command, + Commands::Compare { + from_starter: Some(Some(actual)), + from_project_dir: None, + from_environment: None, + .. + } if actual == expected + )); + } + + let same_project = Cli::try_parse_from([ + "registryctl", + "compare", + "--project-dir", + "candidate", + "--environment", + "candidate", + "--from-environment", + "local", + ]) + .expect("same-project environment comparison parses"); + assert!(matches!( + same_project.command, + Commands::Compare { + from_project_dir: None, + from_environment: Some(environment), + from_starter: None, + .. + } if environment == "local" + )); + + let local_projects = Cli::try_parse_from([ + "registryctl", + "compare", + "--project-dir", + "candidate", + "--environment", + "candidate", + "--from-project-dir", + "reviewed", + "--from-environment", + "production", + ]) + .expect("project-to-project comparison parses"); + assert!(matches!( + local_projects.command, + Commands::Compare { + from_project_dir: Some(project), + from_environment: Some(environment), + from_starter: None, + .. + } if project == std::path::Path::new("reviewed") && environment == "production" + )); + + assert!( + Cli::try_parse_from(["registryctl", "compare", "--environment", "local",]).is_err() + ); + assert!(Cli::try_parse_from([ + "registryctl", + "compare", + "--environment", + "local", + "--from-project-dir", + "reviewed", + ]) + .is_err()); + assert!(Cli::try_parse_from([ + "registryctl", + "compare", + "--environment", + "local", + "--from-starter", + "--from-environment", + "reviewed", + ]) + .is_err()); + assert!(Cli::try_parse_from([ + "registryctl", + "compare", + "--environment", + "local", + "--from-starter", + "unknown", + ]) + .is_err()); + } +} diff --git a/crates/registryctl/src/project_authoring.rs b/crates/registryctl/src/project_authoring.rs index 275f8bfd7..909fc9b41 100644 --- a/crates/registryctl/src/project_authoring.rs +++ b/crates/registryctl/src/project_authoring.rs @@ -19,7 +19,7 @@ use registry_relay::source_plan::{ }, EvidenceClass, PinnedEvidenceArtifact, PinnedSourcePlanArtifact, SourcePlanArtifactBundle, }; -use serde::{Deserialize, Serialize}; +use serde::{de::DeserializeOwned, Deserialize, Serialize}; use serde_json::{json, Map, Value}; use sha2::{Digest, Sha256}; use time::{format_description::well_known::Rfc3339, OffsetDateTime}; @@ -43,7 +43,9 @@ const PROJECT_COMMAND_REPORT_SCHEMA_VERSION: &str = "registryctl.project_command const PROJECT_DIAGNOSTICS_SCHEMA_VERSION: &str = "registryctl.project_diagnostics.v1"; const PROJECT_EDITOR_REPORT_SCHEMA_VERSION: &str = "registryctl.project_editor.v1"; const REVIEW_SCHEMA: &str = "registry.project.review.v1"; -const APPROVAL_STATE_SCHEMA: &str = "registry.project.approval-state.v1"; +const APPROVAL_STATE_SCHEMA_V1: &str = "registry.project.approval-state.v1"; +const APPROVAL_STATE_SCHEMA_V2: &str = "registry.project.approval-state.v2"; +const APPROVAL_STATE_SCHEMA: &str = "registry.project.approval-state.v3"; const APPROVAL_REVIEW_PATH: &str = "approval/review.json"; const APPROVAL_STATE_PATH: &str = "approval/project-state.json"; const MAX_AUTHORED_FILE_BYTES: u64 = 1024 * 1024; @@ -63,11 +65,34 @@ const RELEASED_SCRIPT_RUNTIMES: &[ReleasedScriptRuntime] = &[ReleasedScriptRunti // These ownership-oriented source units share this private module so the // authoring compiler can retain one closed internal type system without a // public API or visibility expansion. +mod report_contract; +pub use report_contract::*; +mod diagnostic_reference; +mod fixture_diagnostics; +pub use diagnostic_reference::*; +mod fixture_coverage; +pub use fixture_coverage::*; +mod capability_inventory; +pub use capability_inventory::*; +mod documentation; +pub use documentation::*; +mod knowledge; +mod preflight; +pub use preflight::*; +mod promotion; +pub use promotion::*; +mod migration; +pub use migration::*; +mod semantic_comparison; +pub use semantic_comparison::*; include!("project_authoring/model.rs"); include!("project_authoring/editor.rs"); +include!("project_authoring/schema_authority.rs"); include!("project_authoring/authoring_contract.rs"); include!("project_authoring/diagnostics.rs"); include!("project_authoring/commands.rs"); +include!("project_authoring/compiler/semantic_impact.rs"); +include!("project_authoring/compiler/explanation.rs"); include!("project_authoring/compiler/artifacts.rs"); include!("project_authoring/compiler/relay.rs"); include!("project_authoring/compiler/notary.rs"); diff --git a/crates/registryctl/src/project_authoring/artifact_manifest.rs b/crates/registryctl/src/project_authoring/artifact_manifest.rs new file mode 100644 index 000000000..01d71df2e --- /dev/null +++ b/crates/registryctl/src/project_authoring/artifact_manifest.rs @@ -0,0 +1,566 @@ +// SPDX-License-Identifier: Apache-2.0 + +const ARTIFACT_MANIFEST_FILE: &str = "artifact-manifest.json"; +const REVIEW_ARTIFACT_ACTIONS: &[ArtifactAction] = &[ + ArtifactAction::Regenerate, + ArtifactAction::Compare, + ArtifactAction::Validate, + ArtifactAction::Discard, +]; +const BUNDLE_INPUT_ACTIONS: &[ArtifactAction] = &[ + ArtifactAction::Regenerate, + ArtifactAction::Compare, + ArtifactAction::Validate, + ArtifactAction::Sign, + ArtifactAction::Verify, + ArtifactAction::Discard, +]; + +#[derive(Debug)] +struct GeneratedArtifactClassification { + format_version: &'static str, + classes: Vec, + sensitivity: ArtifactSensitivity, + publication: ArtifactPublication, + edit: ArtifactEditPolicy, + version_control: ArtifactVersionControl, + review: ArtifactReviewState, + lifecycle: ArtifactLifecycle, + actions: Vec, + consumers: Vec, +} + +fn write_artifact_manifest( + temporary_root: &Path, + project: &str, + environment: &str, + inputs: &[ArtifactInputDigest], +) -> Result { + validate_artifact_manifest_inputs(inputs)?; + let build_prefix = format!("{BUILD_ROOT}/{environment}"); + let mut artifacts = collect_generated_artifacts(temporary_root, &build_prefix)?; + artifacts.sort_by(|left, right| left.path.cmp(&right.path)); + + let manifest = ProjectArtifactManifestV1 { + schema_version: ProjectArtifactManifestSchemaVersion::V1, + format_version: ProjectArtifactManifestFormatVersion::V1, + project: project.to_string(), + environment: environment.to_string(), + generator: ArtifactGenerator { + name: ArtifactGeneratorName::Registryctl, + version: env!("CARGO_PKG_VERSION").to_string(), + }, + inputs: inputs.to_vec(), + artifacts, + }; + let manifest_bytes = canonical_json_line( + &serde_json::to_value(&manifest).context("failed to serialize artifact manifest")?, + ) + .context("failed to canonicalize artifact manifest")?; + let manifest_path = temporary_root.join(ARTIFACT_MANIFEST_FILE); + write_private_file(&manifest_path, &manifest_bytes)?; + + Ok(ProjectArtifactManifestRef { + path: project_relative_path(format!("{build_prefix}/{ARTIFACT_MANIFEST_FILE}"))?, + digest: sha256_digest(&manifest_bytes)?, + }) +} + +fn validate_artifact_manifest_inputs(inputs: &[ArtifactInputDigest]) -> Result<()> { + if inputs.is_empty() { + bail!("artifact manifest requires per-file authored input provenance"); + } + for input in inputs { + if input.path.as_str().starts_with(".registry-stack/") { + bail!("artifact manifest input provenance must name authored project files"); + } + } + if inputs.windows(2).any(|pair| pair[0].path >= pair[1].path) { + bail!("artifact manifest inputs must be sorted by unique project-relative path"); + } + Ok(()) +} + +fn collect_generated_artifacts( + temporary_root: &Path, + build_prefix: &str, +) -> Result> { + let metadata = fs::symlink_metadata(temporary_root).with_context(|| { + format!( + "failed to inspect temporary build root {}", + temporary_root.display() + ) + })?; + if metadata.file_type().is_symlink() || !metadata.is_dir() { + bail!("temporary build root must be a real directory"); + } + let mut artifacts = Vec::new(); + collect_generated_artifacts_under( + temporary_root, + temporary_root, + build_prefix, + &mut artifacts, + )?; + Ok(artifacts) +} + +fn collect_generated_artifacts_under( + temporary_root: &Path, + directory: &Path, + build_prefix: &str, + artifacts: &mut Vec, +) -> Result<()> { + let mut entries = fs::read_dir(directory) + .with_context(|| format!("failed to read generated directory {}", directory.display()))? + .collect::>>() + .with_context(|| { + format!( + "failed to enumerate generated directory {}", + directory.display() + ) + })?; + entries.sort_by_key(fs::DirEntry::file_name); + + for entry in entries { + let path = entry.path(); + let relative = path + .strip_prefix(temporary_root) + .map_err(|_| anyhow!("generated artifact escaped the temporary build root"))?; + let metadata = fs::symlink_metadata(&path) + .with_context(|| format!("failed to inspect generated entry {}", path.display()))?; + if metadata.file_type().is_symlink() { + bail!( + "generated build contains a symlink, which is unsupported: {}", + relative.display() + ); + } + if metadata.is_dir() { + collect_generated_artifacts_under(temporary_root, &path, build_prefix, artifacts)?; + continue; + } + if !metadata.is_file() { + bail!( + "generated build contains an unsupported file type: {}", + relative.display() + ); + } + if relative == Path::new(ARTIFACT_MANIFEST_FILE) { + continue; + } + + let bytes = fs::read(&path) + .with_context(|| format!("failed to read generated artifact {}", path.display()))?; + let classification = classify_generated_artifact(relative)?; + artifacts.push(GeneratedArtifactRecord { + path: project_relative_path(format!( + "{build_prefix}/{}", + normalized_relative_path(relative)? + ))?, + format_version: classification.format_version.to_string(), + digest: sha256_digest(&bytes)?, + classes: classification.classes, + sensitivity: classification.sensitivity, + publication: classification.publication, + edit: classification.edit, + version_control: classification.version_control, + review: classification.review, + lifecycle: classification.lifecycle, + actions: classification.actions, + consumers: classification.consumers, + }); + } + Ok(()) +} + +fn classify_generated_artifact(relative: &Path) -> Result { + let path = normalized_relative_path(relative)?; + let classification = if path == "reviewable/review.json" { + artifact_classification( + "registry.project.review.v1", + &[ArtifactClass::ReviewRecord], + ArtifactSensitivity::Internal, + ArtifactPublication::OperatorOnly, + ArtifactReviewState::NeedsReview, + ArtifactLifecycle::UnsignedNonDeployable, + REVIEW_ARTIFACT_ACTIONS, + &[ + ArtifactConsumer::Operator, + ArtifactConsumer::ProjectDocumentation, + ], + ) + } else if single_json_child(&path, "reviewable/entities/") { + artifact_classification( + "registry.project.entity.v1", + &[ArtifactClass::Documentation, ArtifactClass::ReviewRecord], + ArtifactSensitivity::Internal, + ArtifactPublication::OperatorOnly, + ArtifactReviewState::NeedsReview, + ArtifactLifecycle::UnsignedNonDeployable, + REVIEW_ARTIFACT_ACTIONS, + &[ + ArtifactConsumer::Operator, + ArtifactConsumer::ProjectDocumentation, + ], + ) + } else if single_json_child(&path, "reviewable/integration-packs/") { + artifact_classification( + "registry.relay.integration-pack.v1", + &[ArtifactClass::SourcePlan, ArtifactClass::ReviewRecord], + ArtifactSensitivity::Internal, + ArtifactPublication::OperatorOnly, + ArtifactReviewState::NeedsReview, + ArtifactLifecycle::UnsignedNonDeployable, + REVIEW_ARTIFACT_ACTIONS, + &[ + ArtifactConsumer::RegistryRelay, + ArtifactConsumer::Operator, + ArtifactConsumer::ProjectDocumentation, + ], + ) + } else if single_json_child(&path, "reviewable/consultation-contracts/") { + artifact_classification( + "registry.relay.consultation-contract.v1", + &[ + ArtifactClass::ConsultationContract, + ArtifactClass::ReviewRecord, + ], + ArtifactSensitivity::Internal, + ArtifactPublication::OperatorOnly, + ArtifactReviewState::NeedsReview, + ArtifactLifecycle::UnsignedNonDeployable, + REVIEW_ARTIFACT_ACTIONS, + &[ + ArtifactConsumer::RegistryRelay, + ArtifactConsumer::RegistryNotary, + ArtifactConsumer::Operator, + ArtifactConsumer::ProjectDocumentation, + ], + ) + } else if path == "private/relay/config/relay.yaml" { + artifact_classification( + "registry.relay.config.v1", + &[ArtifactClass::RuntimeConfig, ArtifactClass::DeploymentInput], + ArtifactSensitivity::TopologySensitive, + ArtifactPublication::NeverPublish, + ArtifactReviewState::GeneratedCandidate, + ArtifactLifecycle::UnsignedNonDeployable, + BUNDLE_INPUT_ACTIONS, + &[ + ArtifactConsumer::RegistryRelay, + ArtifactConsumer::BundleSigner, + ArtifactConsumer::DeploymentTooling, + ArtifactConsumer::Operator, + ], + ) + } else if single_json_child(&path, "private/relay/config/artifacts/integration-packs/") { + artifact_classification( + "registry.relay.integration-pack.v1", + &[ArtifactClass::SourcePlan, ArtifactClass::DeploymentInput], + ArtifactSensitivity::Internal, + ArtifactPublication::OperatorOnly, + ArtifactReviewState::GeneratedCandidate, + ArtifactLifecycle::UnsignedNonDeployable, + BUNDLE_INPUT_ACTIONS, + &[ + ArtifactConsumer::RegistryRelay, + ArtifactConsumer::BundleSigner, + ArtifactConsumer::DeploymentTooling, + ], + ) + } else if single_json_child( + &path, + "private/relay/config/artifacts/consultation-contracts/", + ) { + artifact_classification( + "registry.relay.consultation-contract.v1", + &[ + ArtifactClass::ConsultationContract, + ArtifactClass::DeploymentInput, + ], + ArtifactSensitivity::Internal, + ArtifactPublication::OperatorOnly, + ArtifactReviewState::GeneratedCandidate, + ArtifactLifecycle::UnsignedNonDeployable, + BUNDLE_INPUT_ACTIONS, + &[ + ArtifactConsumer::RegistryRelay, + ArtifactConsumer::BundleSigner, + ArtifactConsumer::DeploymentTooling, + ], + ) + } else if single_json_child(&path, "private/relay/config/artifacts/private-bindings/") { + artifact_classification( + "registry.relay.consultation-binding.v1", + &[ArtifactClass::SourcePlan, ArtifactClass::DeploymentInput], + ArtifactSensitivity::TopologySensitive, + ArtifactPublication::NeverPublish, + ArtifactReviewState::GeneratedCandidate, + ArtifactLifecycle::UnsignedNonDeployable, + BUNDLE_INPUT_ACTIONS, + &[ + ArtifactConsumer::RegistryRelay, + ArtifactConsumer::BundleSigner, + ArtifactConsumer::DeploymentTooling, + ], + ) + } else if two_level_json_child(&path, "private/relay/config/artifacts/evidence/") { + artifact_classification( + "registry.project.integration-evidence.v1", + &[ArtifactClass::SourcePlan, ArtifactClass::DeploymentInput], + ArtifactSensitivity::Internal, + ArtifactPublication::OperatorOnly, + ArtifactReviewState::GeneratedCandidate, + ArtifactLifecycle::UnsignedNonDeployable, + BUNDLE_INPUT_ACTIONS, + &[ + ArtifactConsumer::RegistryRelay, + ArtifactConsumer::BundleSigner, + ArtifactConsumer::DeploymentTooling, + ], + ) + } else if single_child_with_suffix(&path, "private/relay/config/artifacts/rhai/", ".rhai") { + artifact_classification( + "registry.relay.rhai-source.v1", + &[ArtifactClass::SourcePlan, ArtifactClass::DeploymentInput], + ArtifactSensitivity::TopologySensitive, + ArtifactPublication::NeverPublish, + ArtifactReviewState::GeneratedCandidate, + ArtifactLifecycle::UnsignedNonDeployable, + BUNDLE_INPUT_ACTIONS, + &[ + ArtifactConsumer::RegistryRelay, + ArtifactConsumer::BundleSigner, + ArtifactConsumer::DeploymentTooling, + ], + ) + } else if path == "private/relay/descriptors/operations.json" { + operational_descriptor_classification(&[ + ArtifactConsumer::RegistryRelay, + ArtifactConsumer::BundleSigner, + ArtifactConsumer::DeploymentTooling, + ArtifactConsumer::Operator, + ]) + } else if path == "private/notary/descriptors/operations.json" { + operational_descriptor_classification(&[ + ArtifactConsumer::RegistryNotary, + ArtifactConsumer::BundleSigner, + ArtifactConsumer::DeploymentTooling, + ArtifactConsumer::Operator, + ]) + } else if path == "private/relay/descriptors/secret-consumers.json" { + secret_consumer_descriptor_classification(&[ + ArtifactConsumer::RegistryRelay, + ArtifactConsumer::BundleSigner, + ArtifactConsumer::DeploymentTooling, + ArtifactConsumer::Operator, + ]) + } else if path == "private/notary/descriptors/secret-consumers.json" { + secret_consumer_descriptor_classification(&[ + ArtifactConsumer::RegistryNotary, + ArtifactConsumer::BundleSigner, + ArtifactConsumer::DeploymentTooling, + ArtifactConsumer::Operator, + ]) + } else if path == "private/relay/approval/review.json" { + product_review_classification( + "registry.project.review.v1", + ArtifactReviewState::NeedsReview, + ArtifactConsumer::RegistryRelay, + ) + } else if path == "private/notary/approval/review.json" { + product_review_classification( + "registry.project.review.v1", + ArtifactReviewState::NeedsReview, + ArtifactConsumer::RegistryNotary, + ) + } else if path == "private/relay/approval/project-state.json" { + product_review_classification( + APPROVAL_STATE_SCHEMA, + ArtifactReviewState::GeneratedCandidate, + ArtifactConsumer::RegistryRelay, + ) + } else if path == "private/notary/approval/project-state.json" { + product_review_classification( + APPROVAL_STATE_SCHEMA, + ArtifactReviewState::GeneratedCandidate, + ArtifactConsumer::RegistryNotary, + ) + } else if path == "private/notary/config/notary.yaml" { + artifact_classification( + "registry.notary.config.v1", + &[ + ArtifactClass::RuntimeConfig, + ArtifactClass::ClaimConfiguration, + ArtifactClass::DeploymentInput, + ], + ArtifactSensitivity::TopologySensitive, + ArtifactPublication::NeverPublish, + ArtifactReviewState::GeneratedCandidate, + ArtifactLifecycle::UnsignedNonDeployable, + BUNDLE_INPUT_ACTIONS, + &[ + ArtifactConsumer::RegistryNotary, + ArtifactConsumer::BundleSigner, + ArtifactConsumer::DeploymentTooling, + ArtifactConsumer::Operator, + ], + ) + } else { + bail!("generated artifact has no reviewed classification: {path}"); + }; + Ok(classification) +} + +// The closed classification dimensions are intentionally visible together so +// every generated artifact review covers the whole publication boundary. +#[allow(clippy::too_many_arguments)] +fn artifact_classification( + format_version: &'static str, + classes: &[ArtifactClass], + sensitivity: ArtifactSensitivity, + publication: ArtifactPublication, + review: ArtifactReviewState, + lifecycle: ArtifactLifecycle, + actions: &[ArtifactAction], + consumers: &[ArtifactConsumer], +) -> GeneratedArtifactClassification { + GeneratedArtifactClassification { + format_version, + classes: classes.to_vec(), + sensitivity, + publication, + edit: ArtifactEditPolicy::GeneratedDoNotEdit, + version_control: ArtifactVersionControl::Ignore, + review, + lifecycle, + actions: actions.to_vec(), + consumers: consumers.to_vec(), + } +} + +fn operational_descriptor_classification( + consumers: &[ArtifactConsumer], +) -> GeneratedArtifactClassification { + artifact_classification( + "registry.project.operations.v1", + &[ArtifactClass::DeploymentInput, ArtifactClass::Documentation], + ArtifactSensitivity::Internal, + ArtifactPublication::OperatorOnly, + ArtifactReviewState::GeneratedCandidate, + ArtifactLifecycle::UnsignedNonDeployable, + BUNDLE_INPUT_ACTIONS, + consumers, + ) +} + +fn secret_consumer_descriptor_classification( + consumers: &[ArtifactConsumer], +) -> GeneratedArtifactClassification { + artifact_classification( + "registry.project.secret-consumers.v1", + &[ArtifactClass::DeploymentInput, ArtifactClass::Documentation], + ArtifactSensitivity::TopologySensitive, + ArtifactPublication::NeverPublish, + ArtifactReviewState::GeneratedCandidate, + ArtifactLifecycle::UnsignedNonDeployable, + BUNDLE_INPUT_ACTIONS, + consumers, + ) +} + +fn product_review_classification( + format_version: &'static str, + review: ArtifactReviewState, + product: ArtifactConsumer, +) -> GeneratedArtifactClassification { + artifact_classification( + format_version, + &[ArtifactClass::ReviewRecord, ArtifactClass::DeploymentInput], + ArtifactSensitivity::Internal, + ArtifactPublication::OperatorOnly, + review, + ArtifactLifecycle::UnsignedNonDeployable, + BUNDLE_INPUT_ACTIONS, + &[ + product, + ArtifactConsumer::BundleSigner, + ArtifactConsumer::DeploymentTooling, + ArtifactConsumer::Operator, + ], + ) +} + +fn single_json_child(path: &str, prefix: &str) -> bool { + single_child_with_suffix(path, prefix, ".json") +} + +fn single_child_with_suffix(path: &str, prefix: &str, suffix: &str) -> bool { + path.strip_prefix(prefix).is_some_and(|name| { + !name.is_empty() + && !name.contains('/') + && name + .strip_suffix(suffix) + .is_some_and(|stem| !stem.is_empty()) + }) +} + +fn two_level_json_child(path: &str, prefix: &str) -> bool { + path.strip_prefix(prefix).is_some_and(|tail| { + let Some((directory, file)) = tail.split_once('/') else { + return false; + }; + !directory.is_empty() + && !file.is_empty() + && !file.contains('/') + && file + .strip_suffix(".json") + .is_some_and(|stem| !stem.is_empty()) + }) +} + +fn normalized_relative_path(path: &Path) -> Result { + let mut normalized = String::new(); + for component in path.components() { + let Component::Normal(component) = component else { + bail!( + "generated artifact path is not normalized and relative: {}", + path.display() + ); + }; + let component = component + .to_str() + .ok_or_else(|| anyhow!("generated artifact path is not Unicode"))?; + if !normalized.is_empty() { + normalized.push('/'); + } + normalized.push_str(component); + } + if normalized.is_empty() { + bail!("generated artifact path is empty"); + } + Ok(normalized) +} + +fn project_relative_path(path: impl Into) -> Result { + ProjectRelativePath::new(path) + .map_err(|error| anyhow!("invalid project-relative artifact path: {error}")) +} + +fn sha256_digest(bytes: &[u8]) -> Result { + Sha256Digest::new(sha256_uri(bytes)) + .map_err(|error| anyhow!("failed to construct artifact digest: {error}")) +} + +#[cfg(test)] +mod artifact_manifest_tests { + use super::*; + + #[test] + fn unclassified_generated_path_fails_closed() { + let error = classify_generated_artifact(Path::new( + "private/relay/config/artifacts/future/output.json", + )) + .expect_err("new generated path family must require an explicit classification"); + assert!(format!("{error:#}").contains("has no reviewed classification")); + } +} diff --git a/crates/registryctl/src/project_authoring/authoring_contract.rs b/crates/registryctl/src/project_authoring/authoring_contract.rs index 656957be5..cd7c19e0e 100644 --- a/crates/registryctl/src/project_authoring/authoring_contract.rs +++ b/crates/registryctl/src/project_authoring/authoring_contract.rs @@ -3,6 +3,7 @@ /// The pre-1.0 project authoring contract. Runtime artifacts may still lower /// this concise model into product-owned structures, but authored files never /// expose those structures. +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct AuthoredIntegrationDocument { @@ -20,6 +21,7 @@ struct AuthoredIntegrationDocument { not_applicable: AuthoredNotApplicableDeclaration, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Default, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct AuthoredNotApplicableDeclaration { @@ -29,6 +31,7 @@ struct AuthoredNotApplicableDeclaration { subject_mismatch: Option, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct AuthoredNotApplicableReason { @@ -36,6 +39,7 @@ struct AuthoredNotApplicableReason { request_fixture: String, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct AuthoredSourceDeclaration { @@ -56,6 +60,7 @@ struct AuthoredSourceDeclaration { protocol: Option, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Clone, Default, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct AuthoredSourceVersions { @@ -65,6 +70,7 @@ struct AuthoredSourceVersions { unverified: Vec, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct AuthoredProtocolDeclaration { @@ -72,6 +78,7 @@ struct AuthoredProtocolDeclaration { signed_dci: Option, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Clone, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct AuthoredSignedDciDeclaration { @@ -86,6 +93,7 @@ struct AuthoredSignedDciDeclaration { selectors: BTreeMap, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Clone, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct AuthoredDciSelectorBinding { @@ -93,6 +101,7 @@ struct AuthoredDciSelectorBinding { response_pointer: String, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Clone, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct AuthoredSourceAllowRule { @@ -102,12 +111,14 @@ struct AuthoredSourceAllowRule { semantics: Option, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Clone, Copy, Deserialize, Serialize, PartialEq, Eq)] #[serde(rename_all = "snake_case")] enum AuthoredRequestSemantics { ReadOnly, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct AuthoredSourceResponse { @@ -117,6 +128,7 @@ struct AuthoredSourceResponse { max_bytes: Option, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Clone, Copy, Deserialize, Serialize, PartialEq, Eq)] #[serde(rename_all = "snake_case")] enum AuthoredResponseFormat { @@ -128,6 +140,7 @@ fn default_authored_response_format() -> AuthoredResponseFormat { AuthoredResponseFormat::Json } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct AuthoredInputDeclaration { @@ -154,6 +167,7 @@ struct AuthoredInputDeclaration { canonicalization: Option, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Clone, Copy, Deserialize, Serialize, PartialEq, Eq)] #[serde(rename_all = "snake_case")] enum AuthoredInputRole { @@ -161,6 +175,7 @@ enum AuthoredInputRole { Parameter, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Clone, Deserialize, Serialize, PartialEq, Eq)] #[serde(untagged)] enum AuthoredSchemaType { @@ -168,6 +183,7 @@ enum AuthoredSchemaType { Union(Vec), } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Clone, Copy, Deserialize, Serialize, PartialEq, Eq)] #[serde(rename_all = "snake_case")] enum AuthoredScalarType { @@ -177,26 +193,47 @@ enum AuthoredScalarType { Null, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Clone, Copy, Deserialize, Serialize, PartialEq, Eq)] #[serde(rename_all = "snake_case")] enum AuthoredStringFormat { Date, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(untagged)] enum AuthoredCapabilityDeclaration { - Http { - http: AuthoredHttpDeclaration, - }, - Script { - script: AuthoredScriptDeclaration, - }, - Snapshot { - snapshot: AuthoredSnapshotDeclaration, - }, + Http(AuthoredHttpCapability), + Script(AuthoredScriptCapability), + Snapshot(AuthoredSnapshotCapability), +} + +// Each untagged union arm needs its own closed object. Putting +// `deny_unknown_fields` only on the enum still lets serde select the first arm +// when an author supplies keys from multiple capability variants. +#[cfg_attr(test, derive(schemars::JsonSchema))] +#[derive(Debug, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +struct AuthoredHttpCapability { + http: AuthoredHttpDeclaration, +} + +#[cfg_attr(test, derive(schemars::JsonSchema))] +#[derive(Debug, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +struct AuthoredScriptCapability { + script: AuthoredScriptDeclaration, +} + +#[cfg_attr(test, derive(schemars::JsonSchema))] +#[derive(Debug, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +struct AuthoredSnapshotCapability { + snapshot: AuthoredSnapshotDeclaration, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct AuthoredHttpDeclaration { @@ -205,6 +242,7 @@ struct AuthoredHttpDeclaration { response: AuthoredHttpResponse, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct AuthoredHttpRequest { @@ -220,6 +258,7 @@ struct AuthoredHttpRequest { body: Option, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Default, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct AuthoredHttpResponse { @@ -231,6 +270,7 @@ struct AuthoredHttpResponse { shape: Option, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(untagged)] enum AuthoredHttpShape { @@ -241,12 +281,14 @@ enum AuthoredHttpShape { }, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Clone, Copy, Deserialize, Serialize, PartialEq, Eq)] #[serde(rename_all = "snake_case")] enum AuthoredSingletonShape { Singleton, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct AuthoredScriptDeclaration { @@ -255,6 +297,7 @@ struct AuthoredScriptDeclaration { modules: Vec, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct AuthoredSnapshotDeclaration { @@ -263,12 +306,14 @@ struct AuthoredSnapshotDeclaration { freshness: String, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct AuthoredInputReference { input: String, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(untagged)] enum AuthoredOutputsDeclaration { @@ -276,6 +321,7 @@ enum AuthoredOutputsDeclaration { EntityFields(Vec), } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct AuthoredOutputDeclaration { @@ -293,6 +339,7 @@ struct AuthoredOutputDeclaration { source: Option, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct AuthoredLimitsDeclaration { @@ -306,6 +353,7 @@ struct AuthoredLimitsDeclaration { deadline: Option, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Clone, Deserialize, Serialize)] #[serde(untagged)] enum AuthoredByteSize { @@ -339,11 +387,14 @@ impl AuthoredByteSize { } } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct AuthoredFixtureDocument { name: String, classification: AuthoredFixtureClassification, + #[serde(default)] + request: Option, input: BTreeMap, #[serde(default)] variables: BTreeMap, @@ -352,12 +403,14 @@ struct AuthoredFixtureDocument { expect: FixtureExpectation, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Clone, Copy, Deserialize, Serialize, PartialEq, Eq)] #[serde(rename_all = "snake_case")] enum AuthoredFixtureClassification { Synthetic, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct AuthoredFixtureInteraction { @@ -365,6 +418,7 @@ struct AuthoredFixtureInteraction { respond: AuthoredFixtureResponse, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct AuthoredFixtureRequest { @@ -378,28 +432,122 @@ struct AuthoredFixtureRequest { body: Option, } -#[derive(Debug, Deserialize, Serialize)] +#[cfg_attr(test, derive(schemars::JsonSchema))] +#[derive(Debug, Serialize)] #[serde(untagged)] enum AuthoredFixtureResponse { - Http { - status: u16, - #[serde(default)] - headers: BTreeMap, - #[serde(default)] - body: Option, - }, - Timeout { - timeout: String, - }, + Http(AuthoredFixtureHttpResponse), + Timeout(AuthoredFixtureTimeoutResponse), +} + +impl<'de> Deserialize<'de> for AuthoredFixtureResponse { + fn deserialize(deserializer: D) -> std::result::Result + where + D: serde::Deserializer<'de>, + { + let value = Value::deserialize(deserializer)?; + let object = value.as_object().ok_or_else(|| { + serde::de::Error::custom( + "fixture response must be an HTTP status object or a timeout object", + ) + })?; + match ( + object.contains_key("status"), + object.contains_key("timeout"), + ) { + (true, false) => serde_json::from_value(value) + .map(Self::Http) + .map_err(serde::de::Error::custom), + (false, true) => serde_json::from_value(value) + .map(Self::Timeout) + .map_err(serde::de::Error::custom), + _ => Err(serde::de::Error::custom( + "fixture response must contain exactly one of `status` or `timeout`", + )), + } + } +} + +// Response modes are exclusive in the published oneOf schema. Closed wrapper +// objects keep the production decoder from silently choosing the HTTP arm for +// a response that also declares `timeout`. +#[cfg_attr(test, derive(schemars::JsonSchema))] +#[derive(Debug, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +struct AuthoredFixtureHttpResponse { + status: u16, + #[serde(default)] + headers: BTreeMap, + #[serde(default)] + body: Option, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +struct AuthoredFixtureTimeoutResponse { + timeout: String, +} + +const FIXTURE_BODY_FILE_REFERENCE_REMEDIATION: &str = "Use exactly `body: { file: bodies/.json }` for a file reference. For inline JSON, rename the reserved top-level `file` field."; + +#[derive(Debug, Serialize)] #[serde(untagged)] enum AuthoredFixtureBody { - File { file: PathBuf }, + File(AuthoredFixtureBodyFile), Inline(Value), } +#[cfg(test)] +impl schemars::JsonSchema for AuthoredFixtureBody { + fn schema_name() -> std::borrow::Cow<'static, str> { + "AuthoredFixtureBody".into() + } + + fn json_schema( + generator: &mut schemars::SchemaGenerator, + ) -> schemars::Schema { + let file_reference = + generator.subschema_for::(); + schemars::json_schema!({ + "oneOf": [ + file_reference, + { + "not": { + "type": "object", + "required": ["file"] + } + } + ] + }) + } +} + +#[cfg_attr(test, derive(schemars::JsonSchema))] +#[derive(Debug, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +struct AuthoredFixtureBodyFile { + file: PathBuf, +} + +impl<'de> Deserialize<'de> for AuthoredFixtureBody { + fn deserialize(deserializer: D) -> std::result::Result + where + D: serde::Deserializer<'de>, + { + let value = Value::deserialize(deserializer)?; + if value + .as_object() + .is_some_and(|object| object.contains_key("file")) + { + let reference = serde_json::from_value::(value) + .map_err(|_| serde::de::Error::custom(FIXTURE_BODY_FILE_REFERENCE_REMEDIATION))?; + return Ok(Self::File(reference)); + } + Ok(Self::Inline(value)) + } +} + const DEFAULT_SOURCE_RESPONSE_BYTES: u64 = 512 * 1024; const MAX_DECLARATIVE_HTTP_RESPONSE_BYTES: u64 = 8 * 1024 * 1024; const DEFAULT_SOURCE_BYTES: u64 = 2 * 1024 * 1024; @@ -477,18 +625,18 @@ fn lower_authored_integration( }; let (capability, outputs) = match (&authored.capability, &authored.outputs) { ( - AuthoredCapabilityDeclaration::Http { http }, + AuthoredCapabilityDeclaration::Http(AuthoredHttpCapability { http }), AuthoredOutputsDeclaration::Schemas(outputs), ) => lower_http_capability(source, http, outputs)?, ( - AuthoredCapabilityDeclaration::Script { script }, + AuthoredCapabilityDeclaration::Script(AuthoredScriptCapability { script }), AuthoredOutputsDeclaration::Schemas(outputs), ) => lower_script_capability(source, script, outputs)?, ( - AuthoredCapabilityDeclaration::Snapshot { .. }, + AuthoredCapabilityDeclaration::Snapshot(_), AuthoredOutputsDeclaration::EntityFields(_), ) => bail!("snapshot entity output lowering requires the loaded entity contract"), - (AuthoredCapabilityDeclaration::Snapshot { .. }, _) => { + (AuthoredCapabilityDeclaration::Snapshot(_), _) => { bail!("snapshot outputs must be a non-empty list of entity fields") } (_, AuthoredOutputsDeclaration::EntityFields(_)) => { @@ -520,7 +668,7 @@ fn lower_authored_integration( bounds: BoundsDeclaration { calls: if matches!( &authored.capability, - AuthoredCapabilityDeclaration::Http { .. } + AuthoredCapabilityDeclaration::Http(_) ) || authored .source .as_ref() @@ -658,7 +806,7 @@ fn validate_authored_integration_contract(authored: &AuthoredIntegrationDocument } } match &authored.capability { - AuthoredCapabilityDeclaration::Http { .. } => { + AuthoredCapabilityDeclaration::Http(_) => { if authored .limits .as_ref() @@ -668,7 +816,7 @@ fn validate_authored_integration_contract(authored: &AuthoredIntegrationDocument bail!("http performs exactly one call and does not accept limits.calls"); } } - AuthoredCapabilityDeclaration::Script { .. } => { + AuthoredCapabilityDeclaration::Script(_) => { let source = authored .source .as_ref() @@ -677,7 +825,7 @@ fn validate_authored_integration_contract(authored: &AuthoredIntegrationDocument bail!("script source.allow must contain between one and sixteen rules"); } } - AuthoredCapabilityDeclaration::Snapshot { .. } => { + AuthoredCapabilityDeclaration::Snapshot(_) => { if authored.source.is_some() || authored.limits.is_some() { bail!("snapshot does not declare remote source or HTTP execution limits"); } diff --git a/crates/registryctl/src/project_authoring/capability_inventory.rs b/crates/registryctl/src/project_authoring/capability_inventory.rs new file mode 100644 index 000000000..356299f08 --- /dev/null +++ b/crates/registryctl/src/project_authoring/capability_inventory.rs @@ -0,0 +1,1187 @@ +// SPDX-License-Identifier: Apache-2.0 +//! Strict, value-free capability inventory for project authoring. +//! +//! The inventory is intentionally limited to closed identifiers, release +//! metadata, state enums, and bounded counts. Country identifiers, origins, +//! paths, secret names, authored values, and runtime observations have no +//! representation in either the builder input or the report. + +use std::collections::{BTreeMap, BTreeSet}; +use std::fmt; + +use serde::ser::SerializeStruct; +use serde::{de, Deserialize, Deserializer, Serialize, Serializer}; + +pub const PROJECT_CAPABILITY_INVENTORY_SCHEMA_VERSION_V1: &str = + "registry.project.capability_inventory.v1"; +pub(crate) const MAX_CAPABILITY_USAGE_COUNT: u32 = 1_000_000; + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +pub enum ProjectCapabilityInventorySchemaVersion { + #[serde(rename = "registry.project.capability_inventory.v1")] + V1, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum CapabilityInventoryEvidenceGrade { + OfflineStatic, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum RuntimeActivationEvaluation { + NotEvaluated, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum CapabilityId { + SourceHttp, + SourceScript, + SourceSnapshot, + RhaiRuntime, + RhaiAbi, + RegistryRelayProduct, + RegistryNotaryProduct, + RegistryRelayValidator, + RegistryNotaryValidator, + ProjectAuthoringSchemas, + RegistryRelayConfigSchema, + RegistryNotaryConfigSchema, +} + +impl CapabilityId { + const ALL: [Self; 12] = [ + Self::SourceHttp, + Self::SourceScript, + Self::SourceSnapshot, + Self::RhaiRuntime, + Self::RhaiAbi, + Self::RegistryRelayProduct, + Self::RegistryNotaryProduct, + Self::RegistryRelayValidator, + Self::RegistryNotaryValidator, + Self::ProjectAuthoringSchemas, + Self::RegistryRelayConfigSchema, + Self::RegistryNotaryConfigSchema, + ]; + + const fn project_declarable(self) -> bool { + matches!( + self, + Self::SourceHttp + | Self::SourceScript + | Self::SourceSnapshot + | Self::RegistryRelayProduct + | Self::RegistryNotaryProduct + ) + } + + const fn environment_enableable(self) -> bool { + self.project_declarable() + } +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum CapabilityKind { + Source, + Runtime, + Abi, + Product, + ProductValidator, + Schema, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum CapabilityOwner { + Registryctl, + RegistryRelay, + RegistryNotary, + ReleaseEngineering, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum CapabilityMaturity { + ReleaseGated, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum SupportedCapabilityVersion { + ProjectAuthoringV1, + RelayIntegrationPackV1, + RhaiLanguageV1, + RhaiXwV1, + RegistryRelayConfigV1, + RegistryNotaryConfigV1, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum InstalledCapabilityState { + Compiled, + NotCompiled, + Unsupported, + NotEvaluated, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum InstalledCapabilityEvidence { + LinkedCrate, + EmbeddedCompiler, + EmbeddedSchema, + LinkedProductValidator, + ReleaseMetadata, + ExplicitlyUnsupported, + NoEvidence, +} + +pub(crate) const COMPILED_CAPABILITY_RELEASE_FACTS: [( + CapabilityId, + InstalledCapabilityState, + InstalledCapabilityEvidence, +); 12] = [ + ( + CapabilityId::SourceHttp, + InstalledCapabilityState::Compiled, + InstalledCapabilityEvidence::EmbeddedCompiler, + ), + ( + CapabilityId::SourceScript, + InstalledCapabilityState::Compiled, + InstalledCapabilityEvidence::EmbeddedCompiler, + ), + ( + CapabilityId::SourceSnapshot, + InstalledCapabilityState::Compiled, + InstalledCapabilityEvidence::EmbeddedCompiler, + ), + ( + CapabilityId::RhaiRuntime, + InstalledCapabilityState::Compiled, + InstalledCapabilityEvidence::LinkedCrate, + ), + ( + CapabilityId::RhaiAbi, + InstalledCapabilityState::Compiled, + InstalledCapabilityEvidence::LinkedCrate, + ), + ( + CapabilityId::RegistryRelayProduct, + InstalledCapabilityState::Compiled, + InstalledCapabilityEvidence::LinkedCrate, + ), + ( + CapabilityId::RegistryNotaryProduct, + InstalledCapabilityState::Compiled, + InstalledCapabilityEvidence::LinkedCrate, + ), + ( + CapabilityId::RegistryRelayValidator, + InstalledCapabilityState::Compiled, + InstalledCapabilityEvidence::LinkedProductValidator, + ), + ( + CapabilityId::RegistryNotaryValidator, + InstalledCapabilityState::Compiled, + InstalledCapabilityEvidence::LinkedProductValidator, + ), + ( + CapabilityId::ProjectAuthoringSchemas, + InstalledCapabilityState::Compiled, + InstalledCapabilityEvidence::EmbeddedSchema, + ), + ( + CapabilityId::RegistryRelayConfigSchema, + InstalledCapabilityState::Compiled, + InstalledCapabilityEvidence::EmbeddedSchema, + ), + ( + CapabilityId::RegistryNotaryConfigSchema, + InstalledCapabilityState::Compiled, + InstalledCapabilityEvidence::EmbeddedSchema, + ), +]; + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum ProjectDeclarationState { + Declared, + NotDeclared, + NotApplicable, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum EnvironmentEnablementState { + Enabled, + NotEnabled, + NotApplicable, +} + +#[derive(Clone, Copy, Debug, Default, Eq, PartialEq)] +pub struct CapabilityUsageCounts { + pub services: u32, + pub consultations: u32, + pub claims: u32, +} + +impl CapabilityUsageCounts { + fn total(self) -> Option { + self.services + .checked_add(self.consultations)? + .checked_add(self.claims) + } + + fn is_empty(self) -> bool { + self == Self::default() + } +} + +impl Serialize for CapabilityUsageCounts { + fn serialize(&self, serializer: S) -> Result + where + S: Serializer, + { + let total = self + .total() + .filter(|total| *total <= MAX_CAPABILITY_USAGE_COUNT) + .ok_or_else(|| serde::ser::Error::custom("capability usage exceeds the report cap"))?; + let mut state = serializer.serialize_struct("CapabilityUsageCounts", 4)?; + state.serialize_field("services", &self.services)?; + state.serialize_field("consultations", &self.consultations)?; + state.serialize_field("claims", &self.claims)?; + state.serialize_field("total", &total)?; + state.end() + } +} + +impl<'de> Deserialize<'de> for CapabilityUsageCounts { + fn deserialize(deserializer: D) -> Result + where + D: Deserializer<'de>, + { + #[derive(Deserialize)] + #[serde(deny_unknown_fields)] + struct Wire { + services: u32, + consultations: u32, + claims: u32, + total: u32, + } + + let wire = Wire::deserialize(deserializer)?; + let usage = Self { + services: wire.services, + consultations: wire.consultations, + claims: wire.claims, + }; + validate_usage(usage).map_err(|_| { + de::Error::custom("capability usage total exceeds the report aggregate cap") + })?; + if usage.total() != Some(wire.total) { + return Err(de::Error::custom( + "capability usage total does not equal its breakdown", + )); + } + Ok(usage) + } +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum CapabilityDisposition { + Used, + UsedButNotEnabled, + UsedWithMissingSupport, + DeclaredEnabledUnused, + DeclaredInactive, + InstalledUnused, + UnavailableUnused, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct CapabilityInventoryRecord { + pub capability: CapabilityId, + pub kind: CapabilityKind, + pub owner: CapabilityOwner, + pub maturity: CapabilityMaturity, + pub supported_versions: Vec, + pub installed_release: InstalledCapabilityState, + pub installed_evidence: InstalledCapabilityEvidence, + pub project_declaration: ProjectDeclarationState, + pub environment_enablement: EnvironmentEnablementState, + pub used_by: CapabilityUsageCounts, + pub disposition: CapabilityDisposition, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum SupportComponent { + HttpSourceWorker, + RhaiScriptWorker, + SnapshotMaterializationWorker, + RhaiXwProtocolHelper, + RegistryRelayProduct, + RegistryNotaryProduct, + RegistryRelayValidator, + RegistryNotaryValidator, + ProjectAuthoringSchema, + RegistryRelayConfigSchema, + RegistryNotaryConfigSchema, + RegistryctlDistribution, + RegistryRelayImage, + RegistryNotaryImage, +} + +impl SupportComponent { + const ALL: [Self; 14] = [ + Self::HttpSourceWorker, + Self::RhaiScriptWorker, + Self::SnapshotMaterializationWorker, + Self::RhaiXwProtocolHelper, + Self::RegistryRelayProduct, + Self::RegistryNotaryProduct, + Self::RegistryRelayValidator, + Self::RegistryNotaryValidator, + Self::ProjectAuthoringSchema, + Self::RegistryRelayConfigSchema, + Self::RegistryNotaryConfigSchema, + Self::RegistryctlDistribution, + Self::RegistryRelayImage, + Self::RegistryNotaryImage, + ]; + + const fn is_image(self) -> bool { + matches!(self, Self::RegistryRelayImage | Self::RegistryNotaryImage) + } +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum SupportKind { + Worker, + ProtocolHelper, + Product, + ProductValidator, + Schema, + Distribution, + Image, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum SupportState { + Available, + Missing, + Unsupported, + NotEvaluated, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum SupportEvidence { + LinkedCrate, + EmbeddedSchema, + LinkedProductValidator, + ReleaseMetadata, + ExplicitlyMissing, + ExplicitlyUnsupported, + NoEvidence, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct SupportAssessment { + pub component: SupportComponent, + pub kind: SupportKind, + pub owner: CapabilityOwner, + pub state: SupportState, + pub evidence: SupportEvidence, + pub required_by: Vec, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum InactiveOrUnusedReason { + DeclaredNotEnabled, + DeclaredEnabledNotUsed, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct InactiveOrUnusedDeclaration { + pub capability: CapabilityId, + pub reason: InactiveOrUnusedReason, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct MissingSupport { + pub component: SupportComponent, + pub kind: SupportKind, + pub state: SupportState, + pub required_by: Vec, +} + +#[derive(Clone, Debug, Eq, PartialEq, Serialize)] +pub struct ProjectCapabilityInventoryReportV1 { + pub schema_version: ProjectCapabilityInventorySchemaVersion, + pub evidence_grade: CapabilityInventoryEvidenceGrade, + pub runtime_activation: RuntimeActivationEvaluation, + pub capabilities: Vec, + pub support: Vec, + pub missing_support: Vec, + pub inactive_or_unused: Vec, +} + +fn validate_decoded_inventory( + capabilities: &[CapabilityInventoryRecord], + support: &[SupportAssessment], + missing_support: &[MissingSupport], + inactive_or_unused: &[InactiveOrUnusedDeclaration], +) -> Result<(), &'static str> { + for assessment in support { + let metadata = support_metadata(assessment.component); + if assessment.kind != metadata.kind + || assessment.owner != metadata.owner + || assessment.required_by.as_slice() != metadata.required_by + { + return Err("support row metadata does not match its closed component"); + } + validate_support_evidence(assessment.component, assessment.state, assessment.evidence) + .map_err(|_| "support row state and evidence are inconsistent")?; + } + + let mut reported_missing = BTreeMap::new(); + for missing in missing_support { + if reported_missing + .insert(missing.component, missing) + .is_some() + { + return Err("missing-support rows contain a duplicate component"); + } + } + let expected_missing = support + .iter() + .filter(|assessment| { + matches!( + assessment.state, + SupportState::Missing | SupportState::Unsupported + ) + }) + .count(); + if reported_missing.len() != expected_missing { + return Err("missing-support rows do not match support assessments"); + } + for assessment in support.iter().filter(|assessment| { + matches!( + assessment.state, + SupportState::Missing | SupportState::Unsupported + ) + }) { + let missing = reported_missing + .get(&assessment.component) + .ok_or("missing-support row is absent for unavailable support")?; + if missing.kind != assessment.kind + || missing.state != assessment.state + || missing.required_by != assessment.required_by + { + return Err("missing-support row contradicts its support assessment"); + } + } + + let mut reported_inactive = BTreeMap::new(); + for inactive in inactive_or_unused { + if reported_inactive + .insert(inactive.capability, inactive.reason) + .is_some() + { + return Err("inactive-or-unused rows contain a duplicate capability"); + } + } + let mut expected_inactive = BTreeMap::new(); + for record in capabilities { + let metadata = capability_metadata(record.capability); + if record.kind != metadata.kind + || record.owner != metadata.owner + || record.supported_versions.as_slice() != metadata.supported_versions + { + return Err("capability row metadata does not match its closed capability"); + } + validate_installed_evidence(record.installed_release, record.installed_evidence) + .map_err(|_| "installed capability state and evidence are inconsistent")?; + + let declarable = record.capability.project_declarable(); + if declarable + != matches!( + record.project_declaration, + ProjectDeclarationState::Declared | ProjectDeclarationState::NotDeclared + ) + || declarable + != matches!( + record.environment_enablement, + EnvironmentEnablementState::Enabled | EnvironmentEnablementState::NotEnabled + ) + { + return Err("capability declaration applicability is inconsistent"); + } + let declared = record.project_declaration == ProjectDeclarationState::Declared; + let enabled = record.environment_enablement == EnvironmentEnablementState::Enabled; + if enabled && !declared { + return Err("capability is enabled without a project declaration"); + } + if declarable && !record.used_by.is_empty() && !declared { + return Err("capability is used without a project declaration"); + } + let missing_required_support = support.iter().any(|assessment| { + support_metadata(assessment.component) + .required_by + .contains(&record.capability) + && matches!( + assessment.state, + SupportState::Missing | SupportState::Unsupported + ) + }); + if record.disposition + != capability_disposition( + record.capability, + record.installed_release, + declared, + enabled, + record.used_by, + missing_required_support, + ) + { + return Err("capability disposition contradicts its reported state"); + } + if declared && record.used_by.is_empty() { + expected_inactive.insert( + record.capability, + if enabled { + InactiveOrUnusedReason::DeclaredEnabledNotUsed + } else { + InactiveOrUnusedReason::DeclaredNotEnabled + }, + ); + } + } + if reported_inactive != expected_inactive { + return Err("inactive-or-unused rows do not match capability state"); + } + Ok(()) +} + +impl<'de> Deserialize<'de> for ProjectCapabilityInventoryReportV1 { + fn deserialize(deserializer: D) -> Result + where + D: Deserializer<'de>, + { + #[derive(Deserialize)] + #[serde(deny_unknown_fields)] + struct Wire { + schema_version: ProjectCapabilityInventorySchemaVersion, + evidence_grade: CapabilityInventoryEvidenceGrade, + runtime_activation: RuntimeActivationEvaluation, + capabilities: Vec, + support: Vec, + missing_support: Vec, + inactive_or_unused: Vec, + } + + let wire = Wire::deserialize(deserializer)?; + let capability_ids = wire + .capabilities + .iter() + .map(|record| record.capability) + .collect::>(); + if wire.capabilities.len() != CapabilityId::ALL.len() + || capability_ids != CapabilityId::ALL.into_iter().collect() + { + return Err(de::Error::custom( + "capability rows must contain every closed capability exactly once", + )); + } + let support_ids = wire + .support + .iter() + .map(|assessment| assessment.component) + .collect::>(); + if wire.support.len() != SupportComponent::ALL.len() + || support_ids != SupportComponent::ALL.into_iter().collect() + { + return Err(de::Error::custom( + "support rows must contain every closed component exactly once", + )); + } + validate_decoded_inventory( + &wire.capabilities, + &wire.support, + &wire.missing_support, + &wire.inactive_or_unused, + ) + .map_err(de::Error::custom)?; + + Ok(Self { + schema_version: wire.schema_version, + evidence_grade: wire.evidence_grade, + runtime_activation: wire.runtime_activation, + capabilities: wire.capabilities, + support: wire.support, + missing_support: wire.missing_support, + inactive_or_unused: wire.inactive_or_unused, + }) + } +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq)] +struct InstalledCapabilityInput { + state: InstalledCapabilityState, + evidence: InstalledCapabilityEvidence, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq)] +struct SupportAssessmentInput { + state: SupportState, + evidence: SupportEvidence, +} + +/// Pure, value-free input seam for a command adapter. +/// +/// A command adapter should populate this only from the already validated +/// authoring model, compile-time/link-time release facts, and local schema or +/// validator availability. It must not populate this from runtime health, +/// image inspection, network calls, or secret lookup. +#[derive(Clone, Debug, Default, Eq, PartialEq)] +pub(crate) struct CapabilityInventoryInput { + installed: BTreeMap, + declared: BTreeSet, + enabled: BTreeSet, + usage: BTreeMap, + support: BTreeMap, +} + +impl CapabilityInventoryInput { + pub(crate) fn new() -> Self { + Self::default() + } + + pub(crate) fn record_installed_capability( + &mut self, + capability: CapabilityId, + state: InstalledCapabilityState, + evidence: InstalledCapabilityEvidence, + ) -> Result<(), CapabilityInventoryError> { + validate_installed_evidence(state, evidence)?; + if self.installed.contains_key(&capability) { + return Err(CapabilityInventoryError::DuplicateInstalledCapability( + capability, + )); + } + self.installed + .insert(capability, InstalledCapabilityInput { state, evidence }); + Ok(()) + } + + pub(crate) fn record_project_declaration( + &mut self, + capability: CapabilityId, + ) -> Result<(), CapabilityInventoryError> { + if !capability.project_declarable() { + return Err(CapabilityInventoryError::CapabilityNotProjectDeclarable( + capability, + )); + } + if !self.declared.insert(capability) { + return Err(CapabilityInventoryError::DuplicateProjectDeclaration( + capability, + )); + } + Ok(()) + } + + pub(crate) fn record_environment_enablement( + &mut self, + capability: CapabilityId, + ) -> Result<(), CapabilityInventoryError> { + if !capability.environment_enableable() { + return Err(CapabilityInventoryError::CapabilityNotEnvironmentEnableable(capability)); + } + if !self.enabled.insert(capability) { + return Err(CapabilityInventoryError::DuplicateEnvironmentEnablement( + capability, + )); + } + Ok(()) + } + + pub(crate) fn record_usage( + &mut self, + capability: CapabilityId, + usage: CapabilityUsageCounts, + ) -> Result<(), CapabilityInventoryError> { + validate_usage(usage)?; + if usage.is_empty() { + return Err(CapabilityInventoryError::EmptyUsage(capability)); + } + if self.usage.contains_key(&capability) { + return Err(CapabilityInventoryError::DuplicateUsage(capability)); + } + self.usage.insert(capability, usage); + Ok(()) + } + + pub(crate) fn record_support( + &mut self, + component: SupportComponent, + state: SupportState, + evidence: SupportEvidence, + ) -> Result<(), CapabilityInventoryError> { + validate_support_evidence(component, state, evidence)?; + if self.support.contains_key(&component) { + return Err(CapabilityInventoryError::DuplicateSupport(component)); + } + self.support + .insert(component, SupportAssessmentInput { state, evidence }); + Ok(()) + } +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq)] +pub(crate) enum CapabilityInventoryError { + DuplicateInstalledCapability(CapabilityId), + DuplicateProjectDeclaration(CapabilityId), + DuplicateEnvironmentEnablement(CapabilityId), + DuplicateUsage(CapabilityId), + DuplicateSupport(SupportComponent), + CapabilityNotProjectDeclarable(CapabilityId), + CapabilityNotEnvironmentEnableable(CapabilityId), + EnabledWithoutDeclaration(CapabilityId), + UsedWithoutDeclaration(CapabilityId), + EmptyUsage(CapabilityId), + UsageCountOutOfRange, + InvalidInstalledEvidence, + InvalidSupportEvidence, + ImageAvailabilityCannotBeClaimed, +} + +impl fmt::Display for CapabilityInventoryError { + fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result { + write!(formatter, "{self:?}") + } +} + +impl std::error::Error for CapabilityInventoryError {} + +pub(crate) fn build_capability_inventory( + input: CapabilityInventoryInput, +) -> Result { + for capability in &input.enabled { + if !input.declared.contains(capability) { + return Err(CapabilityInventoryError::EnabledWithoutDeclaration( + *capability, + )); + } + } + for capability in input.usage.keys() { + if capability.project_declarable() && !input.declared.contains(capability) { + return Err(CapabilityInventoryError::UsedWithoutDeclaration( + *capability, + )); + } + } + + let mut capabilities = Vec::with_capacity(CapabilityId::ALL.len()); + let mut inactive_or_unused = Vec::new(); + for capability in CapabilityId::ALL { + let metadata = capability_metadata(capability); + let installed = + input + .installed + .get(&capability) + .copied() + .unwrap_or(InstalledCapabilityInput { + state: InstalledCapabilityState::NotEvaluated, + evidence: InstalledCapabilityEvidence::NoEvidence, + }); + let usage = input.usage.get(&capability).copied().unwrap_or_default(); + let declared = input.declared.contains(&capability); + let enabled = input.enabled.contains(&capability); + let project_declaration = if capability.project_declarable() { + if declared { + ProjectDeclarationState::Declared + } else { + ProjectDeclarationState::NotDeclared + } + } else { + ProjectDeclarationState::NotApplicable + }; + let environment_enablement = if capability.environment_enableable() { + if enabled { + EnvironmentEnablementState::Enabled + } else { + EnvironmentEnablementState::NotEnabled + } + } else { + EnvironmentEnablementState::NotApplicable + }; + let disposition = capability_disposition( + capability, + installed.state, + declared, + enabled, + usage, + has_missing_support(&input, capability), + ); + if declared && usage.is_empty() { + inactive_or_unused.push(InactiveOrUnusedDeclaration { + capability, + reason: if enabled { + InactiveOrUnusedReason::DeclaredEnabledNotUsed + } else { + InactiveOrUnusedReason::DeclaredNotEnabled + }, + }); + } + capabilities.push(CapabilityInventoryRecord { + capability, + kind: metadata.kind, + owner: metadata.owner, + maturity: CapabilityMaturity::ReleaseGated, + supported_versions: metadata.supported_versions.to_vec(), + installed_release: installed.state, + installed_evidence: installed.evidence, + project_declaration, + environment_enablement, + used_by: usage, + disposition, + }); + } + + let mut support = Vec::with_capacity(SupportComponent::ALL.len()); + let mut missing_support = Vec::new(); + for component in SupportComponent::ALL { + let metadata = support_metadata(component); + let assessment = input + .support + .get(&component) + .copied() + .unwrap_or(SupportAssessmentInput { + state: SupportState::NotEvaluated, + evidence: SupportEvidence::NoEvidence, + }); + let required_by = metadata.required_by.to_vec(); + if matches!( + assessment.state, + SupportState::Missing | SupportState::Unsupported + ) { + missing_support.push(MissingSupport { + component, + kind: metadata.kind, + state: assessment.state, + required_by: required_by.clone(), + }); + } + support.push(SupportAssessment { + component, + kind: metadata.kind, + owner: metadata.owner, + state: assessment.state, + evidence: assessment.evidence, + required_by, + }); + } + + Ok(ProjectCapabilityInventoryReportV1 { + schema_version: ProjectCapabilityInventorySchemaVersion::V1, + evidence_grade: CapabilityInventoryEvidenceGrade::OfflineStatic, + runtime_activation: RuntimeActivationEvaluation::NotEvaluated, + capabilities, + support, + missing_support, + inactive_or_unused, + }) +} + +fn validate_usage(usage: CapabilityUsageCounts) -> Result<(), CapabilityInventoryError> { + let total = usage + .total() + .ok_or(CapabilityInventoryError::UsageCountOutOfRange)?; + if usage.services > MAX_CAPABILITY_USAGE_COUNT + || usage.consultations > MAX_CAPABILITY_USAGE_COUNT + || usage.claims > MAX_CAPABILITY_USAGE_COUNT + || total > MAX_CAPABILITY_USAGE_COUNT + { + return Err(CapabilityInventoryError::UsageCountOutOfRange); + } + Ok(()) +} + +fn validate_installed_evidence( + state: InstalledCapabilityState, + evidence: InstalledCapabilityEvidence, +) -> Result<(), CapabilityInventoryError> { + let valid = match state { + InstalledCapabilityState::Compiled => matches!( + evidence, + InstalledCapabilityEvidence::LinkedCrate + | InstalledCapabilityEvidence::EmbeddedCompiler + | InstalledCapabilityEvidence::EmbeddedSchema + | InstalledCapabilityEvidence::LinkedProductValidator + | InstalledCapabilityEvidence::ReleaseMetadata + ), + InstalledCapabilityState::NotCompiled => { + evidence == InstalledCapabilityEvidence::ReleaseMetadata + } + InstalledCapabilityState::Unsupported => { + evidence == InstalledCapabilityEvidence::ExplicitlyUnsupported + } + InstalledCapabilityState::NotEvaluated => { + evidence == InstalledCapabilityEvidence::NoEvidence + } + }; + if valid { + Ok(()) + } else { + Err(CapabilityInventoryError::InvalidInstalledEvidence) + } +} + +fn validate_support_evidence( + component: SupportComponent, + state: SupportState, + evidence: SupportEvidence, +) -> Result<(), CapabilityInventoryError> { + if component.is_image() + && !matches!( + state, + SupportState::Unsupported | SupportState::NotEvaluated + ) + { + return Err(CapabilityInventoryError::ImageAvailabilityCannotBeClaimed); + } + let valid = match state { + SupportState::Available => matches!( + evidence, + SupportEvidence::LinkedCrate + | SupportEvidence::EmbeddedSchema + | SupportEvidence::LinkedProductValidator + | SupportEvidence::ReleaseMetadata + ), + SupportState::Missing => evidence == SupportEvidence::ExplicitlyMissing, + SupportState::Unsupported => evidence == SupportEvidence::ExplicitlyUnsupported, + SupportState::NotEvaluated => evidence == SupportEvidence::NoEvidence, + }; + if valid { + Ok(()) + } else { + Err(CapabilityInventoryError::InvalidSupportEvidence) + } +} + +fn capability_disposition( + capability: CapabilityId, + installed: InstalledCapabilityState, + declared: bool, + enabled: bool, + usage: CapabilityUsageCounts, + missing_support: bool, +) -> CapabilityDisposition { + if !usage.is_empty() { + if installed != InstalledCapabilityState::Compiled || missing_support { + CapabilityDisposition::UsedWithMissingSupport + } else if capability.environment_enableable() && !enabled { + CapabilityDisposition::UsedButNotEnabled + } else { + CapabilityDisposition::Used + } + } else if declared && enabled { + CapabilityDisposition::DeclaredEnabledUnused + } else if declared { + CapabilityDisposition::DeclaredInactive + } else if installed == InstalledCapabilityState::Compiled { + CapabilityDisposition::InstalledUnused + } else { + CapabilityDisposition::UnavailableUnused + } +} + +fn has_missing_support(input: &CapabilityInventoryInput, capability: CapabilityId) -> bool { + SupportComponent::ALL.into_iter().any(|component| { + support_metadata(component) + .required_by + .contains(&capability) + && input.support.get(&component).is_some_and(|assessment| { + matches!( + assessment.state, + SupportState::Missing | SupportState::Unsupported + ) + }) + }) +} + +struct CapabilityMetadata { + kind: CapabilityKind, + owner: CapabilityOwner, + supported_versions: &'static [SupportedCapabilityVersion], +} + +fn capability_metadata(capability: CapabilityId) -> CapabilityMetadata { + use SupportedCapabilityVersion as Version; + match capability { + CapabilityId::SourceHttp | CapabilityId::SourceScript | CapabilityId::SourceSnapshot => { + CapabilityMetadata { + kind: CapabilityKind::Source, + owner: CapabilityOwner::Registryctl, + supported_versions: &[Version::ProjectAuthoringV1, Version::RelayIntegrationPackV1], + } + } + CapabilityId::RhaiRuntime => CapabilityMetadata { + kind: CapabilityKind::Runtime, + owner: CapabilityOwner::RegistryRelay, + supported_versions: &[Version::RhaiLanguageV1], + }, + CapabilityId::RhaiAbi => CapabilityMetadata { + kind: CapabilityKind::Abi, + owner: CapabilityOwner::RegistryRelay, + supported_versions: &[Version::RhaiXwV1], + }, + CapabilityId::RegistryRelayProduct => CapabilityMetadata { + kind: CapabilityKind::Product, + owner: CapabilityOwner::RegistryRelay, + supported_versions: &[Version::RegistryRelayConfigV1], + }, + CapabilityId::RegistryNotaryProduct => CapabilityMetadata { + kind: CapabilityKind::Product, + owner: CapabilityOwner::RegistryNotary, + supported_versions: &[Version::RegistryNotaryConfigV1], + }, + CapabilityId::RegistryRelayValidator => CapabilityMetadata { + kind: CapabilityKind::ProductValidator, + owner: CapabilityOwner::RegistryRelay, + supported_versions: &[Version::RegistryRelayConfigV1], + }, + CapabilityId::RegistryNotaryValidator => CapabilityMetadata { + kind: CapabilityKind::ProductValidator, + owner: CapabilityOwner::RegistryNotary, + supported_versions: &[Version::RegistryNotaryConfigV1], + }, + CapabilityId::ProjectAuthoringSchemas => CapabilityMetadata { + kind: CapabilityKind::Schema, + owner: CapabilityOwner::Registryctl, + supported_versions: &[Version::ProjectAuthoringV1], + }, + CapabilityId::RegistryRelayConfigSchema => CapabilityMetadata { + kind: CapabilityKind::Schema, + owner: CapabilityOwner::RegistryRelay, + supported_versions: &[Version::RegistryRelayConfigV1], + }, + CapabilityId::RegistryNotaryConfigSchema => CapabilityMetadata { + kind: CapabilityKind::Schema, + owner: CapabilityOwner::RegistryNotary, + supported_versions: &[Version::RegistryNotaryConfigV1], + }, + } +} + +struct SupportMetadata { + kind: SupportKind, + owner: CapabilityOwner, + required_by: &'static [CapabilityId], +} + +fn support_metadata(component: SupportComponent) -> SupportMetadata { + use CapabilityId as Capability; + match component { + SupportComponent::HttpSourceWorker => SupportMetadata { + kind: SupportKind::Worker, + owner: CapabilityOwner::RegistryRelay, + required_by: &[Capability::SourceHttp], + }, + SupportComponent::RhaiScriptWorker => SupportMetadata { + kind: SupportKind::Worker, + owner: CapabilityOwner::RegistryRelay, + required_by: &[Capability::SourceScript, Capability::RhaiRuntime], + }, + SupportComponent::SnapshotMaterializationWorker => SupportMetadata { + kind: SupportKind::Worker, + owner: CapabilityOwner::RegistryRelay, + required_by: &[Capability::SourceSnapshot], + }, + SupportComponent::RhaiXwProtocolHelper => SupportMetadata { + kind: SupportKind::ProtocolHelper, + owner: CapabilityOwner::RegistryRelay, + required_by: &[Capability::SourceScript, Capability::RhaiAbi], + }, + SupportComponent::RegistryRelayProduct => SupportMetadata { + kind: SupportKind::Product, + owner: CapabilityOwner::RegistryRelay, + required_by: &[ + Capability::SourceHttp, + Capability::SourceScript, + Capability::SourceSnapshot, + Capability::RegistryRelayProduct, + ], + }, + SupportComponent::RegistryNotaryProduct => SupportMetadata { + kind: SupportKind::Product, + owner: CapabilityOwner::RegistryNotary, + required_by: &[Capability::RegistryNotaryProduct], + }, + SupportComponent::RegistryRelayValidator => SupportMetadata { + kind: SupportKind::ProductValidator, + owner: CapabilityOwner::RegistryRelay, + required_by: &[Capability::RegistryRelayProduct], + }, + SupportComponent::RegistryNotaryValidator => SupportMetadata { + kind: SupportKind::ProductValidator, + owner: CapabilityOwner::RegistryNotary, + required_by: &[Capability::RegistryNotaryProduct], + }, + SupportComponent::ProjectAuthoringSchema => SupportMetadata { + kind: SupportKind::Schema, + owner: CapabilityOwner::Registryctl, + required_by: &[ + Capability::SourceHttp, + Capability::SourceScript, + Capability::SourceSnapshot, + ], + }, + SupportComponent::RegistryRelayConfigSchema => SupportMetadata { + kind: SupportKind::Schema, + owner: CapabilityOwner::RegistryRelay, + required_by: &[Capability::RegistryRelayProduct], + }, + SupportComponent::RegistryNotaryConfigSchema => SupportMetadata { + kind: SupportKind::Schema, + owner: CapabilityOwner::RegistryNotary, + required_by: &[Capability::RegistryNotaryProduct], + }, + SupportComponent::RegistryctlDistribution => SupportMetadata { + kind: SupportKind::Distribution, + owner: CapabilityOwner::ReleaseEngineering, + required_by: &[ + Capability::SourceHttp, + Capability::SourceScript, + Capability::SourceSnapshot, + Capability::ProjectAuthoringSchemas, + ], + }, + SupportComponent::RegistryRelayImage => SupportMetadata { + kind: SupportKind::Image, + owner: CapabilityOwner::ReleaseEngineering, + required_by: &[Capability::RegistryRelayProduct], + }, + SupportComponent::RegistryNotaryImage => SupportMetadata { + kind: SupportKind::Image, + owner: CapabilityOwner::ReleaseEngineering, + required_by: &[Capability::RegistryNotaryProduct], + }, + } +} diff --git a/crates/registryctl/src/project_authoring/commands.rs b/crates/registryctl/src/project_authoring/commands.rs index c7a900ab9..87c0f3e04 100644 --- a/crates/registryctl/src/project_authoring/commands.rs +++ b/crates/registryctl/src/project_authoring/commands.rs @@ -128,7 +128,10 @@ fn publish_staged_project_into_existing(source: &Path, destination: &Path) -> Re let source_path = entry.path(); let target = destination.join(entry.file_name()); let metadata = fs::symlink_metadata(&source_path).with_context(|| { - format!("failed to inspect staged project path {}", source_path.display()) + format!( + "failed to inspect staged project path {}", + source_path.display() + ) })?; if metadata.file_type().is_symlink() { bail!("staged project contains a forbidden symlink"); @@ -241,12 +244,10 @@ mod project_init_staging_tests { init_registry_project(&options(destination.clone())) .expect_err("late editor publication failure must fail init"); assert!(destination.is_dir()); - assert!( - fs::read_dir(&destination) - .expect("destination reads") - .next() - .is_none() - ); + assert!(fs::read_dir(&destination) + .expect("destination reads") + .next() + .is_none()); #[cfg(unix)] { use std::os::unix::fs::PermissionsExt as _; @@ -263,30 +264,34 @@ mod project_init_staging_tests { } } -fn starter_explanation(loaded: &LoadedRegistryProject) -> Value { - match &loaded.project.starter { - Some(starter) => json!({ - "id": starter.id, - "release": starter.release, - "expected_content_digest": starter.content_digest, - "current_content_digest": loaded.project_content_digest, - "state": if starter.content_digest == loaded.project_content_digest { - "matches" - } else { - "diverged" - }, - }), - None => json!({ "state": "not_initialized_from_starter" }), - } +pub fn test_registry_project(options: &ProjectTestOptions) -> Result { + let execution_context = ProjectExecutionContext::for_current_executable()?; + test_registry_project_with_context(options, &execution_context) } -pub fn test_registry_project(options: &ProjectTestOptions) -> Result { - test_registry_project_selected(options, &ProjectTestSelection::default()) +pub fn test_registry_project_with_context( + options: &ProjectTestOptions, + execution_context: &ProjectExecutionContext, +) -> Result { + test_registry_project_selected_with_context( + options, + &ProjectTestSelection::default(), + execution_context, + ) } pub fn test_registry_project_selected( options: &ProjectTestOptions, selection: &ProjectTestSelection, +) -> Result { + let execution_context = ProjectExecutionContext::for_current_executable()?; + test_registry_project_selected_with_context(options, selection, &execution_context) +} + +pub fn test_registry_project_selected_with_context( + options: &ProjectTestOptions, + selection: &ProjectTestSelection, + execution_context: &ProjectExecutionContext, ) -> Result { if options.live && options.environment.is_none() { bail!("live project tests require an explicit non-production --environment"); @@ -303,14 +308,27 @@ pub fn test_registry_project_selected( let compiled = compile_project_for_environment(&loaded, "offline-fixture", &offline_environment, None)?; validate_generated_product_configs(&compiled)?; - let mut reports = execute_all_fixtures( - &loaded, - &compiled, - selection.integration.as_deref(), - selection.fixture.as_deref(), - selection.trace, - )?; + let (mut reports, generated_observations, request_observations, call_budget_actual) = + execute_all_fixtures_with_coverage_observations( + &loaded, + &compiled, + selection.integration.as_deref(), + selection.fixture.as_deref(), + selection.trace, + execution_context, + )?; require_passing_fixtures(&reports)?; + let fixture_coverage = if selection.integration.is_none() && selection.fixture.is_none() { + Some(generate_fixture_coverage_report( + &loaded, + &reports, + &generated_observations, + &request_observations, + call_budget_actual, + )?) + } else { + None + }; if options.live { reports.push(execute_governed_live_test(&loaded)?); } @@ -323,6 +341,9 @@ pub fn test_registry_project_selected( semantic_changes: Vec::new(), baseline: "initial_without_baseline", output: None, + semantic_impact: None, + artifact_manifest: None, + fixture_coverage, explanation: None, }) } @@ -599,7 +620,7 @@ fn execute_governed_live_test(loaded: &LoadedRegistryProject) -> Result Result Result Result<()> { - let issued_at = OffsetDateTime::parse(&result.issued_at, &Rfc3339) - .map_err(|_| anyhow!("governed Notary result timestamps do not match the public date-time schema"))?; + let issued_at = OffsetDateTime::parse(&result.issued_at, &Rfc3339).map_err(|_| { + anyhow!("governed Notary result timestamps do not match the public date-time schema") + })?; let expires_at = result .expires_at .as_deref() @@ -887,10 +909,8 @@ fn validate_live_result_timestamps( if validation_window.response_received_at < validation_window.request_started_at { bail!("governed Notary validation window is invalid"); } - let earliest_issued_at = - validation_window.request_started_at - GOVERNED_LIVE_REMOTE_CLOCK_SKEW; - let latest_issued_at = - validation_window.response_received_at + GOVERNED_LIVE_REMOTE_CLOCK_SKEW; + let earliest_issued_at = validation_window.request_started_at - GOVERNED_LIVE_REMOTE_CLOCK_SKEW; + let latest_issued_at = validation_window.response_received_at + GOVERNED_LIVE_REMOTE_CLOCK_SKEW; if issued_at < earliest_issued_at || issued_at > latest_issued_at { bail!("governed Notary result timestamps do not bind to the current live evaluation"); } @@ -1045,7 +1065,9 @@ fn validate_live_expected_redaction_fields(fields: &Value) -> Result let field = field .as_str() .filter(|field| is_live_top_level_redaction_field(field)) - .ok_or_else(|| anyhow!("live expected redacted_fields have an invalid bounded shape"))?; + .ok_or_else(|| { + anyhow!("live expected redacted_fields have an invalid bounded shape") + })?; if !unique.insert(field.to_string()) { bail!("live expected redacted_fields have an invalid bounded shape"); } @@ -1172,26 +1194,74 @@ struct ValidatedLiveRequest { notary_service_id: String, } +struct PreparedGovernedLiveRequest { + validated: ValidatedLiveRequest, + body: Vec, +} + +#[derive(Clone, Copy)] +struct GovernedLiveInputContract<'a> { + name: &'a str, + declaration: &'a InputDeclaration, +} + +fn prepare_governed_live_request( + loaded: &LoadedRegistryProject, + request: &Value, +) -> Result { + let (validated, outbound) = validate_live_request_boundary(loaded, request)?; + let body = serde_json::to_vec(&outbound) + .context("failed to construct the validated governed Notary request")?; + Ok(PreparedGovernedLiveRequest { validated, body }) +} + +#[cfg(test)] fn validate_live_request( loaded: &LoadedRegistryProject, request: &Value, ) -> Result { - let object = request - .as_object() - .ok_or_else(|| anyhow!("live request must be a JSON object"))?; + validate_live_request_boundary(loaded, request).map(|(validated, _)| validated) +} + +fn validate_live_request_boundary( + loaded: &LoadedRegistryProject, + request: &Value, +) -> Result<(ValidatedLiveRequest, GovernedLiveRequest)> { + if !request.is_object() { + bail!("live request must be a JSON object"); + } if contains_sensitive_request_key(request) { bail!("live request contains a forbidden credential-like field"); } + let outbound: GovernedLiveRequest = serde_json::from_value(request.clone()) + .map_err(|_| anyhow!("live request does not match the closed governed schema"))?; + let validated = validate_governed_request(loaded, &outbound, true)?; + Ok((validated, outbound)) +} + +fn validate_governed_request( + loaded: &LoadedRegistryProject, + outbound: &GovernedLiveRequest, + require_notary_service: bool, +) -> Result { let notary_service_id = loaded .environment .as_ref() .and_then(|environment| environment.deployment.notary.as_ref()) .map(|notary| notary.service.clone()) - .ok_or_else(|| anyhow!("live request environment does not declare a Notary service"))?; - let purpose = object - .get("purpose") - .and_then(Value::as_str) - .ok_or_else(|| anyhow!("live request must declare one project purpose"))?; + .map_or_else( + || { + if require_notary_service { + Err(anyhow!( + "live request environment does not declare a Notary service" + )) + } else { + Ok("offline-fixture".to_owned()) + } + }, + Ok, + )?; + let purpose = outbound.purpose.as_str(); let services = loaded .project .services @@ -1201,10 +1271,7 @@ fn validate_live_request( if services.is_empty() { bail!("live request purpose is not declared by this project"); } - let claims = object - .get("claims") - .and_then(Value::as_array) - .ok_or_else(|| anyhow!("live request must contain a claims array"))?; + let claims = &outbound.claims; if claims.is_empty() || claims.len() > MAX_CLAIMS { bail!("live request claim count is outside the project bound"); } @@ -1212,25 +1279,18 @@ fn validate_live_request( let mut claim_versions = BTreeMap::new(); let mut selected_claims = Vec::with_capacity(claims.len()); for claim in claims { - let (id, requested_version) = match claim { - Value::String(id) => (id.as_str(), None), - Value::Object(object) => ( - object - .get("id") - .and_then(Value::as_str) - .ok_or_else(|| anyhow!("live request claim reference is invalid"))?, - object.get("version"), - ), - _ => bail!("live request claim reference is invalid"), - }; + let id = claim.id.as_str(); let service = services .iter() + .copied() .find(|service| service.claims.contains_key(id)) .ok_or_else(|| anyhow!("live request contains an unknown project claim"))?; let authored_version = service.version.to_string(); - if requested_version.is_some_and(|version| { - version.as_str() != Some(authored_version.as_str()) - }) { + if claim + .version + .as_deref() + .is_some_and(|version| version != authored_version) + { bail!("live request claim version does not match the authored project"); } if claim_versions @@ -1240,28 +1300,51 @@ fn validate_live_request( bail!("live request contains an unknown or duplicate project claim"); } ids.push(id.to_string()); - selected_claims.push( - service - .claims - .get(id) - .expect("selected project claim remains present"), - ); + let selected_claim = service + .claims + .get(id) + .ok_or_else(|| anyhow!("selected project claim is absent after claim resolution"))?; + selected_claims.push((service, selected_claim)); } - let disclosure = match object.get("disclosure") { - Some(Value::String(disclosure)) => disclosure.as_str(), - Some(_) => bail!("live request disclosure profile is invalid"), - None => expanded_disclosure(&selected_claims[0].disclosure).0, - }; + let first_claim = selected_claims + .first() + .map(|(_, claim)| *claim) + .ok_or_else(|| anyhow!("live request must select at least one project claim"))?; + let disclosure = outbound + .disclosure + .as_deref() + .unwrap_or_else(|| expanded_disclosure(&first_claim.disclosure).0); if registry_notary_core::DisclosureProfile::parse(disclosure).is_none() { bail!("live request disclosure profile is invalid"); } - if selected_claims.iter().any(|claim| { + if selected_claims.iter().any(|(_, claim)| { !expanded_disclosure(&claim.disclosure) .1 .contains(&disclosure) }) { bail!("live request disclosure is not allowed for every selected project claim"); } + if outbound + .format + .as_deref() + .is_some_and(|format| format != registry_notary_core::FORMAT_CLAIM_RESULT_JSON) + { + bail!("live request format must be the governed claim-result media type"); + } + for (name, _) in outbound.variables.iter() { + if !selected_claims + .iter() + .any(|(service, _)| service.variables.contains_key(name)) + { + bail!("live request variable is not declared by a selected project service"); + } + } + validate_governed_live_target( + loaded, + &selected_claims, + &outbound.target, + &outbound.variables, + )?; Ok(ValidatedLiveRequest { claims: ids, claim_versions, @@ -1269,6 +1352,139 @@ fn validate_live_request( }) } +fn validate_governed_live_target( + loaded: &LoadedRegistryProject, + selected_claims: &[(&ServiceDeclaration, &ClaimDeclaration)], + target: &GovernedLiveTarget, + variables: ®istry_notary_core::RequestVariables, +) -> Result<()> { + if !target + .entity_type + .eq_ignore_ascii_case(AUTHORED_CLAIM_SUBJECT_TYPE) + { + bail!("live request target type does not match the authored project"); + } + + let mut id_contracts = Vec::new(); + let mut identifier_contracts = BTreeMap::>>::new(); + let mut attribute_contracts = BTreeMap::>>::new(); + let mut variable_contracts = BTreeMap::>>::new(); + for (service, claim) in selected_claims { + if inferred_claim_evidence(service, claim)? != ClaimEvidence::RegistryBacked { + bail!("governed live requests require registry-backed project claims"); + } + let consultation_name = claim_consultation_name(service, claim)?; + let consultation = service + .consultations + .get(consultation_name) + .ok_or_else(|| anyhow!("selected project claim has no authored live consultation"))?; + let integration = loaded + .integrations + .get(&consultation.integration) + .ok_or_else(|| anyhow!("selected live consultation has no authored integration"))?; + for (name, mapping) in &consultation.input { + let declaration = integration.document.input.get(name).ok_or_else(|| { + anyhow!("selected live consultation input has no authored contract") + })?; + let contract = GovernedLiveInputContract { name, declaration }; + if mapping == "request.target.id" { + id_contracts.push(contract); + } else if let Some(scheme) = mapping.strip_prefix("request.target.identifiers.") { + identifier_contracts + .entry(scheme.to_string()) + .or_default() + .push(contract); + } else if let Some(name) = mapping.strip_prefix("request.target.attributes.") { + attribute_contracts + .entry(name.to_string()) + .or_default() + .push(contract); + } else if let Some(name) = mapping.strip_prefix("request.variables.") { + variable_contracts + .entry(name.to_string()) + .or_default() + .push(contract); + } else { + bail!("authored consultation uses an unsupported governed live input"); + } + } + } + + if id_contracts.is_empty() != target.id.is_none() { + bail!("live request target fields do not exactly match the selected authored inputs"); + } + let mut identifiers = BTreeMap::new(); + for identifier in &target.identifiers { + if identifiers + .insert(identifier.scheme.as_str(), identifier.value.as_str()) + .is_some() + { + bail!("live request target contains a duplicate identifier scheme"); + } + } + if identifiers.keys().copied().collect::>() + != identifier_contracts + .keys() + .map(String::as_str) + .collect::>() + || target + .attributes + .keys() + .map(String::as_str) + .collect::>() + != attribute_contracts + .keys() + .map(String::as_str) + .collect::>() + { + bail!("live request target fields do not exactly match the selected authored inputs"); + } + + if let Some(id) = &target.id { + validate_governed_live_input("target.id", &id_contracts, &Value::String(id.clone()))?; + } + for (scheme, contracts) in &identifier_contracts { + let value = identifiers.get(scheme.as_str()).ok_or_else(|| { + anyhow!("live request target identifier is absent after exact-shape validation") + })?; + validate_governed_live_input( + &format!("target.identifiers.{scheme}"), + contracts, + &Value::String((*value).to_string()), + )?; + } + for (name, contracts) in &attribute_contracts { + let value = target.attributes.get(name).ok_or_else(|| { + anyhow!("live request target attribute is absent after exact-shape validation") + })?; + validate_governed_live_input(&format!("target.attributes.{name}"), contracts, value)?; + } + for (name, contracts) in &variable_contracts { + let value = variables.get(name).ok_or_else(|| { + anyhow!("live request omits a variable required by the selected authored inputs") + })?; + validate_governed_live_input( + &format!("variables.{name}"), + contracts, + &Value::String(value.to_string()), + )?; + } + Ok(()) +} + +fn validate_governed_live_input( + path: &str, + contracts: &[GovernedLiveInputContract<'_>], + value: &Value, +) -> Result<()> { + for contract in contracts { + validate_fixture_input_value(contract.name, contract.declaration, value).map_err(|_| { + anyhow!("live request {path} violates its selected authored type or bounds") + })?; + } + Ok(()) +} + fn contains_sensitive_request_key(value: &Value) -> bool { match value { Value::Object(object) => object.iter().any(|(key, value)| { @@ -1282,7 +1498,223 @@ fn contains_sensitive_request_key(value: &Value) -> bool { } } +#[cfg(test)] +mod governed_live_request_boundary_tests { + use super::*; + + fn loaded_project(name: &str) -> LoadedRegistryProject { + load_registry_project( + &Path::new(env!("CARGO_MANIFEST_DIR")) + .join("tests/fixtures/project-authoring") + .join(name), + Some("local"), + ) + .unwrap_or_else(|error| panic!("{name} project loads: {error:#}")) + } + + fn openspp_request() -> Value { + json!({ + "target": { + "type": "Person", + "identifiers": [{ + "scheme": "openspp_individual_id", + "value": "IND-AB12CD34", + }], + }, + "claims": ["social-registry-record-exists"], + "disclosure": "predicate", + "format": registry_notary_core::FORMAT_CLAIM_RESULT_JSON, + "purpose": "social-programme-verification", + }) + } + + fn assert_rejected_before_outbound_body( + loaded: &LoadedRegistryProject, + request: &Value, + expected_error: &str, + ) -> String { + let error = prepare_governed_live_request(loaded, request) + .err() + .expect("invalid input must not produce an outbound request body"); + let rendered = format!("{error:#}"); + assert!( + rendered.contains(expected_error), + "unexpected error: {rendered}" + ); + rendered + } + + #[test] + fn governed_live_request_rejects_unknown_top_level_before_outbound_body() { + let loaded = loaded_project("openspp-exact"); + let mut request = openspp_request(); + request["raw_record"] = json!({ "national_id": "NID-raw-top-level" }); + + let error = + assert_rejected_before_outbound_body(&loaded, &request, "closed governed schema"); + for private_fragment in ["raw_record", "national_id", "NID-raw-top-level"] { + assert!( + !error.contains(private_fragment), + "closed-schema errors must redact unknown names and values" + ); + } + } + + #[test] + fn governed_live_request_rejects_unknown_nested_field_before_outbound_body() { + let loaded = loaded_project("openspp-exact"); + let mut request = openspp_request(); + request["target"]["raw_record"] = json!({ "record": "unreviewed" }); + + let error = + assert_rejected_before_outbound_body(&loaded, &request, "closed governed schema"); + for private_fragment in ["raw_record", "record", "unreviewed"] { + assert!( + !error.contains(private_fragment), + "closed-schema errors must redact unknown names and values" + ); + } + } + + #[test] + fn governed_live_request_rejects_unmapped_pii_shaped_field_before_outbound_body() { + let loaded = loaded_project("openspp-exact"); + let mut request = openspp_request(); + request["target"]["attributes"]["national_id"] = json!("NID-private-value"); + + let error = assert_rejected_before_outbound_body( + &loaded, + &request, + "do not exactly match the selected authored inputs", + ); + for private_fragment in ["national_id", "NID-private-value"] { + assert!( + !error.contains(private_fragment), + "live validation errors must redact unknown names and values" + ); + } + } + + #[test] + fn governed_live_request_validates_identifier_and_attribute_bounds() { + let openspp = loaded_project("openspp-exact"); + let mut oversized_identifier = openspp_request(); + oversized_identifier["target"]["identifiers"][0]["value"] = json!("X".repeat(257)); + assert_rejected_before_outbound_body( + &openspp, + &oversized_identifier, + "violates its selected authored type or bounds", + ); + + let dhis2 = loaded_project("dhis2-script"); + let invalid_attribute = json!({ + "target": { + "type": "person", + "identifiers": [{ + "scheme": "dhis2_tracked_entity", + "value": "A1234567890", + }], + "attributes": { "include_inactive": "false" }, + }, + "variables": { "as_of_date": "2026-01-01" }, + "claims": ["child-age-band"], + "disclosure": "value", + "purpose": "programme-enrollment-verification", + }); + assert_rejected_before_outbound_body( + &dhis2, + &invalid_attribute, + "violates its selected authored type or bounds", + ); + } + + #[test] + fn governed_live_request_reconstructs_declared_typed_target_and_variables() { + let loaded = loaded_project("dhis2-script"); + let request = json!({ + "target": { + "type": "Person", + "identifiers": [{ + "scheme": "dhis2_tracked_entity", + "value": "A1234567890", + }], + "attributes": { "include_inactive": false }, + }, + "variables": { "as_of_date": "2026-01-01" }, + "claims": ["child-age-band"], + "disclosure": "value", + "format": registry_notary_core::FORMAT_CLAIM_RESULT_JSON, + "purpose": "programme-enrollment-verification", + }); + + let prepared = prepare_governed_live_request(&loaded, &request) + .expect("declared typed live request prepares"); + let outbound = + parse_json_strict(&prepared.body).expect("prepared outbound body is strict JSON"); + assert_eq!( + outbound.pointer("/target/identifiers/0/value"), + Some(&json!("A1234567890")) + ); + assert_eq!( + outbound.pointer("/target/attributes/include_inactive"), + Some(&json!(false)) + ); + assert_eq!( + outbound.pointer("/variables/as_of_date"), + Some(&json!("2026-01-01")) + ); + assert!(outbound.get("raw_record").is_none()); + } + + #[test] + fn governed_live_request_rejects_undeclared_variables_and_formats() { + let loaded = loaded_project("openspp-exact"); + let mut variable = openspp_request(); + variable["variables"] = json!({ "as_of_date": "2026-01-01" }); + assert_rejected_before_outbound_body( + &loaded, + &variable, + "variable is not declared by a selected project service", + ); + + let mut format = openspp_request(); + format["format"] = json!("application/json"); + assert_rejected_before_outbound_body(&loaded, &format, "governed claim-result media type"); + } +} + pub fn check_registry_project(options: &ProjectCheckOptions) -> Result { + let execution_context = ProjectExecutionContext::for_current_executable()?; + check_registry_project_with_context(options, &execution_context) +} + +/// Run the same offline check while also selecting directly authored, +/// non-secret scalars for explicit trusted-local human review. +/// +/// The additional values are not part of the portable command report and this +/// function must only back the human-only `--show-authored-values` CLI path. +pub fn check_registry_project_with_trusted_local_authored_values( + options: &ProjectCheckOptions, +) -> Result { + if !options.explain { + bail!("trusted-local authored values require an explanation"); + } + let execution_context = ProjectExecutionContext::for_current_executable()?; + check_registry_project_internal(options, &execution_context, true) +} + +pub fn check_registry_project_with_context( + options: &ProjectCheckOptions, + execution_context: &ProjectExecutionContext, +) -> Result { + check_registry_project_internal(options, execution_context, false).map(|result| result.report) +} + +fn check_registry_project_internal( + options: &ProjectCheckOptions, + execution_context: &ProjectExecutionContext, + include_trusted_local_authored_values: bool, +) -> Result { validate_baseline_pair(options.against.as_deref(), options.anchor.as_deref())?; let diagnostics = collect_project_authoring_diagnostics( &options.project_directory, @@ -1306,34 +1738,1325 @@ pub fn check_registry_project(options: &ProjectCheckOptions) -> Result Result { + let diagnostics = collect_project_authoring_diagnostics( + &options.project_directory, + options.environment.as_str(), + ); + if !diagnostics.diagnostics.is_empty() { + return Err(anyhow::Error::new(diagnostics)); + } + let loaded = load_registry_project( + &options.project_directory, + Some(options.environment.as_str()), + )?; + let compiled = compile_project(&loaded, None)?; + validate_generated_product_configs(&compiled)?; + let environment = loaded + .environment + .as_ref() + .ok_or_else(|| anyhow!("preflight requires an explicit environment"))?; + let mut input = offline_preflight_input(&loaded, environment, &options.environment)?; + let (requires_relay, requires_notary) = project_product_topology(&loaded.project); + if requires_relay { + input.require_product(PreflightProduct::RegistryRelay); + input.record_product_validator_available(PreflightProduct::RegistryRelay); + } + if requires_notary { + input.require_product(PreflightProduct::RegistryNotary); + input.record_product_validator_available(PreflightProduct::RegistryNotary); + } + Ok(run_offline_preflight(input)) +} + +/// Compare the normalized, environment-bound project state with a verified +/// reviewed baseline. This command deliberately never exposes digest values, +/// authored values, environment names, or filesystem paths in its report. +pub fn promote_registry_project( + options: &ProjectPromotionOptions, +) -> Result { + validate_promotion_baseline_options(options)?; + + let diagnostics = collect_project_authoring_diagnostics( + &options.project_directory, + options.environment.as_str(), + ); + if !diagnostics.diagnostics.is_empty() { + return Err(anyhow::Error::new(diagnostics)); + } + + let loaded = load_registry_project( + &options.project_directory, + Some(options.environment.as_str()), + ) + .map_err(|_| anyhow!("could not load promotion state safely"))?; + preflight_project_rhai_scripts(&loaded) + .map_err(|_| anyhow!("promotion state could not be validated safely"))?; + + // The compiler and product validators establish that the state being + // compared is a valid offline product input. Their detailed errors can + // carry local identifiers or paths, so promotion deliberately returns a + // value-free boundary error instead. + let compiled = compile_project(&loaded, None) + .map_err(|_| anyhow!("promotion state could not be compiled safely"))?; + validate_generated_product_configs(&compiled) + .map_err(|_| anyhow!("promotion compatibility could not be established safely"))?; + + let baselines = match load_verified_promotion_baselines(options, &loaded) { + Ok(baselines) => baselines, + Err(_) if promotion_baseline_supplied(options) => { + return unresolved_promotion_baseline_report(); + } + Err(_) => return Err(anyhow!("could not establish verified promotion baselines")), + }; + + let baseline_values = baselines.iter().cloned().collect::>(); + build_promotion_report_from_normalized_state( + &loaded, + &compiled.approval_state, + &baseline_values, + ) + .map_err(|_| anyhow!("promotion comparison could not be classified safely")) +} + +fn validate_promotion_baseline_options(options: &ProjectPromotionOptions) -> Result<()> { + validate_approved_baseline_set_paths(ApprovedBaselineSetPaths::promotion(options)) +} + +fn promotion_baseline_supplied(options: &ProjectPromotionOptions) -> bool { + options.against.is_some() || options.relay_against.is_some() || options.notary_against.is_some() +} + +fn unresolved_promotion_baseline_report() -> Result { + build_project_promotion_report(ProjectPromotionInput { + reviewed_revision: ReviewedRevisionComparison::NotProven, + changes: Vec::new(), + reviewed_ceiling: ReviewedCeilingInput::Unresolved, + trust: TrustResolutionInput::Unresolved, + compatibility: PromotionCompatibilityInput { + product: PromotionCompatibilityState::Unresolved, + capability: PromotionCompatibilityState::Unresolved, + schema: PromotionCompatibilityState::Unresolved, + abi: PromotionCompatibilityState::Unresolved, + }, }) + .map_err(|_| anyhow!("promotion comparison exceeded its bounded change capacity")) +} + +fn validate_named_baseline_pair( + against_name: &str, + against: Option<&Path>, + anchor_name: &str, + anchor: Option<&Path>, +) -> Result<()> { + if against.is_some() != anchor.is_some() { + bail!("{against_name} and {anchor_name} must be supplied together"); + } + Ok(()) +} + +fn load_verified_promotion_baselines( + options: &ProjectPromotionOptions, + loaded: &LoadedRegistryProject, +) -> Result { + load_verified_approved_baseline_set( + ApprovedBaselineSetPaths::promotion(options), + loaded, + BaselineSetCompleteness::CompleteTopologyWhenPresent, + ) +} + +fn build_promotion_report_from_normalized_state( + loaded: &LoadedRegistryProject, + current_approval_state: &Value, + baselines: &[VerifiedBaseline], +) -> Result { + let current = promotion_projection_from_approval_state(current_approval_state, true)?; + let current_compatibility = + promotion_compatibility(loaded, current_approval_state, ¤t, baselines)?; + + let Some(baseline) = baselines.first() else { + return build_project_promotion_report(ProjectPromotionInput { + reviewed_revision: ReviewedRevisionComparison::NotProven, + changes: Vec::new(), + reviewed_ceiling: ReviewedCeilingInput::WithinReviewedCeiling, + trust: TrustResolutionInput::Unresolved, + compatibility: current_compatibility, + }) + .map_err(|_| anyhow!("promotion comparison exceeded its bounded change capacity")); + }; + + if baselines.iter().any(|baseline| { + baseline + .approval_state + .get("promotion_projection") + .is_none() + }) { + return build_project_promotion_report(ProjectPromotionInput { + reviewed_revision: ReviewedRevisionComparison::NotProven, + changes: Vec::new(), + reviewed_ceiling: ReviewedCeilingInput::Unresolved, + trust: TrustResolutionInput::Unresolved, + compatibility: current_compatibility, + }) + .map_err(|_| anyhow!("promotion comparison exceeded its bounded change capacity")); + } + + let previous = promotion_projection_from_approval_state(&baseline.approval_state, false)?; + if baselines.iter().skip(1).any(|baseline| { + match promotion_projection_from_approval_state(&baseline.approval_state, false) { + Ok(projection) => projection != previous, + Err(_) => true, + } + }) { + return build_project_promotion_report(ProjectPromotionInput { + reviewed_revision: ReviewedRevisionComparison::NotProven, + changes: Vec::new(), + reviewed_ceiling: ReviewedCeilingInput::Unresolved, + trust: TrustResolutionInput::Unresolved, + compatibility: PromotionCompatibilityInput { + schema: PromotionCompatibilityState::Incompatible, + ..current_compatibility + }, + }) + .map_err(|_| anyhow!("promotion comparison exceeded its bounded change capacity")); + } + let current_fields = current.fields_by_kind(); + let previous_fields = previous.fields_by_kind(); + let mut changes = Vec::new(); + let mut reviewed_ceiling = ReviewedCeilingInput::WithinReviewedCeiling; + let mut trust = TrustResolutionInput::Resolved; + + for kind in PromotionChangeKind::ALL { + let current = current_fields + .get(&kind) + .ok_or_else(|| anyhow!("current promotion projection is incomplete"))?; + let previous = previous_fields + .get(&kind) + .ok_or_else(|| anyhow!("baseline promotion projection is incomplete"))?; + if current.digest == previous.digest { + continue; + } + let effect = classify_projected_change_effect(kind, previous, current); + if kind == PromotionChangeKind::IntegrationCeiling { + reviewed_ceiling = match effect { + PromotionChangeEffect::Narrowed => ReviewedCeilingInput::Narrowed, + PromotionChangeEffect::Widened => ReviewedCeilingInput::Widened, + PromotionChangeEffect::ChangedWithinReviewedAuthority => { + ReviewedCeilingInput::WithinReviewedCeiling + } + PromotionChangeEffect::Unresolved => ReviewedCeilingInput::Unresolved, + }; + } + if kind == PromotionChangeKind::Trust && effect == PromotionChangeEffect::Unresolved { + trust = TrustResolutionInput::Unresolved; + } + changes.push(PromotionChangeInput { + kind, + classification: Some(current.classification), + ownership: current.ownership, + effect, + }); + } + + // Raw authored-input digests remain outside comparison evidence, so + // formatting-only edits do not become a reviewed semantic revision. + let reviewed_revision = if changes + .iter() + .any(|change| change.ownership == PromotionFieldOwnership::ReviewedProjectOwned) + { + ReviewedRevisionComparison::DifferentReviewedSemanticRevision + } else { + ReviewedRevisionComparison::SameReviewedSemanticRevision + }; + + build_project_promotion_report(ProjectPromotionInput { + reviewed_revision, + changes, + reviewed_ceiling, + trust, + compatibility: current_compatibility, + }) + .map_err(|_| anyhow!("promotion comparison exceeded its bounded change capacity")) +} + +fn promotion_compatibility( + loaded: &LoadedRegistryProject, + current_approval_state: &Value, + current: &ProjectPromotionProjectionV1, + baselines: &[VerifiedBaseline], +) -> Result { + let closures = current_approval_state + .get("generated_closure_digests") + .and_then(Value::as_object) + .ok_or_else(|| anyhow!("current approval state lacks generated product closures"))?; + let environment = loaded + .environment + .as_ref() + .ok_or_else(|| anyhow!("promotion compatibility requires an environment"))?; + let declared_schemas = project_promotion_authoring_schemas(loaded, environment); + let declared_products = project_promotion_products(environment); + let product = if current.products.is_empty() || current.products != declared_products { + PromotionCompatibilityState::Missing + } else if [ + (PromotionProjectedProduct::Relay, "relay"), + (PromotionProjectedProduct::Notary, "notary"), + ] + .into_iter() + .all(|(product, name)| { + let required = current.products.contains(&product); + closures + .get(name) + .is_some_and(|digest| digest.is_string() == required && (required || digest.is_null())) + }) { + let baseline_products = baselines + .iter() + .map(verified_baseline_product) + .collect::>>()?; + let current_products = current.products.iter().copied().collect::>(); + if baselines.is_empty() || baseline_products == current_products { + PromotionCompatibilityState::Compatible + } else if baseline_products.is_subset(¤t_products) { + PromotionCompatibilityState::Missing + } else { + PromotionCompatibilityState::Incompatible + } + } else { + PromotionCompatibilityState::Missing + }; + let declared_capabilities = project_promotion_capabilities(loaded, environment); + let released_capabilities = loaded + .integrations + .values() + .all(|integration| match &integration.document.capability { + CapabilityDeclaration::Http { .. } | CapabilityDeclaration::Snapshot { .. } => true, + CapabilityDeclaration::Script { script } => { + RELEASED_SCRIPT_RUNTIMES.contains(&match script.runtime { + ScriptRuntime::RhaiV1 => ReleasedScriptRuntime::RhaiV1, + }) + } + }); + let capability = if current.capabilities != declared_capabilities { + PromotionCompatibilityState::Missing + } else if released_capabilities { + PromotionCompatibilityState::Compatible + } else { + PromotionCompatibilityState::Incompatible + }; + let schema = if !baselines.is_empty() { + if baselines.iter().any(|baseline| { + baseline + .approval_state + .get("promotion_projection") + .is_none() + }) { + PromotionCompatibilityState::Missing + } else { + let projections = baselines + .iter() + .map(|baseline| { + promotion_projection_from_approval_state(&baseline.approval_state, false) + }) + .collect::>>()?; + if current.authoring_schemas == declared_schemas + && projections.iter().all(|previous| { + previous.authoring_schemas == current.authoring_schemas + && previous.field_knowledge_revision == current.field_knowledge_revision + }) + { + PromotionCompatibilityState::Compatible + } else { + PromotionCompatibilityState::Incompatible + } + } + } else if current.authoring_schemas == declared_schemas { + PromotionCompatibilityState::Compatible + } else { + PromotionCompatibilityState::Incompatible + }; + let abi = if baselines.is_empty() { + PromotionCompatibilityState::Unresolved + } else if baselines.iter().all(|baseline| { + baseline + .approval_state + .get("compiler_version") + .and_then(Value::as_str) + == Some(env!("CARGO_PKG_VERSION")) + }) { + PromotionCompatibilityState::Compatible + } else { + PromotionCompatibilityState::Incompatible + }; + Ok(PromotionCompatibilityInput { + product, + capability, + schema, + abi, + }) +} + +fn verified_baseline_product(baseline: &VerifiedBaseline) -> Result { + match baseline + .verified_manifest + .get("product") + .and_then(Value::as_str) + { + Some("registry-relay") => Ok(PromotionProjectedProduct::Relay), + Some("registry-notary") => Ok(PromotionProjectedProduct::Notary), + _ => Err(anyhow!( + "verified promotion baseline has an unsupported product" + )), + } +} + +fn promotion_projection_from_approval_state( + approval_state: &Value, + require_current_field_knowledge: bool, +) -> Result { + let projection: ProjectPromotionProjectionV1 = serde_json::from_value( + approval_state + .get("promotion_projection") + .cloned() + .ok_or_else(|| anyhow!("approval state lacks promotion projection"))?, + ) + .context("approval promotion projection is invalid")?; + if require_current_field_knowledge { + validate_project_promotion_projection(&projection, PROMOTION_FIELD_KNOWLEDGE_REVISION) + .map_err(|error| anyhow!(error))?; + } else { + validate_project_promotion_projection_structure(&projection) + .map_err(|error| anyhow!(error))?; + } + Ok(projection) +} + +#[cfg(test)] +mod promotion_adapter_tests { + use super::*; + + fn current_approval_state(loaded: &LoadedRegistryProject) -> Value { + let projection = project_promotion_projection( + loaded, + loaded + .environment + .as_ref() + .expect("promotion fixture has an environment"), + ) + .expect("projection builds"); + let relay = projection + .products + .contains(&PromotionProjectedProduct::Relay) + .then_some("sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"); + let notary = projection + .products + .contains(&PromotionProjectedProduct::Notary) + .then_some("sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"); + json!({ + "schema": APPROVAL_STATE_SCHEMA, + "authored_input_digest": loaded.authored_hash, + "compiler_version": env!("CARGO_PKG_VERSION"), + "generated_closure_digests": { + "relay": relay, + "notary": notary, + }, + "promotion_projection": projection, + }) + } + + fn verified_baselines(approval_state: Value) -> Vec { + vec![ + VerifiedBaseline { + approval_state: approval_state.clone(), + approval_state_digest: + "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd" + .to_string(), + verified_manifest: json!({ "product": "registry-relay" }), + review_digest: + "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc" + .to_string(), + }, + VerifiedBaseline { + approval_state, + approval_state_digest: + "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd" + .to_string(), + verified_manifest: json!({ "product": "registry-notary" }), + review_digest: + "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc" + .to_string(), + }, + ] + } + + #[test] + fn normalized_promotion_comparison_supports_safe_changes_and_blocks_unresolved_ceiling() { + let root = + Path::new(env!("CARGO_MANIFEST_DIR")).join("assets/project-starters/bounded-http"); + let loaded = load_registry_project(&root, Some("local")).expect("starter loads"); + let current = current_approval_state(&loaded); + let serialized_projection = + serde_json::to_string(¤t["promotion_projection"]).expect("projection serializes"); + for forbidden in [ + "fictional-citizen-registry", + "citizen-registry.invalid", + "FICTIONAL_REGISTRY_TOKEN", + "EVIDENCE_CLIENT_TOKEN_HASH", + "public-service-person-verification", + "person-verification", + "person-record", + "evidence-client", + "fictional-registry-relay", + "fictional-registry-notary", + "project-issuer-key", + root.to_str().expect("starter path is UTF-8"), + ] { + assert!(!serialized_projection.contains(forbidden)); + } + let projection = promotion_projection_from_approval_state(¤t, true) + .expect("current projection validates"); + let projected_kinds = projection + .fields + .iter() + .map(|field| field.kind) + .collect::>(); + for kind in [ + PromotionChangeKind::Caller, + PromotionChangeKind::Purpose, + PromotionChangeKind::Origin, + PromotionChangeKind::CredentialBinding, + PromotionChangeKind::Operational, + PromotionChangeKind::ProductEnablement, + PromotionChangeKind::CapabilityEnablement, + ] { + assert!(projected_kinds.contains(&kind), "{kind:?}"); + } + let mut reviewed_state = current.clone(); + reviewed_state["authored_input_digest"] = Value::String("different-raw-input".to_owned()); + let baselines = verified_baselines(reviewed_state); + let ready = build_promotion_report_from_normalized_state(&loaded, ¤t, &baselines) + .expect("matching state compares"); + assert_eq!(ready.disposition, PromotionDisposition::Ready); + + let mut previous = current.clone(); + let origin_index = PromotionChangeKind::ALL + .iter() + .position(|kind| *kind == PromotionChangeKind::Origin) + .expect("origin index"); + previous["promotion_projection"]["fields"][origin_index]["digest"] = Value::String( + "sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc".to_owned(), + ); + let baselines = verified_baselines(previous); + let changed = build_promotion_report_from_normalized_state(&loaded, ¤t, &baselines) + .expect("changed state compares"); + assert_eq!( + changed.disposition, + PromotionDisposition::ReadyAfterRequiredActions + ); + assert_eq!(changed.changes[0].kind, PromotionChangeKind::Origin); + assert_eq!( + changed.changes[0].effect, + PromotionChangeEffect::ChangedWithinReviewedAuthority + ); + + let changed_kinds = [ + PromotionChangeKind::Caller, + PromotionChangeKind::Purpose, + PromotionChangeKind::Origin, + PromotionChangeKind::CredentialBinding, + PromotionChangeKind::Operational, + PromotionChangeKind::ProductEnablement, + PromotionChangeKind::CapabilityEnablement, + ]; + let mut previous = current.clone(); + for (offset, kind) in changed_kinds.iter().enumerate() { + let index = PromotionChangeKind::ALL + .iter() + .position(|candidate| candidate == kind) + .expect("projected kind index"); + let byte = b'1' + u8::try_from(offset).expect("bounded change offset"); + previous["promotion_projection"]["fields"][index]["digest"] = Value::String(format!( + "sha256:{}", + char::from(byte).to_string().repeat(64) + )); + } + let baselines = verified_baselines(previous); + let changed = build_promotion_report_from_normalized_state(&loaded, ¤t, &baselines) + .expect("all classified categories compare"); + assert_eq!( + changed.disposition, + PromotionDisposition::ReadyAfterRequiredActions + ); + assert_eq!( + changed + .changes + .iter() + .map(|change| change.kind) + .collect::>(), + changed_kinds.into_iter().collect() + ); + assert!(changed.changes.iter().all(|change| { + change.effect == PromotionChangeEffect::ChangedWithinReviewedAuthority + })); + + let mut previous = current.clone(); + let ceiling_index = PromotionChangeKind::ALL + .iter() + .position(|kind| *kind == PromotionChangeKind::IntegrationCeiling) + .expect("ceiling index"); + previous["promotion_projection"]["fields"][ceiling_index]["digest"] = Value::String( + "sha256:dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd".to_owned(), + ); + let baselines = verified_baselines(previous); + let blocked = build_promotion_report_from_normalized_state(&loaded, ¤t, &baselines) + .expect("unresolved ceiling compares"); + assert_eq!(blocked.disposition, PromotionDisposition::Blocked); + assert!(blocked + .blocking_reasons + .contains(&PromotionBlockingReason::UnresolvedChange)); + assert!(blocked + .blocking_reasons + .contains(&PromotionBlockingReason::ReviewedCeilingUnresolved)); + let serialized = serde_json::to_string(&changed).expect("changed report serializes"); + assert!(!serialized.contains("citizen-registry.invalid")); + assert!(!serialized.contains(root.to_str().expect("starter path is UTF-8"))); + } + + #[test] + fn new_or_changed_published_field_paths_require_promotion_mapping_review() { + let revision = validate_promotion_field_knowledge_mapping() + .expect("field knowledge mapping is current"); + assert_eq!(revision, PROMOTION_FIELD_KNOWLEDGE_REVISION); + + let index = knowledge::published_field_knowledge_index().expect("knowledge indexes"); + // Both the exact path count and the full knowledge-record digest are + // intentional review pins. Adding or changing a published path without + // updating its closed mapping and reviewed revision fails this test and + // `project_promotion_projection`. + assert_eq!(index.by_path().len(), 645); + let mapped = index + .by_path() + .keys() + .filter_map(promotion_kind_for_field_path) + .collect::>(); + assert_eq!( + mapped, + PromotionChangeKind::ALL + .into_iter() + .collect::>() + ); + assert!(index.by_path().keys().all(|path| { + promotion_kind_for_field_path(path).is_some() + || path.schema == knowledge::SchemaKind::Fixture + })); + } + + #[test] + fn snapshot_environment_entity_enablement_is_bound_into_the_signed_capability_projection() { + let root = Path::new(env!("CARGO_MANIFEST_DIR")) + .join("tests/fixtures/project-authoring/snapshot-exact"); + let loaded = load_registry_project(&root, Some("local")).expect("snapshot project loads"); + let environment = loaded + .environment + .as_ref() + .expect("snapshot project has an environment"); + let projection = + project_promotion_projection(&loaded, environment).expect("projection builds"); + + assert_eq!( + projection.capabilities, + vec![PromotionProjectedCapability::Snapshot] + ); + let capability = projection + .fields_by_kind() + .get(&PromotionChangeKind::CapabilityEnablement) + .copied() + .expect("capability field is projected"); + assert_eq!(capability.authority_members.len(), 1); + let integration = loaded + .integrations + .get("person-snapshot") + .expect("snapshot integration exists"); + assert!(project_promotion_capability_enabled( + "person-snapshot", + &integration.document.capability, + environment, + )); + } + + #[test] + fn promotion_compatibility_is_derived_from_closures_schemas_and_compiler() { + let root = + Path::new(env!("CARGO_MANIFEST_DIR")).join("assets/project-starters/bounded-http"); + let loaded = load_registry_project(&root, Some("local")).expect("starter loads"); + let current = current_approval_state(&loaded); + + let mut missing_product = current.clone(); + missing_product["generated_closure_digests"]["notary"] = Value::Null; + let report = build_promotion_report_from_normalized_state(&loaded, &missing_product, &[]) + .expect("missing product compatibility reports"); + assert!(report + .blocking_reasons + .contains(&PromotionBlockingReason::MissingProduct)); + + let mut previous = current.clone(); + previous["promotion_projection"]["authoring_schemas"]["environment"] = json!(2); + let baselines = verified_baselines(previous); + let report = build_promotion_report_from_normalized_state(&loaded, ¤t, &baselines) + .expect("schema mismatch reports"); + assert!(report + .blocking_reasons + .contains(&PromotionBlockingReason::IncompatibleSchema)); + + let mut previous = current.clone(); + previous["compiler_version"] = json!("0.0.0"); + let baselines = verified_baselines(previous); + let report = build_promotion_report_from_normalized_state(&loaded, ¤t, &baselines) + .expect("compiler mismatch reports"); + assert!(report + .blocking_reasons + .contains(&PromotionBlockingReason::IncompatibleAbi)); + + let mut legacy = current.clone(); + legacy["schema"] = json!(APPROVAL_STATE_SCHEMA_V1); + legacy + .as_object_mut() + .expect("legacy state is an object") + .remove("promotion_projection"); + let baselines = verified_baselines(legacy); + let report = build_promotion_report_from_normalized_state(&loaded, ¤t, &baselines) + .expect("legacy signed baseline fails closed as a report"); + assert!(report + .blocking_reasons + .contains(&PromotionBlockingReason::MissingSchema)); + assert!(report + .blocking_reasons + .contains(&PromotionBlockingReason::ReviewedRevisionNotProven)); + + let baselines = verified_baselines(current.clone()); + let report = + build_promotion_report_from_normalized_state(&loaded, ¤t, &baselines[1..]) + .expect("one product baseline reports missing combined closure"); + assert!(report + .blocking_reasons + .contains(&PromotionBlockingReason::MissingProduct)); + + let mut conflicting = verified_baselines(current.clone()); + let origin_index = PromotionChangeKind::ALL + .iter() + .position(|kind| *kind == PromotionChangeKind::Origin) + .expect("origin index"); + conflicting[1].approval_state["promotion_projection"]["fields"][origin_index]["digest"] = + json!("sha256:eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee"); + let report = build_promotion_report_from_normalized_state(&loaded, ¤t, &conflicting) + .expect("conflicting signed product projections fail closed"); + assert!(report + .blocking_reasons + .contains(&PromotionBlockingReason::IncompatibleSchema)); + assert!(report + .blocking_reasons + .contains(&PromotionBlockingReason::ReviewedRevisionNotProven)); + } + + #[test] + fn promotion_baseline_options_require_complete_non_conflicting_pairs() { + let root = PathBuf::from("/promotion-project"); + let bundle = PathBuf::from("/baseline"); + let anchor = PathBuf::from("/anchor"); + let mut options = ProjectPromotionOptions { + project_directory: root, + environment: "local".to_owned(), + against: None, + anchor: None, + relay_against: Some(bundle.clone()), + relay_anchor: None, + notary_against: None, + notary_anchor: None, + }; + assert!(validate_promotion_baseline_options(&options).is_err()); + + options.relay_anchor = Some(anchor.clone()); + options.against = Some(bundle); + options.anchor = Some(anchor); + assert!(validate_promotion_baseline_options(&options).is_err()); + } +} + +pub fn inspect_project_capabilities( + options: &ProjectCapabilityOptions, +) -> Result { + let loaded = load_registry_project( + &options.project_directory, + Some(options.environment.as_str()), + )?; + let environment = loaded + .environment + .as_ref() + .ok_or_else(|| anyhow!("capability inventory requires an explicit environment"))?; + let mut input = CapabilityInventoryInput::new(); + + for (capability, state, evidence) in capability_inventory::COMPILED_CAPABILITY_RELEASE_FACTS { + input.record_installed_capability(capability, state, evidence)?; + } + + for (component, state, evidence) in [ + ( + SupportComponent::HttpSourceWorker, + SupportState::Available, + SupportEvidence::LinkedCrate, + ), + ( + SupportComponent::RhaiScriptWorker, + SupportState::Available, + SupportEvidence::LinkedCrate, + ), + ( + SupportComponent::SnapshotMaterializationWorker, + SupportState::Available, + SupportEvidence::LinkedCrate, + ), + ( + SupportComponent::RhaiXwProtocolHelper, + SupportState::Available, + SupportEvidence::LinkedCrate, + ), + ( + SupportComponent::RegistryRelayProduct, + SupportState::Available, + SupportEvidence::LinkedCrate, + ), + ( + SupportComponent::RegistryNotaryProduct, + SupportState::Available, + SupportEvidence::LinkedCrate, + ), + ( + SupportComponent::RegistryRelayValidator, + SupportState::Available, + SupportEvidence::LinkedProductValidator, + ), + ( + SupportComponent::RegistryNotaryValidator, + SupportState::Available, + SupportEvidence::LinkedProductValidator, + ), + ( + SupportComponent::ProjectAuthoringSchema, + SupportState::Available, + SupportEvidence::EmbeddedSchema, + ), + ( + SupportComponent::RegistryRelayConfigSchema, + SupportState::Available, + SupportEvidence::EmbeddedSchema, + ), + ( + SupportComponent::RegistryNotaryConfigSchema, + SupportState::Available, + SupportEvidence::EmbeddedSchema, + ), + ( + SupportComponent::RegistryctlDistribution, + SupportState::Available, + SupportEvidence::ReleaseMetadata, + ), + ( + SupportComponent::RegistryRelayImage, + SupportState::NotEvaluated, + SupportEvidence::NoEvidence, + ), + ( + SupportComponent::RegistryNotaryImage, + SupportState::NotEvaluated, + SupportEvidence::NoEvidence, + ), + ] { + input.record_support(component, state, evidence)?; + } + + let mut declarations = BTreeSet::new(); + let mut enabled = BTreeSet::new(); + let mut integration_capabilities = BTreeMap::new(); + for (integration_id, integration) in &loaded.integrations { + let capability = match &integration.document.capability { + CapabilityDeclaration::Http { .. } => CapabilityId::SourceHttp, + CapabilityDeclaration::Script { .. } => CapabilityId::SourceScript, + CapabilityDeclaration::Snapshot { .. } => CapabilityId::SourceSnapshot, + }; + declarations.insert(capability); + integration_capabilities.insert(integration_id.as_str(), capability); + let is_enabled = match &integration.document.capability { + CapabilityDeclaration::Http { .. } | CapabilityDeclaration::Script { .. } => { + environment.integrations.contains_key(integration_id) + } + CapabilityDeclaration::Snapshot { snapshot } => { + environment.entities.contains_key(&snapshot.entity) + } + }; + if is_enabled { + enabled.insert(capability); + } + } + let (requires_relay, requires_notary) = project_product_topology(&loaded.project); + if requires_relay { + declarations.insert(CapabilityId::RegistryRelayProduct); + } + if requires_notary { + declarations.insert(CapabilityId::RegistryNotaryProduct); + } + if environment.deployment.relay.is_some() { + enabled.insert(CapabilityId::RegistryRelayProduct); + } + if environment.deployment.notary.is_some() { + enabled.insert(CapabilityId::RegistryNotaryProduct); + } + for capability in declarations { + input.record_project_declaration(capability)?; + } + for capability in enabled { + input.record_environment_enablement(capability)?; + } + + let mut usage = BTreeMap::::new(); + for service in loaded.project.services.values() { + let mut service_capabilities = BTreeSet::new(); + for consultation in service.consultations.values() { + if let Some(capability) = + integration_capabilities.get(consultation.integration.as_str()) + { + service_capabilities.insert(*capability); + let counts = usage.entry(*capability).or_default(); + counts.consultations = counts.consultations.checked_add(1).ok_or_else(|| { + anyhow!("capability consultation count exceeds the report cap") + })?; + } + } + for capability in service_capabilities { + let counts = usage.entry(capability).or_default(); + counts.services = counts + .services + .checked_add(1) + .ok_or_else(|| anyhow!("capability service count exceeds the report cap"))?; + } + for claim in service.claims.values() { + if inferred_claim_evidence(service, claim)? != ClaimEvidence::RegistryBacked { + continue; + } + let consultation_name = claim_consultation_name(service, claim)?; + let consultation = service + .consultations + .get(consultation_name) + .ok_or_else(|| anyhow!("registry-backed claim consultation is unavailable"))?; + let capability = *integration_capabilities + .get(consultation.integration.as_str()) + .ok_or_else(|| anyhow!("consultation capability is unavailable"))?; + let counts = usage.entry(capability).or_default(); + counts.claims = counts + .claims + .checked_add(1) + .ok_or_else(|| anyhow!("capability claim count exceeds the report cap"))?; + } + let product = match service.kind { + ServiceKind::RecordsApi => CapabilityId::RegistryRelayProduct, + ServiceKind::Evidence => CapabilityId::RegistryNotaryProduct, + }; + let counts = usage.entry(product).or_default(); + counts.services = counts + .services + .checked_add(1) + .ok_or_else(|| anyhow!("product service count exceeds the report cap"))?; + counts.consultations = counts + .consultations + .checked_add(u32::try_from(service.consultations.len())?) + .ok_or_else(|| anyhow!("product consultation count exceeds the report cap"))?; + counts.claims = counts + .claims + .checked_add(u32::try_from(service.claims.len())?) + .ok_or_else(|| anyhow!("product claim count exceeds the report cap"))?; + } + if let Some(script_usage) = usage.get(&CapabilityId::SourceScript).copied() { + usage.insert(CapabilityId::RhaiRuntime, script_usage); + usage.insert(CapabilityId::RhaiAbi, script_usage); + } + for (capability, counts) in usage { + if counts != CapabilityUsageCounts::default() { + input.record_usage(capability, counts)?; + } + } + build_capability_inventory(input).map_err(anyhow::Error::from) +} + +fn offline_preflight_input( + loaded: &LoadedRegistryProject, + environment: &EnvironmentDocument, + environment_name: &str, +) -> Result { + let environment_file = format!("environments/{environment_name}.yaml"); + let root = PreflightFieldAddress::new(PROJECT_FILE, "")?; + let environment_root = PreflightFieldAddress::new(&environment_file, "")?; + let mut input = + OfflinePreflightInput::new(&loaded.project.registry.id, environment_name.to_owned())?; + for capability in [ + PreflightStaticCapability::ProjectModel, + PreflightStaticCapability::EnvironmentCompleteness, + PreflightStaticCapability::OriginRelationships, + PreflightStaticCapability::NonWideningBounds, + ] { + input.record_static_validation(capability, [root.clone(), environment_root.clone()]); + } + + for (integration_id, integration) in &environment.integrations { + let integration = &integration.source; + let prefix = format!( + "/integrations/{}/source", + escape_explanation_pointer_segment(integration_id) + ); + if let Some(credential) = &integration.credential { + for (reference, consumer, field) in [ + ( + credential.username.as_ref(), + PreflightSecretConsumer::SourceBasicUsername, + "username", + ), + ( + credential.password.as_ref(), + PreflightSecretConsumer::SourceBasicPassword, + "password", + ), + ( + credential.token.as_ref(), + PreflightSecretConsumer::SourceBearerToken, + "token", + ), + ( + credential.client_id.as_ref(), + PreflightSecretConsumer::SourceOauthClientId, + "client_id", + ), + ( + credential.client_secret.as_ref(), + PreflightSecretConsumer::SourceOauthClientSecret, + "client_secret", + ), + ( + credential.value.as_ref(), + PreflightSecretConsumer::SourceApiKeyValue, + "value", + ), + ] { + if let Some(reference) = reference { + add_preflight_secret( + &mut input, + &environment_file, + &format!("{prefix}/credential/{field}/secret"), + reference, + consumer, + )?; + } + } + } + add_preflight_transport_files( + &mut input, + &environment_file, + &prefix, + integration.ca.as_ref(), + integration.mtls.as_ref(), + PreflightRuntimeFileKind::SourceCa, + PreflightRuntimeFileKind::SourceMtlsCertificate, + PreflightSecretConsumer::SourceMtlsPrivateKey, + )?; + for (name, endpoint, ca_kind, certificate_kind, private_key_consumer) in [ + ( + "oauth", + integration.oauth.as_ref(), + PreflightRuntimeFileKind::SourceOauthCa, + PreflightRuntimeFileKind::SourceOauthMtlsCertificate, + PreflightSecretConsumer::SourceOauthMtlsPrivateKey, + ), + ( + "jwks", + integration.jwks.as_ref(), + PreflightRuntimeFileKind::SourceJwksCa, + PreflightRuntimeFileKind::SourceJwksMtlsCertificate, + PreflightSecretConsumer::SourceJwksMtlsPrivateKey, + ), + ] { + if let Some(endpoint) = endpoint { + add_preflight_transport_files( + &mut input, + &environment_file, + &format!("{prefix}/{name}"), + endpoint.ca.as_ref(), + endpoint.mtls.as_ref(), + ca_kind, + certificate_kind, + private_key_consumer, + )?; + } + } + } + + for (entity_id, entity) in &environment.entities { + let entity_prefix = format!( + "/entities/{}/provider", + escape_explanation_pointer_segment(entity_id) + ); + match &entity.provider { + RecordProvider::Csv { path, .. } => add_preflight_runtime_file( + &mut input, + &environment_file, + &format!("{entity_prefix}/path"), + path, + PreflightRuntimeFileKind::EntityCsv, + )?, + RecordProvider::Xlsx { path, .. } => add_preflight_runtime_file( + &mut input, + &environment_file, + &format!("{entity_prefix}/path"), + path, + PreflightRuntimeFileKind::EntityXlsx, + )?, + RecordProvider::Parquet { path } => add_preflight_runtime_file( + &mut input, + &environment_file, + &format!("{entity_prefix}/path"), + path, + PreflightRuntimeFileKind::EntityParquet, + )?, + RecordProvider::Postgres { connection, .. } => add_preflight_secret( + &mut input, + &environment_file, + &format!("{entity_prefix}/connection/secret"), + connection, + PreflightSecretConsumer::EntityPostgresConnection, + )?, + } + } + if let Some(issuance) = &environment.issuance { + add_preflight_secret( + &mut input, + &environment_file, + "/issuance/signing_key/secret", + &issuance.signing_key, + PreflightSecretConsumer::IssuanceSigningKey, + )?; + } + for (caller_id, caller) in &environment.callers { + add_preflight_secret( + &mut input, + &environment_file, + &format!( + "/callers/{}/api_key_fingerprint/secret", + escape_explanation_pointer_segment(caller_id) + ), + &caller.api_key_fingerprint, + PreflightSecretConsumer::CallerApiKeyFingerprint, + )?; + } + if let Some(binding) = &environment.notary_relay { + add_preflight_runtime_file( + &mut input, + &environment_file, + "/notary_relay/token_file", + &binding.token_file, + PreflightRuntimeFileKind::NotaryToRelayToken, + )?; + } + if let Some(binding) = &environment.relay_state { + add_preflight_runtime_file( + &mut input, + &environment_file, + "/relay_state/postgresql/root_certificate_path", + &binding.postgresql.root_certificate_path, + PreflightRuntimeFileKind::RelayStateRootCertificate, + )?; + } + if let Some(binding) = &environment.notary_state { + add_preflight_runtime_file( + &mut input, + &environment_file, + "/notary_state/postgresql/root_certificate_path", + &binding.postgresql.root_certificate_path, + PreflightRuntimeFileKind::NotaryStateRootCertificate, + )?; + } + if let Some(oid4vci) = &environment.oid4vci { + for (reference, consumer, pointer) in [ + ( + &oid4vci.client.signing_key, + PreflightSecretConsumer::Oid4vciClientSigningKey, + "/oid4vci/client/signing_key/secret", + ), + ( + &oid4vci.access_token.signing_key, + PreflightSecretConsumer::Oid4vciAccessTokenSigningKey, + "/oid4vci/access_token/signing_key/secret", + ), + ( + &oid4vci.sensitive_state_key, + PreflightSecretConsumer::Oid4vciSensitiveStateKey, + "/oid4vci/sensitive_state_key/secret", + ), + ] { + add_preflight_secret(&mut input, &environment_file, pointer, reference, consumer)?; + } + } + Ok(input) +} + +// Keeping the paired CA and mTLS classifications explicit at each call site +// makes ownership mistakes visible during review. +#[allow(clippy::too_many_arguments)] +fn add_preflight_transport_files( + input: &mut OfflinePreflightInput, + environment_file: &str, + prefix: &str, + ca: Option<&CertificateAuthorityBinding>, + mtls: Option<&MutualTlsBinding>, + ca_kind: PreflightRuntimeFileKind, + certificate_kind: PreflightRuntimeFileKind, + private_key_consumer: PreflightSecretConsumer, +) -> Result<()> { + if let Some(ca) = ca { + add_preflight_runtime_file( + input, + environment_file, + &format!("{prefix}/ca/file"), + &ca.file, + ca_kind, + )?; + } + if let Some(mtls) = mtls { + add_preflight_runtime_file( + input, + environment_file, + &format!("{prefix}/mtls/certificate_file"), + &mtls.certificate_file, + certificate_kind, + )?; + add_preflight_secret( + input, + environment_file, + &format!("{prefix}/mtls/private_key/secret"), + &mtls.private_key, + private_key_consumer, + )?; + } + Ok(()) +} + +fn add_preflight_secret( + input: &mut OfflinePreflightInput, + file: &str, + pointer: &str, + reference: &SecretReference, + consumer: PreflightSecretConsumer, +) -> Result<()> { + input + .add_secret_reference( + &reference.secret, + consumer, + PreflightFieldAddress::new(file, pointer)?, + ) + .map_err(anyhow::Error::from) +} + +fn add_preflight_runtime_file( + input: &mut OfflinePreflightInput, + file: &str, + pointer: &str, + path: &Path, + kind: PreflightRuntimeFileKind, +) -> Result<()> { + input + .add_runtime_file(path, kind, PreflightFieldAddress::new(file, pointer)?) + .map_err(anyhow::Error::from) } pub fn build_registry_project(options: &ProjectBuildOptions) -> Result { - build_registry_project_inner(options, false, None) + let execution_context = ProjectExecutionContext::for_current_executable()?; + build_registry_project_with_context(options, &execution_context) +} + +pub fn build_registry_project_with_baselines( + options: &ProjectBuildOptions, + baselines: &ProjectBuildBaselineSetOptions, +) -> Result { + let execution_context = ProjectExecutionContext::for_current_executable()?; + build_registry_project_with_baselines_and_context(options, baselines, &execution_context) +} + +pub fn build_registry_project_with_context( + options: &ProjectBuildOptions, + execution_context: &ProjectExecutionContext, +) -> Result { + build_registry_project_inner(options, None, false, None, execution_context) +} + +pub fn build_registry_project_with_baselines_and_context( + options: &ProjectBuildOptions, + baselines: &ProjectBuildBaselineSetOptions, + execution_context: &ProjectExecutionContext, +) -> Result { + build_registry_project_inner(options, Some(baselines), false, None, execution_context) } /// Build the closed local tutorial runtime in one atomic publication. @@ -1347,37 +3070,110 @@ pub(crate) fn build_registry_project_for_local_tutorial( options: &ProjectBuildOptions, runtime_identity: Option, ) -> Result { - build_registry_project_inner(options, true, runtime_identity) + let execution_context = ProjectExecutionContext::for_current_executable()?; + build_registry_project_inner(options, None, true, runtime_identity, &execution_context) +} + +/// Compile, statically validate, and publish the local tutorial project without +/// executing its authored fixtures. +/// +/// This reduced-scope seam exists only for unit tests whose process is not a +/// `registryctl` worker executable. It is not a complete project build and must +/// not be used by production commands or end-to-end conformance tests. +#[cfg(test)] +pub(crate) fn build_registry_project_static_validation_only_for_unit_test( + options: &ProjectBuildOptions, + runtime_identity: Option, +) -> Result<()> { + let baseline_paths = ApprovedBaselineSetPaths::build(options, None); + validate_approved_baseline_set_paths(baseline_paths)?; + let loaded = load_registry_project( + &options.project_directory, + Some(options.environment.as_str()), + )?; + preflight_project_rhai_scripts(&loaded)?; + let baselines = load_verified_approved_baseline_set( + baseline_paths, + &loaded, + BaselineSetCompleteness::CompleteTopologyWhenPresent, + ) + .map_err(|_| anyhow!("could not establish verified build baselines"))?; + let mut compiled = compile_project(&loaded, (!baselines.is_empty()).then_some(&baselines))?; + apply_local_tutorial_runtime_overrides(&mut compiled)?; + validate_generated_product_configs(&compiled)?; + let output = loaded + .root + .join(BUILD_ROOT) + .join(options.environment.as_str()); + write_compiled_project( + &loaded.root, + &output, + &compiled, + runtime_identity, + &loaded.project.registry.id, + &options.environment, + &loaded.artifact_inputs, + )?; + Ok(()) } fn build_registry_project_inner( options: &ProjectBuildOptions, + baseline_options: Option<&ProjectBuildBaselineSetOptions>, local_tutorial_runtime: bool, runtime_identity: Option, + execution_context: &ProjectExecutionContext, ) -> Result { - validate_baseline_pair(options.against.as_deref(), options.anchor.as_deref())?; + let baseline_paths = ApprovedBaselineSetPaths::build(options, baseline_options); + validate_approved_baseline_set_paths(baseline_paths)?; let loaded = load_registry_project( &options.project_directory, Some(options.environment.as_str()), )?; preflight_project_rhai_scripts(&loaded)?; - let baseline = load_verified_baseline( - options.against.as_deref(), - options.anchor.as_deref(), + let baselines = load_verified_approved_baseline_set( + baseline_paths, &loaded, - )?; - let mut compiled = compile_project(&loaded, baseline.as_ref())?; + BaselineSetCompleteness::CompleteTopologyWhenPresent, + ) + .map_err(|_| anyhow!("could not establish verified build baselines"))?; + let mut compiled = compile_project(&loaded, (!baselines.is_empty()).then_some(&baselines))?; if local_tutorial_runtime { apply_local_tutorial_runtime_overrides(&mut compiled)?; } validate_generated_product_configs(&compiled)?; - let fixtures = execute_all_fixtures(&loaded, &compiled, None, None, false)?; + let (fixtures, generated_observations, request_observations, call_budget_actual) = + execute_all_fixtures_with_coverage_observations( + &loaded, + &compiled, + None, + None, + false, + execution_context, + )?; require_passing_fixtures(&fixtures)?; + let fixture_coverage = generate_fixture_coverage_report( + &loaded, + &fixtures, + &generated_observations, + &request_observations, + call_budget_actual, + )?; let output = loaded .root .join(BUILD_ROOT) .join(options.environment.as_str()); - write_compiled_project(&loaded.root, &output, &compiled, runtime_identity)?; + let artifact_manifest = write_compiled_project( + &loaded.root, + &output, + &compiled, + runtime_identity, + &loaded.project.registry.id, + &options.environment, + &loaded.artifact_inputs, + )?; + let reported_output = ProjectRelativePath::new(format!("{BUILD_ROOT}/{}", options.environment)) + .map_err(|error| anyhow!("invalid project-relative build output path: {error}"))?; Ok(ProjectCommandReport { schema_version: PROJECT_COMMAND_REPORT_SCHEMA_VERSION, status: "built", @@ -1385,12 +3181,15 @@ fn build_registry_project_inner( environment: loaded.environment_name.clone(), fixtures, semantic_changes: compiled.semantic_changes, - baseline: if baseline.is_some() { + baseline: if !baselines.is_empty() { "verified_signed_bundle" } else { "initial_without_baseline" }, - output: Some(output.display().to_string()), + output: Some(reported_output.as_str().to_string()), + semantic_impact: Some(compiled.semantic_impact), + artifact_manifest: Some(artifact_manifest), + fixture_coverage: Some(fixture_coverage), explanation: None, }) } @@ -1400,10 +3199,9 @@ fn apply_local_tutorial_runtime_overrides(compiled: &mut CompiledProject) -> Res .notary_private .get_mut(Path::new("config/notary.yaml")) .ok_or_else(|| anyhow!("generated local Notary config is absent"))?; - let mut notary_config: serde_norway::Value = serde_norway::from_slice(notary) - .context("generated local Notary config did not parse")?; - notary_config["server"]["bind"] = - serde_norway::Value::String("0.0.0.0:8081".to_string()); + let mut notary_config: serde_norway::Value = + serde_norway::from_slice(notary).context("generated local Notary config did not parse")?; + notary_config["server"]["bind"] = serde_norway::Value::String("0.0.0.0:8081".to_string()); notary_config["state"] = serde_norway::from_str("storage: in_memory\n")?; notary_config["evidence"]["signing_keys"] = serde_norway::from_str(&format!( "relay-workload:\n provider: local_jwk_env\n private_jwk_env: {}\n alg: EdDSA\n kid: {}\n status: active\n", @@ -1421,10 +3219,8 @@ fn apply_local_tutorial_runtime_overrides(compiled: &mut CompiledProject) -> Res .ok_or_else(|| anyhow!("generated local consultation Relay config is absent"))?; let mut relay_config: serde_norway::Value = serde_norway::from_slice(relay) .context("generated local consultation Relay config did not parse")?; - relay_config["server"]["bind"] = - serde_norway::Value::String("0.0.0.0:8082".to_string()); - relay_config["auth"]["oidc"]["allow_dev_insecure_fetch_urls"] = - serde_norway::Value::Bool(true); + relay_config["server"]["bind"] = serde_norway::Value::String("0.0.0.0:8082".to_string()); + relay_config["auth"]["oidc"]["allow_dev_insecure_fetch_urls"] = serde_norway::Value::Bool(true); relay_config["consultation"]["state_plane"]["root_certificate_path"] = serde_norway::Value::String("/run/registry-tls/state-plane-ca.pem".to_string()); *relay = serde_norway::to_string(&relay_config) diff --git a/crates/registryctl/src/project_authoring/compiler/artifacts.rs b/crates/registryctl/src/project_authoring/compiler/artifacts.rs index 185a9329a..61189b11f 100644 --- a/crates/registryctl/src/project_authoring/compiler/artifacts.rs +++ b/crates/registryctl/src/project_authoring/compiler/artifacts.rs @@ -2,7 +2,7 @@ fn compile_project( loaded: &LoadedRegistryProject, - baseline: Option<&VerifiedBaseline>, + baselines: Option<&VerifiedBaselineSet>, ) -> Result { let environment = loaded .environment @@ -12,15 +12,16 @@ fn compile_project( .environment_name .as_deref() .ok_or_else(|| anyhow!("project build requires an explicit environment"))?; - compile_project_for_environment(loaded, environment_name, environment, baseline) + compile_project_for_environment(loaded, environment_name, environment, baselines) } fn compile_project_for_environment( loaded: &LoadedRegistryProject, environment_name: &str, environment: &EnvironmentDocument, - baseline: Option<&VerifiedBaseline>, + baselines: Option<&VerifiedBaselineSet>, ) -> Result { + let baseline = baselines.and_then(VerifiedBaselineSet::common); validate_entity_generation_changes(loaded, environment, baseline)?; let mut reviewable = BTreeMap::new(); let mut relay_private = BTreeMap::new(); @@ -209,11 +210,10 @@ fn compile_project_for_environment( &serde_json::to_value(&disclosure_profiles) .context("failed to serialize disclosure review profiles")?, )?; - let semantic_changes = semantic_change_records( - loaded, - baseline.map(|baseline| &baseline.approval_state), - &disclosure_digest, - ); + let baseline_state = baseline.map(|baseline| &baseline.approval_state); + let semantic_changes = semantic_change_records(loaded, baseline_state, &disclosure_digest); + let semantic_impact = + project_semantic_impact_report(loaded, baseline_state, &disclosure_digest); let entity_materializations = generated_entity_materialization_review(loaded, environment)?; let review = json!({ "schema": REVIEW_SCHEMA, @@ -242,17 +242,19 @@ fn compile_project_for_environment( "authored_input_digest": loaded.authored_hash, "semantic_digests": loaded.semantic_digests, "disclosure_digest": disclosure_digest, + "promotion_projection": project_promotion_projection(loaded, environment)?, "generated_closure_digests": closure_digests, - "baseline": baseline.map(|baseline| json!({ - "verified_manifest": baseline.verified_manifest, + "baseline": baselines.filter(|baselines| !baselines.is_empty()).map(|baselines| json!({ + "verified_manifests": baselines.predecessor_manifest_identities(), })), "entity_materializations": entity_materializations, }); - let explanation = generated_explanation(loaded, environment_name, &profiles); + let explanation = generated_explanation(loaded, environment_name)?; let fixture_profiles = profiles .iter() .map(|profile| FixtureProfile { service_id: profile.service_id.clone(), + consultation_id: profile.consultation_name.clone(), integration_alias: profile.integration_alias.clone(), id: profile.id.clone(), version: profile.version.clone(), @@ -271,6 +273,7 @@ fn compile_project_for_environment( explanation, fixture_profiles, semantic_changes, + semantic_impact, }) } @@ -690,7 +693,8 @@ fn generated_script_pack_semantics( "response_verifier": "dci_jws_v1", }) }); - let operation_timeout_ms = parse_duration_ms(&integration.document.bounds.deadline)?.min(10_000); + let operation_timeout_ms = + parse_duration_ms(&integration.document.bounds.deadline)?.min(10_000); let verification_operations = script.signed_dci.as_ref().map_or_else(Vec::new, |_| { vec![json!({ "id": "jwks", @@ -762,7 +766,14 @@ fn generated_script_pack_semantics( "quota_per_minute": 60, "quota_burst": integration.document.bounds.concurrency.min(60), }); - Ok((acquisition, reviewed, Value::Object(output), plan, limits, None)) + Ok(( + acquisition, + reviewed, + Value::Object(output), + plan, + limits, + None, + )) } fn generated_http_pack_semantics( @@ -1375,7 +1386,8 @@ fn generated_http_operation( .outputs .iter() .filter_map(|(name, output)| { - output.from + output + .from .as_deref() .and_then(|source| source.split_once('.')) .is_some_and(|(source, _)| source == operation_id) @@ -1388,7 +1400,8 @@ fn generated_http_operation( operation_outputs .iter() .filter_map(|(_, output)| { - output.source_pointer + output + .source_pointer .as_deref() .and_then(|pointer| pointer_segments(pointer).ok()) .and_then(|segments| segments.into_iter().next()) @@ -1405,7 +1418,8 @@ fn generated_http_operation( operation_outputs .iter() .filter_map(|(name, output)| { - output.source_pointer + output + .source_pointer .as_ref() .map(|pointer| ((*name).clone(), Value::String(pointer.clone()))) }) diff --git a/crates/registryctl/src/project_authoring/compiler/explanation.rs b/crates/registryctl/src/project_authoring/compiler/explanation.rs new file mode 100644 index 000000000..613000f8d --- /dev/null +++ b/crates/registryctl/src/project_authoring/compiler/explanation.rs @@ -0,0 +1,2209 @@ +// SPDX-License-Identifier: Apache-2.0 + +// Classifier-safe project explanation generation. +// +// The producer deliberately starts from the authored documents and the +// published field-knowledge index. Product configs, generated hashes, secret +// locators, and lowered request construction never cross this boundary. + +struct ExplanationSchemaSet { + documents: BTreeMap, + index: knowledge::FieldKnowledgeIndex, +} + +#[derive(Clone)] +enum ExplanationAddressScope { + Project, + Integration(String), + Entity(String), + Environment(String), + Fixture { + integration: String, + fixture: String, + }, +} + +impl ExplanationAddressScope { + fn address(&self, path: &str) -> Result { + let path = JsonPointer::new(path.to_owned()) + .map_err(|error| anyhow!("explanation field address is invalid: {error}"))?; + Ok(match self { + Self::Project => ProjectFieldAddress::Project { path }, + Self::Integration(integration) => ProjectFieldAddress::Integration { + integration: integration.clone(), + path, + }, + Self::Entity(entity) => ProjectFieldAddress::Entity { + entity: entity.clone(), + path, + }, + Self::Environment(environment) => ProjectFieldAddress::Environment { + environment: environment.clone(), + path, + }, + Self::Fixture { + integration, + fixture, + } => ProjectFieldAddress::Fixture { + integration: integration.clone(), + fixture: fixture.clone(), + path, + }, + }) + } + + fn sort_key(&self, path: &str) -> String { + match self { + Self::Project => format!("0\0{path}"), + Self::Integration(integration) => format!("1\0{integration}\0{path}"), + Self::Entity(entity) => format!("2\0{entity}\0{path}"), + Self::Environment(environment) => format!("3\0{environment}\0{path}"), + Self::Fixture { + integration, + fixture, + } => format!("4\0{integration}\0{fixture}\0{path}"), + } + } +} + +#[derive(Clone, Copy)] +enum ExplanationSource { + Authored, + Defaulted, + Derived { semantic_rule_id: &'static str }, + EnvironmentBound, +} + +impl ExplanationSource { + const fn kind(self) -> FieldSourceKind { + match self { + Self::Authored => FieldSourceKind::Authored, + Self::Defaulted => FieldSourceKind::Defaulted, + Self::Derived { .. } => FieldSourceKind::Derived, + Self::EnvironmentBound => FieldSourceKind::EnvironmentBound, + } + } + + const fn presence(self) -> FieldPresence { + match self { + Self::Authored => FieldPresence::Authored, + Self::Defaulted => FieldPresence::Defaulted, + Self::Derived { .. } => FieldPresence::Derived, + Self::EnvironmentBound => FieldPresence::EnvironmentBound, + } + } + + const fn semantic_rule_id(self) -> Option<&'static str> { + match self { + Self::Derived { semantic_rule_id } => Some(semantic_rule_id), + Self::Authored | Self::Defaulted | Self::EnvironmentBound => None, + } + } +} + +#[derive(Clone, Debug)] +enum ExplanationScalar { + Boolean(bool), + Signed(i64), + Unsigned(u64), + Float(f64), + Text(String), +} + +impl ExplanationScalar { + fn from_json(value: &Value) -> Option { + match value { + Value::Bool(value) => Some(Self::Boolean(*value)), + Value::Number(value) => value + .as_i64() + .map(Self::Signed) + .or_else(|| value.as_u64().map(Self::Unsigned)) + .or_else(|| value.as_f64().map(Self::Float)), + Value::String(value) => Some(Self::Text(value.clone())), + Value::Null | Value::Array(_) | Value::Object(_) => None, + } + } + + fn into_classifier_json(self) -> Value { + match self { + Self::Boolean(value) => Value::Bool(value), + Self::Signed(value) => Value::Number(value.into()), + Self::Unsigned(value) => Value::Number(value.into()), + Self::Float(value) => serde_json::Number::from_f64(value) + .map(Value::Number) + .unwrap_or(Value::Null), + Self::Text(value) => Value::String(value), + } + } +} + +/// The only non-public values allowed to cross the classifier boundary. +/// +/// Call sites must identify the semantic class instead of passing arbitrary +/// JSON. Free-form request data, source values, and operational metadata have +/// no variant here. +#[derive(Clone, Copy, Debug, Eq, PartialEq)] +enum ApprovedSemanticValue { + Capability, + Count, + DeclarationClass, + DisclosureClass, + HumanIntent, + Limit, + Policy, + ProductTopology, +} + +struct PendingExplanationField { + scope: ExplanationAddressScope, + data_path: String, + schema_kind: knowledge::SchemaKind, + schema_path: String, + source: ExplanationSource, + value: Option, + approval: Option, + default: Option<(FieldDefaultSource, bool, ExplanationScalar)>, +} + +struct ExplanationBuilder<'a> { + schemas: &'a ExplanationSchemaSet, + fields: BTreeMap, +} + +impl<'a> ExplanationBuilder<'a> { + fn new(schemas: &'a ExplanationSchemaSet) -> Self { + Self { + schemas, + fields: BTreeMap::new(), + } + } + + fn add(&mut self, pending: PendingExplanationField) -> Result<()> { + let field_path = knowledge::FieldPath { + schema: pending.schema_kind, + pointer: pending.schema_path.clone(), + }; + let field_knowledge = self + .schemas + .index + .by_path() + .get(&field_path) + .ok_or_else(|| anyhow!("published field knowledge is absent for {field_path}"))?; + let address = pending.scope.address(&pending.data_path)?; + let source_address = matches!( + pending.source, + ExplanationSource::Authored | ExplanationSource::EnvironmentBound + ) + .then(|| address.clone()); + let reported_value = + classifier_safe_value(field_knowledge, pending.value, pending.approval); + let default = pending.default.map(|(source, applied, value)| { + let reported_value = + classifier_safe_value(field_knowledge, Some(value), pending.approval); + ProjectFieldDefault { + source, + applied, + reported_value: Some(reported_value), + } + }); + let semantic_rule_ids = field_knowledge + .semantic_rules + .iter() + .map(|rule| knowledge_semantic_rule_id(*rule).to_owned()) + .collect(); + let explanation = ProjectFieldExplanation { + address, + source: ProjectFieldSource { + kind: pending.source.kind(), + address: source_address, + semantic_rule_id: pending.source.semantic_rule_id().map(str::to_owned), + }, + state: ProjectFieldState { + presence: pending.source.presence(), + effect: FieldEffect::Effective, + }, + default, + constraints: ProjectFieldConstraints { + schema_refs: vec![ProjectSchemaRef { + schema: report_schema_kind(pending.schema_kind), + path: JsonPointer::new(pending.schema_path.clone()).map_err(|error| { + anyhow!("explanation schema reference is invalid: {error}") + })?, + }], + semantic_rule_ids, + }, + knowledge: report_field_knowledge(field_knowledge), + reported_value, + }; + self.fields + .insert(pending.scope.sort_key(&pending.data_path), explanation); + Ok(()) + } + + fn add_authored_document( + &mut self, + schema_kind: knowledge::SchemaKind, + scope: ExplanationAddressScope, + document: &Value, + source: ExplanationSource, + ) -> Result<()> { + let schema = self + .schemas + .documents + .get(&schema_kind) + .ok_or_else(|| anyhow!("published {schema_kind} schema is absent"))?; + let mut pending = Vec::new(); + walk_authored_explanation( + schema, + schema, + "", + document, + "", + schema_kind, + &scope, + source, + &mut pending, + )?; + for field in pending { + self.add(field)?; + } + Ok(()) + } + + fn finish(self) -> Vec { + self.fields.into_values().collect() + } +} + +fn explanation_schema_set() -> Result { + let mut documents = BTreeMap::new(); + for (kind, source) in [ + ( + knowledge::SchemaKind::Project, + include_str!("../../../schemas/project-authoring/project.schema.json"), + ), + ( + knowledge::SchemaKind::Environment, + include_str!("../../../schemas/project-authoring/environment.schema.json"), + ), + ( + knowledge::SchemaKind::Integration, + include_str!("../../../schemas/project-authoring/integration.schema.json"), + ), + ( + knowledge::SchemaKind::Fixture, + include_str!("../../../schemas/project-authoring/fixture.schema.json"), + ), + ( + knowledge::SchemaKind::Entity, + include_str!("../../../schemas/project-authoring/entity.schema.json"), + ), + ] { + let schema = + serde_json::from_str(source).with_context(|| format!("published {kind} schema"))?; + documents.insert(kind, schema); + } + let index = knowledge::published_field_knowledge_index() + .context("published field knowledge is inconsistent")?; + Ok(ExplanationSchemaSet { documents, index }) +} + +fn authored_explanation_document(loaded: &LoadedRegistryProject, path: &Path) -> Result { + let bytes = read_authored_file(&loaded.root, path)?; + let relative = path + .strip_prefix(&loaded.root) + .map_err(|_| anyhow!("authored explanation input escapes the project root"))?; + let relative = relative + .to_str() + .ok_or_else(|| anyhow!("authored explanation input path is not Unicode"))?; + let relative = ProjectRelativePath::new(relative.to_owned()) + .map_err(|error| anyhow!("authored explanation input path is invalid: {error}"))?; + let expected = loaded + .artifact_inputs + .iter() + .find(|input| input.path == relative) + .ok_or_else(|| anyhow!("authored explanation input is absent from the loaded project"))?; + let actual = sha256_uri(&bytes); + if expected.digest.as_str() != actual { + bail!("authored explanation input changed after the project was loaded"); + } + serde_norway::from_slice(&bytes).context("authored explanation input did not parse") +} + +fn generated_explanation( + loaded: &LoadedRegistryProject, + environment_name: &str, +) -> Result { + let schemas = explanation_schema_set()?; + let mut builder = ExplanationBuilder::new(&schemas); + + let project_document = authored_explanation_document(loaded, &loaded.root.join(PROJECT_FILE))?; + builder.add_authored_document( + knowledge::SchemaKind::Project, + ExplanationAddressScope::Project, + &project_document, + ExplanationSource::Authored, + )?; + + for (entity_id, reference) in &loaded.project.entities { + let path = resolve_authored_path(&loaded.root, &reference.file)?; + let document = authored_explanation_document(loaded, &path)?; + builder.add_authored_document( + knowledge::SchemaKind::Entity, + ExplanationAddressScope::Entity(entity_id.clone()), + &document, + ExplanationSource::Authored, + )?; + } + + for (integration_id, reference) in &loaded.project.integrations { + let path = resolve_authored_path(&loaded.root, &reference.file)?; + let document = authored_explanation_document(loaded, &path)?; + builder.add_authored_document( + knowledge::SchemaKind::Integration, + ExplanationAddressScope::Integration(integration_id.clone()), + &document, + ExplanationSource::Authored, + )?; + add_effective_integration_fields( + &mut builder, + integration_id, + &loaded.integrations[integration_id].document, + &document, + )?; + for (fixture_path, fixture) in &loaded.integrations[integration_id].fixtures { + let document = authored_explanation_document(loaded, fixture_path)?; + builder.add_authored_document( + knowledge::SchemaKind::Fixture, + ExplanationAddressScope::Fixture { + integration: integration_id.clone(), + fixture: fixture.name.clone(), + }, + &document, + ExplanationSource::Authored, + )?; + } + } + + add_project_topology_fields(&mut builder, loaded)?; + if let (Some(loaded_environment_name), Some(environment)) = ( + loaded.environment_name.as_deref(), + loaded.environment.as_ref(), + ) { + if loaded_environment_name == environment_name { + let environment_path = resolve_authored_path( + &loaded.root, + &PathBuf::from("environments").join(format!("{environment_name}.yaml")), + )?; + let environment_document = authored_explanation_document(loaded, &environment_path)?; + builder.add_authored_document( + knowledge::SchemaKind::Environment, + ExplanationAddressScope::Environment(environment_name.to_owned()), + &environment_document, + ExplanationSource::EnvironmentBound, + )?; + add_environment_effective_fields( + &mut builder, + environment_name, + environment, + &environment_document, + )?; + } + } + + Ok(ProjectExplanationReportV1 { + schema_version: ProjectExplanationSchemaVersion::V1, + project: loaded.project.registry.id.clone(), + environment: environment_name.to_owned(), + fields: builder.finish(), + }) +} + +/// Select directly authored, non-secret scalars for an explicit trusted-local +/// terminal review. +/// +/// The classifier-safe explanation remains the authority for each field's +/// source and sensitivity. This function only joins approved addresses back to +/// digest-checked authored documents. It intentionally excludes fixtures, +/// defaults, derived values, and every secret-bearing classification. +fn trusted_local_authored_values( + loaded: &LoadedRegistryProject, + explanation: &ProjectExplanationReportV1, +) -> Result> { + let project_document = authored_explanation_document(loaded, &loaded.root.join(PROJECT_FILE))?; + let mut integration_documents = BTreeMap::new(); + for (integration_id, reference) in &loaded.project.integrations { + let path = resolve_authored_path(&loaded.root, &reference.file)?; + integration_documents.insert( + integration_id.as_str(), + authored_explanation_document(loaded, &path)?, + ); + } + let mut entity_documents = BTreeMap::new(); + for (entity_id, reference) in &loaded.project.entities { + let path = resolve_authored_path(&loaded.root, &reference.file)?; + entity_documents.insert( + entity_id.as_str(), + authored_explanation_document(loaded, &path)?, + ); + } + let environment_document = if let Some(environment_name) = loaded.environment_name.as_deref() { + let path = resolve_authored_path( + &loaded.root, + &PathBuf::from("environments").join(format!("{environment_name}.yaml")), + )?; + Some(( + environment_name, + authored_explanation_document(loaded, &path)?, + )) + } else { + None + }; + + let mut values = Vec::new(); + for field in &explanation.fields { + if !matches!( + field.source.kind, + FieldSourceKind::Authored | FieldSourceKind::EnvironmentBound + ) || field.source.address.as_ref() != Some(&field.address) + || !matches!( + field.state.presence, + FieldPresence::Authored | FieldPresence::EnvironmentBound + ) + || !matches!( + field.knowledge.sensitivity, + FieldSensitivity::Public + | FieldSensitivity::Internal + | FieldSensitivity::Structural + | FieldSensitivity::Sensitive + ) + { + continue; + } + if trusted_local_value_path_is_prohibited(&field.address) { + continue; + } + let (document, path) = match &field.address { + ProjectFieldAddress::Project { path } => (&project_document, path), + ProjectFieldAddress::Integration { integration, path } => { + let Some(document) = integration_documents.get(integration.as_str()) else { + continue; + }; + (document, path) + } + ProjectFieldAddress::Entity { entity, path } => { + let Some(document) = entity_documents.get(entity.as_str()) else { + continue; + }; + (document, path) + } + ProjectFieldAddress::Environment { environment, path } => { + let Some((loaded_environment, document)) = environment_document.as_ref() else { + continue; + }; + if environment != loaded_environment { + continue; + } + (document, path) + } + // Fixture documents may contain planted private inputs or source + // responses. The trusted-local switch never weakens that boundary. + ProjectFieldAddress::Fixture { .. } => continue, + }; + let Some(value) = document.pointer(path.as_str()) else { + continue; + }; + if !matches!(value, Value::Bool(_) | Value::Number(_) | Value::String(_)) { + continue; + } + values.push(ProjectTrustedLocalAuthoredValue { + address: field.address.clone(), + source: field.source.kind, + sensitivity: field.knowledge.sensitivity, + value: value.clone(), + }); + } + Ok(values) +} + +#[cfg(test)] +pub(crate) fn generated_explanation_for_test( + root: &Path, + environment_name: &str, +) -> Result { + let loaded = load_registry_project(root, Some(environment_name))?; + generated_explanation(&loaded, environment_name) +} + +fn add_project_topology_fields( + builder: &mut ExplanationBuilder<'_>, + loaded: &LoadedRegistryProject, +) -> Result<()> { + let scope = ExplanationAddressScope::Project; + let (requires_relay, requires_notary) = project_product_topology(&loaded.project); + let topology = match (requires_relay, requires_notary) { + (true, false) => "relay_only", + (false, true) => "notary_only", + (true, true) => "combined", + (false, false) => "none", + }; + add_derived_scalar( + builder, + &scope, + "/topology/deployment", + knowledge::SchemaKind::Project, + "/properties/services", + ExplanationScalar::Text(topology.to_owned()), + ApprovedSemanticValue::ProductTopology, + "compiler.product_topology", + )?; + for (path, schema_path, count) in [ + ( + "/topology/source_integration_count", + "/properties/integrations", + loaded.integrations.len(), + ), + ( + "/topology/materialized_entity_count", + "/properties/entities", + loaded.entities.len(), + ), + ( + "/topology/service_count", + "/properties/services", + loaded.project.services.len(), + ), + ( + "/topology/records_api_service_count", + "/properties/services", + loaded + .project + .services + .values() + .filter(|service| service.kind == ServiceKind::RecordsApi) + .count(), + ), + ( + "/topology/evidence_service_count", + "/properties/services", + loaded + .project + .services + .values() + .filter(|service| service.kind == ServiceKind::Evidence) + .count(), + ), + ] { + add_derived_scalar( + builder, + &scope, + path, + knowledge::SchemaKind::Project, + schema_path, + ExplanationScalar::Unsigned(count as u64), + ApprovedSemanticValue::Count, + "compiler.topology_count", + )?; + } + for (service_id, service) in &loaded.project.services { + for (name, count) in [ + ("consultation_count", service.consultations.len()), + ("claim_count", service.claims.len()), + ( + "credential_profile_count", + service.credential_profiles.len(), + ), + ] { + add_derived_scalar( + builder, + &scope, + &format!( + "/services/{}/{name}", + escape_explanation_pointer_segment(service_id) + ), + knowledge::SchemaKind::Project, + "/properties/services", + ExplanationScalar::Unsigned(count as u64), + ApprovedSemanticValue::Count, + "compiler.service_contract_count", + )?; + } + for (claim_id, claim) in &service.claims { + // This is the compiler's authored dependency classification. It + // does not assert live Relay activation or interoperability. + let evidence = match inferred_claim_evidence(service, claim)? { + ClaimEvidence::RegistryBacked => "registry_backed", + ClaimEvidence::SelfAttested => "self_attested", + }; + add_derived_scalar( + builder, + &scope, + &format!( + "/services/{}/claims/{}/evidence", + escape_explanation_pointer_segment(service_id), + escape_explanation_pointer_segment(claim_id) + ), + knowledge::SchemaKind::Project, + "/$defs/evidenceService/properties/claims", + ExplanationScalar::Text(evidence.to_owned()), + ApprovedSemanticValue::DeclarationClass, + "compiler.claim_evidence_dependency", + )?; + } + } + Ok(()) +} + +fn add_effective_integration_fields( + builder: &mut ExplanationBuilder<'_>, + integration_id: &str, + integration: &IntegrationDocument, + authored: &Value, +) -> Result<()> { + let scope = ExplanationAddressScope::Integration(integration_id.to_owned()); + let effective_limit = |builder: &mut ExplanationBuilder<'_>, + path: &str, + schema_path: &str, + value: ExplanationScalar, + authored: bool, + default: ExplanationScalar| + -> Result<()> { + builder.add(PendingExplanationField { + scope: scope.clone(), + data_path: path.to_owned(), + schema_kind: knowledge::SchemaKind::Integration, + schema_path: schema_path.to_owned(), + source: if authored { + ExplanationSource::Authored + } else { + ExplanationSource::Defaulted + }, + value: Some(value), + approval: Some(ApprovedSemanticValue::Limit), + default: Some((FieldDefaultSource::Compiler, !authored, default)), + }) + }; + effective_limit( + builder, + "/limits/request_bytes", + "/$defs/limits/properties/request_bytes", + ExplanationScalar::Unsigned(u64::from(integration.bounds.request_bytes)), + integration.bounds.request_bytes_authored, + ExplanationScalar::Unsigned(DEFAULT_REQUEST_BYTES), + )?; + effective_limit( + builder, + "/limits/source_bytes", + "/$defs/limits/properties/source_bytes", + ExplanationScalar::Unsigned(integration.bounds.source_bytes), + integration.bounds.source_bytes_authored, + ExplanationScalar::Unsigned(DEFAULT_SOURCE_BYTES), + )?; + effective_limit( + builder, + "/limits/deadline", + "/$defs/limits/properties/deadline", + ExplanationScalar::Text(integration.bounds.deadline.clone()), + integration.bounds.deadline_authored, + ExplanationScalar::Text(DEFAULT_DEADLINE.to_owned()), + )?; + + match &integration.capability { + CapabilityDeclaration::Http { http } => { + add_derived_scalar( + builder, + &scope, + "/capability/type", + knowledge::SchemaKind::Integration, + "/$defs/capability/oneOf/0/properties/http", + ExplanationScalar::Text("http".to_owned()), + ApprovedSemanticValue::Capability, + "compiler.capability_class", + )?; + add_derived_scalar( + builder, + &scope, + "/capability/http/operation_count", + knowledge::SchemaKind::Integration, + "/$defs/capability/oneOf/0/properties/http", + ExplanationScalar::Unsigned(http.operations.len() as u64), + ApprovedSemanticValue::Count, + "compiler.lowered_operation_count", + )?; + for (index, operation) in http.operations.values().enumerate() { + add_derived_scalar( + builder, + &scope, + &format!("/capability/http/operations/{index}/role"), + knowledge::SchemaKind::Integration, + "/$defs/capability/oneOf/0/properties/http", + ExplanationScalar::Text( + match operation.role { + OperationRole::Data => "data", + OperationRole::Credential => "credential", + OperationRole::Verification => "verification", + } + .to_owned(), + ), + ApprovedSemanticValue::DeclarationClass, + "compiler.lowered_operation_role", + )?; + } + builder.add(PendingExplanationField { + scope: scope.clone(), + data_path: "/limits/calls".to_owned(), + schema_kind: knowledge::SchemaKind::Integration, + schema_path: "/$defs/limits/properties/calls".to_owned(), + source: if integration.bounds.calls_authored { + ExplanationSource::Authored + } else { + ExplanationSource::Derived { + semantic_rule_id: "compiler.http_single_call", + } + }, + value: Some(ExplanationScalar::Unsigned(1)), + approval: Some(ApprovedSemanticValue::Limit), + default: Some(( + FieldDefaultSource::SemanticRule, + !integration.bounds.calls_authored, + ExplanationScalar::Unsigned(1), + )), + })?; + let response_max_bytes = http + .operations + .values() + .find(|operation| operation.role == OperationRole::Data) + .map_or(DEFAULT_SOURCE_RESPONSE_BYTES, |operation| { + u64::from(operation.response.max_bytes) + }); + effective_limit( + builder, + "/source/response/max_bytes", + "/$defs/source/properties/response/properties/max_bytes", + ExplanationScalar::Unsigned(response_max_bytes), + http.response_max_bytes_authored, + ExplanationScalar::Unsigned(DEFAULT_SOURCE_RESPONSE_BYTES), + )?; + add_effective_response_format( + builder, + &scope, + "json", + authored.pointer("/source/response/format").is_some(), + )?; + } + CapabilityDeclaration::Script { script } => { + add_derived_scalar( + builder, + &scope, + "/capability/type", + knowledge::SchemaKind::Integration, + "/$defs/capability/oneOf/1/properties/script", + ExplanationScalar::Text("script".to_owned()), + ApprovedSemanticValue::Capability, + "compiler.capability_class", + )?; + effective_limit( + builder, + "/limits/calls", + "/$defs/limits/properties/calls", + ExplanationScalar::Unsigned(u64::from(integration.bounds.calls)), + integration.bounds.calls_authored, + ExplanationScalar::Unsigned(u64::from(DEFAULT_SCRIPT_CALLS)), + )?; + effective_limit( + builder, + "/source/response/max_bytes", + "/$defs/source/properties/response/properties/max_bytes", + ExplanationScalar::Unsigned(u64::from(script.response.max_bytes)), + script.response.max_bytes_authored, + ExplanationScalar::Unsigned(DEFAULT_SOURCE_RESPONSE_BYTES), + )?; + add_effective_response_format( + builder, + &scope, + match script.response.format { + AuthoredResponseFormat::Json => "json", + AuthoredResponseFormat::Text => "text", + }, + authored.pointer("/source/response/format").is_some(), + )?; + } + CapabilityDeclaration::Snapshot { .. } => { + add_derived_scalar( + builder, + &scope, + "/capability/type", + knowledge::SchemaKind::Integration, + "/$defs/capability/oneOf/2/properties/snapshot", + ExplanationScalar::Text("snapshot".to_owned()), + ApprovedSemanticValue::Capability, + "compiler.capability_class", + )?; + } + } + Ok(()) +} + +fn add_effective_response_format( + builder: &mut ExplanationBuilder<'_>, + scope: &ExplanationAddressScope, + format: &str, + authored: bool, +) -> Result<()> { + builder.add(PendingExplanationField { + scope: scope.clone(), + data_path: "/source/response/format".to_owned(), + schema_kind: knowledge::SchemaKind::Integration, + schema_path: "/$defs/source/properties/response/properties/format".to_owned(), + source: if authored { + ExplanationSource::Authored + } else { + ExplanationSource::Defaulted + }, + value: Some(ExplanationScalar::Text(format.to_owned())), + approval: Some(ApprovedSemanticValue::DeclarationClass), + default: Some(( + FieldDefaultSource::Compiler, + !authored, + ExplanationScalar::Text("json".to_owned()), + )), + }) +} + +fn add_environment_effective_fields( + builder: &mut ExplanationBuilder<'_>, + environment_name: &str, + environment: &EnvironmentDocument, + authored: &Value, +) -> Result<()> { + let scope = ExplanationAddressScope::Environment(environment_name.to_owned()); + for (path, present) in [ + ( + "/topology/relay_bound", + environment.deployment.relay.is_some(), + ), + ( + "/topology/notary_bound", + environment.deployment.notary.is_some(), + ), + ] { + add_derived_scalar( + builder, + &scope, + path, + knowledge::SchemaKind::Environment, + "/properties/deployment", + ExplanationScalar::Boolean(present), + ApprovedSemanticValue::ProductTopology, + "compiler.environment_product_binding", + )?; + } + for (integration_id, integration) in &environment.integrations { + add_derived_scalar( + builder, + &scope, + &format!( + "/integrations/{}/source/credential_class", + escape_explanation_pointer_segment(integration_id) + ), + knowledge::SchemaKind::Environment, + "/$defs/source/properties/credential", + ExplanationScalar::Text( + match &integration.source.credential { + Some(credential) if credential.username.is_some() => "basic", + Some(credential) if credential.token.is_some() => "static_bearer", + Some(credential) if credential.client_id.is_some() => { + "oauth2_client_credentials" + } + Some(credential) if credential.value.is_some() => "api_key", + Some(_) => "configured", + None => "none", + } + .to_owned(), + ), + ApprovedSemanticValue::DeclarationClass, + "compiler.credential_class", + )?; + } + if let Some(issuance) = &environment.issuance { + add_effective_environment_default( + builder, + &scope, + "/issuance/algorithm", + "/properties/issuance/properties/algorithm", + ExplanationScalar::Text(issuance.algorithm.as_str().to_owned()), + ExplanationScalar::Text("EdDSA".to_owned()), + authored.pointer("/issuance/algorithm").is_some(), + ApprovedSemanticValue::DeclarationClass, + )?; + } + if let Some(oid4vci) = &environment.oid4vci { + add_effective_environment_default( + builder, + &scope, + "/oid4vci/tx_code/required", + "/$defs/oid4vci/properties/tx_code/properties/required", + ExplanationScalar::Boolean(oid4vci.tx_code.required), + ExplanationScalar::Boolean(true), + authored.pointer("/oid4vci/tx_code/required").is_some(), + ApprovedSemanticValue::Policy, + )?; + } + Ok(()) +} + +#[allow(clippy::too_many_arguments)] +fn add_effective_environment_default( + builder: &mut ExplanationBuilder<'_>, + scope: &ExplanationAddressScope, + data_path: &str, + schema_path: &str, + value: ExplanationScalar, + default: ExplanationScalar, + authored: bool, + approval: ApprovedSemanticValue, +) -> Result<()> { + builder.add(PendingExplanationField { + scope: scope.clone(), + data_path: data_path.to_owned(), + schema_kind: knowledge::SchemaKind::Environment, + schema_path: schema_path.to_owned(), + source: if authored { + ExplanationSource::EnvironmentBound + } else { + ExplanationSource::Defaulted + }, + value: Some(value), + approval: Some(approval), + default: Some((FieldDefaultSource::AuthoringSchema, !authored, default)), + }) +} + +#[allow(clippy::too_many_arguments)] +fn add_derived_scalar( + builder: &mut ExplanationBuilder<'_>, + scope: &ExplanationAddressScope, + data_path: &str, + schema_kind: knowledge::SchemaKind, + schema_path: &str, + value: ExplanationScalar, + approval: ApprovedSemanticValue, + semantic_rule_id: &'static str, +) -> Result<()> { + builder.add(PendingExplanationField { + scope: scope.clone(), + data_path: data_path.to_owned(), + schema_kind, + schema_path: schema_path.to_owned(), + source: ExplanationSource::Derived { semantic_rule_id }, + value: Some(value), + approval: Some(approval), + default: None, + }) +} + +#[allow(clippy::too_many_arguments)] +fn walk_authored_explanation( + schema_document: &Value, + schema_node: &Value, + schema_path: &str, + value: &Value, + data_path: &str, + schema_kind: knowledge::SchemaKind, + scope: &ExplanationAddressScope, + source: ExplanationSource, + output: &mut Vec, +) -> Result<()> { + let classification = schema_classification(schema_node); + if classification.is_some_and(classification_is_always_redacted) + || explanation_container_is_opaque(schema_kind, schema_path) + { + output.push(PendingExplanationField { + scope: scope.clone(), + data_path: data_path.to_owned(), + schema_kind, + schema_path: schema_path.to_owned(), + source, + value: None, + approval: None, + default: None, + }); + return Ok(()); + } + + if let Some(scalar) = ExplanationScalar::from_json(value) { + let default = schema_node + .get("default") + .and_then(ExplanationScalar::from_json) + .map(|default| (FieldDefaultSource::AuthoringSchema, false, default)); + output.push(PendingExplanationField { + scope: scope.clone(), + data_path: data_path.to_owned(), + schema_kind, + schema_path: schema_path.to_owned(), + source, + approval: approved_authored_semantic_value( + schema_kind, + schema_path, + data_path, + &scalar, + ), + value: Some(scalar), + default, + }); + return Ok(()); + } + + match value { + Value::Object(object) => { + if schema_is_unclassified_open_object(schema_document, schema_node, object) { + output.push(PendingExplanationField { + scope: scope.clone(), + data_path: data_path.to_owned(), + schema_kind, + schema_path: schema_path.to_owned(), + source, + value: None, + approval: None, + default: None, + }); + return Ok(()); + } + for (name, child) in object { + let (child_schema, child_schema_path) = schema_for_object_property( + schema_document, + schema_node, + schema_path, + name, + object, + ) + .ok_or_else(|| { + anyhow!( + "published {schema_kind} schema has no field for authored path {data_path}/{}", + escape_explanation_pointer_segment(name) + ) + })?; + let child_path = + format!("{data_path}/{}", escape_explanation_pointer_segment(name)); + walk_authored_explanation( + schema_document, + child_schema, + &child_schema_path, + child, + &child_path, + schema_kind, + scope, + source, + output, + )?; + } + } + Value::Array(items) => { + if !items.is_empty() + && schema_for_array_item(schema_document, schema_node, schema_path, value, 0) + .is_none() + { + output.push(PendingExplanationField { + scope: scope.clone(), + data_path: data_path.to_owned(), + schema_kind, + schema_path: schema_path.to_owned(), + source, + value: None, + approval: None, + default: None, + }); + return Ok(()); + } + for (index, item) in items.iter().enumerate() { + let (item_schema, item_schema_path) = schema_for_array_item( + schema_document, + schema_node, + schema_path, + value, + index, + ) + .ok_or_else(|| { + anyhow!( + "published {schema_kind} schema has no item {index} for authored path {data_path}" + ) + })?; + walk_authored_explanation( + schema_document, + item_schema, + &item_schema_path, + item, + &format!("{data_path}/{index}"), + schema_kind, + scope, + source, + output, + )?; + } + } + Value::Null => {} + Value::Bool(_) | Value::Number(_) | Value::String(_) => unreachable!(), + } + Ok(()) +} + +fn schema_for_object_property<'a>( + schema_document: &'a Value, + schema_node: &'a Value, + schema_path: &str, + property: &str, + instance: &Map, +) -> Option<(&'a Value, String)> { + if let Some(property_schema) = schema_node + .get("properties") + .and_then(Value::as_object) + .and_then(|properties| properties.get(property)) + { + return Some(( + property_schema, + format!( + "{schema_path}/properties/{}", + escape_explanation_pointer_segment(property) + ), + )); + } + if let Some((resolved, resolved_path)) = + resolve_local_schema_reference(schema_document, schema_node) + { + if let Some(found) = schema_for_object_property( + schema_document, + resolved, + &resolved_path, + property, + instance, + ) { + return Some(found); + } + } + for keyword in ["oneOf", "anyOf", "allOf"] { + let Some(branches) = schema_node.get(keyword).and_then(Value::as_array) else { + continue; + }; + for (index, branch) in branches.iter().enumerate() { + if keyword != "allOf" && !schema_branch_matches(schema_document, branch, instance) { + continue; + } + let branch_path = format!("{schema_path}/{keyword}/{index}"); + if let Some(found) = schema_for_object_property( + schema_document, + branch, + &branch_path, + property, + instance, + ) { + return Some(found); + } + } + } + schema_node + .get("additionalProperties") + .filter(|schema| schema.is_object()) + .map(|schema| (schema, format!("{schema_path}/additionalProperties"))) +} + +fn schema_for_array_item<'a>( + schema_document: &'a Value, + schema_node: &'a Value, + schema_path: &str, + instance: &Value, + item_index: usize, +) -> Option<(&'a Value, String)> { + if let Some(items) = schema_node.get("items").filter(|items| items.is_object()) { + return Some((items, format!("{schema_path}/items"))); + } + if let Some(item) = schema_node + .get("prefixItems") + .and_then(Value::as_array) + .and_then(|items| items.get(item_index)) + { + return Some((item, format!("{schema_path}/prefixItems/{item_index}"))); + } + if let Some((resolved, resolved_path)) = + resolve_local_schema_reference(schema_document, schema_node) + { + if let Some(found) = schema_for_array_item( + schema_document, + resolved, + &resolved_path, + instance, + item_index, + ) { + return Some(found); + } + } + for keyword in ["oneOf", "anyOf", "allOf"] { + let Some(branches) = schema_node.get(keyword).and_then(Value::as_array) else { + continue; + }; + for (index, branch) in branches.iter().enumerate() { + if keyword != "allOf" + && !schema_type_matches(branch, instance) + && resolve_local_schema_reference(schema_document, branch) + .is_none_or(|(resolved, _)| !schema_type_matches(resolved, instance)) + { + continue; + } + let branch_path = format!("{schema_path}/{keyword}/{index}"); + if let Some(found) = + schema_for_array_item(schema_document, branch, &branch_path, instance, item_index) + { + return Some(found); + } + } + } + None +} + +fn resolve_local_schema_reference<'a>( + schema_document: &'a Value, + schema_node: &Value, +) -> Option<(&'a Value, String)> { + let pointer = schema_node.get("$ref")?.as_str()?.strip_prefix('#')?; + schema_document + .pointer(pointer) + .map(|schema| (schema, pointer.to_owned())) +} + +fn schema_branch_matches( + schema_document: &Value, + branch: &Value, + instance: &Map, +) -> bool { + let branch = resolve_local_schema_reference(schema_document, branch) + .map_or(branch, |(resolved, _)| resolved); + let instance_value = Value::Object(instance.clone()); + if !schema_type_matches(branch, &instance_value) + || branch + .get("const") + .is_some_and(|expected| expected != &instance_value) + { + return false; + } + if branch + .get("required") + .and_then(Value::as_array) + .is_some_and(|required| { + required + .iter() + .filter_map(Value::as_str) + .any(|name| !instance.contains_key(name)) + }) + { + return false; + } + let Some(properties) = branch.get("properties").and_then(Value::as_object) else { + return true; + }; + for (name, property_schema) in properties { + let Some(actual) = instance.get(name) else { + continue; + }; + if property_schema + .get("const") + .is_some_and(|expected| expected != actual) + { + return false; + } + } + true +} + +fn schema_is_unclassified_open_object( + schema_document: &Value, + schema_node: &Value, + instance: &Map, +) -> bool { + if schema_node.get("type").and_then(Value::as_str) == Some("object") + && schema_node + .get("properties") + .and_then(Value::as_object) + .is_none_or(Map::is_empty) + && schema_node.get("propertyNames").is_none() + && schema_node + .get("additionalProperties") + .is_none_or(|additional| additional == &Value::Bool(true)) + { + return true; + } + if let Some((resolved, _)) = resolve_local_schema_reference(schema_document, schema_node) { + if schema_is_unclassified_open_object(schema_document, resolved, instance) { + return true; + } + } + for keyword in ["oneOf", "anyOf"] { + let Some(branches) = schema_node.get(keyword).and_then(Value::as_array) else { + continue; + }; + if branches.iter().any(|branch| { + schema_branch_matches(schema_document, branch, instance) + && schema_is_unclassified_open_object(schema_document, branch, instance) + }) { + return true; + } + } + false +} + +fn schema_type_matches(schema: &Value, instance: &Value) -> bool { + let Some(schema_type) = schema.get("type").and_then(Value::as_str) else { + return true; + }; + matches!( + (schema_type, instance), + ("object", Value::Object(_)) + | ("array", Value::Array(_)) + | ("string", Value::String(_)) + | ("integer" | "number", Value::Number(_)) + | ("boolean", Value::Bool(_)) + | ("null", Value::Null) + ) +} + +fn schema_classification(schema: &Value) -> Option<&str> { + schema.get(knowledge::FIELD_ANNOTATION_KEY)?.as_str() +} + +fn classification_is_always_redacted(classification: &str) -> bool { + matches!( + classification, + "sensitive_property" + | "secret_reference_property" + | "redacted_fixture_property" + | "sensitive_array_item" + | "redacted_fixture_array_item" + | "redacted_fixture_map_key" + | "redacted_fixture_map_value" + ) +} + +fn explanation_container_is_opaque(schema_kind: knowledge::SchemaKind, schema_path: &str) -> bool { + match schema_kind { + knowledge::SchemaKind::Integration => matches!( + schema_path, + "/$defs/capability/oneOf/0/properties/http/properties/request" + | "/$defs/source/properties/auth" + | "/$defs/consultations/additionalProperties/properties/input" + ), + knowledge::SchemaKind::Project => { + schema_path.ends_with("/properties/input") + && schema_path.contains("/$defs/consultations/") + } + knowledge::SchemaKind::Environment => { + schema_path.ends_with("/properties/provider") + || schema_path.ends_with("/properties/credential") + } + knowledge::SchemaKind::Fixture | knowledge::SchemaKind::Entity => false, + } +} + +fn approved_authored_semantic_value( + schema_kind: knowledge::SchemaKind, + schema_path: &str, + _data_path: &str, + value: &ExplanationScalar, +) -> Option { + match schema_kind { + knowledge::SchemaKind::Project => { + if schema_path.ends_with("/properties/purpose") + || schema_path.ends_with("/properties/legal_basis") + || schema_path.ends_with("/properties/scopes/items") + { + Some(ApprovedSemanticValue::HumanIntent) + } else if schema_path.ends_with("/properties/consent") + || schema_path.ends_with("/properties/kind") + || schema_path.ends_with("/properties/format") + || schema_path.ends_with("/properties/value/properties/type") + { + Some(ApprovedSemanticValue::DeclarationClass) + } else if schema_path.ends_with("/properties/disclosure") + || schema_path.ends_with("/properties/default") + || (schema_path.ends_with("/properties/allowed/items") + && schema_path.contains("disclosure")) + { + Some(ApprovedSemanticValue::DisclosureClass) + } else if schema_path.ends_with("/properties/version") + && !matches!(value, ExplanationScalar::Text(_)) + { + Some(ApprovedSemanticValue::Count) + } else { + None + } + } + knowledge::SchemaKind::Integration => { + if schema_path.ends_with("/properties/role") + || schema_path.ends_with("/properties/type") + || schema_path.ends_with("/properties/format") + || schema_path.ends_with("/properties/canonicalization") + || schema_path.ends_with("/properties/cardinality") + { + Some(ApprovedSemanticValue::DeclarationClass) + } else if schema_path.ends_with("/properties/nullable") { + Some(ApprovedSemanticValue::Policy) + } else if [ + "/properties/maxLength", + "/properties/minLength", + "/properties/minimum", + "/properties/maximum", + "/properties/max_bytes", + "/properties/calls", + "/properties/request_bytes", + "/properties/source_bytes", + "/properties/deadline", + ] + .iter() + .any(|suffix| schema_path.ends_with(suffix)) + { + Some(ApprovedSemanticValue::Limit) + } else { + None + } + } + knowledge::SchemaKind::Environment => { + if schema_path.ends_with("/properties/profile") + || schema_path.ends_with("/properties/algorithm") + || schema_path.ends_with("/properties/type") + { + Some(ApprovedSemanticValue::DeclarationClass) + } else if schema_path.ends_with("/properties/scopes/items") { + Some(ApprovedSemanticValue::HumanIntent) + } else if schema_path.ends_with("/properties/required") { + Some(ApprovedSemanticValue::Policy) + } else if [ + "/properties/per_minute", + "/properties/burst", + "/properties/concurrency", + "/properties/timeout", + "/properties/worker_memory_bytes", + ] + .iter() + .any(|suffix| schema_path.ends_with(suffix)) + { + Some(ApprovedSemanticValue::Limit) + } else { + None + } + } + knowledge::SchemaKind::Entity => { + if schema_path.ends_with("/properties/type") + || schema_path.ends_with("/properties/format") + || schema_path.ends_with("/properties/additionalProperties") + { + Some(ApprovedSemanticValue::DeclarationClass) + } else if [ + "/properties/minLength", + "/properties/maxLength", + "/properties/minimum", + "/properties/maximum", + "/properties/max_records", + "/properties/max_bytes", + "/properties/refresh", + "/properties/retain_generations", + ] + .iter() + .any(|suffix| schema_path.ends_with(suffix)) + { + Some(ApprovedSemanticValue::Limit) + } else { + None + } + } + knowledge::SchemaKind::Fixture => None, + } +} + +fn classifier_safe_value( + knowledge: &knowledge::FieldKnowledge, + value: Option, + approval: Option, +) -> ClassifierSafeReportedValue { + let classification = knowledge.sensitivity; + match knowledge.sensitivity { + knowledge::Sensitivity::Sensitive => ClassifierSafeReportedValue::Redacted { + classification, + reason: RedactionReason::SensitiveMetadata, + }, + knowledge::Sensitivity::SecretReference | knowledge::Sensitivity::SecretValue => { + ClassifierSafeReportedValue::Redacted { + classification, + reason: RedactionReason::SecretMaterial, + } + } + knowledge::Sensitivity::RedactedFixture => ClassifierSafeReportedValue::Redacted { + classification, + reason: RedactionReason::Policy, + }, + knowledge::Sensitivity::Public => classifier_approved_value(classification, false, value) + .unwrap_or(ClassifierSafeReportedValue::Absent), + knowledge::Sensitivity::Internal | knowledge::Sensitivity::Structural => { + classifier_approved_value(classification, approval.is_some(), value).unwrap_or( + ClassifierSafeReportedValue::Redacted { + classification, + reason: RedactionReason::Policy, + }, + ) + } + } +} + +fn classifier_approved_value( + classification: FieldSensitivity, + semantic_approved: bool, + value: Option, +) -> Option { + let value = value?; + ClassifierApprovedJson::after_classification( + classification, + semantic_approved, + value.into_classifier_json(), + ) + .map(|value| ClassifierSafeReportedValue::Public { value }) +} + +fn report_schema_kind(kind: knowledge::SchemaKind) -> ProjectAuthoringSchema { + match kind { + knowledge::SchemaKind::Project => ProjectAuthoringSchema::Project, + knowledge::SchemaKind::Environment => ProjectAuthoringSchema::Environment, + knowledge::SchemaKind::Integration => ProjectAuthoringSchema::Integration, + knowledge::SchemaKind::Fixture => ProjectAuthoringSchema::Fixture, + knowledge::SchemaKind::Entity => ProjectAuthoringSchema::Entity, + } +} + +fn report_field_knowledge(knowledge: &knowledge::FieldKnowledge) -> ProjectFieldKnowledge { + ProjectFieldKnowledge { + path_kind: knowledge.path_kind, + semantic_owner: knowledge.semantic_owner, + human_owner: knowledge.human_owner, + sensitivity: knowledge.sensitivity, + products: knowledge.products.clone(), + introduced_in: knowledge.introduced_in.clone(), + availability: knowledge.availability, + stability: knowledge.stability, + migration: knowledge.migration, + consumers: knowledge.consumers.clone(), + generated_artifacts: knowledge.generated_artifacts.clone(), + review_classes: knowledge.review_classes.clone(), + semantic_rules: knowledge.semantic_rules.clone(), + } +} + +fn knowledge_semantic_rule_id(rule: knowledge::SemanticRule) -> &'static str { + match rule { + knowledge::SemanticRule::KnowledgeOnly => "knowledge_only", + knowledge::SemanticRule::GeneratedDocsNeverLoadCountryValues => { + "generated_docs_never_load_country_values" + } + knowledge::SemanticRule::SecretNeverReportable => "secret_never_reportable", + knowledge::SemanticRule::SyntheticFixtureValueRedacted => { + "synthetic_fixture_value_redacted" + } + knowledge::SemanticRule::SensitiveOperationalMetadata => "sensitive_operational_metadata", + knowledge::SemanticRule::ArbitraryMapKeysNotFixedProperties => { + "arbitrary_map_keys_not_fixed_properties" + } + knowledge::SemanticRule::ArrayItemsShareElementContract => { + "array_items_share_element_contract" + } + knowledge::SemanticRule::BranchHasNoAuthoredValue => "branch_has_no_authored_value", + } +} + +fn escape_explanation_pointer_segment(segment: &str) -> String { + segment.replace('~', "~0").replace('/', "~1") +} + +#[cfg(test)] +mod explanation_tests { + use super::*; + + fn bounded_http_project() -> LoadedRegistryProject { + load_registry_project( + &Path::new(env!("CARGO_MANIFEST_DIR")).join("assets/project-starters/bounded-http"), + Some("local"), + ) + .expect("bounded HTTP starter loads") + } + + fn integration_field<'a>( + report: &'a ProjectExplanationReportV1, + integration: &str, + path: &str, + ) -> &'a ProjectFieldExplanation { + report + .fields + .iter() + .find(|field| { + matches!( + &field.address, + ProjectFieldAddress::Integration { + integration: actual, + path: actual_path, + } if actual == integration && actual_path.as_str() == path + ) + }) + .expect("integration explanation field exists") + } + + fn project_public_text<'a>(report: &'a ProjectExplanationReportV1, path: &str) -> &'a str { + let field = report + .fields + .iter() + .find(|field| { + matches!( + &field.address, + ProjectFieldAddress::Project { path: actual_path } + if actual_path.as_str() == path + ) + }) + .expect("project explanation field exists"); + let ClassifierSafeReportedValue::Public { value } = &field.reported_value else { + panic!("classifier-approved project classification is public"); + }; + value + .as_value() + .as_str() + .expect("project classification is text") + } + + #[test] + fn trusted_local_terminal_rendering_fails_closed_for_prohibited_internal_states() { + const SENTINEL: &str = "TRUSTED_LOCAL_PROHIBITED_SENTINEL"; + let address = ProjectFieldAddress::Project { + path: JsonPointer::new("/registry/id".to_owned()).expect("pointer is valid"), + }; + let derived = ProjectTrustedLocalAuthoredValue { + address: address.clone(), + source: FieldSourceKind::Derived, + sensitivity: FieldSensitivity::Internal, + value: json!(SENTINEL), + }; + let secret = ProjectTrustedLocalAuthoredValue { + address: address.clone(), + source: FieldSourceKind::Authored, + sensitivity: FieldSensitivity::SecretReference, + value: json!(SENTINEL), + }; + let fixture = ProjectTrustedLocalAuthoredValue { + address: ProjectFieldAddress::Fixture { + integration: "person-record".to_owned(), + fixture: "private".to_owned(), + path: JsonPointer::new("/input/person_id".to_owned()).expect("pointer is valid"), + }, + source: FieldSourceKind::Authored, + sensitivity: FieldSensitivity::Internal, + value: json!(SENTINEL), + }; + let parser = ProjectTrustedLocalAuthoredValue { + address: ProjectFieldAddress::Project { + path: JsonPointer::new("/services/example/claims/example/cel".to_owned()) + .expect("pointer is valid"), + }, + source: FieldSourceKind::Authored, + sensitivity: FieldSensitivity::Internal, + value: json!(SENTINEL), + }; + + for (field, expected) in [ + ( + derived, + "only authored values can enter trusted-local authored output", + ), + ( + secret, + "secret or fixture data cannot enter trusted-local authored output", + ), + ( + fixture, + "fixture data cannot enter trusted-local authored output", + ), + ( + parser, + "secret locator or parser input cannot enter trusted-local authored output", + ), + ] { + let error = field + .terminal_line() + .expect_err("prohibited internal state fails closed"); + assert_eq!(error.to_string(), expected); + assert!(!error.to_string().contains(SENTINEL)); + } + } + + #[test] + fn bounded_http_explanation_reports_effective_defaults_and_knowledge() { + let loaded = bounded_http_project(); + let report = + generated_explanation(&loaded, "local").expect("bounded HTTP explanation generates"); + + let request_bytes = integration_field(&report, "person-record", "/limits/request_bytes"); + assert_eq!(request_bytes.source.kind, FieldSourceKind::Defaulted); + assert_eq!(request_bytes.state.presence, FieldPresence::Defaulted); + assert_eq!(request_bytes.state.effect, FieldEffect::Effective); + assert!( + request_bytes + .default + .as_ref() + .expect("compiler default is reported") + .applied + ); + let ClassifierSafeReportedValue::Public { value } = &request_bytes.reported_value else { + panic!("classifier-approved effective bound is public"); + }; + assert_eq!(value.as_value(), &json!(64 * 1024)); + assert_eq!( + request_bytes.knowledge.semantic_owner, + FieldSemanticOwner::IntegrationContract + ); + assert!(request_bytes + .knowledge + .generated_artifacts + .contains(&FieldGeneratedArtifact::RelayConfig)); + assert!(request_bytes + .knowledge + .generated_artifacts + .contains(&FieldGeneratedArtifact::NotaryConfig)); + + let calls = integration_field(&report, "person-record", "/limits/calls"); + assert_eq!(calls.source.kind, FieldSourceKind::Derived); + assert_eq!( + calls.source.semantic_rule_id.as_deref(), + Some("compiler.http_single_call") + ); + assert_eq!( + calls + .default + .as_ref() + .expect("intrinsic default is reported") + .source, + FieldDefaultSource::SemanticRule + ); + let response_format = + integration_field(&report, "person-record", "/source/response/format"); + assert_eq!(response_format.source.kind, FieldSourceKind::Defaulted); + let ClassifierSafeReportedValue::Public { value } = &response_format.reported_value else { + panic!("classifier-approved response format is public"); + }; + assert_eq!(value.as_value(), &json!("json")); + + let purpose = report + .fields + .iter() + .find(|field| { + matches!( + &field.address, + ProjectFieldAddress::Project { path } + if path.as_str() == "/services/person-verification/purpose" + ) + }) + .expect("service purpose explanation exists"); + assert_eq!(purpose.source.kind, FieldSourceKind::Authored); + assert_eq!(purpose.state.presence, FieldPresence::Authored); + assert_eq!( + purpose.knowledge.semantic_owner, + FieldSemanticOwner::AuthoringContract + ); + assert!(purpose + .knowledge + .consumers + .contains(&FieldKnowledgeConsumer::RegistryNotary)); + let ClassifierSafeReportedValue::Public { value } = &purpose.reported_value else { + panic!("classifier-approved human intent is public"); + }; + assert_eq!( + value.as_value(), + &json!("public-service-person-verification") + ); + assert_eq!( + project_public_text( + &report, + "/services/person-verification/claims/person-active/evidence" + ), + "registry_backed" + ); + assert_eq!( + project_public_text( + &report, + "/services/person-verification/claims/person-record-exists/evidence" + ), + "registry_backed" + ); + let issuance_algorithm = report + .fields + .iter() + .find(|field| { + matches!( + &field.address, + ProjectFieldAddress::Environment { path, .. } + if path.as_str() == "/issuance/algorithm" + ) + }) + .expect("effective issuance algorithm exists"); + assert_eq!(issuance_algorithm.source.kind, FieldSourceKind::Defaulted); + assert!(issuance_algorithm + .default + .as_ref() + .is_some_and(|default| default.applied)); + + let serialized_once = serde_json::to_vec(&report).expect("report serializes"); + let serialized_twice = serde_json::to_vec( + &generated_explanation(&loaded, "local") + .expect("second bounded HTTP explanation generates"), + ) + .expect("second report serializes"); + assert_eq!(serialized_once, serialized_twice); + } + + #[test] + fn source_free_cel_explanation_remains_self_attested() { + let loaded = load_registry_project( + &Path::new(env!("CARGO_MANIFEST_DIR")) + .join("tests/fixtures/project-authoring/notary-only-evaluation"), + Some("local"), + ) + .expect("source-free Notary project loads"); + let report = + generated_explanation(&loaded, "local").expect("source-free explanation generates"); + + assert_eq!( + project_public_text( + &report, + "/services/applicant-evaluation/claims/application-complete/evidence" + ), + "self_attested" + ); + } + + #[test] + fn explanation_never_serializes_sensitive_or_request_fixture_sentinels() { + let temporary = tempfile::tempdir().expect("temporary directory"); + copy_embedded_dir( + ProjectStarter::Http + .embedded() + .expect("HTTP starter is embedded"), + temporary.path(), + ) + .expect("HTTP starter copies"); + fs::write( + temporary.path().join("environments/local.yaml"), + r#"version: 1 +integrations: + person-record: + source: + origin: https://ORIGIN_SENTINEL.invalid + allowed_private_cidrs: [10.77.0.0/16] + credential: + token: { secret: SECRET_REFERENCE_SENTINEL } + generation: 77 +issuance: + issuer: did:web:ISSUER_SENTINEL.invalid + signing_kid: SIGNING_ID_SENTINEL + signing_key: { secret: SIGNING_SECRET_SENTINEL } + generation: 88 +callers: + evidence-client: + api_key_fingerprint: { secret: CALLER_SECRET_SENTINEL } + scopes: ["evidence:person:read"] +relay: + origin: https://RELAY_ORIGIN_SENTINEL.invalid + issuer: https://ENDPOINT_SENTINEL.invalid + jwks_url: https://ENDPOINT_SENTINEL.invalid/JWKS_PATH_SENTINEL + audience: CLIENT_ID_SENTINEL + allowed_clients: [CLIENT_ID_SENTINEL] +notary_relay: + base_url: http://127.0.0.1:8080 + workload_client_id: CLIENT_ID_SENTINEL + token_file: /ABSOLUTE/RUNTIME/FILE/PATH_SENTINEL +deployment: + profile: local + relay: { service: fictional-registry-relay } + notary: { service: fictional-registry-notary } +"#, + ) + .expect("sentinel environment writes"); + fs::write( + temporary + .path() + .join("integrations/person-record/integration.yaml"), + r#"version: 1 +id: person-record +revision: 1 +source: + product: replace-with-source-product + versions: { unverified: [replace-with-source-version] } + auth: { type: static_bearer } +input: + person_id: + role: selector + type: string + maxLength: 64 +capability: + http: + request: + method: POST + semantics: read_only + path: /REQUEST/PATH/SENTINEL/{input.person_id} + query: { QUERY_SENTINEL: QUERY_VALUE_SENTINEL } + headers: { X-Projection: HEADER_VALUE_SENTINEL } + body: { REQUEST_BODY_SENTINEL: REQUEST_PAYLOAD_SENTINEL } + response: + no_match: [404] + ambiguous: [409] +outputs: + active: + type: boolean + x-registry-source: /SOURCE_VALUE_SENTINEL +not_applicable: + subject_mismatch: + rationale: The selected response projection contains no identifier that can be compared with the requested person identifier. + request_fixture: active-person +"#, + ) + .expect("sentinel integration writes"); + fs::write( + temporary + .path() + .join("integrations/person-record/fixtures/active.yaml"), + r#"name: active-person +classification: synthetic +input: { person_id: FIXTURE_INPUT_SENTINEL } +interactions: + - expect: + method: POST + path: /REQUEST/PATH/SENTINEL/FIXTURE + query: { QUERY_SENTINEL: QUERY_VALUE_SENTINEL } + headers: { X-Projection: HEADER_VALUE_SENTINEL } + body: { REQUEST_BODY_SENTINEL: REQUEST_PAYLOAD_SENTINEL } + respond: { status: 200, body: { FIXTURE_BODY_SENTINEL: true } } +expect: + outcome: match + outputs: { active: true } + claims: { person-record-exists: true, person-active: true } +"#, + ) + .expect("sentinel fixture writes"); + let project_path = temporary.path().join(PROJECT_FILE); + let project = fs::read_to_string(&project_path).expect("project reads"); + fs::write( + &project_path, + project.replace( + "cel: person_record.matched", + "cel: 'person_record.matched && \"CEL_SENTINEL\" == \"CEL_SENTINEL\"'", + ), + ) + .expect("sentinel project writes"); + + let loaded = + load_registry_project(temporary.path(), Some("local")).expect("sentinel project loads"); + let report = + generated_explanation(&loaded, "local").expect("sentinel explanation generates"); + let serialized = serde_json::to_string(&report).expect("sentinel report serializes"); + for sentinel in [ + "ORIGIN_SENTINEL", + "10.77.0.0/16", + "SECRET_REFERENCE_SENTINEL", + "SIGNING_SECRET_SENTINEL", + "CALLER_SECRET_SENTINEL", + "SIGNING_ID_SENTINEL", + "ENDPOINT_SENTINEL", + "JWKS_PATH_SENTINEL", + "CLIENT_ID_SENTINEL", + "/ABSOLUTE/RUNTIME/FILE/PATH_SENTINEL", + "REQUEST/PATH/SENTINEL", + "QUERY_SENTINEL", + "QUERY_VALUE_SENTINEL", + "HEADER_VALUE_SENTINEL", + "REQUEST_BODY_SENTINEL", + "REQUEST_PAYLOAD_SENTINEL", + "SOURCE_VALUE_SENTINEL", + "FIXTURE_INPUT_SENTINEL", + "FIXTURE_BODY_SENTINEL", + "CEL_SENTINEL", + ] { + assert!( + !serialized.contains(sentinel), + "classifier-safe report leaked {sentinel}" + ); + } + assert!(report.fields.iter().any(|field| { + matches!( + field.reported_value, + ClassifierSafeReportedValue::Redacted { + classification: FieldSensitivity::SecretReference, + reason: RedactionReason::SecretMaterial, + } + ) + })); + assert!(report.fields.iter().any(|field| { + matches!( + field.reported_value, + ClassifierSafeReportedValue::Redacted { + classification: FieldSensitivity::RedactedFixture, + .. + } + ) + })); + + let trusted = trusted_local_authored_values(&loaded, &report) + .expect("trusted-local authored values are selected"); + assert!(trusted.iter().all(|field| { + matches!( + field.source, + FieldSourceKind::Authored | FieldSourceKind::EnvironmentBound + ) && matches!( + field.sensitivity, + FieldSensitivity::Public + | FieldSensitivity::Internal + | FieldSensitivity::Structural + | FieldSensitivity::Sensitive + ) && !matches!(field.address, ProjectFieldAddress::Fixture { .. }) + })); + let trusted_values = trusted + .iter() + .map(|field| serde_json::to_string(&field.value).expect("scalar serializes")) + .collect::>() + .join("\n"); + for visible in ["ORIGIN_SENTINEL", "ISSUER_SENTINEL"] { + assert!( + trusted_values.contains(visible), + "trusted-local review should expose authored non-secret metadata {visible}" + ); + } + for hidden in [ + "SECRET_REFERENCE_SENTINEL", + "SIGNING_SECRET_SENTINEL", + "CALLER_SECRET_SENTINEL", + "FIXTURE_INPUT_SENTINEL", + "FIXTURE_BODY_SENTINEL", + "/ABSOLUTE/RUNTIME/FILE/PATH_SENTINEL", + "REQUEST_PAYLOAD_SENTINEL", + "SOURCE_VALUE_SENTINEL", + "CEL_SENTINEL", + ] { + assert!( + !trusted_values.contains(hidden), + "trusted-local review leaked prohibited value {hidden}" + ); + } + } + + #[test] + fn records_standard_objects_use_typed_leaf_knowledge_without_leaking_values() { + let schemas = explanation_schema_set().expect("published explanation schemas load"); + let mut builder = ExplanationBuilder::new(&schemas); + let project = json!({ + "version": 1, + "registry": { "id": "records-standards-test" }, + "services": { + "people-records": { + "kind": "records_api", + "entity": "people", + "api": { + "scopes": { + "metadata": "records:metadata", + "rows": "records:rows" + }, + "projection": ["person_id"], + "pagination": { + "default_limit": 10, + "max_limit": 100 + }, + "standards": { + "ogc_features": { + "collection_id": "COLLECTION_ID_SENTINEL", + "geometry": { + "kind": "point", + "longitude_field": "longitude", + "latitude_field": "latitude", + "crs": "CRS_SENTINEL" + } + }, + "sp_dci": { + "registry": "SP_DCI_REGISTRY_SENTINEL", + "registry_type": "civil-registry", + "record_type": "person", + "identifiers": { "person_id": "person_id" }, + "expression_fields": {} + } + } + } + } + } + }); + builder + .add_authored_document( + knowledge::SchemaKind::Project, + ExplanationAddressScope::Project, + &project, + ExplanationSource::Authored, + ) + .expect("records standards explanation generates"); + let fields = builder.finish(); + for path in [ + "/services/people-records/api/standards/ogc_features/collection_id", + "/services/people-records/api/standards/ogc_features/geometry/crs", + "/services/people-records/api/standards/sp_dci/registry", + ] { + let field = fields + .iter() + .find(|field| { + matches!( + &field.address, + ProjectFieldAddress::Project { path: field_path } + if field_path.as_str() == path + ) + }) + .unwrap_or_else(|| panic!("typed standards field {path} is represented")); + assert!(matches!( + field.reported_value, + ClassifierSafeReportedValue::Redacted { + classification: FieldSensitivity::Internal, + reason: RedactionReason::Policy, + } + )); + } + let serialized = serde_json::to_string(&fields).expect("standards fields serialize"); + for sentinel in [ + "COLLECTION_ID_SENTINEL", + "CRS_SENTINEL", + "SP_DCI_REGISTRY_SENTINEL", + ] { + assert!( + !serialized.contains(sentinel), + "typed standards explanation leaked {sentinel}" + ); + } + } + + #[test] + fn explanation_rejects_authored_bytes_changed_after_load() { + let temporary = tempfile::tempdir().expect("temporary directory"); + copy_embedded_dir( + ProjectStarter::Http + .embedded() + .expect("HTTP starter is embedded"), + temporary.path(), + ) + .expect("HTTP starter copies"); + let loaded = + load_registry_project(temporary.path(), Some("local")).expect("HTTP starter loads"); + let project_path = temporary.path().join(PROJECT_FILE); + let project = fs::read_to_string(&project_path).expect("project reads"); + fs::write( + project_path, + project.replace("public-service-person-verification", "changed-after-load"), + ) + .expect("project changes after load"); + + let error = generated_explanation(&loaded, "local") + .expect_err("explanation must reject a TOCTOU input change"); + assert_eq!( + error.to_string(), + "authored explanation input changed after the project was loaded" + ); + } +} diff --git a/crates/registryctl/src/project_authoring/compiler/notary.rs b/crates/registryctl/src/project_authoring/compiler/notary.rs index 6d037eecb..75bfa845b 100644 --- a/crates/registryctl/src/project_authoring/compiler/notary.rs +++ b/crates/registryctl/src/project_authoring/compiler/notary.rs @@ -1097,276 +1097,6 @@ fn parse_validity_seconds(value: &str) -> Result { .ok_or_else(|| anyhow!("credential validity overflows")) } -fn explained_limit( - value: T, - unit: &str, - authored: bool, - default: Value, - hard_ceiling: Value, -) -> Value { - json!({ - "value": value, - "unit": unit, - "source": if authored { "authored" } else { "platform_default" }, - "default": default, - "hard_ceiling": hard_ceiling, - }) -} - -fn script_call_limit_explanation(value: u8, authored: bool, signed_dci: bool) -> Value { - if signed_dci { - json!({ - "value": 1, - "unit": "calls", - "source": if authored { "authored" } else { "protocol_intrinsic" }, - "default": 1, - "hard_ceiling": 1, - }) - } else { - explained_limit(value, "calls", authored, json!(5), json!(16)) - } -} - -fn integration_explanation(integration: &IntegrationDocument) -> Value { - let mut value = json!({ - "authoring_version": integration.version, - "revision": integration.revision, - "source_product": integration.source.product, - "source_versions": integration.source.versions, - "input": integration.input, - "outputs": integration.outputs, - "not_applicable": integration.not_applicable, - }); - let object = value - .as_object_mut() - .expect("integration explanation object"); - match &integration.capability { - CapabilityDeclaration::Http { http } => { - object.insert("capability".into(), json!("http")); - object.insert("bounds".into(), json!({ - "calls": {"value": 1, "unit": "calls", "source": "intrinsic", "default": 1, "hard_ceiling": 1}, - "request_bytes": explained_limit(integration.bounds.request_bytes, "bytes", integration.bounds.request_bytes_authored, json!(64 * 1024), json!(1024 * 1024)), - "source_response_bytes": explained_limit( - http.operations.values().find(|operation| operation.role == OperationRole::Data).map_or(512 * 1024, |operation| operation.response.max_bytes), - "bytes", - http.response_max_bytes_authored, - json!(512 * 1024), - json!(8 * 1024 * 1024), - ), - "source_bytes": explained_limit(integration.bounds.source_bytes, "bytes", integration.bounds.source_bytes_authored, json!(2 * 1024 * 1024), json!(16 * 1024 * 1024)), - "deadline": explained_limit(&integration.bounds.deadline, "duration", integration.bounds.deadline_authored, json!("15s"), json!("60s")), - })); - object.insert( - "operations".into(), - integration_operations(integration) - .iter() - .map(|(id, operation)| { - json!({ - "id": id, - "role": match operation.role { - OperationRole::Data => "data", - OperationRole::Credential => "credential", - OperationRole::Verification => "verification", - }, - "method": match operation.request.method { ReadMethod::Get => "GET", ReadMethod::Post => "READ_ONLY_POST" }, - "primitive": operation.primitive, - "depends_on": operation.depends_on, - "when": operation.when, - "destination": operation.request.destination, - "path": operation.request.path, - "path_parameters": operation.request.path_parameters, - "query": operation.request.query, - "headers": operation.request.headers, - "body": operation.request.body, - "request_codec": operation.request.codec, - "authorization": operation.request.authorization, - "response_bytes": operation.response.max_bytes, - "response_codec": operation.response.codec, - "response_statuses": operation.response.statuses, - "response_schema": operation.response.schema, - "cardinality": operation.response.cardinality, - }) - }) - .collect::>() - .into(), - ); - } - CapabilityDeclaration::Script { script } => { - object.insert("capability".into(), json!("script")); - object.insert("bounds".into(), json!({ - "calls": script_call_limit_explanation(integration.bounds.calls, integration.bounds.calls_authored, script.signed_dci.is_some()), - "request_bytes": explained_limit(integration.bounds.request_bytes, "bytes", integration.bounds.request_bytes_authored, json!(64 * 1024), json!(1024 * 1024)), - "source_response_bytes": explained_limit(script.response.max_bytes, "bytes", script.response.max_bytes_authored, json!(512 * 1024), json!(8 * 1024 * 1024)), - "source_bytes": explained_limit(integration.bounds.source_bytes, "bytes", integration.bounds.source_bytes_authored, json!(2 * 1024 * 1024), json!(16 * 1024 * 1024)), - "deadline": explained_limit(&integration.bounds.deadline, "duration", integration.bounds.deadline_authored, json!("15s"), json!("60s")), - })); - object.insert( - "script_authority".into(), - json!({ - "allow": script.allow, - "request_headers": script.request_headers, - "response_headers": script.response_headers, - "response": script.response, - "credential_type": credential_interface(integration).credential_type, - "signed_dci": script.signed_dci, - "runtime": script.runtime, - "abi": registry_relay::rhai_worker::xw::XW_ABI_VERSION, - }), - ); - } - CapabilityDeclaration::Snapshot { snapshot } => { - object.insert("capability".into(), json!("snapshot")); - object.insert("materialization".into(), json!(snapshot)); - } - } - value -} - -fn generated_explanation( - loaded: &LoadedRegistryProject, - environment_name: &str, - profiles: &[GeneratedProfile], -) -> Value { - let (requires_relay, requires_notary) = project_product_topology(&loaded.project); - let topology = match (requires_relay, requires_notary) { - (true, false) => "relay_only", - (false, true) => "notary_only", - (true, true) => "combined", - (false, false) => "none", - }; - let records_api_services = loaded - .project - .services - .values() - .filter(|service| service.kind == ServiceKind::RecordsApi) - .count(); - let evidence_services = loaded - .project - .services - .values() - .filter(|service| service.kind == ServiceKind::Evidence) - .collect::>(); - json!({ - "schema": "registry.project.explanation.v1", - "registry": loaded.project.registry.id, - "environment": environment_name, - "starter": starter_explanation(loaded), - "topology": { - "deployment": topology, - "relay": { - "required": requires_relay, - "source_integrations": loaded.integrations.len(), - "records_api_services": records_api_services, - "materialized_entities": loaded.entities.len(), - }, - "notary": { - "required": requires_notary, - "evidence_services": evidence_services.len(), - "source_free_evaluation_services": evidence_services.iter() - .filter(|service| service.claims.values().any(|claim| { - matches!( - inferred_claim_evidence(service, claim), - Ok(ClaimEvidence::SelfAttested) - ) - })).count(), - "relay_backed_services": evidence_services.iter() - .filter(|service| !service.consultations.is_empty()).count(), - }, - }, - "platform": { - "defaults_release": env!("CARGO_PKG_VERSION"), - "script_runtime": "rhai_v1", - "script_abi": registry_relay::rhai_worker::xw::XW_ABI_VERSION, - "defensive_ceilings": { - "selector_count": { "value": 8, "unit": "selectors" }, - "canonical_selector_bytes": { "value": 4096, "unit": "bytes" }, - "total_inputs": { "value": 16, "unit": "inputs" }, - "outputs": { "value": 64, "unit": "outputs" }, - "response_schema_depth": { "value": 8, "unit": "levels" }, - "response_schema_nodes": { "value": 256, "unit": "nodes" }, - "response_array_items": { "value": 256, "unit": "items" }, - "script_string_bytes": { "value": 65536, "unit": "bytes" }, - "script_collection_items": { "value": 1024, "unit": "items" }, - "successful_consultation_bytes": { "value": 65536, "unit": "bytes" }, - "deployment_concurrency": { "value": 8, "unit": "consultations", "hard_ceiling": 16 }, - }, - }, - "integrations": loaded.integrations.iter().map(|(alias, integration)| { - (alias.clone(), integration_explanation(&integration.document)) - }).collect::>(), - "services": loaded.project.services.iter().map(|(id, service)| { - (id.clone(), json!({ - "kind": service.kind, - "entity": service.entity, - "api": service.api, - "purpose": service.purpose, - "legal_basis": service.legal_basis, - "consent": service.consent, - "required_scopes": service.access.scopes, - "variables": service.variables, - "consultations": service.consultations, - "claims": service.claims.iter().map(|(claim, declaration)| (claim, json!({ - "output": declaration.output, - "cel": declaration.cel, - "disclosure": declaration.disclosure, - }))).collect::>(), - "credential_profiles": service.credential_profiles, - "profiles": profiles.iter().filter(|profile| profile.service_id == *id).map(|profile| json!({ - "consultation": profile.consultation_name, - "integration": profile.integration_alias, - "contract_hash": profile.contract.artifact().typed_hash(), - })).collect::>(), - })) - }).collect::>(), - "environment_binding": loaded.environment.as_ref().map(|environment| json!({ - "deployment_profile": environment.deployment.profile, - "integrations": environment.integrations.iter().map(|(alias, binding)| (alias.clone(), json!({ - "source_origin": binding.source.origin, - "allowed_private_cidrs": binding.source.allowed_private_cidrs, - "source_auth_type": credential_interface(&loaded.integrations[alias].document).credential_type, - "credential_generation": binding.source.credential.as_ref().map(|credential| credential.generation), - "oauth_endpoint": binding.source.oauth.as_ref().map(|endpoint| json!({ - "origin": endpoint.origin, - "path": endpoint.path, - "generation": endpoint.generation, - })), - "jwks_endpoint": binding.source.jwks.as_ref().map(|endpoint| json!({ - "origin": endpoint.origin, - "path": endpoint.path, - "generation": endpoint.generation, - })), - "ca_generation": binding.source.ca.as_ref().map(|ca| ca.generation), - "mtls_generation": binding.source.mtls.as_ref().map(|mtls| mtls.generation), - "rate": binding.source.rate, - "concurrency": binding.source.concurrency, - "timeout": binding.source.timeout, - "script_runtime": match &loaded.integrations[alias].document.capability { - CapabilityDeclaration::Script { script } => Some(script.runtime), - CapabilityDeclaration::Http { .. } | CapabilityDeclaration::Snapshot { .. } => None, - }, - }))).collect::>(), - "entities": environment.entities.iter().map(|(id, binding)| (id.clone(), json!({ - "source_revision": binding.source_revision, - "generation": binding.generation, - "materialization_identity": loaded.entities.get(id).and_then(|entity| entity_materialization_resource_id(&entity.document, binding).ok()), - }))).collect::>(), - "callers": environment.callers.iter().map(|(caller, binding)| (caller.clone(), json!({ - "scopes": binding.scopes, - }))).collect::>(), - "relay_oidc": { - "allowed_clients": environment.relay.as_ref().map(|relay| &relay.allowed_clients), - "audience": environment.relay.as_ref().map(|relay| relay.audience.as_str()), - }, - "notary_relay_workload": environment.notary_relay.as_ref().map(|connection| json!({ - "client_id": connection.workload_client_id, - })), - "notary_cel": environment.notary_cel.as_ref().map(|binding| json!({ - "worker_memory_bytes": binding.worker_memory_bytes, - })), - })), - }) -} - #[cfg(test)] mod notary_compiler_tests { use super::*; @@ -1413,34 +1143,6 @@ services: )); } - #[test] - fn signed_dci_call_explanation_reports_the_intrinsic_or_authored_one_call_bound() { - assert_eq!( - script_call_limit_explanation(1, false, true), - json!({ - "value": 1, - "unit": "calls", - "source": "protocol_intrinsic", - "default": 1, - "hard_ceiling": 1, - }) - ); - assert_eq!( - script_call_limit_explanation(1, true, true)["source"], - "authored" - ); - assert_eq!( - script_call_limit_explanation(5, false, false), - json!({ - "value": 5, - "unit": "calls", - "source": "platform_default", - "default": 5, - "hard_ceiling": 16, - }) - ); - } - #[test] fn crosswalk_helper_namespaces_receive_unique_internal_aliases() { let mut names = CROSSWALK_CEL_HELPER_NAMESPACES.to_vec(); diff --git a/crates/registryctl/src/project_authoring/compiler/semantic_impact.rs b/crates/registryctl/src/project_authoring/compiler/semantic_impact.rs new file mode 100644 index 000000000..86fd9695b --- /dev/null +++ b/crates/registryctl/src/project_authoring/compiler/semantic_impact.rs @@ -0,0 +1,1081 @@ +// SPDX-License-Identifier: Apache-2.0 + +/// Produces the conservative semantic-impact view that is justified by the +/// signed approval state. +/// +/// Approval state v1 binds whole-dimension digests. It does not bind an +/// addressable field diff, so this producer deliberately reports dimension +/// precision and does not attempt to recover fields, values, or change +/// direction from the current authored documents. +fn project_semantic_impact_report( + loaded: &LoadedRegistryProject, + baseline: Option<&Value>, + disclosure_digest: &str, +) -> ProjectSemanticImpactReportV1 { + let report_baseline = if baseline.is_some() { + ProjectBaseline::VerifiedSignedBundle + } else { + ProjectBaseline::InitialWithoutBaseline + }; + let direction = if baseline.is_some() { + SemanticDirection::Changed + } else { + SemanticDirection::Unbaselined + }; + let changes = changed_semantic_dimensions(loaded, baseline, disclosure_digest) + .into_iter() + .filter(|dimension| { + affected_products(loaded, baseline, *dimension).any() + && (baseline.is_some() || semantic_dimension_has_current_subjects(loaded, *dimension)) + }) + .map(|dimension| semantic_impact_for_dimension(loaded, baseline, dimension, direction)) + .collect(); + + ProjectSemanticImpactReportV1 { + schema_version: ProjectSemanticImpactSchemaVersion::V1, + baseline: report_baseline, + changes, + } +} + +fn semantic_dimension_has_current_subjects( + loaded: &LoadedRegistryProject, + dimension: SemanticDimension, +) -> bool { + match dimension { + SemanticDimension::Claim | SemanticDimension::Disclosure => loaded + .project + .services + .values() + .any(|service| !service.claims.is_empty()), + SemanticDimension::Integration => { + !loaded.project.integrations.is_empty() + || !loaded.project.entities.is_empty() + || loaded + .project + .services + .values() + .any(|service| !service.consultations.is_empty()) + } + SemanticDimension::ServicePolicy => !loaded.project.services.is_empty(), + SemanticDimension::OperatorSecurity | SemanticDimension::Compiler => true, + } +} + +fn changed_semantic_dimensions( + loaded: &LoadedRegistryProject, + baseline: Option<&Value>, + disclosure_digest: &str, +) -> Vec { + let previous_digests = baseline.and_then(|state| state.get("semantic_digests")); + let mut changes = [ + ( + SemanticDimension::Claim, + loaded.semantic_digests.claim.as_str(), + previous_digests + .and_then(|digests| digests.get("claim")) + .and_then(Value::as_str), + ), + ( + SemanticDimension::Integration, + loaded.semantic_digests.integration.as_str(), + previous_digests + .and_then(|digests| digests.get("integration")) + .and_then(Value::as_str), + ), + ( + SemanticDimension::ServicePolicy, + loaded.semantic_digests.service_policy.as_str(), + previous_digests + .and_then(|digests| digests.get("service_policy")) + .and_then(Value::as_str), + ), + ( + SemanticDimension::OperatorSecurity, + loaded.semantic_digests.operator_security.as_str(), + previous_digests + .and_then(|digests| digests.get("operator_security")) + .and_then(Value::as_str), + ), + ( + SemanticDimension::Disclosure, + disclosure_digest, + baseline + .and_then(|state| state.get("disclosure_digest")) + .and_then(Value::as_str), + ), + ] + .into_iter() + .filter(|(_, current, previous)| *previous != Some(*current)) + .map(|(dimension, _, _)| dimension) + .collect::>(); + + // Compiler changes remain independent of authored semantic dimensions. + // An initial report has no prior compiler to compare, matching the legacy + // semantic_changes projection. + if baseline + .and_then(|state| state.get("compiler_version")) + .and_then(Value::as_str) + .is_some_and(|version| version != env!("CARGO_PKG_VERSION")) + { + changes.push(SemanticDimension::Compiler); + } + changes.sort_unstable(); + changes.dedup(); + changes +} + +fn semantic_impact_for_dimension( + loaded: &LoadedRegistryProject, + baseline: Option<&Value>, + dimension: SemanticDimension, + direction: SemanticDirection, +) -> ProjectSemanticImpact { + let affected_products = affected_products(loaded, baseline, dimension); + ProjectSemanticImpact { + location: SemanticImpactLocation::Dimension, + dimension, + direction, + affected_subjects: affected_subjects(loaded, affected_products), + consumers: consumers(affected_products), + review_classes: review_classes(dimension, affected_products), + product_impacts: product_impacts(dimension, affected_products), + requirements: requirements(affected_products), + } +} + +#[derive(Clone, Copy)] +struct AffectedProducts { + relay: bool, + notary: bool, +} + +impl AffectedProducts { + const fn none() -> Self { + Self { + relay: false, + notary: false, + } + } + + const fn both() -> Self { + Self { + relay: true, + notary: true, + } + } + + const fn any(self) -> bool { + self.relay || self.notary + } + + const fn union(self, other: Self) -> Self { + Self { + relay: self.relay || other.relay, + notary: self.notary || other.notary, + } + } + + const fn intersect(self, other: Self) -> Self { + Self { + relay: self.relay && other.relay, + notary: self.notary && other.notary, + } + } +} + +fn affected_products( + loaded: &LoadedRegistryProject, + baseline: Option<&Value>, + dimension: SemanticDimension, +) -> AffectedProducts { + let dimension_products = match dimension { + SemanticDimension::Claim | SemanticDimension::Disclosure => AffectedProducts { + relay: false, + notary: true, + }, + SemanticDimension::Integration + | SemanticDimension::ServicePolicy + | SemanticDimension::OperatorSecurity + | SemanticDimension::Compiler => AffectedProducts { + relay: true, + notary: true, + }, + }; + let (requires_relay, requires_notary) = project_product_topology(&loaded.project); + let current_products = AffectedProducts { + relay: requires_relay, + notary: requires_notary, + }; + dimension_products.intersect(current_products.union(baseline_product_topology(baseline))) +} + +fn baseline_product_topology(baseline: Option<&Value>) -> AffectedProducts { + let Some(baseline) = baseline else { + return AffectedProducts::none(); + }; + if let Some(products) = baseline + .pointer("/promotion_projection/products") + .and_then(Value::as_array) + { + let mut topology = AffectedProducts::none(); + for product in products { + match product.as_str() { + Some("relay") => topology.relay = true, + Some("notary") => topology.notary = true, + _ => return AffectedProducts::both(), + } + } + return topology; + } + + if let Some(digests) = baseline + .get("generated_closure_digests") + .and_then(Value::as_object) + { + let topology = AffectedProducts { + relay: digests.get("relay").is_some_and(Value::is_string), + notary: digests.get("notary").is_some_and(Value::is_string), + }; + if topology.any() { + return topology; + } + } + + // Older or malformed signed baselines do not provide enough product + // inventory to prove that a removed product has no retirement obligation. + AffectedProducts::both() +} + +fn affected_subjects( + loaded: &LoadedRegistryProject, + products: AffectedProducts, +) -> Vec { + let mut subjects = BTreeMap::<(u8, String), AffectedSubjectKind>::new(); + let mut add = |kind: AffectedSubjectKind, id: String| { + subjects + .entry((subject_kind_rank(kind), id)) + .or_insert(kind); + }; + + // A dimension digest cannot identify the changed member. Include the full + // authored identity closure that can feed compilation, fixture validation, + // policy review, or disclosure review. Only stable authored identifiers and + // aliases are retained, never authored values or filesystem locations. + for (integration_alias, integration) in &loaded.integrations { + add(AffectedSubjectKind::Integration, integration_alias.clone()); + for (_, fixture) in &integration.fixtures { + add( + AffectedSubjectKind::Fixture, + format!("{integration_alias}.{}", fixture.name), + ); + } + } + for (service_id, service) in &loaded.project.services { + add(AffectedSubjectKind::ServicePolicy, service_id.clone()); + for consultation_id in service.consultations.keys() { + add( + AffectedSubjectKind::Consultation, + format!("{service_id}.{consultation_id}"), + ); + } + for claim_id in service.claims.keys() { + let id = format!("{service_id}.{claim_id}"); + add(AffectedSubjectKind::Claim, id.clone()); + add(AffectedSubjectKind::Disclosure, id); + } + } + + if products.relay { + add( + AffectedSubjectKind::ProductInput, + "registry-relay.config".to_string(), + ); + for artifact in [ + "registry-relay.consultation-contracts", + "registry-relay.integration-packs", + "registry-relay.private-bindings", + "registry-relay.runtime-config", + ] { + add(AffectedSubjectKind::GeneratedArtifact, artifact.to_string()); + } + } + if products.notary { + add( + AffectedSubjectKind::ProductInput, + "registry-notary.config".to_string(), + ); + for artifact in [ + "registry-notary.claim-configuration", + "registry-notary.disclosure-policy", + "registry-notary.runtime-config", + ] { + add(AffectedSubjectKind::GeneratedArtifact, artifact.to_string()); + } + } + + subjects + .into_iter() + .map(|((_, id), kind)| AffectedSubject { kind, id }) + .collect() +} + +const fn subject_kind_rank(kind: AffectedSubjectKind) -> u8 { + match kind { + AffectedSubjectKind::Integration => 0, + AffectedSubjectKind::Fixture => 1, + AffectedSubjectKind::ServicePolicy => 2, + AffectedSubjectKind::Consultation => 3, + AffectedSubjectKind::Claim => 4, + AffectedSubjectKind::Disclosure => 5, + AffectedSubjectKind::ProductInput => 6, + AffectedSubjectKind::GeneratedArtifact => 7, + } +} + +fn consumers(products: AffectedProducts) -> Vec { + let mut consumers = vec![ImpactConsumer::RegistryctlAuthoring]; + if products.relay { + consumers.push(ImpactConsumer::RegistryRelay); + } + if products.notary { + consumers.push(ImpactConsumer::RegistryNotary); + } + consumers.push(ImpactConsumer::EditorTooling); + consumers.push(ImpactConsumer::DocsGenerator); + consumers.push(ImpactConsumer::BundleSigner); + consumers.push(ImpactConsumer::DeploymentTooling); + consumers.push(ImpactConsumer::Operator); + consumers +} + +fn review_classes( + dimension: SemanticDimension, + products: AffectedProducts, +) -> Vec { + let mut classes = match dimension { + SemanticDimension::OperatorSecurity => vec![ + ImpactReviewClass::Contract, + ImpactReviewClass::Authoring, + ImpactReviewClass::Interoperability, + ImpactReviewClass::Privacy, + ImpactReviewClass::Security, + ImpactReviewClass::Relay, + ImpactReviewClass::Notary, + ImpactReviewClass::Compatibility, + ImpactReviewClass::Testing, + ImpactReviewClass::Operations, + ImpactReviewClass::Release, + ], + SemanticDimension::Claim | SemanticDimension::Disclosure => vec![ + ImpactReviewClass::Contract, + ImpactReviewClass::Authoring, + ImpactReviewClass::Semantics, + ImpactReviewClass::Interoperability, + ImpactReviewClass::Privacy, + ImpactReviewClass::Security, + ImpactReviewClass::Notary, + ImpactReviewClass::Compatibility, + ImpactReviewClass::Documentation, + ImpactReviewClass::Testing, + ImpactReviewClass::Operations, + ImpactReviewClass::Release, + ], + SemanticDimension::Integration + | SemanticDimension::ServicePolicy + | SemanticDimension::Compiler => vec![ + ImpactReviewClass::Contract, + ImpactReviewClass::Authoring, + ImpactReviewClass::Semantics, + ImpactReviewClass::Interoperability, + ImpactReviewClass::Privacy, + ImpactReviewClass::Security, + ImpactReviewClass::Relay, + ImpactReviewClass::Notary, + ImpactReviewClass::Compatibility, + ImpactReviewClass::Documentation, + ImpactReviewClass::Testing, + ImpactReviewClass::Operations, + ImpactReviewClass::Release, + ], + }; + if !products.relay { + classes.retain(|class| *class != ImpactReviewClass::Relay); + } + if !products.notary { + classes.retain(|class| *class != ImpactReviewClass::Notary); + } + classes +} + +fn product_impacts( + dimension: SemanticDimension, + products: AffectedProducts, +) -> Vec { + let runtime_impact = if dimension == SemanticDimension::OperatorSecurity { + ProductImpactClass::Reconfigure + } else { + ProductImpactClass::Regenerate + }; + let mut impacts = vec![ProductImpact { + product: ProjectProduct::Registryctl, + impact: ProductImpactClass::Revalidate, + }]; + if products.relay { + impacts.push(ProductImpact { + product: ProjectProduct::Relay, + impact: runtime_impact, + }); + } + if products.notary { + impacts.push(ProductImpact { + product: ProjectProduct::Notary, + impact: runtime_impact, + }); + } + impacts.push(ProductImpact { + product: ProjectProduct::Docs, + impact: ProductImpactClass::Republish, + }); + impacts +} + +const fn requirements(products: AffectedProducts) -> ImpactRequirements { + match (products.relay, products.notary) { + (false, false) => ImpactRequirements { + signing: SigningRequirement::None, + activation: ActivationRequirement::None, + restart: RestartRequirement::None, + }, + (true, false) => ImpactRequirements { + signing: SigningRequirement::RelayBundle, + activation: ActivationRequirement::ApplyRelayConfig, + restart: RestartRequirement::RegistryRelay, + }, + (false, true) => ImpactRequirements { + signing: SigningRequirement::NotaryBundle, + activation: ActivationRequirement::ApplyNotaryConfig, + restart: RestartRequirement::RegistryNotary, + }, + (true, true) => ImpactRequirements { + // Relay and Notary remain separately owned product bundles. This + // plural requirement does not represent project-root or atomic + // cross-product signing. + signing: SigningRequirement::RelayAndNotaryBundles, + activation: ActivationRequirement::ApplyRelayAndNotaryConfig, + restart: RestartRequirement::RegistryRelayAndNotary, + }, + } +} + +#[cfg(test)] +mod semantic_impact_tests { + use super::*; + + fn loaded_project() -> LoadedRegistryProject { + load_registry_project( + &PathBuf::from(env!("CARGO_MANIFEST_DIR")) + .join("tests/fixtures/project-authoring/dhis2-tracker"), + Some("local"), + ) + .expect("semantic-impact fixture loads") + } + + fn loaded_relay_only_project() -> LoadedRegistryProject { + load_registry_project( + &PathBuf::from(env!("CARGO_MANIFEST_DIR")) + .join("tests/fixtures/project-authoring/relay-only-materialization"), + Some("local"), + ) + .expect("Relay-only semantic-impact fixture loads") + } + + fn loaded_notary_only_project() -> LoadedRegistryProject { + load_registry_project( + &PathBuf::from(env!("CARGO_MANIFEST_DIR")) + .join("tests/fixtures/project-authoring/notary-only-evaluation"), + Some("local"), + ) + .expect("Notary-only semantic-impact fixture loads") + } + + fn disclosure_digest() -> String { + format!("sha256:{}", "d".repeat(64)) + } + + fn matching_baseline(loaded: &LoadedRegistryProject, disclosure_digest: &str) -> Value { + json!({ + "compiler_version": env!("CARGO_PKG_VERSION"), + "semantic_digests": { + "claim": loaded.semantic_digests.claim, + "integration": loaded.semantic_digests.integration, + "service_policy": loaded.semantic_digests.service_policy, + "operator_security": loaded.semantic_digests.operator_security, + }, + "disclosure_digest": disclosure_digest, + }) + } + + fn dimensions(report: &ProjectSemanticImpactReportV1) -> Vec { + report + .changes + .iter() + .map(|change| change.dimension) + .collect() + } + + fn consumer_rank(consumer: ImpactConsumer) -> u8 { + match consumer { + ImpactConsumer::RegistryctlAuthoring => 0, + ImpactConsumer::RegistryRelay => 1, + ImpactConsumer::RegistryNotary => 2, + ImpactConsumer::EditorTooling => 3, + ImpactConsumer::DocsGenerator => 4, + ImpactConsumer::BundleSigner => 5, + ImpactConsumer::DeploymentTooling => 6, + ImpactConsumer::Operator => 7, + } + } + + fn review_class_rank(class: ImpactReviewClass) -> u8 { + match class { + ImpactReviewClass::Contract => 0, + ImpactReviewClass::Authoring => 1, + ImpactReviewClass::Semantics => 2, + ImpactReviewClass::Interoperability => 3, + ImpactReviewClass::Privacy => 4, + ImpactReviewClass::Security => 5, + ImpactReviewClass::Relay => 6, + ImpactReviewClass::Notary => 7, + ImpactReviewClass::Compatibility => 8, + ImpactReviewClass::Documentation => 9, + ImpactReviewClass::Testing => 10, + ImpactReviewClass::Operations => 11, + ImpactReviewClass::Release => 12, + } + } + + fn product_rank(product: ProjectProduct) -> u8 { + match product { + ProjectProduct::Registryctl => 0, + ProjectProduct::Relay => 1, + ProjectProduct::Notary => 2, + ProjectProduct::Editor => 3, + ProjectProduct::Docs => 4, + } + } + + #[test] + fn initial_report_is_dimension_precise_and_preserves_legacy_projection() { + let loaded = loaded_project(); + let disclosure_digest = disclosure_digest(); + let report = project_semantic_impact_report(&loaded, None, &disclosure_digest); + + assert_eq!(report.baseline, ProjectBaseline::InitialWithoutBaseline); + assert_eq!( + dimensions(&report), + vec![ + SemanticDimension::Claim, + SemanticDimension::Integration, + SemanticDimension::ServicePolicy, + SemanticDimension::OperatorSecurity, + SemanticDimension::Disclosure, + ] + ); + assert!(report.changes.iter().all(|change| { + change.location == SemanticImpactLocation::Dimension + && change.direction == SemanticDirection::Unbaselined + })); + + let legacy = semantic_change_records(&loaded, None, &disclosure_digest); + assert_eq!( + serde_json::to_value(report.dimension_only_changes()).expect("projection serializes"), + serde_json::to_value(legacy).expect("legacy changes serialize"), + ); + } + + #[test] + fn verified_baseline_reports_each_changed_dimension_conservatively() { + let loaded = loaded_project(); + let disclosure_digest = disclosure_digest(); + let dimension_cases = [ + (SemanticDimension::Claim, "claim"), + (SemanticDimension::Integration, "integration"), + (SemanticDimension::ServicePolicy, "service_policy"), + (SemanticDimension::OperatorSecurity, "operator_security"), + (SemanticDimension::Disclosure, "disclosure_digest"), + (SemanticDimension::Compiler, "compiler_version"), + ]; + + for (expected, key) in dimension_cases { + let mut baseline = matching_baseline(&loaded, &disclosure_digest); + match key { + "disclosure_digest" | "compiler_version" => { + baseline[key] = Value::String("previous".to_string()); + } + semantic_digest => { + baseline["semantic_digests"][semantic_digest] = + Value::String(format!("sha256:{}", "0".repeat(64))); + } + } + let report = + project_semantic_impact_report(&loaded, Some(&baseline), &disclosure_digest); + assert_eq!(report.baseline, ProjectBaseline::VerifiedSignedBundle); + assert_eq!( + dimensions(&report), + vec![expected], + "unexpected change set for {key}" + ); + let change = &report.changes[0]; + assert_eq!(change.location, SemanticImpactLocation::Dimension); + assert_eq!(change.direction, SemanticDirection::Changed); + } + } + + #[test] + fn matching_verified_baseline_has_no_changes() { + let loaded = loaded_project(); + let disclosure_digest = disclosure_digest(); + let baseline = matching_baseline(&loaded, &disclosure_digest); + let report = project_semantic_impact_report(&loaded, Some(&baseline), &disclosure_digest); + + assert_eq!(report.baseline, ProjectBaseline::VerifiedSignedBundle); + assert!(report.changes.is_empty()); + assert!(report.dimension_only_changes().is_empty()); + } + + #[test] + fn relay_only_impact_never_requires_notary_review_signing_or_activation() { + let loaded = loaded_relay_only_project(); + let report = project_semantic_impact_report(&loaded, None, &disclosure_digest()); + + assert_eq!( + dimensions(&report), + vec![ + SemanticDimension::Integration, + SemanticDimension::OperatorSecurity, + ] + ); + for change in report.changes { + assert!(change.consumers.contains(&ImpactConsumer::RegistryRelay)); + assert!(!change.consumers.contains(&ImpactConsumer::RegistryNotary)); + assert!(change.review_classes.contains(&ImpactReviewClass::Relay)); + assert!(!change.review_classes.contains(&ImpactReviewClass::Notary)); + assert!(change + .product_impacts + .iter() + .any(|impact| impact.product == ProjectProduct::Relay)); + assert!(!change + .product_impacts + .iter() + .any(|impact| impact.product == ProjectProduct::Notary)); + assert_eq!(change.requirements.signing, SigningRequirement::RelayBundle); + assert_eq!( + change.requirements.activation, + ActivationRequirement::ApplyRelayConfig + ); + assert_eq!( + change.requirements.restart, + RestartRequirement::RegistryRelay + ); + assert!(!change.affected_subjects.iter().any(|subject| { + subject.id.starts_with("registry-notary.") + || matches!( + subject.kind, + AffectedSubjectKind::Claim | AffectedSubjectKind::Disclosure + ) + })); + } + } + + #[test] + fn notary_only_impact_never_requires_relay_review_signing_or_activation() { + let loaded = loaded_notary_only_project(); + let report = project_semantic_impact_report(&loaded, None, &disclosure_digest()); + + assert_eq!( + dimensions(&report), + vec![ + SemanticDimension::Claim, + SemanticDimension::ServicePolicy, + SemanticDimension::OperatorSecurity, + SemanticDimension::Disclosure, + ] + ); + for change in report.changes { + assert!(change.consumers.contains(&ImpactConsumer::RegistryNotary)); + assert!(!change.consumers.contains(&ImpactConsumer::RegistryRelay)); + assert!(change.review_classes.contains(&ImpactReviewClass::Notary)); + assert!(!change.review_classes.contains(&ImpactReviewClass::Relay)); + assert!(change + .product_impacts + .iter() + .any(|impact| impact.product == ProjectProduct::Notary)); + assert!(!change + .product_impacts + .iter() + .any(|impact| impact.product == ProjectProduct::Relay)); + assert_eq!(change.requirements.signing, SigningRequirement::NotaryBundle); + assert_eq!( + change.requirements.activation, + ActivationRequirement::ApplyNotaryConfig + ); + assert_eq!( + change.requirements.restart, + RestartRequirement::RegistryNotary + ); + assert!(!change.affected_subjects.iter().any(|subject| { + subject.id.starts_with("registry-relay.") + || subject.kind == AffectedSubjectKind::Consultation + })); + } + } + + #[test] + fn verified_baseline_product_removal_keeps_removed_product_obligations() { + let current = loaded_relay_only_project(); + let previous = loaded_project(); + let mut baseline = matching_baseline( + &previous, + &format!("sha256:{}", "b".repeat(64)), + ); + for digest in [ + "claim", + "integration", + "service_policy", + "operator_security", + ] { + baseline["semantic_digests"][digest] = + Value::String(format!("sha256:{}", "0".repeat(64))); + } + baseline["promotion_projection"] = json!({ + "products": ["relay", "notary"], + }); + let report = + project_semantic_impact_report(¤t, Some(&baseline), &disclosure_digest()); + + for dimension in [SemanticDimension::Claim, SemanticDimension::Disclosure] { + let change = report + .changes + .iter() + .find(|change| change.dimension == dimension) + .unwrap_or_else(|| panic!("{dimension:?} product-removal impact is retained")); + assert!(change.consumers.contains(&ImpactConsumer::RegistryNotary)); + assert!(!change.consumers.contains(&ImpactConsumer::RegistryRelay)); + assert_eq!(change.requirements.signing, SigningRequirement::NotaryBundle); + assert_eq!( + change.requirements.activation, + ActivationRequirement::ApplyNotaryConfig + ); + assert_eq!( + change.requirements.restart, + RestartRequirement::RegistryNotary + ); + } + for dimension in [ + SemanticDimension::Integration, + SemanticDimension::ServicePolicy, + SemanticDimension::OperatorSecurity, + ] { + let change = report + .changes + .iter() + .find(|change| change.dimension == dimension) + .unwrap_or_else(|| panic!("{dimension:?} product-removal impact is retained")); + assert_eq!( + change.requirements.signing, + SigningRequirement::RelayAndNotaryBundles + ); + assert_eq!( + change.requirements.activation, + ActivationRequirement::ApplyRelayAndNotaryConfig + ); + assert_eq!( + change.requirements.restart, + RestartRequirement::RegistryRelayAndNotary + ); + } + } + + #[test] + fn verified_baseline_relay_removal_keeps_removed_product_obligations() { + let current = loaded_notary_only_project(); + let previous = loaded_project(); + let mut baseline = + matching_baseline(&previous, &format!("sha256:{}", "b".repeat(64))); + for digest in [ + "claim", + "integration", + "service_policy", + "operator_security", + ] { + baseline["semantic_digests"][digest] = + Value::String(format!("sha256:{}", "0".repeat(64))); + } + baseline["promotion_projection"] = json!({ + "products": ["relay", "notary"], + }); + let report = + project_semantic_impact_report(¤t, Some(&baseline), &disclosure_digest()); + + for dimension in [ + SemanticDimension::Integration, + SemanticDimension::ServicePolicy, + SemanticDimension::OperatorSecurity, + ] { + let change = report + .changes + .iter() + .find(|change| change.dimension == dimension) + .unwrap_or_else(|| panic!("{dimension:?} product-removal impact is retained")); + assert!(change.consumers.contains(&ImpactConsumer::RegistryRelay)); + assert!(change.consumers.contains(&ImpactConsumer::RegistryNotary)); + assert_eq!( + change.requirements.signing, + SigningRequirement::RelayAndNotaryBundles + ); + assert_eq!( + change.requirements.activation, + ActivationRequirement::ApplyRelayAndNotaryConfig + ); + assert_eq!( + change.requirements.restart, + RestartRequirement::RegistryRelayAndNotary + ); + } + } + + #[test] + fn legacy_baseline_without_product_inventory_stays_conservative() { + let current = loaded_relay_only_project(); + let previous = loaded_project(); + let mut baseline = + matching_baseline(&previous, &format!("sha256:{}", "b".repeat(64))); + baseline["semantic_digests"]["integration"] = + Value::String(format!("sha256:{}", "0".repeat(64))); + let report = + project_semantic_impact_report(¤t, Some(&baseline), &disclosure_digest()); + let integration = report + .changes + .iter() + .find(|change| change.dimension == SemanticDimension::Integration) + .expect("legacy baseline conservatively retains integration impact"); + + assert_eq!( + integration.requirements.signing, + SigningRequirement::RelayAndNotaryBundles + ); + assert_eq!( + integration.requirements.activation, + ActivationRequirement::ApplyRelayAndNotaryConfig + ); + assert_eq!( + integration.requirements.restart, + RestartRequirement::RegistryRelayAndNotary + ); + } + + #[test] + fn each_dimension_has_conservative_signing_activation_and_restart() { + let loaded = loaded_project(); + let expected = [ + ( + SemanticDimension::Claim, + SigningRequirement::NotaryBundle, + ActivationRequirement::ApplyNotaryConfig, + RestartRequirement::RegistryNotary, + ), + ( + SemanticDimension::Integration, + SigningRequirement::RelayAndNotaryBundles, + ActivationRequirement::ApplyRelayAndNotaryConfig, + RestartRequirement::RegistryRelayAndNotary, + ), + ( + SemanticDimension::ServicePolicy, + SigningRequirement::RelayAndNotaryBundles, + ActivationRequirement::ApplyRelayAndNotaryConfig, + RestartRequirement::RegistryRelayAndNotary, + ), + ( + SemanticDimension::OperatorSecurity, + SigningRequirement::RelayAndNotaryBundles, + ActivationRequirement::ApplyRelayAndNotaryConfig, + RestartRequirement::RegistryRelayAndNotary, + ), + ( + SemanticDimension::Disclosure, + SigningRequirement::NotaryBundle, + ActivationRequirement::ApplyNotaryConfig, + RestartRequirement::RegistryNotary, + ), + ( + SemanticDimension::Compiler, + SigningRequirement::RelayAndNotaryBundles, + ActivationRequirement::ApplyRelayAndNotaryConfig, + RestartRequirement::RegistryRelayAndNotary, + ), + ]; + + for (dimension, signing, activation, restart) in expected { + let impact = semantic_impact_for_dimension( + &loaded, + None, + dimension, + SemanticDirection::Changed, + ); + assert_eq!(impact.requirements.signing, signing); + assert_eq!(impact.requirements.activation, activation); + assert_eq!(impact.requirements.restart, restart); + assert!(impact.consumers.contains(&ImpactConsumer::BundleSigner)); + assert!(impact + .consumers + .contains(&ImpactConsumer::DeploymentTooling)); + assert!(impact.consumers.contains(&ImpactConsumer::Operator)); + assert!(impact + .review_classes + .contains(&ImpactReviewClass::Operations)); + assert!(impact.review_classes.contains(&ImpactReviewClass::Release)); + } + } + + #[test] + fn each_dimension_names_the_full_safe_authored_identity_closure() { + let loaded = loaded_project(); + for dimension in [ + SemanticDimension::Claim, + SemanticDimension::Integration, + SemanticDimension::ServicePolicy, + SemanticDimension::OperatorSecurity, + SemanticDimension::Disclosure, + SemanticDimension::Compiler, + ] { + let impact = semantic_impact_for_dimension( + &loaded, + None, + dimension, + SemanticDirection::Changed, + ); + let subjects = impact + .affected_subjects + .iter() + .map(|subject| (subject_kind_rank(subject.kind), subject.id.as_str())) + .collect::>(); + let unique = subjects.iter().copied().collect::>(); + assert_eq!(subjects.len(), unique.len()); + assert!(subjects.windows(2).all(|pair| pair[0] < pair[1])); + let consumer_ranks = impact + .consumers + .iter() + .copied() + .map(consumer_rank) + .collect::>(); + assert!(consumer_ranks.windows(2).all(|pair| pair[0] < pair[1])); + let review_ranks = impact + .review_classes + .iter() + .copied() + .map(review_class_rank) + .collect::>(); + assert!(review_ranks.windows(2).all(|pair| pair[0] < pair[1])); + let product_ranks = impact + .product_impacts + .iter() + .map(|product| product_rank(product.product)) + .collect::>(); + assert!(product_ranks.windows(2).all(|pair| pair[0] < pair[1])); + assert!(impact.affected_subjects.iter().any(|subject| { + subject.kind == AffectedSubjectKind::Integration && subject.id == "health-record" + })); + assert!(impact.affected_subjects.iter().any(|subject| { + subject.kind == AffectedSubjectKind::Fixture + && subject.id == "health-record.complete-child-health-evidence" + })); + assert!(impact.affected_subjects.iter().any(|subject| { + subject.kind == AffectedSubjectKind::ServicePolicy + && subject.id == "health-verification" + })); + assert!(impact.affected_subjects.iter().any(|subject| { + subject.kind == AffectedSubjectKind::Consultation + && subject.id == "health-verification.health" + })); + assert!(impact.affected_subjects.iter().any(|subject| { + subject.kind == AffectedSubjectKind::Claim + && subject.id == "health-verification.child-program-active" + })); + assert!(impact.affected_subjects.iter().any(|subject| { + subject.kind == AffectedSubjectKind::Disclosure + && subject.id == "health-verification.child-program-active" + })); + assert!(impact + .affected_subjects + .iter() + .any(|subject| { subject.kind == AffectedSubjectKind::ProductInput })); + assert!(impact + .affected_subjects + .iter() + .any(|subject| { subject.kind == AffectedSubjectKind::GeneratedArtifact })); + } + } + + #[test] + fn report_never_exposes_runtime_or_fixture_values() { + let loaded = loaded_project(); + let report = ProjectSemanticImpactReportV1 { + schema_version: ProjectSemanticImpactSchemaVersion::V1, + baseline: ProjectBaseline::VerifiedSignedBundle, + changes: [ + SemanticDimension::Claim, + SemanticDimension::Integration, + SemanticDimension::ServicePolicy, + SemanticDimension::OperatorSecurity, + SemanticDimension::Disclosure, + SemanticDimension::Compiler, + ] + .into_iter() + .map(|dimension| { + semantic_impact_for_dimension( + &loaded, + None, + dimension, + SemanticDirection::Changed, + ) + }) + .collect(), + }; + let rendered = serde_json::to_string(&report).expect("semantic impact serializes"); + + for forbidden in [ + "https://health-registry.invalid", + "127.0.0.1", + "/run/secrets/relay-workload-token", + "HEALTH_REGISTRY_USERNAME", + "REGISTRY_NOTARY_ISSUER_JWK", + "health-relay-client", + "A0000000001", + "Nia", + "REF-0001", + ] { + assert!( + !rendered.contains(forbidden), + "semantic impact exposed unsafe value {forbidden}" + ); + } + } + + #[test] + fn verified_projection_matches_legacy_changes_including_compiler() { + let loaded = loaded_project(); + let disclosure_digest = disclosure_digest(); + let mut baseline = matching_baseline(&loaded, &disclosure_digest); + baseline["semantic_digests"]["claim"] = Value::String(format!("sha256:{}", "0".repeat(64))); + baseline["compiler_version"] = Value::String("previous".to_string()); + + let report = project_semantic_impact_report(&loaded, Some(&baseline), &disclosure_digest); + let legacy = semantic_change_records(&loaded, Some(&baseline), &disclosure_digest); + assert_eq!( + serde_json::to_value(report.dimension_only_changes()).expect("projection serializes"), + serde_json::to_value(legacy).expect("legacy changes serialize"), + ); + } +} diff --git a/crates/registryctl/src/project_authoring/diagnostic_reference.rs b/crates/registryctl/src/project_authoring/diagnostic_reference.rs new file mode 100644 index 000000000..2b8ccf2f9 --- /dev/null +++ b/crates/registryctl/src/project_authoring/diagnostic_reference.rs @@ -0,0 +1,847 @@ +// SPDX-License-Identifier: Apache-2.0 +//! Pure, deterministic references for closed Registry Stack diagnostic codes. +//! +//! Product owners retain their code, meaning, rule, remediation, lifecycle, +//! and evidence-policy definitions. This module projects those definitions +//! into one strict public shape without reading a workspace, environment, +//! secret, runtime service, or process-local diagnostic value. + +use std::collections::BTreeSet; + +use registry_notary_server::{ + NotaryActivationCode, NotaryActivationCodeLifecycle, NOTARY_ACTIVATION_CODE_DEFINITIONS, +}; +use registry_platform_ops::{ + BundleVerificationCode, BundleVerificationCodeLifecycle, BundleVerificationEvidencePolicy, + BUNDLE_VERIFICATION_CODE_DEFINITIONS, +}; +use registry_relay::consultation::{ + consultation_service_activation_definitions, ConsultationServiceActivationCode, + ConsultationServiceActivationLifecycle, +}; +use registry_relay::process_startup::{ + ProcessStartupCode, ProcessStartupCodeLifecycle, ProcessStartupEvidencePolicy, + PROCESS_STARTUP_CODE_DEFINITIONS, +}; +use serde::{Deserialize, Serialize}; + +use super::fixture_diagnostics::{fixture_diagnostic_definition, FIXTURE_DIAGNOSTIC_DEFINITIONS}; +use super::{ + preflight_diagnostic_definition, project_authoring_diagnostic_definitions, + PREFLIGHT_DIAGNOSTIC_DEFINITIONS, +}; + +pub const AUTHORING_ERROR_REFERENCE_SCHEMA_VERSION_V1: &str = + "registryctl.authoring_error_reference.v1"; +pub const FIXTURE_ERROR_REFERENCE_SCHEMA_VERSION_V1: &str = + "registryctl.fixture_error_reference.v1"; +pub const OPERATOR_ERROR_REFERENCE_SCHEMA_VERSION_V1: &str = + "registryctl.operator_error_reference.v1"; + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum ErrorReferenceFamily { + AuthoringValidation, + BundleVerification, + FixtureExecution, + NotaryActivation, + OperatorPreflight, + RelayActivation, + RelayProcessStartup, +} + +impl ErrorReferenceFamily { + #[must_use] + pub const fn as_str(self) -> &'static str { + match self { + Self::AuthoringValidation => "authoring_validation", + Self::BundleVerification => "bundle_verification", + Self::FixtureExecution => "fixture_execution", + Self::NotaryActivation => "notary_activation", + Self::OperatorPreflight => "operator_preflight", + Self::RelayActivation => "relay_activation", + Self::RelayProcessStartup => "relay_process_startup", + } + } + + const fn docs_catalog(self) -> &'static str { + match self { + Self::AuthoringValidation => "authoring", + Self::FixtureExecution => "fixture", + Self::BundleVerification + | Self::NotaryActivation + | Self::OperatorPreflight + | Self::RelayActivation + | Self::RelayProcessStartup => "operator", + } + } +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum ErrorReferenceOwner { + RegistryNotary, + RegistryPlatformOps, + RegistryRelay, + Registryctl, +} + +impl ErrorReferenceOwner { + #[must_use] + pub const fn as_str(self) -> &'static str { + match self { + Self::RegistryNotary => "registry_notary", + Self::RegistryPlatformOps => "registry_platform_ops", + Self::RegistryRelay => "registry_relay", + Self::Registryctl => "registryctl", + } + } +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum ErrorReferenceProduct { + RegistryNotary, + RegistryPlatformOps, + RegistryRelay, + Registryctl, + RegistryctlRelayOfflineHarness, +} + +impl ErrorReferenceProduct { + #[must_use] + pub const fn as_str(self) -> &'static str { + match self { + Self::RegistryNotary => "registry_notary", + Self::RegistryPlatformOps => "registry_platform_ops", + Self::RegistryRelay => "registry_relay", + Self::Registryctl => "registryctl", + Self::RegistryctlRelayOfflineHarness => "registryctl_relay_offline_harness", + } + } +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum ErrorReferenceValuePolicy { + NoReceivedValue, + NoRuntimeValues, + ReceivedTypeOnly, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum ErrorReferenceLifecycle { + Active, + Deprecated, + Released, + Unreleased, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum ErrorReferenceStability { + Pre1StableCode, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct ErrorReferenceEntry { + pub family: ErrorReferenceFamily, + pub code: String, + pub owner: ErrorReferenceOwner, + pub product: ErrorReferenceProduct, + pub phase: String, + pub safe_meaning: String, + pub rule: String, + pub safe_remediation: String, + pub field_address_pattern: Option, + pub evidence_scope: String, + pub secret_sensitive_value_policy: ErrorReferenceValuePolicy, + pub docs_anchor: String, + pub lifecycle: ErrorReferenceLifecycle, + pub introduced_in: Option, + pub stability: ErrorReferenceStability, + pub evidence_limitation: String, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct AuthoringErrorReferenceV1 { + pub schema_version: String, + pub entries: Vec, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct FixtureErrorReferenceV1 { + pub schema_version: String, + pub entries: Vec, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum OperatorErrorOmissionFamily { + BundleVerification, + NotaryActivation, + OperatorPreflight, + RelayActivation, + RelayProcessStartup, +} + +impl OperatorErrorOmissionFamily { + const fn as_str(self) -> &'static str { + match self { + Self::BundleVerification => "bundle_verification", + Self::NotaryActivation => "notary_activation", + Self::OperatorPreflight => "operator_preflight", + Self::RelayActivation => "relay_activation", + Self::RelayProcessStartup => "relay_process_startup", + } + } +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum OperatorErrorOmissionReason { + NoCompletePublicCodeCatalog, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct OperatorErrorOmission { + pub family: OperatorErrorOmissionFamily, + pub product: ErrorReferenceProduct, + pub reason: OperatorErrorOmissionReason, + pub evidence: String, + pub required_action: String, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct OperatorErrorReferenceV1 { + pub schema_version: String, + pub entries: Vec, + pub omissions: Vec, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq)] +pub enum ErrorReferenceValidationError { + SchemaVersionMismatch, + DuplicateEntry, + UnsortedEntries, + LifecycleVersionMismatch, + DocsAnchorMismatch, + EntriesDoNotMatchSources, + DuplicateOmission, + UnsortedOmissions, + OmissionsDoNotMatchSources, + SourceCatalogMismatch, +} + +#[must_use] +pub fn authoring_error_reference() -> AuthoringErrorReferenceV1 { + let mut entries = project_authoring_diagnostic_definitions() + .iter() + .map(|definition| ErrorReferenceEntry { + family: ErrorReferenceFamily::AuthoringValidation, + code: definition.code.to_string(), + owner: ErrorReferenceOwner::Registryctl, + product: ErrorReferenceProduct::Registryctl, + phase: definition.phase.to_string(), + safe_meaning: definition.accepted.to_string(), + rule: definition.rule.to_string(), + safe_remediation: definition.safe_remediation.to_string(), + field_address_pattern: authoring_address_pattern(definition.code).map(str::to_string), + evidence_scope: "offline authored project files selected for registryctl check" + .to_string(), + secret_sensitive_value_policy: match definition.safe_summary_policy { + "no_received_value" => ErrorReferenceValuePolicy::NoReceivedValue, + "received_type_only" => ErrorReferenceValuePolicy::ReceivedTypeOnly, + _ => unreachable!("authoring safe summary policy is closed"), + }, + docs_anchor: definition.documentation.to_string(), + lifecycle: ErrorReferenceLifecycle::Unreleased, + introduced_in: None, + stability: ErrorReferenceStability::Pre1StableCode, + evidence_limitation: + "Static authoring evidence does not prove live source or deployment compatibility." + .to_string(), + }) + .collect::>(); + entries.sort_by(|left, right| entry_key(left).cmp(&entry_key(right))); + AuthoringErrorReferenceV1 { + schema_version: AUTHORING_ERROR_REFERENCE_SCHEMA_VERSION_V1.to_string(), + entries, + } +} + +#[must_use] +pub fn fixture_error_reference() -> FixtureErrorReferenceV1 { + let mut entries = FIXTURE_DIAGNOSTIC_DEFINITIONS + .iter() + .map(|definition| { + let code = closed_string(&definition.code); + ErrorReferenceEntry { + family: ErrorReferenceFamily::FixtureExecution, + code: code.clone(), + owner: ErrorReferenceOwner::Registryctl, + product: ErrorReferenceProduct::RegistryctlRelayOfflineHarness, + phase: "offline_execution".to_string(), + safe_meaning: definition.safe_meaning.to_string(), + rule: definition.rule.to_string(), + safe_remediation: definition.safe_remediation.to_string(), + field_address_pattern: None, + evidence_scope: "offline synthetic fixture execution".to_string(), + secret_sensitive_value_policy: ErrorReferenceValuePolicy::NoRuntimeValues, + docs_anchor: docs_anchor( + ErrorReferenceFamily::FixtureExecution, + ErrorReferenceProduct::RegistryctlRelayOfflineHarness, + &code, + ), + lifecycle: ErrorReferenceLifecycle::Unreleased, + introduced_in: None, + stability: ErrorReferenceStability::Pre1StableCode, + evidence_limitation: + "Offline synthetic evidence does not prove live source compatibility." + .to_string(), + } + }) + .collect::>(); + entries.sort_by(|left, right| entry_key(left).cmp(&entry_key(right))); + FixtureErrorReferenceV1 { + schema_version: FIXTURE_ERROR_REFERENCE_SCHEMA_VERSION_V1.to_string(), + entries, + } +} + +#[must_use] +pub fn operator_error_reference() -> OperatorErrorReferenceV1 { + let mut entries = preflight_reference_entries(); + entries.extend(bundle_verification_reference_entries()); + entries.extend(notary_activation_reference_entries()); + entries.extend(relay_activation_reference_entries()); + entries.extend(relay_process_startup_reference_entries()); + entries.sort_by(|left, right| entry_key(left).cmp(&entry_key(right))); + + OperatorErrorReferenceV1 { + schema_version: OPERATOR_ERROR_REFERENCE_SCHEMA_VERSION_V1.to_string(), + entries, + omissions: expected_operator_omissions(), + } +} + +fn preflight_reference_entries() -> Vec { + PREFLIGHT_DIAGNOSTIC_DEFINITIONS + .iter() + .map(|definition| { + let code = closed_string(&definition.code); + ErrorReferenceEntry { + family: ErrorReferenceFamily::OperatorPreflight, + code: code.clone(), + owner: ErrorReferenceOwner::Registryctl, + product: ErrorReferenceProduct::Registryctl, + phase: closed_string(&definition.phase), + safe_meaning: closed_string(&definition.safe_meaning), + rule: closed_string(&definition.rule), + safe_remediation: definition.safe_remediation.to_string(), + field_address_pattern: definition.field_address_pattern.map(str::to_string), + evidence_scope: "offline local operator preflight".to_string(), + secret_sensitive_value_policy: ErrorReferenceValuePolicy::NoRuntimeValues, + docs_anchor: docs_anchor( + ErrorReferenceFamily::OperatorPreflight, + ErrorReferenceProduct::Registryctl, + &code, + ), + lifecycle: ErrorReferenceLifecycle::Unreleased, + introduced_in: None, + stability: ErrorReferenceStability::Pre1StableCode, + evidence_limitation: + "Preflight does not contact live sources or prove remote availability." + .to_string(), + } + }) + .collect() +} + +fn bundle_verification_reference_entries() -> Vec { + BUNDLE_VERIFICATION_CODE_DEFINITIONS + .iter() + .map(|definition| { + let code = definition.code.as_str().to_string(); + let lifecycle = match definition.lifecycle { + BundleVerificationCodeLifecycle::Unreleased => ErrorReferenceLifecycle::Unreleased, + BundleVerificationCodeLifecycle::Active => ErrorReferenceLifecycle::Active, + BundleVerificationCodeLifecycle::Deprecated => ErrorReferenceLifecycle::Deprecated, + }; + ErrorReferenceEntry { + family: ErrorReferenceFamily::BundleVerification, + code: code.clone(), + owner: ErrorReferenceOwner::RegistryPlatformOps, + product: ErrorReferenceProduct::RegistryPlatformOps, + phase: definition.phase.to_string(), + safe_meaning: definition.safe_meaning.to_string(), + rule: definition.rule.to_string(), + safe_remediation: definition.safe_remediation.to_string(), + field_address_pattern: None, + evidence_scope: definition.evidence_scope.to_string(), + secret_sensitive_value_policy: match definition.evidence_policy { + BundleVerificationEvidencePolicy::NoRuntimeValues => { + ErrorReferenceValuePolicy::NoRuntimeValues + } + _ => panic!("unsupported bundle-verification evidence policy"), + }, + docs_anchor: docs_anchor( + ErrorReferenceFamily::BundleVerification, + ErrorReferenceProduct::RegistryPlatformOps, + definition.docs_slug, + ), + lifecycle, + introduced_in: definition.introduced_in.map(str::to_string), + stability: ErrorReferenceStability::Pre1StableCode, + evidence_limitation: definition.evidence_limitation.to_string(), + } + }) + .collect() +} + +fn relay_activation_reference_entries() -> Vec { + consultation_service_activation_definitions() + .iter() + .map(|definition| { + let code = definition.code.as_str().to_string(); + let lifecycle = match definition.lifecycle { + ConsultationServiceActivationLifecycle::Unreleased => { + ErrorReferenceLifecycle::Unreleased + } + ConsultationServiceActivationLifecycle::Active => ErrorReferenceLifecycle::Active, + ConsultationServiceActivationLifecycle::Deprecated => { + ErrorReferenceLifecycle::Deprecated + } + _ => panic!("unsupported Relay activation lifecycle"), + }; + ErrorReferenceEntry { + family: ErrorReferenceFamily::RelayActivation, + code: code.clone(), + owner: ErrorReferenceOwner::RegistryRelay, + product: ErrorReferenceProduct::RegistryRelay, + phase: definition.phase.to_string(), + safe_meaning: definition.meaning.to_string(), + rule: definition.rule.to_string(), + safe_remediation: definition.remediation.to_string(), + field_address_pattern: None, + evidence_scope: definition.evidence_scope.to_string(), + secret_sensitive_value_policy: ErrorReferenceValuePolicy::NoRuntimeValues, + docs_anchor: docs_anchor( + ErrorReferenceFamily::RelayActivation, + ErrorReferenceProduct::RegistryRelay, + definition.docs_slug, + ), + lifecycle, + introduced_in: definition + .introduced_in + .map(|version| version.as_str().to_string()), + stability: ErrorReferenceStability::Pre1StableCode, + evidence_limitation: definition.evidence_limitation.to_string(), + } + }) + .collect() +} + +fn relay_process_startup_reference_entries() -> Vec { + PROCESS_STARTUP_CODE_DEFINITIONS + .iter() + .map(|definition| { + let code = definition.code.as_str().to_string(); + let lifecycle = match definition.lifecycle { + ProcessStartupCodeLifecycle::Unreleased => ErrorReferenceLifecycle::Unreleased, + ProcessStartupCodeLifecycle::Active => ErrorReferenceLifecycle::Active, + ProcessStartupCodeLifecycle::Deprecated => ErrorReferenceLifecycle::Deprecated, + }; + ErrorReferenceEntry { + family: ErrorReferenceFamily::RelayProcessStartup, + code: code.clone(), + owner: ErrorReferenceOwner::RegistryRelay, + product: ErrorReferenceProduct::RegistryRelay, + phase: definition.phase.to_string(), + safe_meaning: definition.safe_meaning.to_string(), + rule: definition.rule.to_string(), + safe_remediation: definition.safe_remediation.to_string(), + field_address_pattern: None, + evidence_scope: definition.evidence_scope.to_string(), + secret_sensitive_value_policy: match definition.evidence_policy { + ProcessStartupEvidencePolicy::NoRuntimeValues => { + ErrorReferenceValuePolicy::NoRuntimeValues + } + }, + docs_anchor: docs_anchor( + ErrorReferenceFamily::RelayProcessStartup, + ErrorReferenceProduct::RegistryRelay, + definition.docs_slug, + ), + lifecycle, + introduced_in: definition.introduced_in.map(str::to_string), + stability: ErrorReferenceStability::Pre1StableCode, + evidence_limitation: definition.evidence_limitation.to_string(), + } + }) + .collect() +} + +fn notary_activation_reference_entries() -> Vec { + NOTARY_ACTIVATION_CODE_DEFINITIONS + .iter() + .map(|definition| { + let code = definition.code.as_str().to_string(); + let lifecycle = match definition.lifecycle { + NotaryActivationCodeLifecycle::Unreleased => ErrorReferenceLifecycle::Unreleased, + NotaryActivationCodeLifecycle::Released { .. } => ErrorReferenceLifecycle::Released, + }; + ErrorReferenceEntry { + family: ErrorReferenceFamily::NotaryActivation, + code: code.clone(), + owner: ErrorReferenceOwner::RegistryNotary, + product: ErrorReferenceProduct::RegistryNotary, + phase: definition.phase.to_string(), + safe_meaning: definition.meaning.to_string(), + rule: definition.rule.to_string(), + safe_remediation: definition.remediation.to_string(), + field_address_pattern: None, + evidence_scope: definition.evidence_scope.to_string(), + secret_sensitive_value_policy: ErrorReferenceValuePolicy::NoRuntimeValues, + docs_anchor: docs_anchor( + ErrorReferenceFamily::NotaryActivation, + ErrorReferenceProduct::RegistryNotary, + definition.docs_slug, + ), + lifecycle, + introduced_in: definition + .lifecycle + .introduced_version() + .map(str::to_string), + stability: ErrorReferenceStability::Pre1StableCode, + evidence_limitation: definition.evidence_limitation.to_string(), + } + }) + .collect() +} + +fn expected_operator_omissions() -> Vec { + Vec::new() +} + +pub fn validate_authoring_error_reference( + reference: &AuthoringErrorReferenceV1, +) -> Result<(), ErrorReferenceValidationError> { + if reference.schema_version != AUTHORING_ERROR_REFERENCE_SCHEMA_VERSION_V1 { + return Err(ErrorReferenceValidationError::SchemaVersionMismatch); + } + validate_source_catalogs()?; + validate_entries(&reference.entries, &authoring_error_reference().entries) +} + +pub fn validate_fixture_error_reference( + reference: &FixtureErrorReferenceV1, +) -> Result<(), ErrorReferenceValidationError> { + if reference.schema_version != FIXTURE_ERROR_REFERENCE_SCHEMA_VERSION_V1 { + return Err(ErrorReferenceValidationError::SchemaVersionMismatch); + } + validate_source_catalogs()?; + validate_entries(&reference.entries, &fixture_error_reference().entries) +} + +pub fn validate_operator_error_reference( + reference: &OperatorErrorReferenceV1, +) -> Result<(), ErrorReferenceValidationError> { + if reference.schema_version != OPERATOR_ERROR_REFERENCE_SCHEMA_VERSION_V1 { + return Err(ErrorReferenceValidationError::SchemaVersionMismatch); + } + validate_source_catalogs()?; + validate_entries(&reference.entries, &operator_error_reference().entries)?; + validate_omissions(&reference.omissions, &expected_operator_omissions()) +} + +fn validate_entries( + entries: &[ErrorReferenceEntry], + expected: &[ErrorReferenceEntry], +) -> Result<(), ErrorReferenceValidationError> { + let keys = entries.iter().map(entry_key).collect::>(); + if keys.iter().collect::>().len() != keys.len() { + return Err(ErrorReferenceValidationError::DuplicateEntry); + } + if !keys.windows(2).all(|pair| pair[0] < pair[1]) { + return Err(ErrorReferenceValidationError::UnsortedEntries); + } + for entry in entries { + if !lifecycle_version_is_valid(entry.lifecycle, entry.introduced_in.as_deref()) { + return Err(ErrorReferenceValidationError::LifecycleVersionMismatch); + } + if entry.docs_anchor != expected_docs_anchor(entry) { + return Err(ErrorReferenceValidationError::DocsAnchorMismatch); + } + } + if entries != expected { + return Err(ErrorReferenceValidationError::EntriesDoNotMatchSources); + } + Ok(()) +} + +fn validate_omissions( + omissions: &[OperatorErrorOmission], + expected: &[OperatorErrorOmission], +) -> Result<(), ErrorReferenceValidationError> { + let keys = omissions.iter().map(omission_key).collect::>(); + if keys.iter().collect::>().len() != keys.len() { + return Err(ErrorReferenceValidationError::DuplicateOmission); + } + if !keys.windows(2).all(|pair| pair[0] < pair[1]) { + return Err(ErrorReferenceValidationError::UnsortedOmissions); + } + if omissions != expected { + return Err(ErrorReferenceValidationError::OmissionsDoNotMatchSources); + } + Ok(()) +} + +fn validate_source_catalogs() -> Result<(), ErrorReferenceValidationError> { + if !project_authoring_diagnostic_definitions() + .windows(2) + .all(|pair| pair[0].code < pair[1].code) + { + return Err(ErrorReferenceValidationError::SourceCatalogMismatch); + } + if !FIXTURE_DIAGNOSTIC_DEFINITIONS + .iter() + .all(|definition| fixture_diagnostic_definition(definition.code) == definition) + || !PREFLIGHT_DIAGNOSTIC_DEFINITIONS + .iter() + .all(|definition| preflight_diagnostic_definition(definition.code) == definition) + { + return Err(ErrorReferenceValidationError::SourceCatalogMismatch); + } + let mut bundle_docs_slugs = BTreeSet::new(); + if BUNDLE_VERIFICATION_CODE_DEFINITIONS.len() != BundleVerificationCode::ALL.len() + || !BundleVerificationCode::ALL.iter().all(|code| { + let definition = code.definition(); + definition.code == *code + && definition.lifecycle_metadata_is_valid() + && static_metadata_is_complete(&[ + definition.phase, + definition.safe_meaning, + definition.rule, + definition.safe_remediation, + definition.safe_report_message, + definition.evidence_scope, + definition.evidence_limitation, + ]) + && docs_slug_is_valid(definition.docs_slug) + && bundle_docs_slugs.insert(definition.docs_slug) + && BUNDLE_VERIFICATION_CODE_DEFINITIONS.contains(definition) + }) + { + return Err(ErrorReferenceValidationError::SourceCatalogMismatch); + } + let relay_definitions = consultation_service_activation_definitions(); + let mut relay_docs_slugs = BTreeSet::new(); + if relay_definitions.len() != ConsultationServiceActivationCode::ALL.len() + || !ConsultationServiceActivationCode::ALL.iter().all(|code| { + let definition = code.definition(); + definition.code == *code + && definition.catalog_metadata_is_valid() + && static_metadata_is_complete(&[ + definition.phase, + definition.meaning, + definition.rule, + definition.remediation, + definition.evidence_scope, + definition.evidence_policy, + definition.evidence_limitation, + ]) + && docs_slug_is_valid(definition.docs_slug) + && relay_docs_slugs.insert(definition.docs_slug) + && relay_definitions.contains(definition) + }) + { + return Err(ErrorReferenceValidationError::SourceCatalogMismatch); + } + let mut process_startup_docs_slugs = BTreeSet::new(); + if PROCESS_STARTUP_CODE_DEFINITIONS.len() != ProcessStartupCode::ALL.len() + || !ProcessStartupCode::ALL.iter().all(|code| { + let definition = code.definition(); + definition.code == *code + && definition.lifecycle_metadata_is_valid() + && static_metadata_is_complete(&[ + definition.phase, + definition.safe_meaning, + definition.rule, + definition.safe_remediation, + definition.evidence_scope, + definition.evidence_limitation, + ]) + && docs_slug_is_valid(definition.docs_slug) + && process_startup_docs_slugs.insert(definition.docs_slug) + && PROCESS_STARTUP_CODE_DEFINITIONS.contains(definition) + }) + { + return Err(ErrorReferenceValidationError::SourceCatalogMismatch); + } + let mut notary_docs_slugs = BTreeSet::new(); + if NOTARY_ACTIVATION_CODE_DEFINITIONS.len() != NotaryActivationCode::ALL.len() + || !NotaryActivationCode::ALL.iter().all(|code| { + let definition = code.definition(); + definition.code == *code + && notary_lifecycle_version_is_valid(definition.lifecycle) + && static_metadata_is_complete(&[ + definition.phase, + definition.meaning, + definition.rule, + definition.remediation, + definition.evidence_scope, + definition.evidence_policy, + definition.evidence_limitation, + ]) + && docs_slug_is_valid(definition.docs_slug) + && notary_docs_slugs.insert(definition.docs_slug) + && NOTARY_ACTIVATION_CODE_DEFINITIONS.contains(definition) + }) + { + return Err(ErrorReferenceValidationError::SourceCatalogMismatch); + } + Ok(()) +} + +fn static_metadata_is_complete(fields: &[&str]) -> bool { + fields.iter().all(|field| !field.trim().is_empty()) +} + +fn docs_slug_is_valid(slug: &str) -> bool { + !slug.is_empty() + && slug + .bytes() + .all(|byte| byte.is_ascii_lowercase() || byte.is_ascii_digit() || byte == b'-') +} + +fn notary_lifecycle_version_is_valid(lifecycle: NotaryActivationCodeLifecycle) -> bool { + match lifecycle { + NotaryActivationCodeLifecycle::Unreleased => lifecycle.introduced_version().is_none(), + NotaryActivationCodeLifecycle::Released { introduced_version } => { + is_numeric_release_version(introduced_version) + } + } +} + +fn lifecycle_version_is_valid( + lifecycle: ErrorReferenceLifecycle, + introduced_in: Option<&str>, +) -> bool { + match lifecycle { + ErrorReferenceLifecycle::Unreleased => introduced_in.is_none(), + ErrorReferenceLifecycle::Active + | ErrorReferenceLifecycle::Deprecated + | ErrorReferenceLifecycle::Released => { + introduced_in.is_some_and(is_numeric_release_version) + } + } +} + +fn is_numeric_release_version(version: &str) -> bool { + let mut parts = version.split('.'); + (0..3).all(|_| { + parts.next().is_some_and(|part| { + !part.is_empty() + && (part == "0" || !part.starts_with('0')) + && part.bytes().all(|byte| byte.is_ascii_digit()) + }) + }) && parts.next().is_none() +} + +fn entry_key(entry: &ErrorReferenceEntry) -> (&str, &str, &str) { + ( + entry.family.as_str(), + entry.product.as_str(), + entry.code.as_str(), + ) +} + +fn omission_key(omission: &OperatorErrorOmission) -> (&str, &str) { + (omission.family.as_str(), omission.product.as_str()) +} + +fn docs_anchor( + family: ErrorReferenceFamily, + product: ErrorReferenceProduct, + fragment: &str, +) -> String { + format!( + "/reference/diagnostics/{}/#{}--{}", + family.docs_catalog(), + product.as_str(), + fragment + ) +} + +fn expected_docs_anchor(entry: &ErrorReferenceEntry) -> String { + let source_slug = match entry.family { + ErrorReferenceFamily::BundleVerification => BUNDLE_VERIFICATION_CODE_DEFINITIONS + .iter() + .find(|definition| definition.code.as_str() == entry.code) + .map(|definition| definition.docs_slug), + ErrorReferenceFamily::NotaryActivation => NOTARY_ACTIVATION_CODE_DEFINITIONS + .iter() + .find(|definition| definition.code.as_str() == entry.code) + .map(|definition| definition.docs_slug), + ErrorReferenceFamily::RelayActivation => consultation_service_activation_definitions() + .iter() + .find(|definition| definition.code.as_str() == entry.code) + .map(|definition| definition.docs_slug), + ErrorReferenceFamily::RelayProcessStartup => PROCESS_STARTUP_CODE_DEFINITIONS + .iter() + .find(|definition| definition.code.as_str() == entry.code) + .map(|definition| definition.docs_slug), + ErrorReferenceFamily::AuthoringValidation + | ErrorReferenceFamily::FixtureExecution + | ErrorReferenceFamily::OperatorPreflight => None, + }; + docs_anchor( + entry.family, + entry.product, + source_slug.unwrap_or(&entry.code), + ) +} + +fn closed_string(value: &impl Serialize) -> String { + serde_json::to_value(value) + .expect("closed diagnostic enum serializes") + .as_str() + .expect("closed diagnostic enum serializes as a string") + .to_string() +} + +fn authoring_address_pattern(code: &str) -> Option<&'static str> { + match code { + "registryctl.authoring.diagnostics.truncated" => None, + "registryctl.authoring.entity.invalid" => Some("#"), + "registryctl.authoring.environment.invalid" => Some("environments/.yaml#"), + "registryctl.authoring.file.too_large" + | "registryctl.authoring.file.unreadable" + | "registryctl.authoring.path.unsafe" => Some("#"), + "registryctl.authoring.fixture.invalid" + | "registryctl.authoring.fixture.reserved_body_field" => { + Some("integrations//fixtures/.yaml#") + } + "registryctl.authoring.integration.invalid" => { + Some("integrations//integration.yaml#") + } + "registryctl.authoring.project.invalid" + | "registryctl.authoring.project.scope_collision" => Some("registry-stack.yaml#"), + "registryctl.authoring.script.closed_contract_violation" + | "registryctl.authoring.script.invalid_signature" + | "registryctl.authoring.script.syntax_error" + | "registryctl.authoring.script.unknown_function" => Some("#"), + "registryctl.authoring.yaml.invalid_syntax" + | "registryctl.authoring.yaml.unknown_field" => { + Some("#") + } + _ => unreachable!("authoring diagnostic catalog coverage is exact"), + } +} diff --git a/crates/registryctl/src/project_authoring/diagnostics.rs b/crates/registryctl/src/project_authoring/diagnostics.rs index 75a20a237..c4e5242df 100644 --- a/crates/registryctl/src/project_authoring/diagnostics.rs +++ b/crates/registryctl/src/project_authoring/diagnostics.rs @@ -21,8 +21,7 @@ impl DiagnosticReadFailure { const PROJECT_SCHEMA_HINT: &str = "registryctl authoring schema --kind project > project.schema.json"; -const ENTITY_SCHEMA_HINT: &str = - "registryctl authoring schema --kind entity > entity.schema.json"; +const ENTITY_SCHEMA_HINT: &str = "registryctl authoring schema --kind entity > entity.schema.json"; const INTEGRATION_SCHEMA_HINT: &str = "registryctl authoring schema --kind integration > integration.schema.json"; const FIXTURE_SCHEMA_HINT: &str = @@ -30,6 +29,110 @@ const FIXTURE_SCHEMA_HINT: &str = const ENVIRONMENT_SCHEMA_HINT: &str = "registryctl authoring schema --kind environment > environment.schema.json"; +#[allow(dead_code)] +const PROJECT_DIAGNOSTIC_CATALOG_SCHEMA_VERSION: &str = + "registryctl.project_authoring_diagnostic_catalog.v1"; + +/// A stable, generated-reference definition for an authoring failure code. +/// +/// The diagnostic collector may attach a more precise field-specific cause and +/// remediation, but the code's validation contract, safe summary boundary, +/// and documentation route live only here. This prevents emitted codes and +/// the public reference from drifting independently. +#[derive(Clone, Copy, Debug, Eq, PartialEq, Serialize)] +#[serde(deny_unknown_fields)] +pub struct ProjectAuthoringDiagnosticDefinition { + pub code: &'static str, + pub phase: &'static str, + pub rule: &'static str, + pub accepted: &'static str, + pub safe_remediation: &'static str, + pub safe_summary_policy: &'static str, + pub documentation: &'static str, + #[serde(skip_serializing_if = "Option::is_none")] + pub replacement: Option<&'static str>, + #[serde(skip_serializing_if = "Option::is_none")] + pub changed_behavior: Option<&'static str>, +} + +#[derive(Clone, Debug, Eq, PartialEq, Serialize)] +#[serde(deny_unknown_fields)] +#[allow(dead_code)] +pub struct ProjectAuthoringDiagnosticCatalogV1 { + pub schema_version: &'static str, + pub diagnostics: Vec, +} + +macro_rules! diagnostic_definition { + ($code:literal, $phase:literal, $rule:literal, $accepted:literal, $remediation:literal, $summary:literal, $route:literal) => { + ProjectAuthoringDiagnosticDefinition { + code: $code, + phase: $phase, + rule: $rule, + accepted: $accepted, + safe_remediation: $remediation, + safe_summary_policy: $summary, + documentation: concat!( + "/reference/diagnostics/authoring/#registryctl--", + $code + ), + replacement: None, + changed_behavior: None, + } + }; +} + +const AUTHORING_DIAGNOSTIC_CATALOG: &[ProjectAuthoringDiagnosticDefinition] = &[ + diagnostic_definition!("registryctl.authoring.diagnostics.truncated", "aggregation", "diagnostic_limit", "At most 64 diagnostics are returned in deterministic order.", "Fix the reported diagnostics and run the check again.", "no_received_value", "diagnostics-truncated"), + diagnostic_definition!("registryctl.authoring.entity.invalid", "semantic_validation", "entity_contract", "A declared entity id and shape must match the project contract.", "Correct the entity declaration with the entity schema and its project alias.", "no_received_value", "entity-invalid"), + diagnostic_definition!("registryctl.authoring.environment.invalid", "semantic_validation", "environment_binding", "Environment bindings must match declared products, integrations, identities, origins, and bounded generations.", "Align the selected environment with the declared project contract.", "no_received_value", "environment-invalid"), + diagnostic_definition!("registryctl.authoring.file.too_large", "safe_input", "authored_file_size", "Authored files must remain below their documented fixed byte bound.", "Reduce the file below its documented maximum size.", "no_received_value", "file-too-large"), + diagnostic_definition!("registryctl.authoring.file.unreadable", "safe_input", "authored_file_readability", "A regular file inside the project root must be readable.", "Restore a readable regular project-relative file.", "no_received_value", "file-unreadable"), + diagnostic_definition!("registryctl.authoring.fixture.invalid", "semantic_validation", "fixture_contract", "Fixtures must be deterministic, bounded, and satisfy the integration contract without live values.", "Correct the fixture declaration and its closed interaction contract.", "no_received_value", "fixture-invalid"), + diagnostic_definition!("registryctl.authoring.fixture.reserved_body_field", "syntax", "fixture_body_file_reference", "A fixture body object may use `file` only as the closed body-file reference shape.", "Use the documented body-file reference shape or an inline JSON body.", "received_type_only", "fixture-reserved-body-field"), + diagnostic_definition!("registryctl.authoring.integration.invalid", "semantic_validation", "integration_contract", "An integration alias, capability, and declared contract must be internally consistent.", "Correct the integration declaration with the integration schema.", "no_received_value", "integration-invalid"), + diagnostic_definition!("registryctl.authoring.path.unsafe", "safe_input", "project_relative_path", "Paths must be normalized project-relative paths to regular non-symlink entries.", "Use a normalized project-relative regular file path.", "no_received_value", "path-unsafe"), + diagnostic_definition!("registryctl.authoring.project.invalid", "semantic_validation", "project_contract", "Project services, entities, integrations, and references must form a closed valid graph.", "Align the project declaration and referenced contracts.", "no_received_value", "project-invalid"), + diagnostic_definition!("registryctl.authoring.project.scope_collision", "semantic_validation", "authorization_scope_uniqueness", "Effective authorization scopes must be distinct across records API and attribute-release access.", "Assign distinct scopes to each authorization purpose.", "no_received_value", "project-scope-collision"), + diagnostic_definition!("registryctl.authoring.script.closed_contract_violation", "script_validation", "released_script_contract", "Scripts must use the released bounded Script contract and module rules.", "Use only the released bounded Script contract.", "no_received_value", "script-closed-contract-violation"), + diagnostic_definition!("registryctl.authoring.script.invalid_signature", "script_validation", "script_entrypoint_signature", "The Script entrypoint must be exactly `consult(context)`.", "Define the exact released entrypoint signature.", "no_received_value", "script-invalid-signature"), + diagnostic_definition!("registryctl.authoring.script.syntax_error", "script_validation", "script_syntax", "The Script source must parse under the released runtime.", "Correct the Script syntax at the reported location.", "no_received_value", "script-syntax-error"), + diagnostic_definition!("registryctl.authoring.script.unknown_function", "script_validation", "script_entrypoint", "The Script must define the released `consult(context)` entrypoint.", "Define consult(context) as the Script entrypoint.", "no_received_value", "script-unknown-function"), + diagnostic_definition!("registryctl.authoring.yaml.invalid_syntax", "syntax", "closed_yaml_document", "YAML must parse as the selected closed authoring document shape.", "Correct the YAML with the matching authoring schema.", "received_type_only", "yaml-invalid-syntax"), + ProjectAuthoringDiagnosticDefinition { + code: "registryctl.authoring.yaml.unknown_field", + phase: "syntax", + rule: "closed_yaml_unknown_field", + accepted: "Only documented fields in the closed authoring schema are accepted.", + safe_remediation: "Remove the unsupported field or replace it with its documented field.", + safe_summary_policy: "received_type_only", + documentation: "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.yaml.unknown_field", + replacement: Some("No deprecated replacement is implied by an unknown field; use only a documented field."), + changed_behavior: Some("Unknown fields are rejected rather than ignored."), + }, +]; + +#[must_use] +#[allow(dead_code)] +pub fn project_authoring_diagnostic_catalog() -> ProjectAuthoringDiagnosticCatalogV1 { + ProjectAuthoringDiagnosticCatalogV1 { + schema_version: PROJECT_DIAGNOSTIC_CATALOG_SCHEMA_VERSION, + diagnostics: AUTHORING_DIAGNOSTIC_CATALOG.to_vec(), + } +} + +pub(crate) fn project_authoring_diagnostic_definitions( +) -> &'static [ProjectAuthoringDiagnosticDefinition] { + AUTHORING_DIAGNOSTIC_CATALOG +} + +fn diagnostic_definition(code: &str) -> &'static ProjectAuthoringDiagnosticDefinition { + AUTHORING_DIAGNOSTIC_CATALOG + .iter() + .find(|definition| definition.code == code) + .unwrap_or_else(|| panic!("unregistered registryctl authoring diagnostic code: {code}")) +} + impl std::fmt::Display for ProjectAuthoringDiagnostics { fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result { formatter.write_str(&render_project_authoring_diagnostics(self)) @@ -45,7 +148,11 @@ pub fn render_project_authoring_diagnostics(report: &ProjectAuthoringDiagnostics let mut output = format!( "Registry Stack project is invalid: {} authoring diagnostic{}", report.diagnostics.len(), - if report.diagnostics.len() == 1 { "" } else { "s" } + if report.diagnostics.len() == 1 { + "" + } else { + "s" + } ); for diagnostic in &report.diagnostics { let _ = write!(output, "\n{}", diagnostic.file); @@ -55,11 +162,7 @@ pub fn render_project_authoring_diagnostics(report: &ProjectAuthoringDiagnostics let _ = write!(output, ":{column}"); } } - let _ = write!( - output, - " [{}] {}", - diagnostic.code, diagnostic.cause - ); + let _ = write!(output, " [{}] {}", diagnostic.code, diagnostic.cause); if let Some(field) = diagnostic.field { let _ = write!(output, " (field: {field})"); } @@ -74,6 +177,24 @@ pub fn render_project_authoring_diagnostics(report: &ProjectAuthoringDiagnostics output } +/// Produces the value-free strict JSON fallback for a `check` failure that did +/// not already carry exact typed authoring diagnostics. +/// +/// Human output retains the underlying local error. Portable output cannot +/// serialize arbitrary `anyhow` chains because they may contain paths, +/// authored values, or runtime details. +#[must_use] +pub fn redacted_project_check_failure_diagnostics() -> ProjectAuthoringDiagnostics { + finalized_diagnostics(vec![invalid_diagnostic( + "registryctl.authoring.project.invalid", + PROJECT_FILE, + None, + "The offline project check could not complete safely.", + "Correct the reported project or option issue, then run the check again with trusted local human output if more detail is needed.", + Some(PROJECT_SCHEMA_HINT), + )]) +} + fn collect_project_authoring_diagnostics( project_directory: &Path, environment_name: &str, @@ -92,19 +213,20 @@ fn collect_project_authoring_diagnostics( Ok(file) => file, Err(diagnostic) => return finalized_diagnostics(vec![*diagnostic]), }; - let project: RegistryProject = match diagnostic_parse_yaml( - &project_bytes, - PROJECT_FILE, - "project", - PROJECT_SCHEMA_HINT, - ) { - Ok(project) => project, - Err(diagnostic) => { - diagnostics.push(*diagnostic); - collect_selected_environment_syntax(&root, environment_name, &mut diagnostics); - return finalized_diagnostics(diagnostics); - } - }; + let project: RegistryProject = + match diagnostic_parse_yaml(&project_bytes, PROJECT_FILE, "project", PROJECT_SCHEMA_HINT) { + Ok(project) => project, + Err(diagnostic) => { + diagnostics.push(*diagnostic); + collect_selected_environment_syntax(&root, environment_name, &mut diagnostics); + return finalized_diagnostics(diagnostics); + } + }; + diagnostics.extend(project_declaration_semantic_diagnostics(&project)); + if !diagnostics.is_empty() { + collect_selected_environment_syntax(&root, environment_name, &mut diagnostics); + return finalized_diagnostics(diagnostics); + } for reference in project .entities @@ -157,18 +279,14 @@ fn collect_project_authoring_diagnostics( } }; let file = normalized_authored_file(&root, &path); - let document: EntityDefinition = match diagnostic_parse_yaml( - &bytes, - &file, - "entity", - ENTITY_SCHEMA_HINT, - ) { - Ok(document) => document, - Err(diagnostic) => { - diagnostics.push(*diagnostic); - continue; - } - }; + let document: EntityDefinition = + match diagnostic_parse_yaml(&bytes, &file, "entity", ENTITY_SCHEMA_HINT) { + Ok(document) => document, + Err(diagnostic) => { + diagnostics.push(*diagnostic); + continue; + } + }; if validate_entity_definition(&document).is_err() || alias != &document.id { diagnostics.push(invalid_diagnostic( "registryctl.authoring.entity.invalid", @@ -217,24 +335,32 @@ fn collect_project_authoring_diagnostics( } }; let file = normalized_authored_file(&root, &integration_path); - let authored: AuthoredIntegrationDocument = match diagnostic_parse_yaml( - &bytes, - &file, - "integration", - INTEGRATION_SCHEMA_HINT, - ) { - Ok(document) => document, - Err(diagnostic) => { - diagnostics.push(*diagnostic); + let authored: AuthoredIntegrationDocument = + match diagnostic_parse_yaml(&bytes, &file, "integration", INTEGRATION_SCHEMA_HINT) { + Ok(document) => document, + Err(diagnostic) => { + diagnostics.push(*diagnostic); + continue; + } + }; + if let AuthoredCapabilityDeclaration::Snapshot(AuthoredSnapshotCapability { snapshot }) = + &authored.capability + { + if !entities.contains_key(&snapshot.entity) { + diagnostics.push(cross_file_diagnostic( + "registryctl.authoring.project.invalid", + &file, + Some("capability.snapshot.entity"), + "A snapshot integration references an unknown project entity.", + "Reference one entity declared by the project.", + Some(INTEGRATION_SCHEMA_HINT), + vec![ + diagnostic_address(&file, &["capability", "snapshot", "entity"]), + diagnostic_address(PROJECT_FILE, &["entities"]), + ], + )); continue; } - }; - if matches!( - &authored.capability, - AuthoredCapabilityDeclaration::Snapshot { snapshot } - if !entities.contains_key(&snapshot.entity) - ) { - continue; } let document = match lower_project_integration(&authored, &entities) { Ok(document) => document, @@ -302,7 +428,8 @@ fn collect_project_authoring_diagnostics( } let before_environment = diagnostics.len(); - let environment = collect_selected_environment_syntax(&root, environment_name, &mut diagnostics); + let environment = + collect_selected_environment_syntax(&root, environment_name, &mut diagnostics); if diagnostics[before_environment..] .iter() .any(|diagnostic| terminal_diagnostic_code(diagnostic.code)) @@ -311,16 +438,14 @@ fn collect_project_authoring_diagnostics( } let all_integrations_loaded = integrations.len() == project.integrations.len(); if all_entities_loaded && all_integrations_loaded { - if validate_service_integration_links(&project, &integrations).is_err() { - diagnostics.push(invalid_diagnostic( - "registryctl.authoring.project.invalid", - PROJECT_FILE, - Some("services.consultations"), - "A service consultation does not match its integration.", - "Align each consultation input with its referenced integration.", - Some(PROJECT_SCHEMA_HINT), - )); - } + diagnostics.extend(service_integration_link_diagnostics( + &project, + &integrations, + )); + diagnostics.extend(claim_integration_link_diagnostics( + &project, + &integrations, + )); if validate_project_entity_links(&project, &integrations, &entities).is_err() { if let Some(collision) = project_records_scope_collision(&project, &entities) { let (field, cause, remediation) = match collision.kind { @@ -344,14 +469,20 @@ fn collect_project_authoring_diagnostics( Some(PROJECT_SCHEMA_HINT), )); } else { - diagnostics.push(invalid_diagnostic( - "registryctl.authoring.project.invalid", - PROJECT_FILE, - Some("services"), - "A project entity reference is inconsistent.", - "Align services, snapshots, and relationships with declared entities.", - Some(PROJECT_SCHEMA_HINT), - )); + let relationship_diagnostics = + project_entity_link_diagnostics(&project, &integrations, &entities); + if relationship_diagnostics.is_empty() { + diagnostics.push(invalid_diagnostic( + "registryctl.authoring.project.invalid", + PROJECT_FILE, + Some("services"), + "A project entity reference is inconsistent.", + "Align services, snapshots, and relationships with declared entities.", + Some(PROJECT_SCHEMA_HINT), + )); + } else { + diagnostics.extend(relationship_diagnostics); + } } } for (alias, integration) in &integrations { @@ -367,16 +498,12 @@ fn collect_project_authoring_diagnostics( ) .is_err() { - diagnostics.push(invalid_diagnostic( - "registryctl.authoring.fixture.invalid", - &normalized_authored_file( - &root, - &root.join(&project.integrations[alias].file), - ), - Some("not_applicable"), - "Fixture coverage is inconsistent with the integration contract.", - "Correct the integration's not-applicable fixture declarations.", - Some(INTEGRATION_SCHEMA_HINT), + diagnostics.push(not_applicable_diagnostic( + &root, + &project, + alias, + integration, + &entities, )); } } @@ -394,6 +521,178 @@ fn collect_project_authoring_diagnostics( finalized_diagnostics(diagnostics) } +fn project_declaration_semantic_diagnostics( + project: &RegistryProject, +) -> Vec { + let mut diagnostics = Vec::new(); + for (service_id, service) in project + .services + .iter() + .filter(|(_, service)| service.kind == ServiceKind::Evidence) + { + for (consultation_id, consultation) in &service.consultations { + if !project.integrations.contains_key(&consultation.integration) { + diagnostics.push(cross_file_diagnostic( + "registryctl.authoring.project.invalid", + PROJECT_FILE, + Some("services.consultations.integration"), + "A service consultation references an unknown integration.", + "Reference one integration declared by the project.", + Some(PROJECT_SCHEMA_HINT), + vec![ + diagnostic_address( + PROJECT_FILE, + &[ + "services", + service_id, + "consultations", + consultation_id, + "integration", + ], + ), + diagnostic_address(PROJECT_FILE, &["integrations"]), + ], + )); + } + for (input_id, mapping) in &consultation.input { + if validate_request_mapping(mapping).is_err() { + diagnostics.push(cross_file_diagnostic( + "registryctl.authoring.project.invalid", + PROJECT_FILE, + Some("services.consultations.input"), + "A consultation input uses an unsupported governed request path.", + "Use request.target.id, request.target.identifiers., or request.target.attributes..", + Some(PROJECT_SCHEMA_HINT), + vec![diagnostic_address( + PROJECT_FILE, + &[ + "services", + service_id, + "consultations", + consultation_id, + "input", + input_id, + ], + )], + )); + } + } + } + + for (claim_id, claim) in &service.claims { + if let Some(output) = claim.output.as_deref() { + let consultation = output.split_once('.').map(|(name, _)| name); + if consultation.is_none() + || consultation.is_some_and(|name| !service.consultations.contains_key(name)) + { + diagnostics.push(cross_file_diagnostic( + "registryctl.authoring.project.invalid", + PROJECT_FILE, + Some("services.claims.output"), + "A direct claim output does not name a declared consultation.", + "Use . with a consultation declared by this service.", + Some(PROJECT_SCHEMA_HINT), + vec![ + diagnostic_address( + PROJECT_FILE, + &["services", service_id, "claims", claim_id, "output"], + ), + diagnostic_address( + PROJECT_FILE, + &["services", service_id, "consultations"], + ), + ], + )); + } + } else if let Some(expression) = claim.cel.as_deref() { + let roots = cel_member_roots(expression); + if roots.as_ref().is_err() + || (claim.value.is_none() + && roots.is_ok_and(|roots| { + !service + .consultations + .keys() + .any(|name| roots.contains(name.as_str())) + })) + { + diagnostics.push(cross_file_diagnostic( + "registryctl.authoring.project.invalid", + PROJECT_FILE, + Some("services.claims.cel"), + "A claim evaluation does not resolve to a declared consultation.", + "Reference one declared consultation or add the explicit source-free value contract.", + Some(PROJECT_SCHEMA_HINT), + vec![ + diagnostic_address( + PROJECT_FILE, + &["services", service_id, "claims", claim_id, "cel"], + ), + diagnostic_address( + PROJECT_FILE, + &["services", service_id, "consultations"], + ), + ], + )); + } + } + } + + for (profile_id, profile) in &service.credential_profiles { + for (index, claim_id) in profile.claims.iter().enumerate() { + if !service.claims.contains_key(claim_id) { + let index = index.to_string(); + diagnostics.push(cross_file_diagnostic( + "registryctl.authoring.project.invalid", + PROJECT_FILE, + Some("services.credential_profiles.claims"), + "A credential profile references an unknown claim.", + "Reference only claims declared by this service.", + Some(PROJECT_SCHEMA_HINT), + vec![ + diagnostic_address( + PROJECT_FILE, + &[ + "services", + service_id, + "credential_profiles", + profile_id, + "claims", + &index, + ], + ), + diagnostic_address( + PROJECT_FILE, + &["services", service_id, "claims"], + ), + ], + )); + } + } + if parse_validity_seconds(&profile.validity).is_err() { + diagnostics.push(cross_file_diagnostic( + "registryctl.authoring.project.invalid", + PROJECT_FILE, + Some("services.credential_profiles.validity"), + "A credential profile validity is invalid.", + "Use a positive bounded validity in seconds, minutes, or hours.", + Some(PROJECT_SCHEMA_HINT), + vec![diagnostic_address( + PROJECT_FILE, + &[ + "services", + service_id, + "credential_profiles", + profile_id, + "validity", + ], + )], + )); + } + } + } + diagnostics +} + fn collect_selected_environment_syntax( root: &Path, name: &str, @@ -536,32 +835,21 @@ fn collect_integration_fixtures( let relative = path .strip_prefix(root) .map_err(|_| Box::new(path_unsafe(PROJECT_FILE, Some("fixtures"))))?; - let (_, bytes) = diagnostic_read_relative( - root, - relative, - Some("fixture"), - MAX_AUTHORED_FILE_BYTES, - )?; + let (_, bytes) = + diagnostic_read_relative(root, relative, Some("fixture"), MAX_AUTHORED_FILE_BYTES)?; let file = relative_path_string(relative).unwrap_or_else(|| "fixtures".to_string()); - let authored: AuthoredFixtureDocument = match diagnostic_parse_yaml( - &bytes, - &file, - "fixture", - FIXTURE_SCHEMA_HINT, - ) { - Ok(document) => document, - Err(diagnostic) => { - diagnostics.push(*diagnostic); - complete = false; - continue; - } - }; + let authored: AuthoredFixtureDocument = + match diagnostic_parse_yaml(&bytes, &file, "fixture", FIXTURE_SCHEMA_HINT) { + Ok(document) => document, + Err(diagnostic) => { + diagnostics.push(*diagnostic); + complete = false; + continue; + } + }; for body in authored_fixture_body_paths(&authored) { let Some(body_relative) = diagnostic_fixture_body_relative(relative, body) else { - return Err(Box::new(path_unsafe( - &file, - Some("interactions.body"), - ))); + return Err(Box::new(path_unsafe(&file, Some("interactions.body")))); }; let (_, body_bytes) = diagnostic_read_relative( root, @@ -597,13 +885,21 @@ fn collect_integration_fixtures( }; let mut candidate = vec![(path.clone(), fixture)]; if validate_fixture_inputs(alias, document, &candidate).is_err() { - diagnostics.push(invalid_diagnostic( + diagnostics.push(cross_file_diagnostic( "registryctl.authoring.fixture.invalid", &file, - None, + Some("input"), "The fixture does not satisfy its integration contract.", "Correct fixture inputs, interactions, and expectations without using live values.", Some(FIXTURE_SCHEMA_HINT), + vec![ + diagnostic_address(&file, &["input"]), + diagnostic_address( + &relative_path_string(integration_file) + .unwrap_or_else(|| PROJECT_FILE.to_string()), + &["input"], + ), + ], )); complete = false; continue; @@ -622,30 +918,517 @@ fn collect_integration_fixtures( complete = false; } if validate_fixture_inputs(alias, document, &fixtures).is_err() { - diagnostics.push(invalid_diagnostic( - "registryctl.authoring.fixture.invalid", - &relative_or_fallback(root, &directory_path), - Some("fixtures"), - "The fixture set is inconsistent with its integration contract.", - "Use unique fixture names and satisfy the integration contract in every fixture.", - Some(FIXTURE_SCHEMA_HINT), - )); + diagnostics.extend(fixture_set_diagnostics(root, integration_file, &fixtures)); complete = false; } fixtures.sort_by(|left, right| left.1.name.as_bytes().cmp(right.1.name.as_bytes())); Ok((fixtures, complete)) } +fn service_integration_link_diagnostics( + project: &RegistryProject, + integrations: &BTreeMap, +) -> Vec { + let mut diagnostics = Vec::new(); + for (service_id, service) in project + .services + .iter() + .filter(|(_, service)| service.kind == ServiceKind::Evidence) + { + for (consultation_id, consultation) in &service.consultations { + let Some(integration) = integrations.get(&consultation.integration) else { + continue; + }; + let input_set_mismatch = consultation + .input + .keys() + .ne(integration.document.input.keys()); + let non_injective = consultation.input.values().collect::>().len() + != consultation.input.len(); + if input_set_mismatch || non_injective { + let Some(reference) = project.integrations.get(&consultation.integration) else { + continue; + }; + let integration_file = relative_path_string(&reference.file) + .unwrap_or_else(|| PROJECT_FILE.to_string()); + diagnostics.push(cross_file_diagnostic( + "registryctl.authoring.project.invalid", + PROJECT_FILE, + Some("services.consultations"), + "A service consultation does not match its integration.", + "Align each consultation input with its referenced integration.", + Some(PROJECT_SCHEMA_HINT), + vec![ + diagnostic_address( + PROJECT_FILE, + &[ + "services", + service_id, + "consultations", + consultation_id, + "input", + ], + ), + diagnostic_address(&integration_file, &["input"]), + ], + )); + continue; + } + for (input_id, mapping) in &consultation.input { + let Some(declaration) = integration.document.input.get(input_id) else { + continue; + }; + let request_source_is_string = mapping == "request.target.id" + || mapping.starts_with("request.target.identifiers."); + if !request_source_is_string + || matches!( + declaration.input_type, + InputType::String | InputType::FullDate + ) + { + continue; + } + let Some(reference) = project.integrations.get(&consultation.integration) else { + continue; + }; + let integration_file = relative_path_string(&reference.file) + .unwrap_or_else(|| PROJECT_FILE.to_string()); + diagnostics.push(cross_file_diagnostic( + "registryctl.authoring.project.invalid", + PROJECT_FILE, + Some("services.consultations.input"), + "A governed request string source is incompatible with its integration input.", + "Map target ids and identifiers only to String or full-date integration inputs; use a target attribute for other scalar types.", + Some(PROJECT_SCHEMA_HINT), + vec![ + diagnostic_address( + PROJECT_FILE, + &[ + "services", + service_id, + "consultations", + consultation_id, + "input", + input_id, + ], + ), + diagnostic_address(&integration_file, &["input", input_id, "type"]), + ], + )); + } + } + } + diagnostics +} + +fn claim_integration_link_diagnostics( + project: &RegistryProject, + integrations: &BTreeMap, +) -> Vec { + let mut diagnostics = Vec::new(); + for (service_id, service) in project + .services + .iter() + .filter(|(_, service)| service.kind == ServiceKind::Evidence) + { + for (claim_id, claim) in &service.claims { + let Some((consultation_id, output_id)) = + claim.output.as_deref().and_then(|output| output.split_once('.')) + else { + continue; + }; + let Some(consultation) = service.consultations.get(consultation_id) else { + continue; + }; + let Some(integration) = integrations.get(&consultation.integration) else { + continue; + }; + if integration.document.outputs.contains_key(output_id) { + continue; + } + let Some(reference) = project.integrations.get(&consultation.integration) else { + continue; + }; + let integration_file = + relative_path_string(&reference.file).unwrap_or_else(|| PROJECT_FILE.to_string()); + diagnostics.push(cross_file_diagnostic( + "registryctl.authoring.project.invalid", + PROJECT_FILE, + Some("services.claims.output"), + "A direct claim references an unknown integration output.", + "Reference an output declared by the selected consultation's integration.", + Some(PROJECT_SCHEMA_HINT), + vec![ + diagnostic_address( + PROJECT_FILE, + &["services", service_id, "claims", claim_id, "output"], + ), + diagnostic_address(&integration_file, &["outputs"]), + ], + )); + } + } + diagnostics +} + +fn project_entity_link_diagnostics( + project: &RegistryProject, + integrations: &BTreeMap, + entities: &BTreeMap, +) -> Vec { + let mut diagnostics = Vec::new(); + for (service_id, service) in project + .services + .iter() + .filter(|(_, service)| service.kind == ServiceKind::RecordsApi) + { + let Some(entity_id) = service.entity.as_deref() else { + continue; + }; + let Some(entity) = entities.get(entity_id) else { + diagnostics.push(cross_file_diagnostic( + "registryctl.authoring.project.invalid", + PROJECT_FILE, + Some("services"), + "A records service references an unknown entity.", + "Reference one entity declared by the project.", + Some(PROJECT_SCHEMA_HINT), + vec![ + diagnostic_address(PROJECT_FILE, &["services", service_id, "entity"]), + diagnostic_address(PROJECT_FILE, &["entities"]), + ], + )); + continue; + }; + if validate_records_service(service_id, service, &entity.document).is_err() { + let entity_file = project + .entities + .get(entity_id) + .and_then(|reference| relative_path_string(&reference.file)) + .unwrap_or_else(|| PROJECT_FILE.to_string()); + diagnostics.push(cross_file_diagnostic( + "registryctl.authoring.project.invalid", + PROJECT_FILE, + Some("services"), + "A records service does not match its entity contract.", + "Align the records projection, filters, relationships, and standards with the entity schema.", + Some(PROJECT_SCHEMA_HINT), + vec![ + diagnostic_address(PROJECT_FILE, &["services", service_id, "api"]), + diagnostic_address(&entity_file, &["schema"]), + ], + )); + } + let Some(api) = service.api.as_ref() else { + continue; + }; + for (relationship_id, relationship) in &api.relationships { + if entities.contains_key(&relationship.target) { + continue; + } + diagnostics.push(cross_file_diagnostic( + "registryctl.authoring.project.invalid", + PROJECT_FILE, + Some("services"), + "A records relationship references an unknown entity.", + "Point the relationship target at one entity declared by the project.", + Some(PROJECT_SCHEMA_HINT), + vec![ + diagnostic_address( + PROJECT_FILE, + &[ + "services", + service_id, + "api", + "relationships", + relationship_id, + "target", + ], + ), + diagnostic_address(PROJECT_FILE, &["entities"]), + ], + )); + } + } + + for (integration_id, loaded) in integrations { + let CapabilityDeclaration::Snapshot { snapshot } = &loaded.document.capability else { + continue; + }; + let Some(entity) = entities.get(&snapshot.entity) else { + continue; + }; + let invalid_exact = snapshot.exact.iter().any(|(field, input)| { + !entity.document.schema.properties.contains_key(field) + || !loaded.document.input.contains_key(input) + }); + let projected = loaded + .document + .outputs + .values() + .filter_map(snapshot_output_field) + .collect::>(); + let invalid_projection = projected.is_empty() + || projected + .iter() + .any(|field| !entity.document.schema.properties.contains_key(*field)); + let invalid_output_contract = projected.iter().any(|name| { + let Some(field) = entity.document.schema.properties.get(*name) else { + return false; + }; + let Some(output) = loaded.document.outputs.get(*name) else { + return true; + }; + match entity_output_contract(name, field) { + Ok((expected_type, expected_nullable, _)) => { + expected_type != output.output_type || expected_nullable != output.nullable + } + Err(_) => true, + } + }); + if !invalid_exact && !invalid_projection && !invalid_output_contract { + continue; + } + let integration_file = project + .integrations + .get(integration_id) + .and_then(|reference| relative_path_string(&reference.file)) + .unwrap_or_else(|| PROJECT_FILE.to_string()); + let entity_file = project + .entities + .get(&snapshot.entity) + .and_then(|reference| relative_path_string(&reference.file)) + .unwrap_or_else(|| PROJECT_FILE.to_string()); + diagnostics.push(cross_file_diagnostic( + "registryctl.authoring.project.invalid", + &integration_file, + Some("capability.snapshot"), + "A snapshot integration does not match its entity contract.", + "Align exact selectors and projected outputs with the referenced entity schema.", + Some(INTEGRATION_SCHEMA_HINT), + vec![ + diagnostic_address(&integration_file, &["capability", "snapshot"]), + diagnostic_address(&entity_file, &["schema", "properties"]), + ], + )); + } + diagnostics +} + +fn not_applicable_diagnostic( + root: &Path, + project: &RegistryProject, + alias: &str, + integration: &LoadedIntegration, + entities: &BTreeMap, +) -> ProjectAuthoringDiagnostic { + let integration_file = project + .integrations + .get(alias) + .and_then(|reference| relative_path_string(&reference.file)) + .unwrap_or_else(|| PROJECT_FILE.to_string()); + let mut addresses = Vec::new(); + + let fixture_named = |name: &str| { + integration + .fixtures + .iter() + .find(|(_, fixture)| fixture.name == name) + }; + let invalid_evidence = |reason: &NotApplicableReason| { + fixture_named(&reason.request_fixture).filter(|(_, fixture)| { + fixture.interactions.is_empty() + || fixture.expect.error.is_some() + || !matches!( + fixture.expect.outcome.as_deref(), + None | Some("match" | "no_match") + ) + }) + }; + let ambiguity_conflict = integration + .document + .not_applicable + .ambiguity + .as_ref() + .and_then(|_| { + integration + .fixtures + .iter() + .find(|(_, fixture)| fixture.expect.outcome.as_deref() == Some("ambiguous")) + }); + let ambiguity_evidence = integration + .document + .not_applicable + .ambiguity + .as_ref() + .and_then(invalid_evidence); + let subject_conflict = integration + .document + .not_applicable + .subject_mismatch + .as_ref() + .and_then(|_| { + integration.fixtures.iter().find(|(_, fixture)| { + fixture.expect.error.as_deref() == Some("failure.subject_mismatch") + }) + }); + let subject_evidence = integration + .document + .not_applicable + .subject_mismatch + .as_ref() + .and_then(|reason| { + invalid_evidence(reason).or_else(|| fixture_named(&reason.request_fixture)) + }); + let invalid_snapshot_ambiguity = match &integration.document.capability { + CapabilityDeclaration::Snapshot { snapshot } + if integration.document.not_applicable.ambiguity.is_some() + && entities.get(&snapshot.entity).is_some_and(|entity| { + !snapshot.exact.contains_key(&entity.document.primary_key) + }) => + { + Some(snapshot) + } + _ => None, + }; + if let Some((path, _)) = ambiguity_conflict { + addresses.push(diagnostic_address( + &integration_file, + &["not_applicable", "ambiguity"], + )); + addresses.push(diagnostic_address( + &normalized_authored_file(root, path), + &["expect", "outcome"], + )); + } else if let Some((path, fixture)) = ambiguity_evidence { + addresses.push(diagnostic_address( + &integration_file, + &["not_applicable", "ambiguity", "request_fixture"], + )); + addresses.push(not_applicable_evidence_address(root, path, fixture)); + } else if let Some(snapshot) = invalid_snapshot_ambiguity { + addresses.push(diagnostic_address( + &integration_file, + &["not_applicable", "ambiguity"], + )); + if entities.contains_key(&snapshot.entity) { + let entity_file = project + .entities + .get(&snapshot.entity) + .and_then(|reference| relative_path_string(&reference.file)) + .unwrap_or_else(|| PROJECT_FILE.to_string()); + addresses.push(diagnostic_address(&entity_file, &["primary_key"])); + } + } else if let Some((path, _)) = subject_conflict { + addresses.push(diagnostic_address( + &integration_file, + &["not_applicable", "subject_mismatch"], + )); + addresses.push(diagnostic_address( + &normalized_authored_file(root, path), + &["expect", "error"], + )); + } else if let Some((path, fixture)) = subject_evidence { + addresses.push(diagnostic_address( + &integration_file, + &["not_applicable", "subject_mismatch", "request_fixture"], + )); + addresses.push(not_applicable_evidence_address(root, path, fixture)); + } else if let Some((script_path, _)) = integration.script.as_ref() { + addresses.push(diagnostic_address( + &integration_file, + &["not_applicable", "subject_mismatch"], + )); + addresses.push(diagnostic_address( + &normalized_authored_file(root, script_path), + &[], + )); + } else { + addresses.push(diagnostic_address(&integration_file, &["not_applicable"])); + } + + cross_file_diagnostic( + "registryctl.authoring.fixture.invalid", + &integration_file, + Some("not_applicable"), + "Fixture coverage is inconsistent with the integration contract.", + "Correct the integration's not-applicable fixture declarations.", + Some(INTEGRATION_SCHEMA_HINT), + addresses, + ) +} + +fn not_applicable_evidence_address( + root: &Path, + path: &Path, + fixture: &FixtureDocument, +) -> ProjectAuthoringDiagnosticAddress { + let pointer = if fixture.interactions.is_empty() { + &["interactions"][..] + } else if fixture.expect.error.is_some() { + &["expect", "error"][..] + } else { + &["expect", "outcome"][..] + }; + diagnostic_address(&normalized_authored_file(root, path), pointer) +} + +fn fixture_set_diagnostics( + root: &Path, + integration_file: &Path, + fixtures: &[(PathBuf, FixtureDocument)], +) -> Vec { + let integration_file = + relative_path_string(integration_file).unwrap_or_else(|| PROJECT_FILE.to_string()); + let mut first_by_name = BTreeMap::new(); + for (path, fixture) in fixtures { + if let Some(first) = first_by_name.insert(fixture.name.as_str(), path) { + let first_file = normalized_authored_file(root, first); + let second_file = normalized_authored_file(root, path); + return vec![cross_file_diagnostic( + "registryctl.authoring.fixture.invalid", + &second_file, + Some("name"), + "Fixture names are duplicated within one integration.", + "Give every fixture in the integration a unique name.", + Some(FIXTURE_SCHEMA_HINT), + vec![ + diagnostic_address(&first_file, &["name"]), + diagnostic_address(&second_file, &["name"]), + diagnostic_address(&integration_file, &["fixtures"]), + ], + )]; + } + } + fixtures.first().map_or_else(Vec::new, |(path, _)| { + let file = normalized_authored_file(root, path); + vec![cross_file_diagnostic( + "registryctl.authoring.fixture.invalid", + &file, + Some("input"), + "The fixture set is inconsistent with its integration contract.", + "Use unique fixture names and satisfy the integration contract in every fixture.", + Some(FIXTURE_SCHEMA_HINT), + vec![ + diagnostic_address(&file, &["input"]), + diagnostic_address(&integration_file, &["input"]), + ], + )] + }) +} + fn authored_fixture_body_paths(authored: &AuthoredFixtureDocument) -> Vec<&Path> { let mut paths = Vec::new(); for interaction in &authored.interactions { - if let Some(AuthoredFixtureBody::File { file }) = interaction.expect.body.as_ref() { + if let Some(AuthoredFixtureBody::File(AuthoredFixtureBodyFile { file })) = + interaction.expect.body.as_ref() + { paths.push(file.as_path()); } - if let AuthoredFixtureResponse::Http { - body: Some(AuthoredFixtureBody::File { file }), + if let AuthoredFixtureResponse::Http(AuthoredFixtureHttpResponse { + body: Some(AuthoredFixtureBody::File(AuthoredFixtureBodyFile { file })), .. - } = &interaction.respond + }) = &interaction.respond { paths.push(file.as_path()); } @@ -677,14 +1460,12 @@ fn collect_integration_script( let parent = integration_path .parent() .ok_or_else(|| path_unsafe(integration_file, Some("capability.script.file")))?; - let parent_relative = parent - .strip_prefix(root) - .map_err(|_| { - Box::new(path_unsafe( - integration_file, - Some("capability.script.file"), - )) - })?; + let parent_relative = parent.strip_prefix(root).map_err(|_| { + Box::new(path_unsafe( + integration_file, + Some("capability.script.file"), + )) + })?; let script_relative = diagnostic_join_relative( parent_relative, script_reference, @@ -785,7 +1566,12 @@ fn collect_integration_script( return Ok(false); }; let (path, line, field) = rhai_diagnostic_source(loaded, probe.line()).unwrap_or(( - loaded.script.as_ref().expect("script is present").0.as_path(), + loaded + .script + .as_ref() + .expect("script is present") + .0 + .as_path(), None, "capability.script.file", )); @@ -812,17 +1598,18 @@ fn collect_integration_script( "Use only the released bounded Script contract.", ), }; - diagnostics.push(ProjectAuthoringDiagnostic { + diagnostics.push(make_diagnostic( code, - file, - field: Some(field), + &file, + Some(field), line, - column: probe.column(), - schema_hint: None, - suggestion: probe.valid_signatures().first().copied(), + probe.column(), + None, + probe.valid_signatures().first().copied(), cause, remediation, - }); + Vec::new(), + )); Ok(true) } @@ -855,11 +1642,22 @@ fn collect_environment_semantics( ) .is_err() { - diagnostics.push(environment_invalid( + let integration_file = project + .integrations + .get(alias) + .and_then(|reference| relative_path_string(&reference.file)) + .unwrap_or_else(|| PROJECT_FILE.to_string()); + diagnostics.push(cross_file_diagnostic( + "registryctl.authoring.environment.invalid", &file, - "integrations.source.credential", + Some("integrations.source.credential"), "An integration credential binding is invalid.", "Match the credential shape and positive generation to the integration auth type.", + Some(ENVIRONMENT_SCHEMA_HINT), + vec![ + diagnostic_address(&file, &["integrations", alias, "source", "credential"]), + diagnostic_address(&integration_file, &["source", "auth"]), + ], )); } } @@ -880,15 +1678,114 @@ fn collect_environment_semantics( if diagnostics.len() == before && validate_environment(project, integrations, entities, environment).is_err() { - diagnostics.push(environment_invalid( + diagnostics.push(environment_relationship_diagnostic( + project, + integrations, + entities, + environment, &file, - "deployment", - "The environment binding is invalid.", - "Align deployment, integration, entity, caller, and product bindings with the project.", )); } } +fn environment_relationship_diagnostic( + project: &RegistryProject, + integrations: &BTreeMap, + entities: &BTreeMap, + environment: &EnvironmentDocument, + file: &str, +) -> ProjectAuthoringDiagnostic { + let mut addresses = Vec::new(); + + for (alias, loaded) in integrations { + let integration_file = project + .integrations + .get(alias) + .and_then(|reference| relative_path_string(&reference.file)) + .unwrap_or_else(|| PROJECT_FILE.to_string()); + match &loaded.document.capability { + CapabilityDeclaration::Snapshot { .. } => { + if environment.integrations.contains_key(alias) { + addresses.push(diagnostic_address(file, &["integrations", alias])); + addresses.push(diagnostic_address( + &integration_file, + &["capability", "snapshot"], + )); + break; + } + } + CapabilityDeclaration::Http { .. } | CapabilityDeclaration::Script { .. } => { + let Some(binding) = environment.integrations.get(alias) else { + addresses.push(diagnostic_address(file, &["integrations"])); + addresses.push(diagnostic_address(&integration_file, &["capability"])); + break; + }; + if validate_source_binding(alias, &loaded.document, &binding.source).is_err() { + addresses.push(diagnostic_address(file, &["integrations", alias, "source"])); + addresses.push(diagnostic_address(&integration_file, &["source"])); + break; + } + } + } + } + if addresses.is_empty() { + if let Some(alias) = environment + .integrations + .keys() + .find(|alias| !integrations.contains_key(*alias)) + { + addresses.push(diagnostic_address(file, &["integrations", alias])); + addresses.push(diagnostic_address(PROJECT_FILE, &["integrations"])); + } + } + if addresses.is_empty() { + for (entity_id, loaded) in entities { + let entity_file = project + .entities + .get(entity_id) + .and_then(|reference| relative_path_string(&reference.file)) + .unwrap_or_else(|| PROJECT_FILE.to_string()); + let Some(binding) = environment.entities.get(entity_id) else { + addresses.push(diagnostic_address(file, &["entities"])); + addresses.push(diagnostic_address(&entity_file, &[])); + break; + }; + if validate_environment_entity(&loaded.document, binding).is_err() { + addresses.push(diagnostic_address( + file, + &["entities", entity_id, "columns"], + )); + addresses.push(diagnostic_address(&entity_file, &["schema", "properties"])); + break; + } + } + } + if addresses.is_empty() { + if let Some(entity_id) = environment + .entities + .keys() + .find(|entity_id| !entities.contains_key(*entity_id)) + { + addresses.push(diagnostic_address(file, &["entities", entity_id])); + addresses.push(diagnostic_address(PROJECT_FILE, &["entities"])); + } + } + if addresses.is_empty() { + addresses.push(diagnostic_address(file, &["deployment"])); + addresses.push(diagnostic_address(PROJECT_FILE, &["services"])); + } + + cross_file_diagnostic( + "registryctl.authoring.environment.invalid", + file, + Some("deployment"), + "The environment binding is invalid.", + "Align deployment, integration, entity, caller, and product bindings with the project.", + Some(ENVIRONMENT_SCHEMA_HINT), + addresses, + ) +} + fn inspect_environment_file_boundaries(root: &Path) -> DiagnosticResult<()> { let relative_directory = Path::new("environments"); let directory = root.join(relative_directory); @@ -902,8 +1799,8 @@ fn inspect_environment_file_boundaries(root: &Path) -> DiagnosticResult<()> { return Err(Box::new(path_unsafe("environments", field))); } - let entries = fs::read_dir(&directory) - .map_err(|_| Box::new(file_unreadable("environments", field)))?; + let entries = + fs::read_dir(&directory).map_err(|_| Box::new(file_unreadable("environments", field)))?; let mut environment_files = Vec::new(); for (index, entry) in entries.enumerate() { if index >= MAX_ENVIRONMENT_DIRECTORY_ENTRIES { @@ -948,8 +1845,8 @@ fn inspect_environment_file_boundaries(root: &Path) -> DiagnosticResult<()> { } fn diagnostic_project_root(root: &Path) -> DiagnosticResult { - let metadata = fs::symlink_metadata(root) - .map_err(|_| Box::new(file_unreadable(PROJECT_FILE, None)))?; + let metadata = + fs::symlink_metadata(root).map_err(|_| Box::new(file_unreadable(PROJECT_FILE, None)))?; if metadata.file_type().is_symlink() || !metadata.is_dir() { return Err(Box::new(path_unsafe(PROJECT_FILE, None))); } @@ -1012,9 +1909,9 @@ fn diagnostic_read_relative_classified( )))); } Err(_) => { - return Err(DiagnosticReadFailure::Terminal(Box::new( - file_unreadable(&file, field), - ))); + return Err(DiagnosticReadFailure::Terminal(Box::new(file_unreadable( + &file, field, + )))); } }; if metadata.file_type().is_symlink() || !metadata.is_file() { @@ -1027,18 +1924,17 @@ fn diagnostic_read_relative_classified( &file, field, )))); } - let canonical = path.canonicalize().map_err(|_| { - DiagnosticReadFailure::Terminal(Box::new(file_unreadable(&file, field))) - })?; + let canonical = path + .canonicalize() + .map_err(|_| DiagnosticReadFailure::Terminal(Box::new(file_unreadable(&file, field))))?; if !canonical.starts_with(root) { return Err(DiagnosticReadFailure::Terminal(Box::new(path_unsafe( PROJECT_FILE, field, )))); } - let bytes = fs::read(&canonical).map_err(|_| { - DiagnosticReadFailure::Terminal(Box::new(file_unreadable(&file, field))) - })?; + let bytes = fs::read(&canonical) + .map_err(|_| DiagnosticReadFailure::Terminal(Box::new(file_unreadable(&file, field))))?; if u64::try_from(bytes.len()).unwrap_or(u64::MAX) > max_bytes { return Err(DiagnosticReadFailure::Terminal(Box::new(file_too_large( &file, field, @@ -1090,45 +1986,82 @@ fn diagnostic_join_relative( Ok(joined) } -fn diagnostic_parse_yaml Deserialize<'de>>( +fn diagnostic_parse_yaml( bytes: &[u8], file: &str, kind: &'static str, schema_hint: &'static str, ) -> DiagnosticResult { - serde_norway::from_slice(bytes).map_err(|error| { - let unknown_field = error.to_string().contains("unknown field"); - let location = error.location(); - Box::new(ProjectAuthoringDiagnostic { - code: if unknown_field { + parse_current_authoring_document(bytes).map_err(|error| { + if error.is_unsafe_authored_path() { + return Box::new(path_unsafe(file, None)); + } + let reserved_fixture_body = error.is_reserved_fixture_body(); + let unknown_field = error.keyword() == Some("additionalProperties"); + let syntax = error.is_syntax(); + let schema_code = match T::KIND { + ProjectSchemaKind::Project => "registryctl.authoring.project.invalid", + ProjectSchemaKind::Environment => { + "registryctl.authoring.environment.invalid" + } + ProjectSchemaKind::Integration => { + "registryctl.authoring.integration.invalid" + } + ProjectSchemaKind::Fixture => "registryctl.authoring.fixture.invalid", + ProjectSchemaKind::Entity => "registryctl.authoring.entity.invalid", + }; + let (line, column) = error.location(); + let instance_path = error.instance_path().map(str::to_string); + let mut diagnostic = make_diagnostic( + if reserved_fixture_body { + "registryctl.authoring.fixture.reserved_body_field" + } else if unknown_field { "registryctl.authoring.yaml.unknown_field" - } else { + } else if syntax { "registryctl.authoring.yaml.invalid_syntax" + } else { + schema_code }, - file: file.to_string(), - field: None, - line: location.as_ref().map(serde_norway::Location::line), - column: location.as_ref().map(serde_norway::Location::column), - schema_hint: Some(schema_hint), - suggestion: None, - cause: if unknown_field { + file, + reserved_fixture_body.then_some("interactions.body"), + line, + column, + Some(schema_hint), + None, + if reserved_fixture_body { + "A fixture body object uses the reserved top-level `file` field without matching the closed file-reference shape." + } else if unknown_field { "The YAML document contains an unknown field." + } else if syntax { + "The YAML document has invalid syntax." } else { - "The YAML document has invalid syntax or shape." + "The YAML document does not satisfy its canonical authoring schema." }, - remediation: match kind { - "project" => "Correct the project YAML using the project authoring schema.", - "entity" => "Correct the entity YAML using the entity authoring schema.", - "integration" => { - "Correct the integration YAML using the integration authoring schema." - } - "fixture" => "Correct the fixture YAML using the fixture authoring schema.", - "environment" => { - "Correct the environment YAML using the environment authoring schema." + if reserved_fixture_body { + FIXTURE_BODY_FILE_REFERENCE_REMEDIATION + } else { + match kind { + "project" => "Correct the project YAML using the project authoring schema. If this project passed with an earlier registryctl, run `registryctl migrate --project-dir --target-version 1` to check the reviewed compatibility catalog. It does not change or approve the source project; any candidate is separate and requires review.", + "entity" => "Correct the entity YAML using the entity authoring schema.", + "integration" => { + "Correct the integration YAML using the integration authoring schema." + } + "fixture" => "Correct the fixture YAML using the fixture authoring schema.", + "environment" => { + "Correct the environment YAML using the environment authoring schema." + } + _ => "Correct the YAML using the matching authoring schema.", } - _ => "Correct the YAML using the matching authoring schema.", }, - }) + Vec::new(), + ); + if let Some(pointer) = instance_path { + diagnostic.addresses = vec![ProjectAuthoringDiagnosticAddress { + file: file.to_string(), + pointer, + }]; + } + Box::new(diagnostic) }) } @@ -1143,27 +2076,27 @@ fn finalized_diagnostics( .then_with(|| left.column.unwrap_or(0).cmp(&right.column.unwrap_or(0))) .then_with(|| left.field.unwrap_or("").cmp(right.field.unwrap_or(""))) .then_with(|| left.code.cmp(right.code)) + .then_with(|| diagnostic_addresses_cmp(&left.addresses, &right.addresses)) + .then_with(|| left.cause.cmp(right.cause)) + .then_with(|| left.remediation.cmp(right.remediation)) + .then_with(|| left.schema_hint.cmp(&right.schema_hint)) + .then_with(|| left.suggestion.cmp(&right.suggestion)) }); - diagnostics.dedup_by(|left, right| { - left.code == right.code - && left.file == right.file - && left.field == right.field - && left.line == right.line - && left.column == right.column - }); + diagnostics.dedup(); if diagnostics.len() > MAX_AUTHORING_DIAGNOSTICS { diagnostics.truncate(MAX_AUTHORING_DIAGNOSTICS - 1); - diagnostics.push(ProjectAuthoringDiagnostic { - code: "registryctl.authoring.diagnostics.truncated", - file: PROJECT_FILE.to_string(), - field: None, - line: None, - column: None, - schema_hint: None, - suggestion: None, - cause: "Additional authoring diagnostics were omitted at the fixed limit.", - remediation: "Fix the reported diagnostics, then run project check again.", - }); + diagnostics.push(make_diagnostic( + "registryctl.authoring.diagnostics.truncated", + PROJECT_FILE, + None, + None, + None, + None, + None, + "Additional authoring diagnostics were omitted at the fixed limit.", + "Fix the reported diagnostics, then run project check again.", + Vec::new(), + )); } ProjectAuthoringDiagnostics { schema_version: PROJECT_DIAGNOSTICS_SCHEMA_VERSION, @@ -1172,6 +2105,23 @@ fn finalized_diagnostics( } } +fn diagnostic_addresses_cmp( + left: &[ProjectAuthoringDiagnosticAddress], + right: &[ProjectAuthoringDiagnosticAddress], +) -> std::cmp::Ordering { + left.iter() + .zip(right) + .find_map(|(left, right)| { + let ordering = left + .file + .as_bytes() + .cmp(right.file.as_bytes()) + .then_with(|| left.pointer.as_bytes().cmp(right.pointer.as_bytes())); + ordering.ne(&std::cmp::Ordering::Equal).then_some(ordering) + }) + .unwrap_or_else(|| left.len().cmp(&right.len())) +} + fn terminal_diagnostic_code(code: &str) -> bool { matches!( code, @@ -1181,6 +2131,79 @@ fn terminal_diagnostic_code(code: &str) -> bool { ) } +/// Constructs an emitted authoring diagnostic from the one catalog authority. +/// +/// `additional_addresses` is intentionally available for relationship +/// validators to attach both authored sides without changing the legacy +/// single-file/field rendering contract. Existing collectors currently use +/// the primary location; relation emitters can opt in as they gain exact +/// source locations. +#[allow(clippy::too_many_arguments)] +fn make_diagnostic( + code: &str, + file: &str, + field: Option<&'static str>, + line: Option, + column: Option, + schema_hint: Option<&'static str>, + suggestion: Option<&'static str>, + cause: &'static str, + remediation: &'static str, + mut additional_addresses: Vec, +) -> ProjectAuthoringDiagnostic { + let definition = diagnostic_definition(code); + let primary = ProjectAuthoringDiagnosticAddress { + file: file.to_string(), + pointer: authored_field_pointer(field), + }; + additional_addresses.retain(|address| address != &primary); + let mut addresses = vec![primary]; + addresses.extend(additional_addresses); + addresses.sort_by(|left, right| { + left.file + .as_bytes() + .cmp(right.file.as_bytes()) + .then_with(|| left.pointer.as_bytes().cmp(right.pointer.as_bytes())) + }); + addresses.dedup(); + ProjectAuthoringDiagnostic { + code: definition.code, + file: file.to_string(), + field, + line, + column, + schema_hint, + suggestion, + addresses, + phase: definition.phase, + rule: definition.rule, + accepted: definition.accepted, + safe_summary_policy: definition.safe_summary_policy, + received_summary: match definition.safe_summary_policy { + "no_received_value" => "not_disclosed_by_policy", + "received_type_only" => "invalid_type_or_shape", + _ => unreachable!("catalog summary policy is closed"), + }, + documentation: definition.documentation, + replacement: definition.replacement, + changed_behavior: definition.changed_behavior, + cause, + remediation, + } +} + +fn authored_field_pointer(field: Option<&str>) -> String { + let Some(field) = field else { + return String::new(); + }; + let mut pointer = String::new(); + for segment in field.split('.') { + pointer.push('/'); + pointer.push_str(&segment.replace('~', "~0").replace('/', "~1")); + } + pointer +} + fn invalid_diagnostic( code: &'static str, file: &str, @@ -1189,16 +2212,52 @@ fn invalid_diagnostic( remediation: &'static str, schema_hint: Option<&'static str>, ) -> ProjectAuthoringDiagnostic { - ProjectAuthoringDiagnostic { + make_diagnostic( code, - file: file.to_string(), + file, field, - line: None, - column: None, + None, + None, schema_hint, - suggestion: None, + None, cause, remediation, + Vec::new(), + ) +} + +fn cross_file_diagnostic( + code: &'static str, + file: &str, + field: Option<&'static str>, + cause: &'static str, + remediation: &'static str, + schema_hint: Option<&'static str>, + mut addresses: Vec, +) -> ProjectAuthoringDiagnostic { + addresses.sort_by(|left, right| { + left.file + .as_bytes() + .cmp(right.file.as_bytes()) + .then_with(|| left.pointer.as_bytes().cmp(right.pointer.as_bytes())) + }); + addresses.dedup(); + let mut diagnostic = invalid_diagnostic(code, file, field, cause, remediation, schema_hint); + if !addresses.is_empty() { + diagnostic.addresses = addresses; + } + diagnostic +} + +fn diagnostic_address(file: &str, segments: &[&str]) -> ProjectAuthoringDiagnosticAddress { + let mut pointer = String::new(); + for segment in segments { + pointer.push('/'); + pointer.push_str(&segment.replace('~', "~0").replace('/', "~1")); + } + ProjectAuthoringDiagnosticAddress { + file: file.to_string(), + pointer, } } @@ -1224,17 +2283,18 @@ fn script_contract_diagnostic( line: Option, column: Option, ) -> ProjectAuthoringDiagnostic { - ProjectAuthoringDiagnostic { - code: "registryctl.authoring.script.closed_contract_violation", - file: file.to_string(), + make_diagnostic( + "registryctl.authoring.script.closed_contract_violation", + file, field, line, column, - schema_hint: None, - suggestion: None, - cause: "The Script violates the closed authoring contract.", - remediation: "Use only the released bounded Script contract.", - } + None, + None, + "The Script violates the closed authoring contract.", + "Use only the released bounded Script contract.", + Vec::new(), + ) } fn path_unsafe(file: &str, field: Option<&'static str>) -> ProjectAuthoringDiagnostic { @@ -1295,3 +2355,154 @@ fn relative_path_string(path: &Path) -> Option { } (!output.is_empty()).then_some(output) } + +#[cfg(test)] +mod diagnostic_catalog_tests { + use super::*; + use std::collections::BTreeSet; + + #[test] + fn canonical_catalog_fixture_is_exact_and_deterministic() { + let fixture: serde_json::Value = serde_json::from_str(include_str!( + "../../tests/fixtures/project-reports/registryctl.project_authoring_diagnostic_catalog.v1.json" + )) + .expect("catalog fixture parses"); + let rendered = serde_json::to_value(project_authoring_diagnostic_catalog()) + .expect("catalog serializes"); + assert_eq!(rendered, fixture); + + let codes = AUTHORING_DIAGNOSTIC_CATALOG + .iter() + .map(|definition| definition.code) + .collect::>(); + let mut sorted = codes.clone(); + sorted.sort_unstable(); + assert_eq!(codes, sorted, "catalog ordering is deterministic"); + assert_eq!(codes.len(), 17); + assert_eq!(codes.iter().collect::>().len(), codes.len()); + } + + #[test] + fn every_literal_emitted_authoring_code_has_one_catalog_definition() { + let source = include_str!("diagnostics.rs"); + let emitted = source + .split('"') + .filter(|fragment| { + fragment + .strip_prefix("registryctl.authoring.") + .is_some_and(|suffix| !suffix.is_empty()) + }) + .collect::>(); + let catalogued = AUTHORING_DIAGNOSTIC_CATALOG + .iter() + .map(|definition| definition.code) + .collect::>(); + assert_eq!( + emitted, catalogued, + "every literal emitted authoring code must be represented by the generated catalog" + ); + } + + #[test] + fn typed_address_is_rfc6901() { + let diagnostic = make_diagnostic( + "registryctl.authoring.yaml.unknown_field", + "integrations/example/fixture.yaml", + Some("interactions.body"), + Some(7), + Some(3), + None, + None, + "The YAML document contains an unknown field.", + "Correct the fixture YAML using the fixture authoring schema.", + vec![ProjectAuthoringDiagnosticAddress { + file: "registry-stack.yaml".to_string(), + pointer: "/services/example".to_string(), + }], + ); + assert_eq!(diagnostic.addresses[0].pointer, "/interactions/body"); + assert_eq!(diagnostic.addresses.len(), 2); + } + + #[test] + fn parser_diagnostic_never_carries_planted_invalid_scalars() { + for (input, sentinel) in [ + ( + br#" +version: secret-sentinel +registry: + id: synthetic-registry +services: {} +"# + .as_slice(), + "secret-sentinel", + ), + ( + br#" +version: 1 +registry: personal-sentinel +services: {} +"# + .as_slice(), + "personal-sentinel", + ), + ] { + let raw_error = serde_norway::from_slice::(input) + .expect_err("control parser rejects planted invalid scalar"); + assert!( + raw_error.to_string().contains(sentinel), + "negative control must place {sentinel:?} on a parser error path that could leak it" + ); + let diagnostic = diagnostic_parse_yaml::( + input, + PROJECT_FILE, + "project", + PROJECT_SCHEMA_HINT, + ) + .expect_err("planted invalid scalar is rejected"); + assert_eq!(diagnostic.code, "registryctl.authoring.project.invalid"); + let serialized = serde_json::to_string(&diagnostic).expect("diagnostic serializes"); + assert!( + !serialized.contains(sentinel), + "parser diagnostic leaked planted scalar {sentinel:?}" + ); + } + } + + #[test] + fn dynamic_relationship_address_escapes_each_rfc6901_segment() { + assert_eq!( + diagnostic_address( + "registry-stack.yaml", + &["services", "service/with~reserved", "input"], + ) + .pointer, + "/services/service~1with~0reserved/input" + ); + } + + #[test] + fn finalization_only_collapses_fully_identical_diagnostics() { + let make = |service: &str| { + cross_file_diagnostic( + "registryctl.authoring.project.invalid", + PROJECT_FILE, + Some("services.consultations"), + "A service consultation does not match its integration.", + "Align each consultation input with its referenced integration.", + Some(PROJECT_SCHEMA_HINT), + vec![ + diagnostic_address( + PROJECT_FILE, + &["services", service, "consultations", "person", "input"], + ), + diagnostic_address("integrations/person/integration.yaml", &["input"]), + ], + ) + }; + let alpha = make("alpha"); + let beta = make("beta"); + let report = finalized_diagnostics(vec![beta.clone(), alpha.clone(), alpha.clone()]); + assert_eq!(report.diagnostics, vec![alpha, beta]); + } +} diff --git a/crates/registryctl/src/project_authoring/documentation.rs b/crates/registryctl/src/project_authoring/documentation.rs new file mode 100644 index 000000000..42b8c1a03 --- /dev/null +++ b/crates/registryctl/src/project_authoring/documentation.rs @@ -0,0 +1,2771 @@ +// SPDX-License-Identifier: Apache-2.0 +//! Deterministic documentation data for project-authoring and product runtime contracts. +//! +//! The generator has three declared inputs: committed JSON Schemas, the field-knowledge catalog, +//! and reviewed human intent. It has no project-directory argument and cannot open a country +//! workspace. Schema validation remains authoritative; this projection exists only for reference +//! documentation and coverage enforcement. + +use std::collections::{BTreeMap, BTreeSet}; +use std::fmt; + +use serde::{Deserialize, Serialize}; +use serde_json::Value; + +use super::knowledge::{ + index_published_field_knowledge, reachable_published_field_paths, Availability, Consumer, + FieldKnowledgeCatalog, FieldPath, FieldPathKind, GeneratedArtifact, HumanOwner, Migration, + Product, PublishedSchema, ReviewClass, SchemaKind, SemanticOwner, SemanticRule, Sensitivity, + Stability, +}; + +pub const CONFIGURATION_REFERENCE_FORMAT_VERSION: &str = "1.0"; +pub const CONFIGURATION_REFERENCE_SCHEMA_ID: &str = + "https://id.registrystack.org/schemas/registryctl/project-documentation/registry.project.configuration_reference.v1.schema.json"; +pub const CONFIGURATION_REFERENCE_COVERAGE_SCHEMA_ID: &str = + "https://id.registrystack.org/schemas/registryctl/project-documentation/registry.project.configuration_reference_coverage.v1.schema.json"; + +const INTENT_ASSET: &str = + include_str!("../../schemas/project-authoring/documentation-intent.json"); +const PROJECT_SCHEMA: &str = include_str!("../../schemas/project-authoring/project.schema.json"); +const ENVIRONMENT_SCHEMA: &str = + include_str!("../../schemas/project-authoring/environment.schema.json"); +const INTEGRATION_SCHEMA: &str = + include_str!("../../schemas/project-authoring/integration.schema.json"); +const FIXTURE_SCHEMA: &str = include_str!("../../schemas/project-authoring/fixture.schema.json"); +const ENTITY_SCHEMA: &str = include_str!("../../schemas/project-authoring/entity.schema.json"); +const KNOWLEDGE_ASSET: &str = include_str!("../../schemas/project-authoring/parity-coverage.json"); +const RELAY_RUNTIME_INTENT_ASSET: &str = + include_str!("../../../registry-relay/config/documentation-intent.json"); +const NOTARY_RUNTIME_INTENT_ASSET: &str = + include_str!("../../../registry-notary-core/config/documentation-intent.json"); +const RELAY_RUNTIME_INTENT_SOURCE: &str = "crates/registry-relay/config/documentation-intent.json"; +const NOTARY_RUNTIME_INTENT_SOURCE: &str = + "crates/registry-notary-core/config/documentation-intent.json"; + +const CONSTRAINT_KEYWORDS: [&str; 21] = [ + "const", + "dependentRequired", + "enum", + "exclusiveMaximum", + "exclusiveMinimum", + "format", + "maxItems", + "maxLength", + "maxProperties", + "maximum", + "minItems", + "minLength", + "minProperties", + "minimum", + "multipleOf", + "pattern", + "patternProperties", + "required", + "type", + "uniqueItems", + "unevaluatedProperties", +]; + +#[derive(Clone, Debug, Deserialize)] +#[serde(deny_unknown_fields)] +pub struct DocumentationIntentCatalog { + #[serde(rename = "$schema")] + pub schema: Option, + pub format_version: String, + pub policy: DocumentationIntentPolicy, + pub structural_intents: BTreeMap, + pub structural_reviews: Vec, + pub domains: Vec, + pub overrides: Vec, +} + +#[derive(Clone, Debug, Deserialize)] +#[serde(deny_unknown_fields)] +pub struct DocumentationIntentPolicy { + pub human_sources: Vec, + pub prohibited_sources: Vec, + pub prose_required_for: Vec, +} + +#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum HumanIntentSource { + SchemaDescription, + ReviewedOverride, + StructuralTaxonomy, + ReviewedProfile, +} + +#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd)] +#[serde(rename_all = "snake_case")] +pub enum ProhibitedIntentSource { + CountryWorkspace, + CountryValue, + RuntimeConfiguration, + DerivedFieldLabel, +} + +#[derive(Clone, Debug, Deserialize)] +#[serde(deny_unknown_fields)] +pub struct StructuralIntent { + pub purpose: String, +} + +#[derive(Clone, Debug, Deserialize)] +#[serde(deny_unknown_fields)] +pub struct StructuralIntentReview { + pub schema: SchemaKind, + pub pointer: String, + pub path_kind: FieldPathKind, +} + +#[derive(Clone, Debug, Deserialize)] +#[serde(deny_unknown_fields)] +pub struct RuntimeIntentCatalog { + #[serde(rename = "$schema")] + pub schema: String, + pub format_version: String, + pub runtime_schema: ConfigurationSchemaKind, + pub schema_id: String, + pub schema_source: String, + pub profiles: Vec, + pub assignments: Vec, + pub overrides: Vec, +} + +#[derive(Clone, Debug, Deserialize)] +#[serde(deny_unknown_fields)] +pub struct RuntimeIntentProfile { + pub id: String, + pub purpose: String, + pub semantic_owner: SemanticOwner, + pub human_owner: HumanOwner, + pub scope: String, + pub environment_behavior: EnvironmentBehavior, + pub sensitivity: Sensitivity, + pub state: ConfigurationState, + pub products: Vec, + pub availability: Availability, + pub stability: Stability, + pub validation_stages: Vec, + pub diagnostic: String, + pub introduced_in: String, + pub migration: Migration, + pub migration_note: String, + pub example_guidance: String, + pub consumers: Vec, + pub generated_artifacts: Vec, + pub review_classes: Vec, + pub semantic_rules: Vec, + #[serde(default)] + pub open_map_semantics: Option, +} + +#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq)] +#[serde(rename_all = "snake_case")] +pub enum RuntimePurposeSource { + SchemaDescription, + Profile, + Override, +} + +#[derive(Clone, Copy, Debug, Deserialize, Eq, PartialEq)] +#[serde(rename_all = "snake_case")] +pub enum RuntimeDefaultSource { + SchemaDefault, + NoSchemaDefault, + ReviewedRuntimeDefault, + NotApplicable, +} + +#[derive(Clone, Debug, Deserialize)] +#[serde(deny_unknown_fields)] +pub struct RuntimeIntentAssignment { + pub schema: ConfigurationSchemaKind, + pub pointer: String, + pub key_path: String, + pub path_kind: FieldPathKind, + pub profile: String, + pub purpose_source: RuntimePurposeSource, + pub default_source: RuntimeDefaultSource, + pub schema_facts_reviewed: bool, +} + +#[derive(Clone, Debug, Deserialize)] +#[serde(deny_unknown_fields)] +pub struct RuntimeIntentOverride { + pub schema: ConfigurationSchemaKind, + pub pointer: String, + pub key_path: String, + pub path_kind: FieldPathKind, + #[serde(default)] + pub purpose: Option, + #[serde(default)] + pub runtime_default_note: Option, +} + +#[derive(Clone, Debug, Deserialize)] +#[serde(deny_unknown_fields)] +pub struct DocumentationDomainIntent { + pub schema: SchemaKind, + pub scope: String, + pub state: ConfigurationState, + pub environment_behavior: EnvironmentBehavior, + pub validation_stages: Vec, + pub diagnostic: String, + pub migration_note: String, + pub example_guidance: String, +} + +#[derive(Clone, Debug, Deserialize)] +#[serde(deny_unknown_fields)] +pub struct FieldIntentOverride { + pub schema: SchemaKind, + pub pointer: String, + pub purpose: String, + #[serde(default)] + pub environment_behavior: Option, + #[serde(default)] + pub diagnostic: Option, + #[serde(default)] + pub migration_note: Option, + #[serde(default)] + pub example_guidance: Option, +} + +#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum ConfigurationState { + Authored, + EnvironmentBound, + Runtime, +} + +#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum EnvironmentBehavior { + EnvironmentIndependent, + BoundByEnvironment, + NarrowsReviewedAuthority, +} + +#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum ValidationStage { + JsonSchema, + RustDeserialization, + CrossFileSemantic, + FixtureExecution, + ProductBuild, + OperatorPreflight, +} + +#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum ConfigurationSchemaKind { + Project, + Environment, + Integration, + Fixture, + Entity, + Relay, + Notary, +} + +impl fmt::Display for ConfigurationSchemaKind { + fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result { + formatter.write_str(match self { + Self::Project => "project", + Self::Environment => "environment", + Self::Integration => "integration", + Self::Fixture => "fixture", + Self::Entity => "entity", + Self::Relay => "relay", + Self::Notary => "notary", + }) + } +} + +impl From for ConfigurationSchemaKind { + fn from(kind: SchemaKind) -> Self { + match kind { + SchemaKind::Project => Self::Project, + SchemaKind::Environment => Self::Environment, + SchemaKind::Integration => Self::Integration, + SchemaKind::Fixture => Self::Fixture, + SchemaKind::Entity => Self::Entity, + } + } +} + +#[derive(Clone, Debug, Eq, PartialEq, Serialize)] +#[serde(deny_unknown_fields)] +pub struct ConfigurationReferenceV1 { + pub schema_id: &'static str, + pub format_version: &'static str, + pub reference_baseline: ReferenceBaseline, + pub source_contract: ReferenceSourceContract, + pub coverage: ReferenceCoverageSummary, + pub fields: Vec, +} + +#[derive(Clone, Debug, Eq, PartialEq, Serialize)] +#[serde(deny_unknown_fields)] +pub struct ReferenceBaseline { + pub generator_lifecycle: GeneratorLifecycle, + pub published_release: Option, + pub field_history_status: FieldHistoryStatus, + pub history_verification_method: Option, + pub compared_releases: Vec, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum GeneratorLifecycle { + Unreleased, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum FieldHistoryStatus { + NotVerified, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum HistoryVerificationMethod { + ReleaseSchemaDiff, +} + +#[derive(Clone, Debug, Eq, PartialEq, Serialize)] +#[serde(deny_unknown_fields)] +pub struct ReferenceSourceContract { + pub schemas: Vec, + pub schema_sources: Vec, + pub field_knowledge: &'static str, + pub human_intent: &'static str, + pub runtime_intent: Vec<&'static str>, + pub reads_country_workspaces: bool, + pub reads_runtime_configuration: bool, +} + +#[derive(Clone, Debug, Eq, PartialEq, Serialize)] +#[serde(deny_unknown_fields)] +pub struct ReferenceCoverageSummary { + pub schema_count: usize, + pub path_count: usize, + pub reference_count: usize, + pub by_schema: BTreeMap, + pub by_path_kind: BTreeMap, + pub by_sensitivity: BTreeMap, + pub by_intent_source: BTreeMap, + pub by_intent_profile: BTreeMap, +} + +#[derive(Clone, Debug, Eq, PartialEq, Serialize)] +#[serde(deny_unknown_fields)] +pub struct ConfigurationFieldReference { + pub address: DocumentationFieldAddress, + pub purpose: String, + pub purpose_source: HumanIntentSource, + #[serde(skip_serializing_if = "Option::is_none")] + pub intent_profile: Option, + pub semantic_owner: SemanticOwner, + pub human_owner: HumanOwner, + pub scope: String, + pub field_type: FieldTypeDocumentation, + pub requiredness: Requiredness, + pub null_behavior: NullBehavior, + pub empty_behavior: EmptyBehavior, + pub default: DefaultDocumentation, + pub environment_behavior: EnvironmentBehavior, + pub sensitivity: Sensitivity, + pub state: ConfigurationState, + pub products: Vec, + pub availability: Availability, + pub stability: Stability, + pub validation_stages: Vec, + pub diagnostic: String, + pub history_status: FieldHistoryStatus, + pub introduced_in: Option, + pub version_history: Vec, + pub example: ExampleDocumentation, + pub migration: Migration, + pub migration_note: String, + pub consumers: Vec, + pub generated_artifacts: Vec, + pub review_classes: Vec, + pub semantic_rules: Vec, + pub constraints: Vec, + #[serde(skip_serializing_if = "Option::is_none")] + pub local_reference: Option, +} + +#[derive(Clone, Debug, Eq, Ord, PartialEq, PartialOrd, Serialize)] +#[serde(deny_unknown_fields)] +pub struct DocumentationFieldAddress { + pub schema: ConfigurationSchemaKind, + pub pointer: String, + #[serde(skip_serializing_if = "Option::is_none")] + pub key_path: Option, + pub path_kind: FieldPathKind, +} + +#[derive(Clone, Debug, Eq, Ord, PartialEq, PartialOrd, Serialize)] +#[serde(deny_unknown_fields)] +pub struct DocumentationSchemaAddress { + pub schema: ConfigurationSchemaKind, + pub pointer: String, +} + +#[derive(Clone, Debug, Eq, PartialEq, Serialize)] +#[serde(deny_unknown_fields)] +pub struct FieldTypeDocumentation { + pub schema_types: Vec, + #[serde(skip_serializing_if = "Option::is_none")] + pub local_reference: Option, + pub composed: bool, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum Requiredness { + Required, + Optional, + Conditional, + NotApplicable, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum NullBehavior { + Allowed, + Rejected, + Conditional, + NotApplicable, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum EmptyBehavior { + Allowed, + Rejected, + Conditional, + NotApplicable, +} + +#[derive(Clone, Debug, Eq, PartialEq, Serialize)] +#[serde(deny_unknown_fields)] +pub struct DefaultDocumentation { + pub behavior: DefaultBehavior, + #[serde(skip_serializing_if = "Option::is_none")] + pub schema_value: Option, + #[serde(skip_serializing_if = "Option::is_none")] + pub source_version: Option, + #[serde(skip_serializing_if = "Option::is_none")] + pub reviewed_behavior: Option, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum DefaultBehavior { + NoSchemaDefault, + SchemaDefault, + ReviewedRuntimeDefault, + NotApplicable, +} + +#[derive(Clone, Debug, Eq, PartialEq, Serialize)] +#[serde(deny_unknown_fields)] +pub struct VersionHistoryEntry { + pub version: String, + pub change: VersionChange, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum VersionChange { + Introduced, +} + +#[derive(Clone, Debug, Eq, PartialEq, Serialize)] +#[serde(deny_unknown_fields)] +pub struct ExampleDocumentation { + pub guidance: String, + pub schema_examples_available: bool, + pub contains_country_values: bool, +} + +#[derive(Clone, Debug, Eq, PartialEq, Serialize)] +#[serde(deny_unknown_fields)] +pub struct SchemaConstraint { + pub keyword: String, + pub value: Value, +} + +#[derive(Clone, Debug, Eq, PartialEq, Serialize)] +#[serde(deny_unknown_fields)] +pub struct ConfigurationReferenceCoverageV1 { + pub schema_id: &'static str, + pub format_version: &'static str, + pub status: CoverageStatus, + pub reference_baseline: ReferenceBaseline, + pub source_contract: ReferenceSourceContract, + pub coverage: ReferenceCoverageSummary, + pub reviewed_intent_assignment_required_count: usize, + pub reviewed_intent_assignment_covered_count: usize, + pub distinct_reviewed_intent_count: usize, + pub distinct_reviewed_intents_reused_count: usize, + pub reviewed_intent_assignments_using_reused_intent_count: usize, + pub missing_intent: Vec, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum CoverageStatus { + Complete, + Incomplete, +} + +#[derive(Clone, Debug, Eq, PartialEq)] +pub struct DocumentationError(String); + +impl fmt::Display for DocumentationError { + fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result { + formatter.write_str(&self.0) + } +} + +impl std::error::Error for DocumentationError {} + +fn documentation_error(message: impl Into) -> DocumentationError { + DocumentationError(message.into()) +} + +#[derive(Debug)] +pub struct DocumentationSchema<'a> { + pub published: PublishedSchema<'a>, + pub source_name: &'a str, +} + +#[derive(Debug)] +struct PreparedDocumentation<'a> { + schemas: &'a [DocumentationSchema<'a>], + index: super::knowledge::FieldKnowledgeIndex, + domains: BTreeMap, + overrides: BTreeMap, + structural_reviews: BTreeSet<(FieldPath, FieldPathKind)>, + purpose_sources: BTreeMap, + purpose_counts: BTreeMap, + missing: Vec, +} + +#[derive(Clone, Debug, Eq, Ord, PartialEq, PartialOrd)] +struct RuntimePathIdentity { + schema: ConfigurationSchemaKind, + pointer: String, + key_path: String, + path_kind: FieldPathKind, +} + +#[derive(Clone, Debug)] +struct RuntimeSchemaPath { + identity: RuntimePathIdentity, + nodes: Vec, + required: BTreeSet, +} + +#[derive(Debug)] +struct PreparedRuntimeIntent<'a> { + paths: BTreeMap, + profiles: BTreeMap<&'a str, &'a RuntimeIntentProfile>, + assignments: BTreeMap, + overrides: BTreeMap, + missing: Vec, +} + +/// Audits all documentation inputs and returns a deterministic, value-free coverage report. +pub fn configuration_reference_coverage( + catalog: &FieldKnowledgeCatalog, + schemas: &[DocumentationSchema<'_>], + intent: &DocumentationIntentCatalog, +) -> Result { + let prepared = prepare(catalog, schemas, intent)?; + let source_contract = source_contract(schemas); + let coverage = coverage_summary(&prepared); + let reviewed_intent_assignment_required_count = prepared + .index + .by_path() + .values() + .filter(|knowledge| { + intent + .policy + .prose_required_for + .contains(&knowledge.path_kind) + }) + .count(); + let reviewed_intent_assignment_covered_count = + reviewed_intent_assignment_required_count - prepared.missing.len(); + let intent_counts = reviewed_intent_counts(&prepared.purpose_counts); + Ok(ConfigurationReferenceCoverageV1 { + schema_id: CONFIGURATION_REFERENCE_COVERAGE_SCHEMA_ID, + format_version: CONFIGURATION_REFERENCE_FORMAT_VERSION, + status: if prepared.missing.is_empty() { + CoverageStatus::Complete + } else { + CoverageStatus::Incomplete + }, + reference_baseline: reference_baseline(), + source_contract, + coverage, + reviewed_intent_assignment_required_count, + reviewed_intent_assignment_covered_count, + distinct_reviewed_intent_count: intent_counts.distinct, + distinct_reviewed_intents_reused_count: intent_counts.distinct_reused, + reviewed_intent_assignments_using_reused_intent_count: intent_counts + .assignments_using_reused, + missing_intent: prepared.missing, + }) +} + +/// Generates the canonical reference only after every prose-required field has reviewed intent. +pub fn generate_configuration_reference( + catalog: &FieldKnowledgeCatalog, + schemas: &[DocumentationSchema<'_>], + intent: &DocumentationIntentCatalog, +) -> Result { + let prepared = prepare(catalog, schemas, intent)?; + if !prepared.missing.is_empty() { + let paths = prepared + .missing + .iter() + .map(|address| format!("{}#{}", address.schema, address.pointer)) + .collect::>() + .join(", "); + return Err(documentation_error(format!( + "configuration reference has {} fields without reviewed human intent: {paths}", + prepared.missing.len() + ))); + } + + let fields = prepared + .index + .by_path() + .iter() + .map(|(path, knowledge)| { + let schema = prepared + .schemas + .iter() + .find(|schema| schema.published.kind == path.schema) + .ok_or_else(|| documentation_error(format!("missing schema for {path}")))?; + let node = schema + .published + .document + .pointer(&path.pointer) + .ok_or_else(|| { + documentation_error(format!("published documentation path disappeared: {path}")) + })?; + let contract_node = resolve_local_reference(schema.published.document, node)?; + let domain = prepared.domains[&path.schema]; + let override_intent = prepared.overrides.get(path).copied(); + let (purpose, purpose_source) = reviewed_purpose( + node, + contract_node, + knowledge.path_kind, + override_intent, + intent, + path, + &prepared.structural_reviews, + )?; + let environment_behavior = override_intent + .and_then(|entry| entry.environment_behavior) + .unwrap_or(domain.environment_behavior); + let diagnostic = override_intent + .and_then(|entry| entry.diagnostic.as_ref()) + .unwrap_or(&domain.diagnostic) + .clone(); + let migration_note = override_intent + .and_then(|entry| entry.migration_note.as_ref()) + .unwrap_or(&domain.migration_note) + .clone(); + let example_guidance = override_intent + .and_then(|entry| entry.example_guidance.as_ref()) + .unwrap_or(&domain.example_guidance) + .clone(); + let reference = prepared.index.references().get(path); + + Ok(ConfigurationFieldReference { + address: field_address(path, knowledge.path_kind), + purpose, + purpose_source, + intent_profile: None, + semantic_owner: knowledge.semantic_owner, + human_owner: knowledge.human_owner, + scope: domain.scope.clone(), + field_type: field_type(node, contract_node), + requiredness: requiredness( + schema.published.document, + path, + node, + knowledge.path_kind, + ), + null_behavior: null_behavior(contract_node, knowledge.path_kind), + empty_behavior: empty_behavior(contract_node, knowledge.path_kind), + default: default_documentation(contract_node, knowledge.path_kind), + environment_behavior, + sensitivity: knowledge.sensitivity, + state: domain.state, + products: knowledge.products.clone(), + availability: knowledge.availability, + stability: knowledge.stability, + validation_stages: domain.validation_stages.clone(), + diagnostic, + history_status: FieldHistoryStatus::NotVerified, + introduced_in: None, + version_history: Vec::new(), + example: ExampleDocumentation { + guidance: example_guidance, + schema_examples_available: contract_node + .get("examples") + .and_then(Value::as_array) + .is_some_and(|examples| !examples.is_empty()), + contains_country_values: false, + }, + migration: knowledge.migration, + migration_note, + consumers: knowledge.consumers.clone(), + generated_artifacts: knowledge.generated_artifacts.clone(), + review_classes: knowledge.review_classes.clone(), + semantic_rules: knowledge.semantic_rules.clone(), + constraints: schema_constraints(node, contract_node), + local_reference: reference.map(|target| DocumentationSchemaAddress { + schema: target.schema.into(), + pointer: target.pointer.clone(), + }), + }) + }) + .collect::, DocumentationError>>()?; + + Ok(ConfigurationReferenceV1 { + schema_id: CONFIGURATION_REFERENCE_SCHEMA_ID, + format_version: CONFIGURATION_REFERENCE_FORMAT_VERSION, + reference_baseline: reference_baseline(), + source_contract: source_contract(schemas), + coverage: coverage_summary(&prepared), + fields, + }) +} + +fn runtime_schema_paths( + schema: ConfigurationSchemaKind, + document: &Value, +) -> Result, DocumentationError> { + let mut paths = BTreeMap::new(); + let mut visited_references = BTreeSet::new(); + record_runtime_path( + &mut paths, + RuntimePathIdentity { + schema, + pointer: String::new(), + key_path: String::new(), + path_kind: FieldPathKind::Root, + }, + document, + None, + )?; + walk_runtime_schema( + schema, + document, + document, + "", + "", + &mut visited_references, + &mut paths, + )?; + Ok(paths) +} + +fn walk_runtime_schema( + schema: ConfigurationSchemaKind, + document: &Value, + node: &Value, + pointer: &str, + key_path: &str, + visited_references: &mut BTreeSet<(String, String)>, + paths: &mut BTreeMap, +) -> Result<(), DocumentationError> { + let Some(object) = node.as_object() else { + return Ok(()); + }; + if let Some(reference) = object.get("$ref").and_then(Value::as_str) { + let target_pointer = reference.strip_prefix('#').ok_or_else(|| { + documentation_error(format!( + "{schema} runtime schema uses external reference {reference:?}" + )) + })?; + let visit = (target_pointer.to_owned(), key_path.to_owned()); + if visited_references.insert(visit) { + let target = document.pointer(target_pointer).ok_or_else(|| { + documentation_error(format!( + "{schema} runtime schema has unresolved reference {reference:?}" + )) + })?; + walk_runtime_schema( + schema, + document, + target, + target_pointer, + key_path, + visited_references, + paths, + )?; + } + } + + for keyword in ["allOf", "anyOf", "oneOf"] { + if let Some(branches) = object.get(keyword).and_then(Value::as_array) { + for (index, branch) in branches.iter().enumerate() { + walk_runtime_schema( + schema, + document, + branch, + &format!("{pointer}/{keyword}/{index}"), + key_path, + visited_references, + paths, + )?; + } + } + } + + if let Some(properties) = object.get("properties").and_then(Value::as_object) { + let required = object + .get("required") + .and_then(Value::as_array) + .into_iter() + .flatten() + .filter_map(Value::as_str) + .collect::>(); + for (name, property) in properties { + let child_pointer = format!("{pointer}/properties/{}", escape_pointer_segment(name)); + let child_key_path = if key_path.is_empty() { + name.clone() + } else { + format!("{key_path}.{name}") + }; + record_runtime_path( + paths, + RuntimePathIdentity { + schema, + pointer: child_pointer.clone(), + key_path: child_key_path.clone(), + path_kind: FieldPathKind::Property, + }, + property, + Some(required.contains(name.as_str())), + )?; + walk_runtime_schema( + schema, + document, + property, + &child_pointer, + &child_key_path, + visited_references, + paths, + )?; + } + } + + if let Some(items) = object.get("items").filter(|value| value.is_object()) { + let child_pointer = format!("{pointer}/items"); + let child_key_path = format!("{key_path}[]"); + record_runtime_path( + paths, + RuntimePathIdentity { + schema, + pointer: child_pointer.clone(), + key_path: child_key_path.clone(), + path_kind: FieldPathKind::ArrayItem, + }, + items, + None, + )?; + walk_runtime_schema( + schema, + document, + items, + &child_pointer, + &child_key_path, + visited_references, + paths, + )?; + } + + if let Some(values) = object + .get("additionalProperties") + .filter(|value| value.is_object()) + { + let child_pointer = format!("{pointer}/additionalProperties"); + let child_key_path = format!("{key_path}.*"); + record_runtime_path( + paths, + RuntimePathIdentity { + schema, + pointer: child_pointer.clone(), + key_path: child_key_path.clone(), + path_kind: FieldPathKind::MapValue, + }, + values, + None, + )?; + walk_runtime_schema( + schema, + document, + values, + &child_pointer, + &child_key_path, + visited_references, + paths, + )?; + } + Ok(()) +} + +fn record_runtime_path( + paths: &mut BTreeMap, + identity: RuntimePathIdentity, + node: &Value, + required: Option, +) -> Result<(), DocumentationError> { + if let Some(existing) = paths.get_mut(&identity.key_path) { + if existing.identity.schema != identity.schema + || existing.identity.path_kind != identity.path_kind + { + return Err(documentation_error(format!( + "runtime key path {:?} resolves to conflicting schema path kinds", + identity.key_path + ))); + } + if identity.pointer < existing.identity.pointer { + existing.identity.pointer = identity.pointer; + } + existing.nodes.push(node.clone()); + if let Some(required) = required { + existing.required.insert(required); + } + return Ok(()); + } + let mut requiredness = BTreeSet::new(); + if let Some(required) = required { + requiredness.insert(required); + } + paths.insert( + identity.key_path.clone(), + RuntimeSchemaPath { + identity, + nodes: vec![node.clone()], + required: requiredness, + }, + ); + Ok(()) +} + +fn escape_pointer_segment(segment: &str) -> String { + segment.replace('~', "~0").replace('/', "~1") +} + +fn prepare_runtime_intent<'a>( + document: &Value, + intent: &'a RuntimeIntentCatalog, +) -> Result, DocumentationError> { + if intent.schema + != "https://id.registrystack.org/schemas/registryctl/project-documentation/registry.runtime.configuration_intent.v1.schema.json" + || intent.format_version != CONFIGURATION_REFERENCE_FORMAT_VERSION + { + return Err(documentation_error( + "runtime intent must identify the strict v1 intent contract", + )); + } + if !matches!( + intent.runtime_schema, + ConfigurationSchemaKind::Relay | ConfigurationSchemaKind::Notary + ) { + return Err(documentation_error( + "runtime intent schema must be relay or notary", + )); + } + if document.get("$id").and_then(Value::as_str) != Some(intent.schema_id.as_str()) { + return Err(documentation_error(format!( + "{} runtime intent schema id does not match its product schema", + intent.runtime_schema + ))); + } + if !intent.schema_source.ends_with(".schema.json") { + return Err(documentation_error( + "runtime intent schema source must name a JSON Schema artifact", + )); + } + let paths = runtime_schema_paths(intent.runtime_schema, document)?; + + let mut profiles = BTreeMap::new(); + for profile in &intent.profiles { + if profile.id.is_empty() + || !profile.id.chars().all(|character| { + character.is_ascii_lowercase() || character.is_ascii_digit() || character == '_' + }) + { + return Err(documentation_error(format!( + "runtime intent profile id {:?} is invalid", + profile.id + ))); + } + for (name, prose) in [ + ("purpose", &profile.purpose), + ("scope", &profile.scope), + ("migration_note", &profile.migration_note), + ("example_guidance", &profile.example_guidance), + ] { + validate_prose( + prose, + &format!("{} profile {} {name}", intent.runtime_schema, profile.id), + )?; + } + if let Some(semantics) = &profile.open_map_semantics { + validate_prose( + semantics, + &format!( + "{} profile {} open_map_semantics", + intent.runtime_schema, profile.id + ), + )?; + } + validate_introduced_version(&profile.introduced_in)?; + if profile.products.is_empty() + || profile.validation_stages.is_empty() + || profile.consumers.is_empty() + || profile.generated_artifacts.is_empty() + || profile.review_classes.is_empty() + || profile.semantic_rules.is_empty() + { + return Err(documentation_error(format!( + "{} profile {} has an empty required semantic dimension", + intent.runtime_schema, profile.id + ))); + } + validate_runtime_profile(intent.runtime_schema, profile)?; + if profiles.insert(profile.id.as_str(), profile).is_some() { + return Err(documentation_error(format!( + "duplicate runtime intent profile {}", + profile.id + ))); + } + } + + let mut assignments = BTreeMap::new(); + let mut used_profiles = BTreeSet::new(); + for assignment in &intent.assignments { + if assignment.schema != intent.runtime_schema { + return Err(documentation_error(format!( + "runtime assignment {:?} declares the wrong product schema", + assignment.key_path + ))); + } + let path = paths.get(&assignment.key_path).ok_or_else(|| { + documentation_error(format!( + "{} runtime assignment targets stale key path {:?}", + intent.runtime_schema, assignment.key_path + )) + })?; + if assignment.pointer != path.identity.pointer + || assignment.path_kind != path.identity.path_kind + { + return Err(documentation_error(format!( + "{} runtime assignment {:?} has stale pointer or wrong path kind", + intent.runtime_schema, assignment.key_path + ))); + } + if !assignment.schema_facts_reviewed { + return Err(documentation_error(format!( + "{} runtime assignment {:?} has not reviewed its schema facts", + intent.runtime_schema, assignment.key_path + ))); + } + let profile = profiles.get(assignment.profile.as_str()).ok_or_else(|| { + documentation_error(format!( + "{} runtime assignment {:?} uses unknown profile {:?}", + intent.runtime_schema, assignment.key_path, assignment.profile + )) + })?; + if assignment.path_kind == FieldPathKind::MapValue && profile.open_map_semantics.is_none() { + return Err(documentation_error(format!( + "{} open map {:?} lacks exact extension semantics", + intent.runtime_schema, assignment.key_path + ))); + } + if assignment.path_kind != FieldPathKind::MapValue && profile.open_map_semantics.is_some() { + return Err(documentation_error(format!( + "{} non-map path {:?} uses an open-map profile", + intent.runtime_schema, assignment.key_path + ))); + } + let required_path_rule = match assignment.path_kind { + FieldPathKind::MapKey | FieldPathKind::MapValue => { + Some(SemanticRule::ArbitraryMapKeysNotFixedProperties) + } + FieldPathKind::ArrayItem => Some(SemanticRule::ArrayItemsShareElementContract), + FieldPathKind::Branch => Some(SemanticRule::BranchHasNoAuthoredValue), + FieldPathKind::Root | FieldPathKind::Property => None, + }; + if required_path_rule.is_some_and(|rule| !profile.semantic_rules.contains(&rule)) { + return Err(documentation_error(format!( + "{} runtime assignment {:?} profile lacks its path-kind semantic rule", + intent.runtime_schema, assignment.key_path + ))); + } + used_profiles.insert(assignment.profile.as_str()); + if assignments + .insert(assignment.key_path.clone(), assignment) + .is_some() + { + return Err(documentation_error(format!( + "duplicate {} runtime assignment for {:?}", + intent.runtime_schema, assignment.key_path + ))); + } + } + let unused_profiles = profiles + .keys() + .copied() + .collect::>() + .difference(&used_profiles) + .copied() + .collect::>(); + if !unused_profiles.is_empty() { + return Err(documentation_error(format!( + "{} runtime intent has unused profiles: {}", + intent.runtime_schema, + unused_profiles.join(", ") + ))); + } + + let mut overrides = BTreeMap::new(); + for entry in &intent.overrides { + if entry.schema != intent.runtime_schema { + return Err(documentation_error( + "runtime override declares wrong schema", + )); + } + let assignment = assignments.get(&entry.key_path).ok_or_else(|| { + documentation_error(format!( + "{} runtime override targets unassigned key path {:?}", + intent.runtime_schema, entry.key_path + )) + })?; + if entry.pointer != assignment.pointer || entry.path_kind != assignment.path_kind { + return Err(documentation_error(format!( + "{} runtime override {:?} has stale pointer or wrong path kind", + intent.runtime_schema, entry.key_path + ))); + } + if entry.purpose.is_some() != (assignment.purpose_source == RuntimePurposeSource::Override) + || entry.runtime_default_note.is_some() + != (assignment.default_source == RuntimeDefaultSource::ReviewedRuntimeDefault) + { + return Err(documentation_error(format!( + "{} runtime override {:?} conflicts with assignment source flags", + intent.runtime_schema, entry.key_path + ))); + } + if let Some(prose) = &entry.purpose { + validate_prose( + prose, + &format!("{}#{} purpose", entry.schema, entry.key_path), + )?; + } + if let Some(prose) = &entry.runtime_default_note { + validate_prose( + prose, + &format!("{}#{} runtime default", entry.schema, entry.key_path), + )?; + } + if entry.purpose.is_none() && entry.runtime_default_note.is_none() { + return Err(documentation_error(format!( + "{} runtime override {:?} is unused", + intent.runtime_schema, entry.key_path + ))); + } + if overrides.insert(entry.key_path.clone(), entry).is_some() { + return Err(documentation_error(format!( + "duplicate {} runtime override for {:?}", + intent.runtime_schema, entry.key_path + ))); + } + } + + let mut missing = paths + .values() + .filter(|path| !assignments.contains_key(&path.identity.key_path)) + .map(|path| DocumentationFieldAddress { + schema: path.identity.schema, + pointer: path.identity.pointer.clone(), + key_path: Some(path.identity.key_path.clone()), + path_kind: path.identity.path_kind, + }) + .collect::>(); + missing.sort(); + Ok(PreparedRuntimeIntent { + paths, + profiles, + assignments, + overrides, + missing, + }) +} + +fn validate_runtime_profile( + schema: ConfigurationSchemaKind, + profile: &RuntimeIntentProfile, +) -> Result<(), DocumentationError> { + let (id_prefix, semantic_owner, human_owner, product, consumer, artifact, review_class) = + match schema { + ConfigurationSchemaKind::Relay => ( + "relay_", + SemanticOwner::RelayRuntime, + HumanOwner::RelayMaintainers, + Product::Relay, + Consumer::RegistryRelay, + GeneratedArtifact::RelayConfig, + ReviewClass::Relay, + ), + ConfigurationSchemaKind::Notary => ( + "notary_", + SemanticOwner::NotaryRuntime, + HumanOwner::NotaryMaintainers, + Product::Notary, + Consumer::RegistryNotary, + GeneratedArtifact::NotaryConfig, + ReviewClass::Notary, + ), + _ => { + return Err(documentation_error( + "runtime profile validation requires a product runtime schema", + )); + } + }; + if !profile.id.starts_with(id_prefix) + || profile.semantic_owner != semantic_owner + || profile.human_owner != human_owner + || profile.state != ConfigurationState::Runtime + || profile.diagnostic.trim().is_empty() + { + return Err(documentation_error(format!( + "{schema} profile {} crosses its product ownership boundary", + profile.id + ))); + } + if profile.diagnostic.contains(' ') { + validate_prose( + &profile.diagnostic, + &format!("{schema} profile {} diagnostic limitation", profile.id), + )?; + } else { + let product_prefix = match schema { + ConfigurationSchemaKind::Relay => "registry.relay.config.", + ConfigurationSchemaKind::Notary => "registry.notary.config.", + _ => unreachable!("runtime profile schema was restricted above"), + }; + let suffix = profile + .diagnostic + .strip_prefix("config.") + .or_else(|| profile.diagnostic.strip_prefix(product_prefix)); + if suffix.is_none_or(|suffix| { + suffix.is_empty() + || !suffix.chars().all(|character| { + character.is_ascii_lowercase() + || character.is_ascii_digit() + || matches!(character, '_' | '.') + }) + }) { + return Err(documentation_error(format!( + "{schema} profile {} has an invalid or cross-product diagnostic code", + profile.id + ))); + } + } + let products = profile.products.iter().copied().collect::>(); + let consumers = profile.consumers.iter().copied().collect::>(); + let artifacts = profile + .generated_artifacts + .iter() + .copied() + .collect::>(); + let reviews = profile + .review_classes + .iter() + .copied() + .collect::>(); + let rules = profile + .semantic_rules + .iter() + .copied() + .collect::>(); + if products != [product, Product::Docs].into_iter().collect() + || consumers != [consumer, Consumer::DocsGenerator].into_iter().collect() + || artifacts + != [artifact, GeneratedArtifact::FieldReference] + .into_iter() + .collect() + || ![ + ReviewClass::Contract, + review_class, + ReviewClass::Documentation, + ] + .into_iter() + .all(|required| reviews.contains(&required)) + || ![ + SemanticRule::KnowledgeOnly, + SemanticRule::GeneratedDocsNeverLoadCountryValues, + ] + .into_iter() + .all(|required| rules.contains(&required)) + { + return Err(documentation_error(format!( + "{schema} profile {} has incomplete or cross-product ownership metadata", + profile.id + ))); + } + let sensitivity_rule = match profile.sensitivity { + Sensitivity::Sensitive => Some(SemanticRule::SensitiveOperationalMetadata), + Sensitivity::SecretReference | Sensitivity::SecretValue => { + Some(SemanticRule::SecretNeverReportable) + } + Sensitivity::RedactedFixture => Some(SemanticRule::SyntheticFixtureValueRedacted), + Sensitivity::Public | Sensitivity::Internal | Sensitivity::Structural => None, + }; + if sensitivity_rule.is_some_and(|rule| !rules.contains(&rule)) { + return Err(documentation_error(format!( + "{schema} profile {} lacks its sensitivity semantic rule", + profile.id + ))); + } + Ok(()) +} + +fn validate_introduced_version(version: &str) -> Result<(), DocumentationError> { + let parts = version.split('.').collect::>(); + if parts.len() != 3 + || parts.iter().any(|part| { + part.is_empty() || !part.chars().all(|character| character.is_ascii_digit()) + }) + { + return Err(documentation_error(format!( + "runtime intent introduced version {version:?} must be semver-like" + ))); + } + Ok(()) +} + +fn runtime_configuration_fields( + document: &Value, + intent: &RuntimeIntentCatalog, +) -> Result< + ( + Vec, + Vec, + ), + DocumentationError, +> { + let prepared = prepare_runtime_intent(document, intent)?; + let fields = prepared + .paths + .iter() + .filter(|(key_path, _)| prepared.assignments.contains_key(*key_path)) + .map(|(key_path, path)| { + let assignment = prepared.assignments[key_path]; + let profile = prepared.profiles[assignment.profile.as_str()]; + let override_intent = prepared.overrides.get(key_path).copied(); + let descriptions = runtime_schema_values(document, &path.nodes, "description")? + .into_iter() + .filter_map(|value| value.as_str().map(str::to_owned)) + .collect::>(); + let (purpose, purpose_source) = match assignment.purpose_source { + RuntimePurposeSource::SchemaDescription => { + if descriptions.len() != 1 { + return Err(documentation_error(format!( + "{} runtime path {key_path:?} reviewed schema-description source but resolves to {} descriptions", + intent.runtime_schema, + descriptions.len() + ))); + } + let purpose = descriptions + .iter() + .next() + .expect("one description is present") + .clone(); + validate_prose( + &purpose, + &format!("{}#{key_path} schema description", intent.runtime_schema), + )?; + (purpose, HumanIntentSource::SchemaDescription) + } + RuntimePurposeSource::Profile => { + if override_intent.and_then(|entry| entry.purpose.as_ref()).is_some() { + return Err(documentation_error(format!( + "{} runtime path {key_path:?} has a conflicting purpose override", + intent.runtime_schema + ))); + } + (profile.purpose.clone(), HumanIntentSource::ReviewedProfile) + } + RuntimePurposeSource::Override => { + let purpose = override_intent + .and_then(|entry| entry.purpose.as_ref()) + .ok_or_else(|| { + documentation_error(format!( + "{} runtime path {key_path:?} lacks its reviewed purpose override", + intent.runtime_schema + )) + })? + .clone(); + (purpose, HumanIntentSource::ReviewedOverride) + } + }; + let defaults = runtime_schema_values(document, &path.nodes, "default")?; + let default = match assignment.default_source { + RuntimeDefaultSource::SchemaDefault => { + if defaults.len() != 1 { + return Err(documentation_error(format!( + "{} runtime path {key_path:?} reviewed schema-default source but resolves to {} defaults", + intent.runtime_schema, + defaults.len() + ))); + } + DefaultDocumentation { + behavior: DefaultBehavior::SchemaDefault, + // Runtime schema defaults may contain deployment-local names or paths. + // The reviewed reference reports behavior without copying the value. + schema_value: None, + source_version: None, + reviewed_behavior: Some( + "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + .to_owned(), + ), + } + } + RuntimeDefaultSource::NoSchemaDefault => { + if !defaults.is_empty() { + return Err(documentation_error(format!( + "{} runtime path {key_path:?} declares no schema default but one is present", + intent.runtime_schema + ))); + } + DefaultDocumentation { + behavior: DefaultBehavior::NoSchemaDefault, + schema_value: None, + source_version: None, + reviewed_behavior: None, + } + } + RuntimeDefaultSource::ReviewedRuntimeDefault => { + if !defaults.is_empty() { + return Err(documentation_error(format!( + "{} runtime path {key_path:?} declares an out-of-schema default but the schema publishes one", + intent.runtime_schema + ))); + } + DefaultDocumentation { + behavior: DefaultBehavior::ReviewedRuntimeDefault, + schema_value: None, + source_version: None, + reviewed_behavior: Some( + override_intent + .and_then(|entry| entry.runtime_default_note.as_ref()) + .ok_or_else(|| { + documentation_error(format!( + "{} runtime path {key_path:?} lacks its reviewed default override", + intent.runtime_schema + )) + })? + .clone(), + ), + } + } + RuntimeDefaultSource::NotApplicable => { + if !defaults.is_empty() { + return Err(documentation_error(format!( + "{} runtime path {key_path:?} marks default not applicable but the schema publishes one", + intent.runtime_schema + ))); + } + DefaultDocumentation { + behavior: DefaultBehavior::NotApplicable, + schema_value: None, + source_version: None, + reviewed_behavior: None, + } + } + }; + let schema_types = runtime_schema_types(document, &path.nodes)?; + let requiredness = runtime_requiredness(path); + let null_behavior = runtime_null_behavior(path.identity.path_kind, &schema_types); + let empty_behavior = + runtime_empty_behavior(document, path.identity.path_kind, &path.nodes, &schema_types)?; + let constraints = runtime_schema_constraints(document, &path.nodes)?; + let local_reference = path + .nodes + .iter() + .find_map(|node| node.get("$ref").and_then(Value::as_str)) + .map(|pointer| DocumentationSchemaAddress { + schema: intent.runtime_schema, + pointer: pointer.strip_prefix('#').unwrap_or(pointer).to_owned(), + }); + Ok(ConfigurationFieldReference { + address: DocumentationFieldAddress { + schema: intent.runtime_schema, + pointer: path.identity.pointer.clone(), + key_path: Some(key_path.clone()), + path_kind: path.identity.path_kind, + }, + purpose, + purpose_source, + intent_profile: Some(profile.id.clone()), + semantic_owner: profile.semantic_owner, + human_owner: profile.human_owner, + scope: profile.scope.clone(), + field_type: FieldTypeDocumentation { + schema_types, + local_reference: path + .nodes + .iter() + .find_map(|node| node.get("$ref").and_then(Value::as_str)) + .map(str::to_owned), + composed: path.nodes.iter().any(|node| { + ["allOf", "anyOf", "oneOf"] + .iter() + .any(|keyword| node.get(keyword).is_some()) + }), + }, + requiredness, + null_behavior, + empty_behavior, + default, + environment_behavior: profile.environment_behavior, + sensitivity: profile.sensitivity, + state: profile.state, + products: profile.products.clone(), + availability: profile.availability, + stability: profile.stability, + validation_stages: profile.validation_stages.clone(), + diagnostic: profile.diagnostic.clone(), + history_status: FieldHistoryStatus::NotVerified, + introduced_in: None, + version_history: Vec::new(), + example: ExampleDocumentation { + guidance: profile.example_guidance.clone(), + schema_examples_available: !runtime_schema_values( + document, + &path.nodes, + "examples", + )? + .is_empty(), + contains_country_values: false, + }, + migration: profile.migration, + migration_note: profile.migration_note.clone(), + consumers: profile.consumers.clone(), + generated_artifacts: profile.generated_artifacts.clone(), + review_classes: profile.review_classes.clone(), + semantic_rules: profile.semantic_rules.clone(), + constraints, + local_reference, + }) + }) + .collect::, DocumentationError>>()?; + Ok((fields, prepared.missing)) +} + +pub fn runtime_configuration_intent_gaps( + document: &Value, + intent: &RuntimeIntentCatalog, +) -> Result, DocumentationError> { + Ok(prepare_runtime_intent(document, intent)?.missing) +} + +pub fn generate_runtime_configuration_fields( + document: &Value, + intent: &RuntimeIntentCatalog, +) -> Result, DocumentationError> { + let (fields, missing) = runtime_configuration_fields(document, intent)?; + if !missing.is_empty() { + return Err(documentation_error(format!( + "{} runtime configuration has {} paths without exact reviewed intent", + intent.runtime_schema, + missing.len() + ))); + } + Ok(fields) +} + +fn runtime_schema_values( + document: &Value, + nodes: &[Value], + keyword: &str, +) -> Result, DocumentationError> { + let mut values = BTreeMap::new(); + for node in nodes { + collect_runtime_schema_values(document, node, keyword, &mut BTreeSet::new(), &mut values)?; + } + Ok(values.into_values().collect()) +} + +fn collect_runtime_schema_values( + document: &Value, + node: &Value, + keyword: &str, + visited: &mut BTreeSet, + values: &mut BTreeMap, +) -> Result<(), DocumentationError> { + let Some(object) = node.as_object() else { + return Ok(()); + }; + if let Some(value) = object.get(keyword) { + values.insert( + serde_json::to_string(value).expect("schema keyword value serializes"), + value.clone(), + ); + } + if let Some(reference) = object.get("$ref").and_then(Value::as_str) { + let pointer = reference.strip_prefix('#').ok_or_else(|| { + documentation_error(format!( + "runtime schema uses external reference {reference:?}" + )) + })?; + if visited.insert(pointer.to_owned()) { + let target = document.pointer(pointer).ok_or_else(|| { + documentation_error(format!( + "runtime schema has unresolved reference {reference:?}" + )) + })?; + collect_runtime_schema_values(document, target, keyword, visited, values)?; + } + } + for composer in ["allOf", "anyOf", "oneOf"] { + if let Some(branches) = object.get(composer).and_then(Value::as_array) { + for branch in branches { + collect_runtime_schema_values(document, branch, keyword, visited, values)?; + } + } + } + Ok(()) +} + +fn runtime_schema_types( + document: &Value, + nodes: &[Value], +) -> Result, DocumentationError> { + let values = runtime_schema_values(document, nodes, "type")?; + let mut types = BTreeSet::new(); + for value in values { + match value { + Value::String(kind) => { + types.insert(kind); + } + Value::Array(kinds) => { + types.extend( + kinds + .into_iter() + .filter_map(|kind| kind.as_str().map(str::to_owned)), + ); + } + _ => { + return Err(documentation_error( + "runtime schema type keyword must be a string or string array", + )); + } + } + } + if runtime_schema_values(document, nodes, "const")? + .iter() + .any(Value::is_null) + { + types.insert("null".to_owned()); + } + Ok(types.into_iter().collect()) +} + +fn runtime_requiredness(path: &RuntimeSchemaPath) -> Requiredness { + match path.identity.path_kind { + FieldPathKind::Root | FieldPathKind::ArrayItem | FieldPathKind::MapValue => { + Requiredness::NotApplicable + } + FieldPathKind::Property if path.required == [true].into_iter().collect() => { + Requiredness::Required + } + FieldPathKind::Property if path.required == [false].into_iter().collect() => { + Requiredness::Optional + } + FieldPathKind::Property => Requiredness::Conditional, + FieldPathKind::MapKey | FieldPathKind::Branch => Requiredness::NotApplicable, + } +} + +fn runtime_null_behavior(kind: FieldPathKind, schema_types: &[String]) -> NullBehavior { + if kind == FieldPathKind::Root { + return NullBehavior::NotApplicable; + } + if schema_types.iter().any(|kind| kind == "null") { + if schema_types.len() == 1 { + NullBehavior::Allowed + } else { + NullBehavior::Conditional + } + } else { + NullBehavior::Rejected + } +} + +fn runtime_empty_behavior( + document: &Value, + kind: FieldPathKind, + nodes: &[Value], + schema_types: &[String], +) -> Result { + if kind == FieldPathKind::Root || !schema_types.iter().any(|kind| kind == "string") { + return Ok(EmptyBehavior::NotApplicable); + } + let minimums = runtime_schema_values(document, nodes, "minLength")? + .into_iter() + .filter_map(|value| value.as_u64()) + .collect::>(); + Ok(if minimums.is_empty() { + EmptyBehavior::Allowed + } else if minimums.iter().all(|minimum| *minimum >= 1) { + EmptyBehavior::Rejected + } else { + EmptyBehavior::Conditional + }) +} + +fn runtime_schema_constraints( + document: &Value, + nodes: &[Value], +) -> Result, DocumentationError> { + let mut constraints = BTreeMap::new(); + for keyword in CONSTRAINT_KEYWORDS { + let values = runtime_schema_values(document, nodes, keyword)?; + if values.len() == 1 { + constraints.insert( + keyword.to_owned(), + values + .into_iter() + .next() + .expect("one constraint is present"), + ); + } else if !values.is_empty() { + constraints.insert( + keyword.to_owned(), + Value::Array(values.into_iter().collect()), + ); + } + } + Ok(constraints + .into_iter() + .map(|(keyword, value)| SchemaConstraint { keyword, value }) + .collect()) +} + +/// Returns the embedded coverage audit. This function parses committed release assets only. +pub fn embedded_configuration_reference_coverage( +) -> Result { + let authored_coverage = with_embedded_inputs(configuration_reference_coverage)?; + let (fields, missing) = embedded_seven_domain_fields()?; + let coverage = combined_coverage_summary(&fields, &missing); + let authored_path_count = [ + ConfigurationSchemaKind::Project, + ConfigurationSchemaKind::Environment, + ConfigurationSchemaKind::Integration, + ConfigurationSchemaKind::Fixture, + ConfigurationSchemaKind::Entity, + ] + .into_iter() + .map(|schema| coverage.by_schema.get(&schema).copied().unwrap_or_default()) + .sum::(); + if authored_coverage.status != CoverageStatus::Complete + || authored_coverage.coverage.path_count != authored_path_count + { + return Err(documentation_error( + "combined reference does not preserve the complete authored coverage audit", + )); + } + let reviewed_intent_assignment_required_count = coverage.path_count; + let purpose_counts = fields.iter().fold(BTreeMap::new(), |mut counts, field| { + *counts.entry(field.purpose.clone()).or_default() += 1; + counts + }); + let intent_counts = reviewed_intent_counts(&purpose_counts); + Ok(ConfigurationReferenceCoverageV1 { + schema_id: CONFIGURATION_REFERENCE_COVERAGE_SCHEMA_ID, + format_version: CONFIGURATION_REFERENCE_FORMAT_VERSION, + status: if missing.is_empty() { + CoverageStatus::Complete + } else { + CoverageStatus::Incomplete + }, + reference_baseline: reference_baseline(), + source_contract: combined_source_contract(), + coverage, + reviewed_intent_assignment_required_count, + reviewed_intent_assignment_covered_count: fields.len(), + distinct_reviewed_intent_count: intent_counts.distinct, + distinct_reviewed_intents_reused_count: intent_counts.distinct_reused, + reviewed_intent_assignments_using_reused_intent_count: intent_counts + .assignments_using_reused, + missing_intent: missing, + }) +} + +/// Returns the embedded canonical reference, failing until human-intent coverage is complete. +pub fn embedded_configuration_reference() -> Result { + let (fields, missing) = embedded_seven_domain_fields()?; + if !missing.is_empty() { + return Err(documentation_error(format!( + "configuration reference has {} runtime paths without reviewed product intent", + missing.len() + ))); + } + Ok(ConfigurationReferenceV1 { + schema_id: CONFIGURATION_REFERENCE_SCHEMA_ID, + format_version: CONFIGURATION_REFERENCE_FORMAT_VERSION, + reference_baseline: reference_baseline(), + source_contract: combined_source_contract(), + coverage: combined_coverage_summary(&fields, &[]), + fields, + }) +} + +fn embedded_seven_domain_fields() -> Result< + ( + Vec, + Vec, + ), + DocumentationError, +> { + let authored = with_embedded_inputs(generate_configuration_reference)?; + let relay_document = registry_relay::config::schema::document(); + let notary_document = registry_notary_core::config::schema::document(); + let relay_intent: RuntimeIntentCatalog = serde_json::from_str(RELAY_RUNTIME_INTENT_ASSET) + .map_err(|error| documentation_error(format!("embedded Relay runtime intent: {error}")))?; + let notary_intent: RuntimeIntentCatalog = serde_json::from_str(NOTARY_RUNTIME_INTENT_ASSET) + .map_err(|error| documentation_error(format!("embedded Notary runtime intent: {error}")))?; + validate_embedded_runtime_identity( + &relay_intent, + ConfigurationSchemaKind::Relay, + "registry-relay.config.schema.json", + )?; + validate_embedded_runtime_identity( + ¬ary_intent, + ConfigurationSchemaKind::Notary, + "registry-notary.config.schema.json", + )?; + let relay_required = + runtime_schema_paths(ConfigurationSchemaKind::Relay, &relay_document)?.len(); + let notary_required = + runtime_schema_paths(ConfigurationSchemaKind::Notary, ¬ary_document)?.len(); + let mut missing = runtime_configuration_intent_gaps(&relay_document, &relay_intent)?; + let notary_missing = runtime_configuration_intent_gaps(¬ary_document, ¬ary_intent)?; + let relay_fields = if missing.is_empty() { + generate_runtime_configuration_fields(&relay_document, &relay_intent)? + } else { + runtime_configuration_fields(&relay_document, &relay_intent)?.0 + }; + let notary_fields = if notary_missing.is_empty() { + generate_runtime_configuration_fields(¬ary_document, ¬ary_intent)? + } else { + runtime_configuration_fields(¬ary_document, ¬ary_intent)?.0 + }; + if relay_fields.len() + missing.len() != relay_required { + return Err(documentation_error( + "Relay runtime reference coverage does not match its authoritative schema paths", + )); + } + if notary_fields.len() + notary_missing.len() != notary_required { + return Err(documentation_error( + "Notary runtime reference coverage does not match its authoritative schema paths", + )); + } + missing.extend(notary_missing); + missing.sort(); + let mut fields = authored.fields; + fields.extend(relay_fields); + fields.extend(notary_fields); + fields.sort_by(|left, right| left.address.cmp(&right.address)); + if fields + .windows(2) + .any(|pair| pair[0].address == pair[1].address) + { + return Err(documentation_error( + "combined configuration reference contains a duplicate field address", + )); + } + Ok((fields, missing)) +} + +fn validate_embedded_runtime_identity( + intent: &RuntimeIntentCatalog, + schema: ConfigurationSchemaKind, + schema_source: &str, +) -> Result<(), DocumentationError> { + if intent.runtime_schema != schema || intent.schema_source != schema_source { + return Err(documentation_error(format!( + "{schema} runtime intent does not identify its exact product schema source" + ))); + } + Ok(()) +} + +fn combined_source_contract() -> ReferenceSourceContract { + ReferenceSourceContract { + schemas: vec![ + ConfigurationSchemaKind::Project, + ConfigurationSchemaKind::Environment, + ConfigurationSchemaKind::Integration, + ConfigurationSchemaKind::Fixture, + ConfigurationSchemaKind::Entity, + ConfigurationSchemaKind::Relay, + ConfigurationSchemaKind::Notary, + ], + schema_sources: vec![ + "project.schema.json".to_owned(), + "environment.schema.json".to_owned(), + "integration.schema.json".to_owned(), + "fixture.schema.json".to_owned(), + "entity.schema.json".to_owned(), + "registry-relay.config.schema.json".to_owned(), + "registry-notary.config.schema.json".to_owned(), + ], + field_knowledge: "schemas/project-authoring/parity-coverage.json#field_knowledge", + human_intent: "schemas/project-authoring/documentation-intent.json", + runtime_intent: vec![RELAY_RUNTIME_INTENT_SOURCE, NOTARY_RUNTIME_INTENT_SOURCE], + reads_country_workspaces: false, + reads_runtime_configuration: false, + } +} + +fn combined_coverage_summary( + fields: &[ConfigurationFieldReference], + missing: &[DocumentationFieldAddress], +) -> ReferenceCoverageSummary { + let mut by_schema = BTreeMap::new(); + let mut by_path_kind = BTreeMap::new(); + let mut by_sensitivity = BTreeMap::new(); + let mut by_intent_source = BTreeMap::new(); + let mut by_intent_profile = BTreeMap::new(); + let mut reference_count = 0; + for field in fields { + *by_schema.entry(field.address.schema).or_default() += 1; + *by_path_kind.entry(field.address.path_kind).or_default() += 1; + *by_sensitivity.entry(field.sensitivity).or_default() += 1; + *by_intent_source.entry(field.purpose_source).or_default() += 1; + if let Some(profile) = &field.intent_profile { + *by_intent_profile.entry(profile.clone()).or_default() += 1; + } + if field.local_reference.is_some() { + reference_count += 1; + } + } + for address in missing { + *by_schema.entry(address.schema).or_default() += 1; + *by_path_kind.entry(address.path_kind).or_default() += 1; + } + ReferenceCoverageSummary { + schema_count: by_schema.len(), + path_count: fields.len() + missing.len(), + reference_count, + by_schema, + by_path_kind, + by_sensitivity, + by_intent_source, + by_intent_profile, + } +} + +struct EmbeddedInputs { + catalog: FieldKnowledgeCatalog, + documents: Vec<(SchemaKind, Value, &'static str)>, + intent: DocumentationIntentCatalog, +} + +fn embedded_inputs() -> Result { + #[derive(Deserialize)] + struct CoverageAsset { + field_knowledge: FieldKnowledgeCatalog, + } + + let coverage: CoverageAsset = serde_json::from_str(KNOWLEDGE_ASSET) + .map_err(|error| documentation_error(format!("embedded field knowledge: {error}")))?; + let intent: DocumentationIntentCatalog = serde_json::from_str(INTENT_ASSET) + .map_err(|error| documentation_error(format!("embedded documentation intent: {error}")))?; + let documents = [ + (SchemaKind::Project, PROJECT_SCHEMA, "project.schema.json"), + ( + SchemaKind::Environment, + ENVIRONMENT_SCHEMA, + "environment.schema.json", + ), + ( + SchemaKind::Integration, + INTEGRATION_SCHEMA, + "integration.schema.json", + ), + (SchemaKind::Fixture, FIXTURE_SCHEMA, "fixture.schema.json"), + (SchemaKind::Entity, ENTITY_SCHEMA, "entity.schema.json"), + ] + .into_iter() + .map(|(kind, text, source)| { + serde_json::from_str(text) + .map(|document| (kind, document, source)) + .map_err(|error| { + documentation_error(format!("embedded {kind} authoring schema: {error}")) + }) + }) + .collect::, _>>()?; + + Ok(EmbeddedInputs { + catalog: coverage.field_knowledge, + documents, + intent, + }) +} + +fn with_embedded_inputs( + operation: impl FnOnce( + &FieldKnowledgeCatalog, + &[DocumentationSchema<'_>], + &DocumentationIntentCatalog, + ) -> Result, +) -> Result { + let embedded = embedded_inputs()?; + let schemas = embedded + .documents + .iter() + .map(|(kind, document, source_name)| DocumentationSchema { + published: PublishedSchema { + kind: *kind, + document, + }, + source_name, + }) + .collect::>(); + operation(&embedded.catalog, &schemas, &embedded.intent) +} + +fn prepare<'a>( + catalog: &FieldKnowledgeCatalog, + schemas: &'a [DocumentationSchema<'a>], + intent: &'a DocumentationIntentCatalog, +) -> Result, DocumentationError> { + validate_intent_policy(intent)?; + let published = schemas + .iter() + .map(|schema| PublishedSchema { + kind: schema.published.kind, + document: schema.published.document, + }) + .collect::>(); + let index = index_published_field_knowledge(catalog, &published) + .map_err(|error| documentation_error(format!("field knowledge: {error}")))?; + let reachable = published + .iter() + .map(reachable_published_field_paths) + .collect::, _>>() + .map_err(|error| documentation_error(format!("reachable schema fields: {error}")))? + .into_iter() + .flatten() + .collect::>(); + if reachable != index.by_path().keys().cloned().collect::>() { + return Err(documentation_error( + "documentation fields and reachable authored schema paths differ", + )); + } + let domains = unique_domains(intent, schemas)?; + let overrides = unique_overrides(intent, &index)?; + let structural_reviews = unique_structural_reviews(intent, &index)?; + let mut missing = Vec::new(); + let mut purpose_sources = BTreeMap::new(); + let mut purpose_counts = BTreeMap::new(); + for (path, knowledge) in index.by_path() { + if !intent + .policy + .prose_required_for + .contains(&knowledge.path_kind) + { + continue; + } + let schema = schemas + .iter() + .find(|schema| schema.published.kind == path.schema) + .ok_or_else(|| documentation_error(format!("missing schema for {path}")))?; + let node = schema + .published + .document + .pointer(&path.pointer) + .ok_or_else(|| { + documentation_error(format!("published documentation path disappeared: {path}")) + })?; + let contract_node = resolve_local_reference(schema.published.document, node)?; + match reviewed_purpose( + node, + contract_node, + knowledge.path_kind, + overrides.get(path).copied(), + intent, + path, + &structural_reviews, + ) { + Ok((purpose, source)) => { + *purpose_sources.entry(source).or_default() += 1; + *purpose_counts.entry(purpose).or_default() += 1; + } + Err(_) => missing.push(field_address(path, knowledge.path_kind)), + } + } + missing.sort(); + + Ok(PreparedDocumentation { + schemas, + index, + domains, + overrides, + structural_reviews, + purpose_sources, + purpose_counts, + missing, + }) +} + +fn validate_intent_policy(intent: &DocumentationIntentCatalog) -> Result<(), DocumentationError> { + if intent.schema.as_deref() + != Some( + "https://id.registrystack.org/schemas/registryctl/project-authoring/documentation-intent.v1.schema.json", + ) + { + return Err(documentation_error( + "documentation intent must identify its strict v1 schema", + )); + } + if intent.format_version != CONFIGURATION_REFERENCE_FORMAT_VERSION { + return Err(documentation_error(format!( + "unsupported documentation-intent format version {:?}", + intent.format_version + ))); + } + let human_sources = intent + .policy + .human_sources + .iter() + .copied() + .collect::>(); + let required_sources = [ + HumanIntentSource::SchemaDescription, + HumanIntentSource::ReviewedOverride, + HumanIntentSource::StructuralTaxonomy, + ] + .into_iter() + .collect::>(); + if human_sources != required_sources { + return Err(documentation_error( + "documentation intent must declare the exact reviewed human sources", + )); + } + let prohibited = intent + .policy + .prohibited_sources + .iter() + .copied() + .collect::>(); + let required_prohibited = [ + ProhibitedIntentSource::CountryWorkspace, + ProhibitedIntentSource::CountryValue, + ProhibitedIntentSource::RuntimeConfiguration, + ProhibitedIntentSource::DerivedFieldLabel, + ] + .into_iter() + .collect::>(); + if prohibited != required_prohibited { + return Err(documentation_error( + "documentation intent must prohibit country, runtime, and derived-label sources", + )); + } + let prose_kinds = intent + .policy + .prose_required_for + .iter() + .copied() + .collect::>(); + if prose_kinds + != [ + FieldPathKind::Root, + FieldPathKind::Property, + FieldPathKind::MapKey, + FieldPathKind::MapValue, + FieldPathKind::ArrayItem, + FieldPathKind::Branch, + ] + .into_iter() + .collect() + { + return Err(documentation_error( + "documentation prose coverage must include every published path kind", + )); + } + let structural = intent + .structural_intents + .keys() + .copied() + .collect::>(); + let required_structural = [ + FieldPathKind::MapKey, + FieldPathKind::MapValue, + FieldPathKind::ArrayItem, + FieldPathKind::Branch, + ] + .into_iter() + .collect::>(); + if structural != required_structural { + return Err(documentation_error( + "structural intent taxonomy must cover map keys, map values, array items, and branches exactly", + )); + } + for (kind, entry) in &intent.structural_intents { + validate_prose( + &entry.purpose, + &format!("structural intent {kind:?} purpose"), + )?; + } + Ok(()) +} + +fn unique_domains<'a>( + intent: &'a DocumentationIntentCatalog, + schemas: &[DocumentationSchema<'_>], +) -> Result, DocumentationError> { + let mut domains = BTreeMap::new(); + for domain in &intent.domains { + validate_prose(&domain.scope, &format!("{} scope", domain.schema))?; + validate_prose( + &domain.migration_note, + &format!("{} migration note", domain.schema), + )?; + validate_prose( + &domain.example_guidance, + &format!("{} example guidance", domain.schema), + )?; + if !domain.diagnostic.starts_with("registryctl.authoring.") { + return Err(documentation_error(format!( + "{} diagnostic must be in registryctl.authoring.*", + domain.schema + ))); + } + if domain.validation_stages.is_empty() { + return Err(documentation_error(format!( + "{} validation stages cannot be empty", + domain.schema + ))); + } + if domains.insert(domain.schema, domain).is_some() { + return Err(documentation_error(format!( + "duplicate documentation domain for {}", + domain.schema + ))); + } + } + let schema_kinds = schemas + .iter() + .map(|schema| schema.published.kind) + .collect::>(); + if domains.keys().copied().collect::>() != schema_kinds { + return Err(documentation_error( + "documentation domains must exactly match the supplied authored schemas", + )); + } + Ok(domains) +} + +fn unique_overrides<'a>( + intent: &'a DocumentationIntentCatalog, + index: &super::knowledge::FieldKnowledgeIndex, +) -> Result, DocumentationError> { + let mut overrides = BTreeMap::new(); + for entry in &intent.overrides { + validate_prose( + &entry.purpose, + &format!("{}#{} purpose", entry.schema, entry.pointer), + )?; + for (name, prose) in [ + ("migration_note", entry.migration_note.as_ref()), + ("example_guidance", entry.example_guidance.as_ref()), + ] { + if let Some(prose) = prose { + validate_prose(prose, &format!("{}#{} {name}", entry.schema, entry.pointer))?; + } + } + if entry + .diagnostic + .as_ref() + .is_some_and(|code| !code.starts_with("registryctl.authoring.")) + { + return Err(documentation_error(format!( + "{}#{} override diagnostic must be in registryctl.authoring.*", + entry.schema, entry.pointer + ))); + } + let path = FieldPath { + schema: entry.schema, + pointer: entry.pointer.clone(), + }; + if !index.by_path().contains_key(&path) { + return Err(documentation_error(format!( + "documentation intent override targets unknown path {path}" + ))); + } + if overrides.insert(path.clone(), entry).is_some() { + return Err(documentation_error(format!( + "duplicate documentation intent override for {path}" + ))); + } + } + Ok(overrides) +} + +fn unique_structural_reviews( + intent: &DocumentationIntentCatalog, + index: &super::knowledge::FieldKnowledgeIndex, +) -> Result, DocumentationError> { + let mut reviews = BTreeSet::new(); + for entry in &intent.structural_reviews { + if !matches!( + entry.path_kind, + FieldPathKind::MapKey + | FieldPathKind::MapValue + | FieldPathKind::ArrayItem + | FieldPathKind::Branch + ) { + return Err(documentation_error(format!( + "{}#{} structural review must use a structural path kind", + entry.schema, entry.pointer + ))); + } + let path = FieldPath { + schema: entry.schema, + pointer: entry.pointer.clone(), + }; + let knowledge = index.by_path().get(&path).ok_or_else(|| { + documentation_error(format!("structural review targets unknown path {path}")) + })?; + if knowledge.path_kind != entry.path_kind { + return Err(documentation_error(format!( + "structural review for {path} declares {:?} but schema path is {:?}", + entry.path_kind, knowledge.path_kind + ))); + } + if !reviews.insert((path.clone(), entry.path_kind)) { + return Err(documentation_error(format!( + "duplicate structural review for {path}" + ))); + } + } + Ok(reviews) +} + +fn validate_prose(prose: &str, context: &str) -> Result<(), DocumentationError> { + let trimmed = prose.trim(); + if trimmed.len() < 24 || trimmed != prose || prose.contains("TODO") || prose.contains("TBD") { + return Err(documentation_error(format!( + "{context} must be reviewed, non-placeholder prose of at least 24 characters" + ))); + } + Ok(()) +} + +fn reviewed_purpose( + node: &Value, + contract_node: &Value, + kind: FieldPathKind, + override_intent: Option<&FieldIntentOverride>, + intent: &DocumentationIntentCatalog, + path: &FieldPath, + structural_reviews: &BTreeSet<(FieldPath, FieldPathKind)>, +) -> Result<(String, HumanIntentSource), DocumentationError> { + let structural_kind = matches!( + kind, + FieldPathKind::MapKey + | FieldPathKind::MapValue + | FieldPathKind::ArrayItem + | FieldPathKind::Branch + ); + if structural_kind && !structural_reviews.contains(&(path.clone(), kind)) { + return Err(documentation_error( + "structural path has no exact reviewed schema, pointer, and path-kind entry", + )); + } + if let Some(entry) = override_intent { + return Ok((entry.purpose.clone(), HumanIntentSource::ReviewedOverride)); + } + if let Some(description) = node.get("description").and_then(Value::as_str) { + validate_prose(description, "schema description")?; + return Ok((description.to_owned(), HumanIntentSource::SchemaDescription)); + } + if !std::ptr::eq(node, contract_node) { + if let Some(description) = contract_node.get("description").and_then(Value::as_str) { + validate_prose(description, "referenced schema description")?; + return Ok((description.to_owned(), HumanIntentSource::SchemaDescription)); + } + } + if structural_reviews.contains(&(path.clone(), kind)) { + let structural = intent.structural_intents.get(&kind).ok_or_else(|| { + documentation_error(format!( + "reviewed structural path {path} has no structural taxonomy entry" + )) + })?; + return Ok(( + structural.purpose.clone(), + HumanIntentSource::StructuralTaxonomy, + )); + } + Err(documentation_error("field has no reviewed human intent")) +} + +fn reference_baseline() -> ReferenceBaseline { + ReferenceBaseline { + generator_lifecycle: GeneratorLifecycle::Unreleased, + published_release: None, + field_history_status: FieldHistoryStatus::NotVerified, + history_verification_method: None, + compared_releases: Vec::new(), + } +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq)] +struct ReviewedIntentCounts { + distinct: usize, + distinct_reused: usize, + assignments_using_reused: usize, +} + +fn reviewed_intent_counts(purpose_counts: &BTreeMap) -> ReviewedIntentCounts { + ReviewedIntentCounts { + distinct: purpose_counts.len(), + distinct_reused: purpose_counts.values().filter(|count| **count > 1).count(), + assignments_using_reused: purpose_counts.values().filter(|count| **count > 1).sum(), + } +} + +fn source_contract(schemas: &[DocumentationSchema<'_>]) -> ReferenceSourceContract { + ReferenceSourceContract { + schemas: schemas + .iter() + .map(|schema| schema.published.kind.into()) + .collect(), + schema_sources: schemas + .iter() + .map(|schema| schema.source_name.to_owned()) + .collect(), + field_knowledge: "schemas/project-authoring/parity-coverage.json#field_knowledge", + human_intent: "schemas/project-authoring/documentation-intent.json", + runtime_intent: Vec::new(), + reads_country_workspaces: false, + reads_runtime_configuration: false, + } +} + +fn coverage_summary(prepared: &PreparedDocumentation<'_>) -> ReferenceCoverageSummary { + ReferenceCoverageSummary { + schema_count: prepared.schemas.len(), + path_count: prepared.index.by_path().len(), + reference_count: prepared.index.references().len(), + by_schema: prepared + .index + .coverage_by_schema() + .into_iter() + .map(|(kind, count)| (kind.into(), count)) + .collect(), + by_path_kind: prepared.index.coverage_by_path_kind(), + by_sensitivity: prepared.index.coverage_by_sensitivity(), + by_intent_source: prepared.purpose_sources.clone(), + by_intent_profile: BTreeMap::new(), + } +} + +fn field_address(path: &FieldPath, path_kind: FieldPathKind) -> DocumentationFieldAddress { + DocumentationFieldAddress { + schema: path.schema.into(), + pointer: path.pointer.clone(), + key_path: None, + path_kind, + } +} + +fn field_type(node: &Value, contract_node: &Value) -> FieldTypeDocumentation { + let mut schema_types = BTreeSet::new(); + collect_schema_types(contract_node, &mut schema_types); + FieldTypeDocumentation { + schema_types: schema_types.into_iter().collect(), + local_reference: node.get("$ref").and_then(Value::as_str).map(str::to_owned), + composed: ["allOf", "anyOf", "oneOf"] + .iter() + .any(|keyword| node.get(keyword).is_some()), + } +} + +fn collect_schema_types(node: &Value, types: &mut BTreeSet) { + match node.get("type") { + Some(Value::String(kind)) => { + types.insert(kind.clone()); + } + Some(Value::Array(kinds)) => { + types.extend(kinds.iter().filter_map(Value::as_str).map(str::to_owned)); + } + _ => {} + } + if node.get("const").is_some_and(Value::is_null) { + types.insert("null".to_owned()); + } + for keyword in ["allOf", "anyOf", "oneOf"] { + if let Some(branches) = node.get(keyword).and_then(Value::as_array) { + for branch in branches { + collect_schema_types(branch, types); + } + } + } +} + +fn requiredness( + document: &Value, + path: &FieldPath, + node: &Value, + kind: FieldPathKind, +) -> Requiredness { + if kind != FieldPathKind::Property { + return if kind == FieldPathKind::Branch { + Requiredness::Conditional + } else { + Requiredness::NotApplicable + }; + } + let Some((parent_pointer, name)) = property_parent(&path.pointer) else { + return Requiredness::NotApplicable; + }; + let Some(parent) = document.pointer(&parent_pointer) else { + return Requiredness::Optional; + }; + if parent + .get("required") + .and_then(Value::as_array) + .is_some_and(|required| required.iter().any(|entry| entry.as_str() == Some(&name))) + { + Requiredness::Required + } else if node.get("readOnly") == Some(&Value::Bool(true)) { + Requiredness::NotApplicable + } else { + Requiredness::Optional + } +} + +fn property_parent(pointer: &str) -> Option<(String, String)> { + let (parent, name) = pointer.rsplit_once("/properties/")?; + if name.contains('/') { + return None; + } + Some((parent.to_owned(), unescape_pointer_segment(name))) +} + +fn null_behavior(node: &Value, kind: FieldPathKind) -> NullBehavior { + if matches!(kind, FieldPathKind::Root | FieldPathKind::Branch) { + return NullBehavior::NotApplicable; + } + let mut types = BTreeSet::new(); + collect_schema_types(node, &mut types); + if types.contains("null") { + if types.len() == 1 { + NullBehavior::Allowed + } else { + NullBehavior::Conditional + } + } else { + NullBehavior::Rejected + } +} + +fn empty_behavior(node: &Value, kind: FieldPathKind) -> EmptyBehavior { + if matches!(kind, FieldPathKind::Root | FieldPathKind::Branch) { + return EmptyBehavior::NotApplicable; + } + let mut types = BTreeSet::new(); + collect_schema_types(node, &mut types); + if !types.contains("string") { + return EmptyBehavior::NotApplicable; + } + let minimums = collect_numeric_keyword(node, "minLength"); + if minimums.is_empty() { + EmptyBehavior::Allowed + } else if minimums.iter().all(|minimum| *minimum >= 1) { + EmptyBehavior::Rejected + } else { + EmptyBehavior::Conditional + } +} + +fn collect_numeric_keyword(node: &Value, keyword: &str) -> Vec { + let mut values = node + .get(keyword) + .and_then(Value::as_i64) + .into_iter() + .collect::>(); + for composer in ["allOf", "anyOf", "oneOf"] { + if let Some(branches) = node.get(composer).and_then(Value::as_array) { + for branch in branches { + values.extend(collect_numeric_keyword(branch, keyword)); + } + } + } + values +} + +fn default_documentation(node: &Value, kind: FieldPathKind) -> DefaultDocumentation { + if matches!(kind, FieldPathKind::Root | FieldPathKind::Branch) { + return DefaultDocumentation { + behavior: DefaultBehavior::NotApplicable, + schema_value: None, + source_version: None, + reviewed_behavior: None, + }; + } + if let Some(value) = node.get("default") { + DefaultDocumentation { + behavior: DefaultBehavior::SchemaDefault, + schema_value: Some(value.clone()), + source_version: None, + reviewed_behavior: None, + } + } else { + DefaultDocumentation { + behavior: DefaultBehavior::NoSchemaDefault, + schema_value: None, + source_version: None, + reviewed_behavior: None, + } + } +} + +fn schema_constraints(node: &Value, contract_node: &Value) -> Vec { + let mut constraints = BTreeMap::new(); + for source in [contract_node, node] { + for keyword in CONSTRAINT_KEYWORDS { + if let Some(value) = source.get(keyword) { + constraints.insert(keyword.to_owned(), value.clone()); + } + } + } + constraints + .into_iter() + .map(|(keyword, value)| SchemaConstraint { keyword, value }) + .collect() +} + +fn resolve_local_reference<'a>( + document: &'a Value, + node: &'a Value, +) -> Result<&'a Value, DocumentationError> { + let mut current = node; + let mut visited = BTreeSet::new(); + loop { + let Some(reference) = current.get("$ref").and_then(Value::as_str) else { + return Ok(current); + }; + let pointer = reference.strip_prefix('#').ok_or_else(|| { + documentation_error(format!( + "documentation schema uses external reference {reference:?}" + )) + })?; + if !visited.insert(pointer.to_owned()) { + return Err(documentation_error(format!( + "documentation schema has cyclic reference {reference:?}" + ))); + } + current = document.pointer(pointer).ok_or_else(|| { + documentation_error(format!( + "documentation schema has unresolved reference {reference:?}" + )) + })?; + } +} + +fn unescape_pointer_segment(segment: &str) -> String { + segment.replace("~1", "/").replace("~0", "~") +} + +#[cfg(test)] +mod tests { + use super::*; + + #[test] + fn embedded_entry_points_have_no_workspace_or_runtime_input() { + let coverage = with_embedded_inputs(configuration_reference_coverage) + .expect("embedded reference coverage is readable"); + assert!(!coverage.source_contract.reads_country_workspaces); + assert!(!coverage.source_contract.reads_runtime_configuration); + assert_eq!(coverage.coverage.path_count, 645); + } + + #[test] + fn removed_project_paths_cannot_remain_as_reviewed_intent() { + const REMOVED_PATHS: [&str; 3] = [ + "/$defs/recordAttributeReleaseProfile/properties/subject/properties/input", + "/$defs/recordAttributeReleaseProfile/properties/response", + "/$defs/recordAttributeReleaseProfile/properties/response/properties/max_age_seconds", + ]; + + let embedded = embedded_inputs().expect("embedded documentation inputs parse"); + let schemas = embedded + .documents + .iter() + .map(|(kind, document, source_name)| DocumentationSchema { + published: PublishedSchema { + kind: *kind, + document, + }, + source_name, + }) + .collect::>(); + + for pointer in REMOVED_PATHS { + let mut intent: DocumentationIntentCatalog = + serde_json::from_str(INTENT_ASSET).expect("embedded intent parses"); + assert!( + intent + .overrides + .iter() + .all(|entry| entry.pointer != pointer), + "removed path {pointer} must not remain in committed intent" + ); + intent.overrides.push(FieldIntentOverride { + schema: SchemaKind::Project, + pointer: pointer.to_owned(), + purpose: + "This deliberately stale reviewed purpose must fail the exact coverage gate." + .to_owned(), + environment_behavior: None, + diagnostic: None, + migration_note: None, + example_guidance: None, + }); + let error = configuration_reference_coverage(&embedded.catalog, &schemas, &intent) + .expect_err("removed path intent must fail closed"); + assert!( + error.to_string().contains("targets unknown path"), + "removed path {pointer} produced unexpected error: {error}" + ); + } + } +} diff --git a/crates/registryctl/src/project_authoring/fixture_coverage.rs b/crates/registryctl/src/project_authoring/fixture_coverage.rs new file mode 100644 index 000000000..19d2d8ee9 --- /dev/null +++ b/crates/registryctl/src/project_authoring/fixture_coverage.rs @@ -0,0 +1,2402 @@ +// SPDX-License-Identifier: Apache-2.0 +//! Strict, value-free fixture-coverage evidence for offline project tests. +//! +//! Coverage is reported per integration target. Evidence contains only stable +//! identifiers, content digests, bounded counts, closed outcomes, and closed +//! safe error classes. Fixture values, request material, source observations, +//! paths, origins, outputs, claims, and secrets have no representation here. + +use std::collections::BTreeSet; + +use serde::{Deserialize, Serialize}; +use sha2::{Digest as _, Sha256}; + +use super::Sha256Digest; + +pub const PROJECT_FIXTURE_COVERAGE_SCHEMA_VERSION_V1: &str = "registry.project.fixture_coverage.v1"; +pub(crate) const MAX_FIXTURE_COVERAGE_TARGETS: usize = 256; +pub(crate) const MAX_FIXTURE_COVERAGE_AUTHORED_RECORDS: usize = 1_024; +pub(crate) const MAX_FIXTURE_COVERAGE_GENERATED_RECORDS: usize = + MAX_FIXTURE_COVERAGE_AUTHORED_RECORDS * GeneratorRecipeId::ALL.len(); +pub(crate) const MAX_FIXTURE_COVERAGE_PLATFORM_RECORDS: usize = PlatformGeneratedCaseId::ALL.len(); +pub(crate) const MAX_FIXTURE_COVERAGE_CONSULTATIONS: usize = 512; + +const INVALID_REPORT: &str = "fixture coverage report violates the closed v1 invariants"; +const INVALID_COMPARISON: &str = + "fixture coverage comparison input violates the closed v1 invariants"; + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +pub enum ProjectFixtureCoverageSchemaVersion { + #[serde(rename = "registry.project.fixture_coverage.v1")] + V1, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum FixtureEvidenceScope { + OfflineSynthetic, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum FixtureCompatibilityClaim { + None, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum LiveCompatibilityEvaluation { + NotEvaluated, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum GovernedRequestEvidence { + /// Proof method only. Per-target requirement state remains authoritative + /// about whether every reachable consultation has a passing witness. + PerConsultationAuthoredRequestWitnessEvaluation, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum FixtureCapability { + DeclarativeHttp, + Script, + Snapshot, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum FixtureCoverageClassification { + Synthetic, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum FixtureSetState { + FixtureBearing, + Fixtureless, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum FixtureSemanticOutcome { + Match, + NoMatch, + Ambiguous, + Successful, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +pub enum FixtureSafeCode { + #[serde(rename = "authorization.denied")] + AuthorizationDenied, + #[serde(rename = "failure.subject_mismatch")] + FailureSubjectMismatch, + #[serde(rename = "fixture.execution_contract_invalid")] + FixtureExecutionContractInvalid, + #[serde(rename = "fixture.profile_not_found")] + FixtureProfileNotFound, + #[serde(rename = "fixture.request_mismatch")] + FixtureRequestMismatch, + #[serde(rename = "fixture.source_operation_unknown")] + FixtureSourceOperationUnknown, + #[serde(rename = "input.pattern_mismatch")] + InputPatternMismatch, + #[serde(rename = "source.cardinality_violation")] + SourceCardinalityViolation, + #[serde(rename = "source.deadline_exceeded")] + SourceDeadlineExceeded, + #[serde(rename = "source.response_malformed")] + SourceResponseMalformed, + #[serde(rename = "source.response_too_large")] + SourceResponseTooLarge, + #[serde(rename = "source.call_budget_exceeded")] + SourceCallBudgetExceeded, + #[serde(rename = "source.status_rejected")] + SourceStatusRejected, + #[serde(rename = "source.unavailable")] + SourceUnavailable, + #[serde(rename = "source_unavailable")] + SourceUnavailableLegacy, + /// A runtime error class outside the reviewed allow-list. Its value is + /// intentionally not copied into the report. + #[serde(rename = "redacted_unclassified_error")] + RedactedUnclassifiedError, +} + +impl FixtureSafeCode { + pub(crate) fn from_runtime_code(code: &str) -> Self { + match code { + "authorization.denied" => Self::AuthorizationDenied, + "failure.subject_mismatch" => Self::FailureSubjectMismatch, + "fixture.execution_contract_invalid" => Self::FixtureExecutionContractInvalid, + "fixture.profile_not_found" => Self::FixtureProfileNotFound, + "fixture.request_mismatch" => Self::FixtureRequestMismatch, + "fixture.source_operation_unknown" => Self::FixtureSourceOperationUnknown, + "input.pattern_mismatch" => Self::InputPatternMismatch, + "source.cardinality_violation" => Self::SourceCardinalityViolation, + "source.deadline_exceeded" => Self::SourceDeadlineExceeded, + "source.response_malformed" => Self::SourceResponseMalformed, + "source.response_too_large" => Self::SourceResponseTooLarge, + "source.call_budget_exceeded" => Self::SourceCallBudgetExceeded, + "source.status_rejected" => Self::SourceStatusRejected, + "source.unavailable" => Self::SourceUnavailable, + "source_unavailable" => Self::SourceUnavailableLegacy, + _ => Self::RedactedUnclassifiedError, + } + } + + pub(crate) const fn is_source_failure(self) -> bool { + matches!( + self, + Self::SourceCardinalityViolation + | Self::SourceDeadlineExceeded + | Self::SourceResponseMalformed + | Self::SourceResponseTooLarge + | Self::SourceCallBudgetExceeded + | Self::SourceStatusRejected + | Self::SourceUnavailable + | Self::SourceUnavailableLegacy + ) + } +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(tag = "kind", rename_all = "snake_case", deny_unknown_fields)] +pub enum FixtureSemanticExpectation { + Outcome { outcome: FixtureSemanticOutcome }, + SafeErrorCode { code: FixtureSafeCode }, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum FixturePassState { + Passed, + Failed, + NotExecuted, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum FixtureDisclosureMode { + Predicate, + Redacted, + Value, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum FixtureStatusOutcome { + Ambiguous, + NoMatch, +} + +#[derive(Clone, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct FixtureStatusMapping { + pub outcome: FixtureStatusOutcome, + pub statuses: Vec, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum FixtureProtocolHelper { + RequestPrimitive, + ResponseCodec, + SignedDci, + Verification, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum FixtureLimit { + AggregateSourceBytes, + CallCount, + Deadline, + OutputBytes, + RequestBytes, + ResponseBytes, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum FixtureCoverageEvidenceKind { + AuthoredFixture, + GeneratedCase, + PlatformCase, + CompiledContract, + SemanticComparison, +} + +#[derive(Clone, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct FixtureCoverageEvidence { + pub kind: FixtureCoverageEvidenceKind, + pub id: String, + pub digest: Sha256Digest, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct AuthoredSemanticFixtureCoverage { + pub evidence: FixtureCoverageEvidence, + pub fixture_id: String, + pub fixture_digest: Sha256Digest, + pub expectation: FixtureSemanticExpectation, + pub semantic_null: bool, + pub interaction_count: u32, + pub input_ids: Vec, + pub output_ids: Vec, + pub claim_ids: Vec, + pub exercised_status_mappings: Vec, + pub classification: FixtureCoverageClassification, + pub pass_state: FixturePassState, + pub request_to_consultation_binding: FixtureRequestBindingCoverage, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum FixtureRequestBindingState { + NotAuthored, + NotExecuted, + Passed, + Failed, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct FixtureRequestBindingCoverage { + pub state: FixtureRequestBindingState, + /// Safe authored identities selected by a passing production Notary plan. + /// Values, selectors, and rendered requests never enter this report. + pub consultations: Vec, + pub actual_relay_consultations: Option, + pub safe_error_code: Option, +} + +#[derive(Clone, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct FixtureConsultationIdentity { + pub service_id: String, + pub consultation_id: String, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum GeneratorRecipeId { + RequestAuthority, + RequestOrder, + StatusRejection, + MalformedDecode, + ByteCeiling, + Timeout, + ProtocolVerification, + AuthorizationBeforeSource, + OutputMinimization, +} + +impl GeneratorRecipeId { + pub const ALL: [Self; 9] = [ + Self::RequestAuthority, + Self::RequestOrder, + Self::StatusRejection, + Self::MalformedDecode, + Self::ByteCeiling, + Self::Timeout, + Self::ProtocolVerification, + Self::AuthorizationBeforeSource, + Self::OutputMinimization, + ]; + + pub(crate) const fn mutation_target(self) -> FixtureMutationTargetClass { + match self { + Self::RequestAuthority => FixtureMutationTargetClass::RequestPathAuthority, + Self::RequestOrder => FixtureMutationTargetClass::RequestInteractionOrder, + Self::StatusRejection => FixtureMutationTargetClass::SourceStatus, + Self::MalformedDecode => FixtureMutationTargetClass::ResponseBodyDecoding, + Self::ByteCeiling => FixtureMutationTargetClass::DeclaredResponseByteCount, + Self::Timeout => FixtureMutationTargetClass::SourceDeadline, + Self::ProtocolVerification => FixtureMutationTargetClass::ProtocolResponseEnvelope, + Self::AuthorizationBeforeSource => FixtureMutationTargetClass::AuthorizationGate, + Self::OutputMinimization => FixtureMutationTargetClass::UnselectedResponseMember, + } + } + + pub(crate) const fn expected_safe_code(self) -> Option { + match self { + Self::RequestAuthority | Self::RequestOrder => { + Some(FixtureSafeCode::FixtureRequestMismatch) + } + Self::StatusRejection => Some(FixtureSafeCode::SourceStatusRejected), + Self::MalformedDecode | Self::ProtocolVerification => { + Some(FixtureSafeCode::SourceResponseMalformed) + } + Self::ByteCeiling => Some(FixtureSafeCode::SourceResponseTooLarge), + Self::Timeout => Some(FixtureSafeCode::SourceDeadlineExceeded), + Self::AuthorizationBeforeSource => Some(FixtureSafeCode::AuthorizationDenied), + Self::OutputMinimization => None, + } + } +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +pub enum GeneratorRecipeVersion { + #[serde(rename = "v1")] + V1, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct GeneratorRecipe { + pub id: GeneratorRecipeId, + pub version: GeneratorRecipeVersion, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum FixtureMutationTargetClass { + RequestPathAuthority, + RequestInteractionOrder, + SourceStatus, + ResponseBodyDecoding, + DeclaredResponseByteCount, + SourceDeadline, + ProtocolResponseEnvelope, + AuthorizationGate, + UnselectedResponseMember, + SourceCallBudget, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum GeneratedNotApplicableReason { + NoRemoteSourceCapability, + NoSourceInteraction, + SingleSourceInteraction, + NoDistinguishableRequestPair, + NoGeneratedRequestMatcher, + FinalResponseIsNotJsonObject, + IntegrationHasNoProductClaims, + SnapshotUsesClosedMaterialization, + ProtocolMatcherOwnsResponseMutation, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum CoverageInvariant { + RemoteMutationRequiresRemoteSourceCapability, + MutationRequiresSourceInteraction, + OrderMutationRequiresMultipleSourceInteractions, + OrderMutationRequiresDistinguishableSourceInteractions, + ProtocolMutationRequiresGeneratedRequestMatcher, + MutationRequiresFinalJsonObjectResponse, + AuthorizationCheckRequiresProductClaimEvaluation, + SnapshotOutputUsesClosedMaterializationProjection, + ProtocolMatcherFixtureUsesProtocolVerificationInstead, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(tag = "state", rename_all = "snake_case", deny_unknown_fields)] +pub enum GeneratedRecipeApplicability { + Applicable {}, + NotApplicable { + reason: GeneratedNotApplicableReason, + invariant: CoverageInvariant, + }, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct GeneratedSourceFixture { + pub fixture_id: String, + pub fixture_digest: Sha256Digest, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum SourceCallExpectation { + Zero, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct SourceAccessAssertion { + pub expected_source_calls: SourceCallExpectation, + pub actual_source_calls: Option, + pub passed: bool, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct GeneratedFixtureCoverage { + pub evidence: FixtureCoverageEvidence, + pub recipe: GeneratorRecipe, + pub source_fixture: GeneratedSourceFixture, + pub applicability: GeneratedRecipeApplicability, + pub mutation_target_class: FixtureMutationTargetClass, + pub expected_safe_code: Option, + pub actual_safe_code: Option, + pub pass_state: FixturePassState, + pub source_access_assertion: Option, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum PlatformGeneratedCaseId { + RelayScriptCallBudget, +} + +impl PlatformGeneratedCaseId { + pub const ALL: [Self; 1] = [Self::RelayScriptCallBudget]; +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum PlatformCoverageComponent { + RelayScriptWorker, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct PlatformGeneratedFixtureCoverage { + pub evidence: FixtureCoverageEvidence, + pub case_id: PlatformGeneratedCaseId, + pub version: GeneratorRecipeVersion, + pub component: PlatformCoverageComponent, + pub mutation_target_class: FixtureMutationTargetClass, + pub expected_safe_code: FixtureSafeCode, + pub actual_safe_code: FixtureSafeCode, + pub pass_state: FixturePassState, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct FixtureCoverageDimensions { + pub input_ids: Vec, + pub output_ids: Vec, + pub claim_ids: Vec, + pub disclosure_modes: Vec, + pub status_mappings: Vec, + pub protocol_helpers: Vec, + pub limits: Vec, + /// Real branch identifiers only. Semantic outcomes must never be copied + /// here as a proxy for implementation branch coverage. + pub script_branch_ids: Vec, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct FixtureCoverageTargetIdentity { + pub integration: String, + pub capability: FixtureCapability, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum FixtureCoverageReviewedNotApplicable { + SemanticAmbiguity, + SubjectMismatch, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct FixtureCoverageTargetContract { + /// Present only for declarative HTTP targets. This is the compiled + /// operation cardinality, not a source endpoint or authored path. + pub source_operation_count: Option, + pub reviewed_not_applicable: Vec, + /// Every registry-backed consultation reachable through claims for this + /// integration. Coverage must include an independently authored passing + /// request for each identity, not merely any passing fixture. + pub registry_backed_consultations: Vec, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum RequiredFixtureCoverageRequirement { + SemanticMatch, + SemanticNoMatch, + SemanticAmbiguity, + SubjectMismatch, + SemanticNull, + AuthorizationDenial, + SourceFailure, + RequestRendering, + RequestToConsultationBinding, + ExpectedSourceInteractions, + SourceInteractionOrder, + OutputFields, + Claims, + DeclaredDisclosureModes, + ExercisedDisclosureModes, + ScriptBranches, + PaginationAndContinuation, + StatusMappings, + ProtocolHelpers, + ProtocolVerification, + AuthorizationBeforeSource, + MalformedDecoding, + StructuralLimits, + RequestBytes, + ResponseBytes, + AggregateSourceBytes, + OutputBytes, + CallLimits, + TimeoutClassification, + NumericDeadlineEnforcement, + OutputMinimization, + ChangedInputAffectedFixtures, + ChangedOutputAffectedFixtures, + ChangedClaimAffectedFixtures, + ChangedSourceContractAffectedFixtures, +} + +impl RequiredFixtureCoverageRequirement { + pub const ALL: [Self; 35] = [ + Self::SemanticMatch, + Self::SemanticNoMatch, + Self::SemanticAmbiguity, + Self::SubjectMismatch, + Self::SemanticNull, + Self::AuthorizationDenial, + Self::SourceFailure, + Self::RequestRendering, + Self::RequestToConsultationBinding, + Self::ExpectedSourceInteractions, + Self::SourceInteractionOrder, + Self::OutputFields, + Self::Claims, + Self::DeclaredDisclosureModes, + Self::ExercisedDisclosureModes, + Self::ScriptBranches, + Self::PaginationAndContinuation, + Self::StatusMappings, + Self::ProtocolHelpers, + Self::ProtocolVerification, + Self::AuthorizationBeforeSource, + Self::MalformedDecoding, + Self::StructuralLimits, + Self::RequestBytes, + Self::ResponseBytes, + Self::AggregateSourceBytes, + Self::OutputBytes, + Self::CallLimits, + Self::TimeoutClassification, + Self::NumericDeadlineEnforcement, + Self::OutputMinimization, + Self::ChangedInputAffectedFixtures, + Self::ChangedOutputAffectedFixtures, + Self::ChangedClaimAffectedFixtures, + Self::ChangedSourceContractAffectedFixtures, + ]; +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum FixtureCoverageGapReason { + RequiredEvidenceMissing, + TargetHasNoFixtures, + RuntimeDimensionNotObserved, + NumericBoundaryNotExercised, + ScriptBranchContractNotDeclared, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum FixtureCoverageNotApplicableReason { + NoProductClaimsDeclared, + NoProtocolHelpersDeclared, + NoVerificationProtocolDeclared, + NoContinuationProtocolDeclared, + NoRemoteSourceCapability, + NoScriptCapability, + NoStatusMappingsDeclared, + NoDynamicSourceCallsCapability, + SingleCompiledSourceOperation, + ProtocolMatcherOwnsOutputValidation, + ReviewedAmbiguityNotApplicable, + ReviewedSubjectMismatchNotApplicable, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum FixtureCoverageNotEvaluatedReason { + ComparisonInputAbsent, + TargetComparisonAbsent, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(tag = "state", rename_all = "snake_case", deny_unknown_fields)] +pub enum FixtureRequirementCoverage { + Covered { + requirement: RequiredFixtureCoverageRequirement, + evidence: Vec, + }, + Missing { + requirement: RequiredFixtureCoverageRequirement, + reason: FixtureCoverageGapReason, + evidence: Vec, + }, + NotApplicable { + requirement: RequiredFixtureCoverageRequirement, + reason: FixtureCoverageNotApplicableReason, + evidence: Vec, + }, + NotEvaluated { + requirement: RequiredFixtureCoverageRequirement, + reason: FixtureCoverageNotEvaluatedReason, + evidence: Vec, + }, +} + +impl FixtureRequirementCoverage { + pub fn requirement(&self) -> RequiredFixtureCoverageRequirement { + match self { + Self::Covered { requirement, .. } + | Self::Missing { requirement, .. } + | Self::NotApplicable { requirement, .. } + | Self::NotEvaluated { requirement, .. } => *requirement, + } + } + + pub fn evidence(&self) -> &[FixtureCoverageEvidence] { + match self { + Self::Covered { evidence, .. } + | Self::Missing { evidence, .. } + | Self::NotApplicable { evidence, .. } + | Self::NotEvaluated { evidence, .. } => evidence, + } + } + + pub const fn state(&self) -> FixtureCoverageRequirementState { + match self { + Self::Covered { .. } => FixtureCoverageRequirementState::Covered, + Self::Missing { .. } => FixtureCoverageRequirementState::Missing, + Self::NotApplicable { .. } => FixtureCoverageRequirementState::NotApplicable, + Self::NotEvaluated { .. } => FixtureCoverageRequirementState::NotEvaluated, + } + } +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum FixtureCoverageRequirementState { + Covered, + Missing, + NotApplicable, + NotEvaluated, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +#[allow(clippy::enum_variant_names)] +pub enum FixtureCoverageChangeKind { + ChangedInput, + ChangedOutput, + ChangedClaim, + ChangedSourceContract, +} + +impl FixtureCoverageChangeKind { + pub const ALL: [Self; 4] = [ + Self::ChangedInput, + Self::ChangedOutput, + Self::ChangedClaim, + Self::ChangedSourceContract, + ]; + + pub const fn requirement(self) -> RequiredFixtureCoverageRequirement { + match self { + Self::ChangedInput => RequiredFixtureCoverageRequirement::ChangedInputAffectedFixtures, + Self::ChangedOutput => { + RequiredFixtureCoverageRequirement::ChangedOutputAffectedFixtures + } + Self::ChangedClaim => RequiredFixtureCoverageRequirement::ChangedClaimAffectedFixtures, + Self::ChangedSourceContract => { + RequiredFixtureCoverageRequirement::ChangedSourceContractAffectedFixtures + } + } + } +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct FixtureCoverageChangeImpact { + pub kind: FixtureCoverageChangeKind, + pub changed_member_ids: Vec, + pub affected_fixture_ids: Vec, + pub evidence: FixtureCoverageEvidence, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct FixtureCoverageSemanticComparison { + pub baseline_digest: Sha256Digest, + pub candidate_digest: Sha256Digest, + pub impacts: Vec, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct FixtureCoverageTarget { + pub identity: FixtureCoverageTargetIdentity, + pub contract: FixtureCoverageTargetContract, + pub fixture_set_state: FixtureSetState, + pub compiled_contract: FixtureCoverageEvidence, + pub fixture_inventory: Vec, + pub generated_cases: Vec, + pub platform_cases: Vec, + pub declared: FixtureCoverageDimensions, + pub exercised: FixtureCoverageDimensions, + pub comparison: Option, + pub requirements: Vec, +} + +impl FixtureCoverageTarget { + /// Recomputes the closed requirement matrix from this target's evidence. + /// The reason is used only when no semantic comparison is attached. + pub fn refresh_requirements(&mut self, comparison_reason: FixtureCoverageNotEvaluatedReason) { + self.requirements = derive_fixture_coverage_requirements(self, comparison_reason); + } +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum FixtureCoverageTargetSetState { + NoTargets, + TargetsPresent, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct FixtureCoverageRequirementCounts { + pub covered: u32, + pub missing: u32, + pub not_applicable: u32, + pub not_evaluated: u32, + pub total: u32, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct FixtureCoverageSummary { + pub target_set_state: FixtureCoverageTargetSetState, + pub target_count: u32, + pub fixture_bearing_target_count: u32, + pub fixtureless_target_count: u32, + pub requirements: FixtureCoverageRequirementCounts, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(try_from = "UncheckedProjectFixtureCoverageReportV1")] +#[serde(deny_unknown_fields)] +pub struct ProjectFixtureCoverageReportV1 { + pub schema_version: ProjectFixtureCoverageSchemaVersion, + pub project: String, + pub environment: Option, + pub evidence_scope: FixtureEvidenceScope, + pub compatibility_claim: FixtureCompatibilityClaim, + pub live_compatibility: LiveCompatibilityEvaluation, + pub governed_request_evidence: GovernedRequestEvidence, + pub targets: Vec, + pub summary: FixtureCoverageSummary, +} + +#[derive(Deserialize)] +#[serde(deny_unknown_fields)] +struct UncheckedProjectFixtureCoverageReportV1 { + schema_version: ProjectFixtureCoverageSchemaVersion, + project: String, + environment: Option, + evidence_scope: FixtureEvidenceScope, + compatibility_claim: FixtureCompatibilityClaim, + live_compatibility: LiveCompatibilityEvaluation, + governed_request_evidence: GovernedRequestEvidence, + targets: Vec, + summary: FixtureCoverageSummary, +} + +impl ProjectFixtureCoverageReportV1 { + pub fn from_targets( + project: String, + environment: Option, + targets: Vec, + ) -> Result { + let summary = derive_fixture_coverage_summary(&targets)?; + let unchecked = UncheckedProjectFixtureCoverageReportV1 { + schema_version: ProjectFixtureCoverageSchemaVersion::V1, + project, + environment, + evidence_scope: FixtureEvidenceScope::OfflineSynthetic, + compatibility_claim: FixtureCompatibilityClaim::None, + live_compatibility: LiveCompatibilityEvaluation::NotEvaluated, + governed_request_evidence: + GovernedRequestEvidence::PerConsultationAuthoredRequestWitnessEvaluation, + targets, + summary, + }; + Self::try_from(unchecked) + } + + /// Adds a closed semantic comparison and recomputes the four affected + /// fixture requirements for every target. Selection is deliberately based + /// only on declared fixture member identifiers. Generated cases are a + /// different evidence class and can never become affected authored + /// fixtures. + pub fn with_comparison( + mut self, + input: &FixtureCoverageComparisonInput, + ) -> Result { + input.validate()?; + for target in &mut self.targets { + let comparison_input = input + .targets + .binary_search_by(|candidate| { + candidate + .integration + .as_str() + .cmp(target.identity.integration.as_str()) + }) + .ok() + .map(|index| &input.targets[index]); + target.comparison = comparison_input + .map(|comparison_input| { + build_target_comparison( + target, + input.baseline_digest.clone(), + input.candidate_digest.clone(), + comparison_input, + ) + }) + .transpose()?; + replace_comparison_requirements(target)?; + } + self.summary = derive_fixture_coverage_summary(&self.targets)?; + let unchecked = UncheckedProjectFixtureCoverageReportV1 { + schema_version: self.schema_version, + project: self.project, + environment: self.environment, + evidence_scope: self.evidence_scope, + compatibility_claim: self.compatibility_claim, + live_compatibility: self.live_compatibility, + governed_request_evidence: self.governed_request_evidence, + targets: self.targets, + summary: self.summary, + }; + Self::try_from(unchecked) + } +} + +impl TryFrom for ProjectFixtureCoverageReportV1 { + type Error = &'static str; + + fn try_from(value: UncheckedProjectFixtureCoverageReportV1) -> Result { + validate_fixture_coverage_report(&value)?; + Ok(Self { + schema_version: value.schema_version, + project: value.project, + environment: value.environment, + evidence_scope: value.evidence_scope, + compatibility_claim: value.compatibility_claim, + live_compatibility: value.live_compatibility, + governed_request_evidence: value.governed_request_evidence, + targets: value.targets, + summary: value.summary, + }) + } +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(try_from = "UncheckedFixtureCoverageComparisonInput")] +#[serde(deny_unknown_fields)] +pub struct FixtureCoverageComparisonInput { + pub baseline_digest: Sha256Digest, + pub candidate_digest: Sha256Digest, + pub targets: Vec, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct FixtureCoverageTargetComparisonInput { + pub integration: String, + pub changed_input_ids: Vec, + pub changed_output_ids: Vec, + pub changed_claim_ids: Vec, + pub source_contract_changed: bool, +} + +impl FixtureCoverageComparisonInput { + pub fn validate(&self) -> Result<(), &'static str> { + validate_comparison_input_targets(&self.targets) + } +} + +#[derive(Deserialize)] +#[serde(deny_unknown_fields)] +struct UncheckedFixtureCoverageComparisonInput { + baseline_digest: Sha256Digest, + candidate_digest: Sha256Digest, + targets: Vec, +} + +impl TryFrom for FixtureCoverageComparisonInput { + type Error = &'static str; + + fn try_from(value: UncheckedFixtureCoverageComparisonInput) -> Result { + validate_comparison_input_targets(&value.targets)?; + Ok(Self { + baseline_digest: value.baseline_digest, + candidate_digest: value.candidate_digest, + targets: value.targets, + }) + } +} + +fn validate_comparison_input_targets( + targets: &[FixtureCoverageTargetComparisonInput], +) -> Result<(), &'static str> { + if targets.len() > MAX_FIXTURE_COVERAGE_TARGETS + || !targets + .windows(2) + .all(|pair| pair[0].integration < pair[1].integration) + || targets.iter().any(|target| { + !is_report_identifier(&target.integration) + || !is_sorted_unique_identifiers(&target.changed_input_ids) + || !is_sorted_unique_identifiers(&target.changed_output_ids) + || !is_sorted_unique_identifiers(&target.changed_claim_ids) + }) + { + return Err(INVALID_COMPARISON); + } + Ok(()) +} + +pub(crate) fn fixture_coverage_digest( + serializable: &impl Serialize, +) -> Result { + let bytes = serde_json::to_vec(serializable).map_err(|_| INVALID_REPORT)?; + let digest = Sha256::digest(bytes); + Sha256Digest::new(format!("sha256:{}", hex::encode(digest))).map_err(|_| INVALID_REPORT) +} + +pub(crate) fn fixture_coverage_evidence( + kind: FixtureCoverageEvidenceKind, + id: String, + digest: Sha256Digest, +) -> Result { + if !is_evidence_id(&id) { + return Err(INVALID_REPORT); + } + Ok(FixtureCoverageEvidence { kind, id, digest }) +} + +pub(crate) fn target_compiled_contract_evidence( + identity: &FixtureCoverageTargetIdentity, + contract: &FixtureCoverageTargetContract, + declared: &FixtureCoverageDimensions, +) -> Result { + let digest = fixture_coverage_digest(&(identity, contract, declared))?; + fixture_coverage_evidence( + FixtureCoverageEvidenceKind::CompiledContract, + format!( + "target/{}/compiled-contract/v1", + identity.integration.as_str() + ), + digest, + ) +} + +fn build_target_comparison( + target: &FixtureCoverageTarget, + baseline_digest: Sha256Digest, + candidate_digest: Sha256Digest, + input: &FixtureCoverageTargetComparisonInput, +) -> Result { + let mut impacts = Vec::with_capacity(FixtureCoverageChangeKind::ALL.len()); + for kind in FixtureCoverageChangeKind::ALL { + let changed_member_ids = match kind { + FixtureCoverageChangeKind::ChangedInput => input.changed_input_ids.clone(), + FixtureCoverageChangeKind::ChangedOutput => input.changed_output_ids.clone(), + FixtureCoverageChangeKind::ChangedClaim => input.changed_claim_ids.clone(), + FixtureCoverageChangeKind::ChangedSourceContract if input.source_contract_changed => { + vec!["source-contract".to_owned()] + } + FixtureCoverageChangeKind::ChangedSourceContract => Vec::new(), + }; + let affected_fixture_ids = target + .fixture_inventory + .iter() + .filter(|fixture| match kind { + FixtureCoverageChangeKind::ChangedInput => { + slices_intersect(&fixture.input_ids, &changed_member_ids) + } + FixtureCoverageChangeKind::ChangedOutput => { + slices_intersect(&fixture.output_ids, &changed_member_ids) + } + FixtureCoverageChangeKind::ChangedClaim => { + slices_intersect(&fixture.claim_ids, &changed_member_ids) + } + FixtureCoverageChangeKind::ChangedSourceContract => input.source_contract_changed, + }) + .map(|fixture| fixture.fixture_id.clone()) + .collect::>(); + let digest = fixture_coverage_digest(&( + &baseline_digest, + &candidate_digest, + &target.identity, + kind, + &changed_member_ids, + &affected_fixture_ids, + ))?; + let evidence = fixture_coverage_evidence( + FixtureCoverageEvidenceKind::SemanticComparison, + format!( + "target/{}/semantic-comparison/{}/v1", + target.identity.integration, + change_suffix(kind) + ), + digest, + )?; + impacts.push(FixtureCoverageChangeImpact { + kind, + changed_member_ids, + affected_fixture_ids, + evidence, + }); + } + Ok(FixtureCoverageSemanticComparison { + baseline_digest, + candidate_digest, + impacts, + }) +} + +fn replace_comparison_requirements(target: &mut FixtureCoverageTarget) -> Result<(), &'static str> { + target.refresh_requirements(FixtureCoverageNotEvaluatedReason::TargetComparisonAbsent); + Ok(()) +} + +fn slices_intersect(left: &[String], right: &[String]) -> bool { + left.iter() + .any(|candidate| right.binary_search(candidate).is_ok()) +} + +fn validate_fixture_coverage_report( + report: &UncheckedProjectFixtureCoverageReportV1, +) -> Result<(), &'static str> { + if !is_report_identifier(&report.project) + || report + .environment + .as_deref() + .is_some_and(|value| !is_report_identifier(value)) + || report.targets.len() > MAX_FIXTURE_COVERAGE_TARGETS + || !report.targets.windows(2).all(|pair| { + pair[0].identity.integration.as_str() < pair[1].identity.integration.as_str() + }) + || report.summary != derive_fixture_coverage_summary(&report.targets)? + { + return Err(INVALID_REPORT); + } + for target in &report.targets { + validate_target(target)?; + } + Ok(()) +} + +fn validate_target(target: &FixtureCoverageTarget) -> Result<(), &'static str> { + if !is_report_identifier(&target.identity.integration) { + return Err("fixture coverage target identity is invalid"); + } + if !valid_target_contract(&target.identity, &target.contract) { + return Err("fixture coverage target contract is invalid"); + } + if target.fixture_inventory.len() > MAX_FIXTURE_COVERAGE_AUTHORED_RECORDS + || target.generated_cases.len() > MAX_FIXTURE_COVERAGE_GENERATED_RECORDS + || target.platform_cases.len() > MAX_FIXTURE_COVERAGE_PLATFORM_RECORDS + { + return Err("fixture coverage target exceeds a record ceiling"); + } + if target.fixture_set_state + != if target.fixture_inventory.is_empty() { + FixtureSetState::Fixtureless + } else { + FixtureSetState::FixtureBearing + } + { + return Err("fixture coverage target fixture state is not derived from inventory"); + } + if target.compiled_contract + != target_compiled_contract_evidence(&target.identity, &target.contract, &target.declared)? + { + return Err("fixture coverage compiled-contract evidence is inconsistent"); + } + if !valid_dimensions(&target.declared) { + return Err("fixture coverage declared dimensions are invalid"); + } + if !valid_dimensions(&target.exercised) { + return Err("fixture coverage exercised dimensions are invalid"); + } + if let Some(error) = dimensions_subset_error(&target.exercised, &target.declared) { + return Err(error); + } + if target + .requirements + .iter() + .map(FixtureRequirementCoverage::requirement) + .collect::>() + != RequiredFixtureCoverageRequirement::ALL + { + return Err("fixture coverage target requirements are not the exact ordered contract"); + } + + let mut available_evidence = BTreeSet::from([target.compiled_contract.clone()]); + let mut fixture_ids = BTreeSet::new(); + let mut prior_fixture = None; + for fixture in &target.fixture_inventory { + if !validate_authored_fixture(target, fixture) + || prior_fixture + .as_deref() + .is_some_and(|prior| prior >= fixture.fixture_id.as_str()) + || !fixture_ids.insert(fixture.fixture_id.clone()) + { + return Err("fixture coverage authored inventory is invalid"); + } + prior_fixture = Some(fixture.fixture_id.clone()); + available_evidence.insert(fixture.evidence.clone()); + } + + let mut prior_generated = None; + let mut generated_keys = BTreeSet::new(); + for case in &target.generated_cases { + let key = (case.source_fixture.fixture_id.as_str(), case.recipe.id); + if prior_generated.is_some_and(|prior| prior >= key) + || !generated_keys.insert((case.source_fixture.fixture_id.clone(), case.recipe.id)) + || !validate_generated_case(target, case) + { + return Err("fixture coverage generated cases are invalid"); + } + prior_generated = Some(key); + available_evidence.insert(case.evidence.clone()); + } + if target.generated_cases.len() + != target + .fixture_inventory + .len() + .checked_mul(GeneratorRecipeId::ALL.len()) + .ok_or(INVALID_REPORT)? + { + return Err("fixture coverage generated-case cardinality is invalid"); + } + + let mut prior_platform = None; + for case in &target.platform_cases { + if prior_platform.is_some_and(|prior| prior >= case.case_id) + || !validate_platform_case(target, case) + { + return Err("fixture coverage platform cases are invalid"); + } + prior_platform = Some(case.case_id); + available_evidence.insert(case.evidence.clone()); + } + if (target.identity.capability == FixtureCapability::Script) + != (target.platform_cases.len() == PlatformGeneratedCaseId::ALL.len()) + { + return Err("fixture coverage platform-case capability is inconsistent"); + } + + if let Some(comparison) = &target.comparison { + validate_comparison(target, comparison)?; + available_evidence.extend( + comparison + .impacts + .iter() + .map(|impact| impact.evidence.clone()), + ); + } + + let comparison_reason = + comparison_absence_reason(&target.requirements, target.comparison.is_some())?; + if target.requirements != derive_fixture_coverage_requirements(target, comparison_reason) { + return Err( + "fixture coverage requirement states or evidence are not derived from target evidence", + ); + } + for requirement in &target.requirements { + if !requirement + .evidence() + .windows(2) + .all(|pair| pair[0] < pair[1]) + { + return Err("fixture coverage requirement evidence is not sorted and unique"); + } + if requirement + .evidence() + .iter() + .any(|evidence| !available_evidence.contains(evidence)) + { + return Err("fixture coverage requirement references foreign evidence"); + } + match requirement { + FixtureRequirementCoverage::Covered { evidence, .. } if evidence.is_empty() => { + return Err("fixture coverage covered requirement has no evidence"); + } + FixtureRequirementCoverage::NotEvaluated { evidence, .. } if !evidence.is_empty() => { + return Err("fixture coverage unevaluated requirement carries evidence"); + } + _ => {} + } + } + Ok(()) +} + +fn validate_authored_fixture( + target: &FixtureCoverageTarget, + fixture: &AuthoredSemanticFixtureCoverage, +) -> bool { + fixture.fixture_id.len() <= 256 + && is_report_identifier(&fixture.fixture_id) + && fixture.interaction_count > 0 + && fixture.interaction_count <= 16 + && is_sorted_unique_identifiers(&fixture.input_ids) + && is_sorted_unique_identifiers(&fixture.output_ids) + && is_sorted_unique_identifiers(&fixture.claim_ids) + && valid_status_mappings(&fixture.exercised_status_mappings) + && fixture.exercised_status_mappings.iter().all(|mapping| { + target.declared.status_mappings.iter().any(|declared| { + mapping.outcome == declared.outcome + && slice_is_subset(&mapping.statuses, &declared.statuses) + }) + }) + && fixture.evidence.kind == FixtureCoverageEvidenceKind::AuthoredFixture + && fixture.evidence.id + == format!( + "target/{}/fixture/{}", + target.identity.integration, fixture.fixture_id + ) + && fixture.evidence.digest == fixture.fixture_digest + && valid_request_binding( + &fixture.request_to_consultation_binding, + &target.contract.registry_backed_consultations, + ) +} + +fn valid_target_contract( + identity: &FixtureCoverageTargetIdentity, + contract: &FixtureCoverageTargetContract, +) -> bool { + contract + .reviewed_not_applicable + .windows(2) + .all(|pair| pair[0] < pair[1]) + && valid_consultation_identities(&contract.registry_backed_consultations) + && match identity.capability { + FixtureCapability::DeclarativeHttp => contract.source_operation_count.is_some(), + FixtureCapability::Script | FixtureCapability::Snapshot => { + contract.source_operation_count.is_none() + } + } +} + +fn valid_request_binding( + binding: &FixtureRequestBindingCoverage, + declared: &[FixtureConsultationIdentity], +) -> bool { + valid_consultation_identities(&binding.consultations) + && slice_is_subset(&binding.consultations, declared) + && match binding.state { + FixtureRequestBindingState::NotAuthored | FixtureRequestBindingState::NotExecuted => { + binding.consultations.is_empty() + && binding.actual_relay_consultations.is_none() + && binding.safe_error_code.is_none() + } + FixtureRequestBindingState::Passed => { + !binding.consultations.is_empty() + && binding + .actual_relay_consultations + .is_some_and(|count| count > 0) + && binding.safe_error_code.is_none() + } + FixtureRequestBindingState::Failed => { + binding.consultations.is_empty() + && binding.actual_relay_consultations.is_some() + && binding.safe_error_code.is_some() + } + } +} + +fn valid_consultation_identities(identities: &[FixtureConsultationIdentity]) -> bool { + identities.len() <= MAX_FIXTURE_COVERAGE_CONSULTATIONS + && identities.windows(2).all(|pair| pair[0] < pair[1]) + && identities.iter().all(|identity| { + is_report_identifier(&identity.service_id) + && is_report_identifier(&identity.consultation_id) + }) +} + +fn validate_generated_case( + target: &FixtureCoverageTarget, + case: &GeneratedFixtureCoverage, +) -> bool { + let expected_id = format!( + "target/{}/fixture/{}/generated/{}/v1", + target.identity.integration, + case.source_fixture.fixture_id, + recipe_suffix(case.recipe.id) + ); + let authored = target + .fixture_inventory + .iter() + .find(|fixture| fixture.fixture_id == case.source_fixture.fixture_id); + let applicable = matches!( + case.applicability, + GeneratedRecipeApplicability::Applicable {} + ); + if case.evidence.kind != FixtureCoverageEvidenceKind::GeneratedCase + || case.evidence.id != expected_id + || case.recipe.version != GeneratorRecipeVersion::V1 + || case.mutation_target_class != case.recipe.id.mutation_target() + || case.expected_safe_code != case.recipe.id.expected_safe_code() + || authored + .is_none_or(|fixture| fixture.fixture_digest != case.source_fixture.fixture_digest) + || (!applicable + && (case.pass_state != FixturePassState::NotExecuted + || case.actual_safe_code.is_some() + || case.source_access_assertion.is_some())) + || (applicable + && case.pass_state == FixturePassState::Passed + && case.actual_safe_code != case.expected_safe_code) + { + return false; + } + if let GeneratedRecipeApplicability::NotApplicable { reason, invariant } = case.applicability { + if !generated_not_applicable_is_valid(case.recipe.id, reason, invariant) { + return false; + } + } + if case.recipe.id == GeneratorRecipeId::AuthorizationBeforeSource && applicable { + case.source_access_assertion + .as_ref() + .is_some_and(|assertion| { + assertion.expected_source_calls == SourceCallExpectation::Zero + && assertion.passed == (assertion.actual_source_calls == Some(0)) + }) + } else { + case.source_access_assertion.is_none() + } +} + +fn validate_platform_case( + target: &FixtureCoverageTarget, + case: &PlatformGeneratedFixtureCoverage, +) -> bool { + target.identity.capability == FixtureCapability::Script + && case.evidence.kind == FixtureCoverageEvidenceKind::PlatformCase + && case.evidence.id == "platform/relay-script-worker/call-budget/v1" + && case.case_id == PlatformGeneratedCaseId::RelayScriptCallBudget + && case.version == GeneratorRecipeVersion::V1 + && case.component == PlatformCoverageComponent::RelayScriptWorker + && case.mutation_target_class == FixtureMutationTargetClass::SourceCallBudget + && case.expected_safe_code == FixtureSafeCode::SourceCallBudgetExceeded + && case.pass_state + == if case.actual_safe_code == case.expected_safe_code { + FixturePassState::Passed + } else { + FixturePassState::Failed + } +} + +fn validate_comparison( + target: &FixtureCoverageTarget, + comparison: &FixtureCoverageSemanticComparison, +) -> Result<(), &'static str> { + if comparison + .impacts + .iter() + .map(|impact| impact.kind) + .collect::>() + != FixtureCoverageChangeKind::ALL + { + return Err(INVALID_REPORT); + } + let fixture_ids = target + .fixture_inventory + .iter() + .map(|fixture| fixture.fixture_id.as_str()) + .collect::>(); + for impact in &comparison.impacts { + if !is_sorted_unique_identifiers(&impact.changed_member_ids) + || !is_sorted_unique_identifiers(&impact.affected_fixture_ids) + || impact + .affected_fixture_ids + .iter() + .any(|id| !fixture_ids.contains(id.as_str())) + || impact.evidence.kind != FixtureCoverageEvidenceKind::SemanticComparison + || impact.evidence.id + != format!( + "target/{}/semantic-comparison/{}/v1", + target.identity.integration, + change_suffix(impact.kind) + ) + || impact.evidence.digest + != fixture_coverage_digest(&( + &comparison.baseline_digest, + &comparison.candidate_digest, + &target.identity, + impact.kind, + &impact.changed_member_ids, + &impact.affected_fixture_ids, + ))? + { + return Err(INVALID_REPORT); + } + let expected = target + .fixture_inventory + .iter() + .filter(|fixture| match impact.kind { + FixtureCoverageChangeKind::ChangedInput => { + slices_intersect(&fixture.input_ids, &impact.changed_member_ids) + } + FixtureCoverageChangeKind::ChangedOutput => { + slices_intersect(&fixture.output_ids, &impact.changed_member_ids) + } + FixtureCoverageChangeKind::ChangedClaim => { + slices_intersect(&fixture.claim_ids, &impact.changed_member_ids) + } + FixtureCoverageChangeKind::ChangedSourceContract => { + impact.changed_member_ids == ["source-contract"] + } + }) + .map(|fixture| fixture.fixture_id.as_str()) + .collect::>(); + if impact + .affected_fixture_ids + .iter() + .map(String::as_str) + .collect::>() + != expected + { + return Err(INVALID_REPORT); + } + } + Ok(()) +} + +fn comparison_absence_reason( + requirements: &[FixtureRequirementCoverage], + has_comparison: bool, +) -> Result { + if has_comparison { + return Ok(FixtureCoverageNotEvaluatedReason::ComparisonInputAbsent); + } + let comparison_requirement_start = + RequiredFixtureCoverageRequirement::ALL.len() - FixtureCoverageChangeKind::ALL.len(); + let mut reasons = requirements + .iter() + .skip(comparison_requirement_start) + .map(|coverage| match coverage { + FixtureRequirementCoverage::NotEvaluated { + reason, evidence, .. + } if evidence.is_empty() => Ok(*reason), + _ => Err(INVALID_REPORT), + }); + let first = reasons.next().transpose()?.ok_or(INVALID_REPORT)?; + if reasons.any(|reason| reason != Ok(first)) { + return Err(INVALID_REPORT); + } + Ok(first) +} + +pub(crate) fn derive_fixture_coverage_requirements( + target: &FixtureCoverageTarget, + comparison_reason: FixtureCoverageNotEvaluatedReason, +) -> Vec { + RequiredFixtureCoverageRequirement::ALL + .into_iter() + .map(|requirement| { + derive_fixture_coverage_requirement(target, requirement, comparison_reason) + }) + .collect() +} + +fn derive_fixture_coverage_requirement( + target: &FixtureCoverageTarget, + requirement: RequiredFixtureCoverageRequirement, + comparison_reason: FixtureCoverageNotEvaluatedReason, +) -> FixtureRequirementCoverage { + use RequiredFixtureCoverageRequirement as Requirement; + + let fixture_gap = if target.fixture_inventory.is_empty() { + FixtureCoverageGapReason::TargetHasNoFixtures + } else { + FixtureCoverageGapReason::RequiredEvidenceMissing + }; + let authored = |predicate: fn(&AuthoredSemanticFixtureCoverage) -> bool| { + passed_authored_evidence(target, predicate) + }; + match requirement { + Requirement::SemanticMatch => covered_or_missing( + requirement, + authored(|fixture| { + fixture.expectation + == FixtureSemanticExpectation::Outcome { + outcome: FixtureSemanticOutcome::Match, + } + }), + fixture_gap, + ), + Requirement::SemanticNoMatch => covered_or_missing( + requirement, + authored(|fixture| { + fixture.expectation + == FixtureSemanticExpectation::Outcome { + outcome: FixtureSemanticOutcome::NoMatch, + } + }), + fixture_gap, + ), + Requirement::SemanticAmbiguity => { + let evidence = authored(|fixture| { + fixture.expectation + == FixtureSemanticExpectation::Outcome { + outcome: FixtureSemanticOutcome::Ambiguous, + } + }); + if !evidence.is_empty() { + covered(requirement, evidence) + } else if reviewed_not_applicable( + target, + FixtureCoverageReviewedNotApplicable::SemanticAmbiguity, + ) { + not_applicable( + requirement, + FixtureCoverageNotApplicableReason::ReviewedAmbiguityNotApplicable, + vec![target.compiled_contract.clone()], + ) + } else { + missing(requirement, fixture_gap, Vec::new()) + } + } + Requirement::SubjectMismatch => { + let evidence = authored(|fixture| { + fixture.expectation + == FixtureSemanticExpectation::SafeErrorCode { + code: FixtureSafeCode::FailureSubjectMismatch, + } + }); + if !evidence.is_empty() { + covered(requirement, evidence) + } else if reviewed_not_applicable( + target, + FixtureCoverageReviewedNotApplicable::SubjectMismatch, + ) { + not_applicable( + requirement, + FixtureCoverageNotApplicableReason::ReviewedSubjectMismatchNotApplicable, + vec![target.compiled_contract.clone()], + ) + } else { + missing(requirement, fixture_gap, Vec::new()) + } + } + Requirement::SemanticNull => covered_or_missing( + requirement, + authored(|fixture| fixture.semantic_null), + fixture_gap, + ), + Requirement::AuthorizationDenial => { + if target.declared.claim_ids.is_empty() { + no_claims_not_applicable(target, requirement) + } else { + covered_or_missing( + requirement, + authored(|fixture| { + fixture.expectation + == FixtureSemanticExpectation::SafeErrorCode { + code: FixtureSafeCode::AuthorizationDenied, + } + }), + fixture_gap, + ) + } + } + Requirement::SourceFailure => { + if target.identity.capability == FixtureCapability::Snapshot { + no_remote_not_applicable(target, requirement) + } else { + covered_or_missing( + requirement, + authored(|fixture| { + matches!( + fixture.expectation, + FixtureSemanticExpectation::SafeErrorCode { code } + if code.is_source_failure() + ) + }), + fixture_gap, + ) + } + } + Requirement::RequestRendering => { + if target.identity.capability == FixtureCapability::Snapshot { + no_remote_not_applicable(target, requirement) + } else { + generated_requirement( + target, + requirement, + GeneratorRecipeId::RequestAuthority, + fixture_gap, + ) + } + } + Requirement::RequestToConsultationBinding => { + let required = &target.contract.registry_backed_consultations; + if required.is_empty() { + no_claims_not_applicable(target, requirement) + } else { + let passing = target + .fixture_inventory + .iter() + .filter(|fixture| { + fixture.pass_state == FixturePassState::Passed + && fixture.request_to_consultation_binding.state + == FixtureRequestBindingState::Passed + }) + .collect::>(); + let covered_consultations = passing + .iter() + .flat_map(|fixture| { + fixture.request_to_consultation_binding.consultations.iter() + }) + .collect::>(); + let evidence = passing + .into_iter() + .map(|fixture| fixture.evidence.clone()) + .collect::>(); + if required + .iter() + .all(|consultation| covered_consultations.contains(consultation)) + { + covered(requirement, evidence) + } else { + missing(requirement, fixture_gap, evidence) + } + } + } + Requirement::ExpectedSourceInteractions => { + let evidence = authored(|_| true); + if !target.fixture_inventory.is_empty() + && evidence.len() == target.fixture_inventory.len() + { + covered(requirement, evidence) + } else { + missing(requirement, fixture_gap, evidence) + } + } + Requirement::SourceInteractionOrder => { + let (complete, evidence) = + generated_recipe_evidence(target, GeneratorRecipeId::RequestOrder); + if complete { + covered(requirement, evidence) + } else if target.identity.capability == FixtureCapability::Snapshot { + no_remote_not_applicable(target, requirement) + } else if target.identity.capability == FixtureCapability::DeclarativeHttp + && target + .contract + .source_operation_count + .is_some_and(|count| count <= 1) + { + not_applicable( + requirement, + FixtureCoverageNotApplicableReason::SingleCompiledSourceOperation, + vec![target.compiled_contract.clone()], + ) + } else { + missing(requirement, fixture_gap, evidence) + } + } + Requirement::OutputFields => { + let evidence = authored(|fixture| !fixture.output_ids.is_empty()); + if !target.declared.output_ids.is_empty() + && target.exercised.output_ids == target.declared.output_ids + && !evidence.is_empty() + { + covered(requirement, evidence) + } else { + missing(requirement, fixture_gap, evidence) + } + } + Requirement::Claims => { + if target.declared.claim_ids.is_empty() { + no_claims_not_applicable(target, requirement) + } else { + let evidence = authored(|fixture| !fixture.claim_ids.is_empty()); + if target.exercised.claim_ids == target.declared.claim_ids && !evidence.is_empty() { + covered(requirement, evidence) + } else { + missing(requirement, fixture_gap, evidence) + } + } + } + Requirement::DeclaredDisclosureModes => { + if target.declared.claim_ids.is_empty() { + no_claims_not_applicable(target, requirement) + } else { + covered(requirement, vec![target.compiled_contract.clone()]) + } + } + Requirement::ExercisedDisclosureModes => { + if target.declared.claim_ids.is_empty() { + no_claims_not_applicable(target, requirement) + } else { + missing( + requirement, + FixtureCoverageGapReason::RuntimeDimensionNotObserved, + Vec::new(), + ) + } + } + Requirement::ScriptBranches => { + if target.identity.capability != FixtureCapability::Script { + not_applicable( + requirement, + FixtureCoverageNotApplicableReason::NoScriptCapability, + vec![target.compiled_contract.clone()], + ) + } else { + missing( + requirement, + FixtureCoverageGapReason::ScriptBranchContractNotDeclared, + Vec::new(), + ) + } + } + Requirement::PaginationAndContinuation => match target.identity.capability { + FixtureCapability::Snapshot => no_remote_not_applicable(target, requirement), + FixtureCapability::DeclarativeHttp => not_applicable( + requirement, + FixtureCoverageNotApplicableReason::NoContinuationProtocolDeclared, + vec![target.compiled_contract.clone()], + ), + FixtureCapability::Script => missing( + requirement, + FixtureCoverageGapReason::RequiredEvidenceMissing, + Vec::new(), + ), + }, + Requirement::StatusMappings => { + if target.declared.status_mappings.is_empty() { + not_applicable( + requirement, + FixtureCoverageNotApplicableReason::NoStatusMappingsDeclared, + vec![target.compiled_contract.clone()], + ) + } else { + let evidence = authored(|fixture| !fixture.exercised_status_mappings.is_empty()); + if target.exercised.status_mappings == target.declared.status_mappings + && !evidence.is_empty() + { + covered(requirement, evidence) + } else { + missing(requirement, fixture_gap, evidence) + } + } + } + Requirement::ProtocolHelpers => { + if target.declared.protocol_helpers.is_empty() { + not_applicable( + requirement, + FixtureCoverageNotApplicableReason::NoProtocolHelpersDeclared, + vec![target.compiled_contract.clone()], + ) + } else { + let (complete, evidence) = + generated_recipe_evidence(target, GeneratorRecipeId::ProtocolVerification); + if complete && target.exercised.protocol_helpers == target.declared.protocol_helpers + { + covered(requirement, evidence) + } else { + missing(requirement, fixture_gap, evidence) + } + } + } + Requirement::ProtocolVerification => { + if !target.declared.protocol_helpers.iter().any(|helper| { + matches!( + helper, + FixtureProtocolHelper::SignedDci | FixtureProtocolHelper::Verification + ) + }) { + not_applicable( + requirement, + FixtureCoverageNotApplicableReason::NoVerificationProtocolDeclared, + vec![target.compiled_contract.clone()], + ) + } else { + generated_requirement( + target, + requirement, + GeneratorRecipeId::ProtocolVerification, + fixture_gap, + ) + } + } + Requirement::AuthorizationBeforeSource => { + if target.declared.claim_ids.is_empty() { + no_claims_not_applicable(target, requirement) + } else { + generated_requirement( + target, + requirement, + GeneratorRecipeId::AuthorizationBeforeSource, + fixture_gap, + ) + } + } + Requirement::MalformedDecoding => { + if target.identity.capability == FixtureCapability::Snapshot { + no_remote_not_applicable(target, requirement) + } else { + generated_requirement( + target, + requirement, + GeneratorRecipeId::MalformedDecode, + fixture_gap, + ) + } + } + Requirement::StructuralLimits => { + covered(requirement, vec![target.compiled_contract.clone()]) + } + Requirement::RequestBytes => { + if target.identity.capability == FixtureCapability::Snapshot { + no_remote_not_applicable(target, requirement) + } else { + missing( + requirement, + FixtureCoverageGapReason::NumericBoundaryNotExercised, + vec![target.compiled_contract.clone()], + ) + } + } + Requirement::ResponseBytes => { + if target.identity.capability == FixtureCapability::Snapshot { + no_remote_not_applicable(target, requirement) + } else { + generated_requirement( + target, + requirement, + GeneratorRecipeId::ByteCeiling, + fixture_gap, + ) + } + } + Requirement::AggregateSourceBytes | Requirement::OutputBytes => missing( + requirement, + FixtureCoverageGapReason::NumericBoundaryNotExercised, + vec![target.compiled_contract.clone()], + ), + Requirement::CallLimits => { + if target.identity.capability == FixtureCapability::Script { + let evidence = target + .platform_cases + .iter() + .filter(|case| case.pass_state == FixturePassState::Passed) + .map(|case| case.evidence.clone()) + .collect::>(); + covered_or_missing( + requirement, + evidence, + FixtureCoverageGapReason::RequiredEvidenceMissing, + ) + } else { + not_applicable( + requirement, + FixtureCoverageNotApplicableReason::NoDynamicSourceCallsCapability, + vec![target.compiled_contract.clone()], + ) + } + } + Requirement::TimeoutClassification => { + if target.identity.capability == FixtureCapability::Snapshot { + no_remote_not_applicable(target, requirement) + } else { + generated_requirement(target, requirement, GeneratorRecipeId::Timeout, fixture_gap) + } + } + Requirement::NumericDeadlineEnforcement => { + if target.identity.capability == FixtureCapability::Snapshot { + no_remote_not_applicable(target, requirement) + } else { + let (_, mut evidence) = + generated_recipe_evidence(target, GeneratorRecipeId::Timeout); + evidence.push(target.compiled_contract.clone()); + missing( + requirement, + FixtureCoverageGapReason::NumericBoundaryNotExercised, + evidence, + ) + } + } + Requirement::OutputMinimization => { + if target.identity.capability == FixtureCapability::Snapshot { + no_remote_not_applicable(target, requirement) + } else { + let (protocol_complete, protocol_evidence) = + generated_recipe_evidence(target, GeneratorRecipeId::ProtocolVerification); + let protocol_owns_mutation = target.generated_cases.iter().any(|case| { + case.recipe.id == GeneratorRecipeId::OutputMinimization + && matches!( + case.applicability, + GeneratedRecipeApplicability::NotApplicable { + reason: + GeneratedNotApplicableReason::ProtocolMatcherOwnsResponseMutation, + .. + } + ) + }); + if protocol_owns_mutation && protocol_complete { + not_applicable( + requirement, + FixtureCoverageNotApplicableReason::ProtocolMatcherOwnsOutputValidation, + protocol_evidence, + ) + } else { + generated_requirement( + target, + requirement, + GeneratorRecipeId::OutputMinimization, + fixture_gap, + ) + } + } + } + Requirement::ChangedInputAffectedFixtures + | Requirement::ChangedOutputAffectedFixtures + | Requirement::ChangedClaimAffectedFixtures + | Requirement::ChangedSourceContractAffectedFixtures => { + comparison_requirement(target, requirement, comparison_reason) + } + } +} + +fn passed_authored_evidence( + target: &FixtureCoverageTarget, + predicate: fn(&AuthoredSemanticFixtureCoverage) -> bool, +) -> Vec { + target + .fixture_inventory + .iter() + .filter(|fixture| fixture.pass_state == FixturePassState::Passed && predicate(fixture)) + .map(|fixture| fixture.evidence.clone()) + .collect() +} + +fn reviewed_not_applicable( + target: &FixtureCoverageTarget, + requirement: FixtureCoverageReviewedNotApplicable, +) -> bool { + target + .contract + .reviewed_not_applicable + .binary_search(&requirement) + .is_ok() +} + +fn generated_recipe_evidence( + target: &FixtureCoverageTarget, + recipe: GeneratorRecipeId, +) -> (bool, Vec) { + let applicable = target + .generated_cases + .iter() + .filter(|case| { + case.recipe.id == recipe + && matches!( + case.applicability, + GeneratedRecipeApplicability::Applicable {} + ) + }) + .collect::>(); + let evidence = applicable + .iter() + .filter(|case| { + case.pass_state == FixturePassState::Passed + && case + .source_access_assertion + .as_ref() + .is_none_or(|assertion| assertion.passed) + }) + .map(|case| case.evidence.clone()) + .collect::>(); + ( + !applicable.is_empty() && evidence.len() == applicable.len(), + evidence, + ) +} + +fn generated_requirement( + target: &FixtureCoverageTarget, + requirement: RequiredFixtureCoverageRequirement, + recipe: GeneratorRecipeId, + gap: FixtureCoverageGapReason, +) -> FixtureRequirementCoverage { + let (complete, evidence) = generated_recipe_evidence(target, recipe); + if complete { + covered(requirement, evidence) + } else { + missing(requirement, gap, evidence) + } +} + +fn comparison_requirement( + target: &FixtureCoverageTarget, + requirement: RequiredFixtureCoverageRequirement, + comparison_reason: FixtureCoverageNotEvaluatedReason, +) -> FixtureRequirementCoverage { + let kind = FixtureCoverageChangeKind::ALL + .into_iter() + .find(|kind| kind.requirement() == requirement) + .expect("comparison requirements have a change kind"); + let Some(impact) = target + .comparison + .as_ref() + .and_then(|comparison| comparison.impacts.iter().find(|impact| impact.kind == kind)) + else { + return FixtureRequirementCoverage::NotEvaluated { + requirement, + reason: comparison_reason, + evidence: Vec::new(), + }; + }; + let evidence = vec![impact.evidence.clone()]; + if impact.changed_member_ids.is_empty() || !impact.affected_fixture_ids.is_empty() { + covered(requirement, evidence) + } else { + missing( + requirement, + FixtureCoverageGapReason::RequiredEvidenceMissing, + evidence, + ) + } +} + +fn no_claims_not_applicable( + target: &FixtureCoverageTarget, + requirement: RequiredFixtureCoverageRequirement, +) -> FixtureRequirementCoverage { + not_applicable( + requirement, + FixtureCoverageNotApplicableReason::NoProductClaimsDeclared, + vec![target.compiled_contract.clone()], + ) +} + +fn no_remote_not_applicable( + target: &FixtureCoverageTarget, + requirement: RequiredFixtureCoverageRequirement, +) -> FixtureRequirementCoverage { + not_applicable( + requirement, + FixtureCoverageNotApplicableReason::NoRemoteSourceCapability, + vec![target.compiled_contract.clone()], + ) +} + +fn covered_or_missing( + requirement: RequiredFixtureCoverageRequirement, + evidence: Vec, + gap: FixtureCoverageGapReason, +) -> FixtureRequirementCoverage { + if evidence.is_empty() { + missing(requirement, gap, evidence) + } else { + covered(requirement, evidence) + } +} + +fn covered( + requirement: RequiredFixtureCoverageRequirement, + mut evidence: Vec, +) -> FixtureRequirementCoverage { + evidence.sort(); + evidence.dedup(); + FixtureRequirementCoverage::Covered { + requirement, + evidence, + } +} + +fn missing( + requirement: RequiredFixtureCoverageRequirement, + reason: FixtureCoverageGapReason, + mut evidence: Vec, +) -> FixtureRequirementCoverage { + evidence.sort(); + evidence.dedup(); + FixtureRequirementCoverage::Missing { + requirement, + reason, + evidence, + } +} + +fn not_applicable( + requirement: RequiredFixtureCoverageRequirement, + reason: FixtureCoverageNotApplicableReason, + mut evidence: Vec, +) -> FixtureRequirementCoverage { + evidence.sort(); + evidence.dedup(); + FixtureRequirementCoverage::NotApplicable { + requirement, + reason, + evidence, + } +} + +fn valid_dimensions(dimensions: &FixtureCoverageDimensions) -> bool { + is_sorted_unique_identifiers(&dimensions.input_ids) + && is_sorted_unique_identifiers(&dimensions.output_ids) + && is_sorted_unique_identifiers(&dimensions.claim_ids) + && dimensions + .disclosure_modes + .windows(2) + .all(|pair| pair[0] < pair[1]) + && valid_status_mappings(&dimensions.status_mappings) + && dimensions + .protocol_helpers + .windows(2) + .all(|pair| pair[0] < pair[1]) + && dimensions.limits.windows(2).all(|pair| pair[0] < pair[1]) + && is_sorted_unique_identifiers(&dimensions.script_branch_ids) +} + +fn valid_status_mappings(mappings: &[FixtureStatusMapping]) -> bool { + mappings.windows(2).all(|pair| pair[0] < pair[1]) + && mappings.iter().all(|mapping| { + !mapping.statuses.is_empty() + && mapping.statuses.windows(2).all(|pair| pair[0] < pair[1]) + }) +} + +fn dimensions_subset_error( + exercised: &FixtureCoverageDimensions, + declared: &FixtureCoverageDimensions, +) -> Option<&'static str> { + if !slice_is_subset(&exercised.input_ids, &declared.input_ids) { + return Some("fixture coverage exercised inputs exceed declarations"); + } + if !slice_is_subset(&exercised.output_ids, &declared.output_ids) { + return Some("fixture coverage exercised outputs exceed declarations"); + } + if !slice_is_subset(&exercised.claim_ids, &declared.claim_ids) { + return Some("fixture coverage exercised claims exceed declarations"); + } + if !slice_is_subset(&exercised.disclosure_modes, &declared.disclosure_modes) { + return Some("fixture coverage exercised disclosure modes exceed declarations"); + } + if !exercised.status_mappings.iter().all(|mapping| { + declared.status_mappings.iter().any(|declared_mapping| { + mapping.outcome == declared_mapping.outcome + && slice_is_subset(&mapping.statuses, &declared_mapping.statuses) + }) + }) { + return Some("fixture coverage exercised status mappings exceed declarations"); + } + if !slice_is_subset(&exercised.protocol_helpers, &declared.protocol_helpers) { + return Some("fixture coverage exercised protocol helpers exceed declarations"); + } + if !slice_is_subset(&exercised.limits, &declared.limits) { + return Some("fixture coverage exercised limits exceed declarations"); + } + if !slice_is_subset(&exercised.script_branch_ids, &declared.script_branch_ids) { + return Some("fixture coverage exercised script branches exceed declarations"); + } + None +} + +fn slice_is_subset(subset: &[T], superset: &[T]) -> bool { + subset + .iter() + .all(|value| superset.binary_search(value).is_ok()) +} + +fn derive_fixture_coverage_summary( + targets: &[FixtureCoverageTarget], +) -> Result { + let target_count = u32::try_from(targets.len()).map_err(|_| INVALID_REPORT)?; + let fixture_bearing_target_count = u32::try_from( + targets + .iter() + .filter(|target| target.fixture_set_state == FixtureSetState::FixtureBearing) + .count(), + ) + .map_err(|_| INVALID_REPORT)?; + let fixtureless_target_count = target_count + .checked_sub(fixture_bearing_target_count) + .ok_or(INVALID_REPORT)?; + let mut covered = 0_u32; + let mut missing = 0_u32; + let mut not_applicable = 0_u32; + let mut not_evaluated = 0_u32; + for state in targets + .iter() + .flat_map(|target| target.requirements.iter()) + .map(FixtureRequirementCoverage::state) + { + match state { + FixtureCoverageRequirementState::Covered => covered += 1, + FixtureCoverageRequirementState::Missing => missing += 1, + FixtureCoverageRequirementState::NotApplicable => not_applicable += 1, + FixtureCoverageRequirementState::NotEvaluated => not_evaluated += 1, + } + } + let total = covered + .checked_add(missing) + .and_then(|total| total.checked_add(not_applicable)) + .and_then(|total| total.checked_add(not_evaluated)) + .ok_or(INVALID_REPORT)?; + Ok(FixtureCoverageSummary { + target_set_state: if targets.is_empty() { + FixtureCoverageTargetSetState::NoTargets + } else { + FixtureCoverageTargetSetState::TargetsPresent + }, + target_count, + fixture_bearing_target_count, + fixtureless_target_count, + requirements: FixtureCoverageRequirementCounts { + covered, + missing, + not_applicable, + not_evaluated, + total, + }, + }) +} + +fn generated_not_applicable_is_valid( + recipe: GeneratorRecipeId, + reason: GeneratedNotApplicableReason, + invariant: CoverageInvariant, +) -> bool { + match (reason, invariant) { + ( + GeneratedNotApplicableReason::NoRemoteSourceCapability, + CoverageInvariant::RemoteMutationRequiresRemoteSourceCapability, + ) => matches!( + recipe, + GeneratorRecipeId::RequestAuthority + | GeneratorRecipeId::RequestOrder + | GeneratorRecipeId::StatusRejection + | GeneratorRecipeId::ProtocolVerification + | GeneratorRecipeId::MalformedDecode + | GeneratorRecipeId::ByteCeiling + | GeneratorRecipeId::Timeout + ), + ( + GeneratedNotApplicableReason::NoSourceInteraction, + CoverageInvariant::MutationRequiresSourceInteraction, + ) => true, + ( + GeneratedNotApplicableReason::SingleSourceInteraction, + CoverageInvariant::OrderMutationRequiresMultipleSourceInteractions, + ) => recipe == GeneratorRecipeId::RequestOrder, + ( + GeneratedNotApplicableReason::NoDistinguishableRequestPair, + CoverageInvariant::OrderMutationRequiresDistinguishableSourceInteractions, + ) => recipe == GeneratorRecipeId::RequestOrder, + ( + GeneratedNotApplicableReason::NoGeneratedRequestMatcher, + CoverageInvariant::ProtocolMutationRequiresGeneratedRequestMatcher, + ) => recipe == GeneratorRecipeId::ProtocolVerification, + ( + GeneratedNotApplicableReason::FinalResponseIsNotJsonObject, + CoverageInvariant::MutationRequiresFinalJsonObjectResponse, + ) => matches!( + recipe, + GeneratorRecipeId::ProtocolVerification | GeneratorRecipeId::OutputMinimization + ), + ( + GeneratedNotApplicableReason::IntegrationHasNoProductClaims, + CoverageInvariant::AuthorizationCheckRequiresProductClaimEvaluation, + ) => recipe == GeneratorRecipeId::AuthorizationBeforeSource, + ( + GeneratedNotApplicableReason::SnapshotUsesClosedMaterialization, + CoverageInvariant::SnapshotOutputUsesClosedMaterializationProjection, + ) + | ( + GeneratedNotApplicableReason::ProtocolMatcherOwnsResponseMutation, + CoverageInvariant::ProtocolMatcherFixtureUsesProtocolVerificationInstead, + ) => recipe == GeneratorRecipeId::OutputMinimization, + _ => false, + } +} + +pub(crate) const fn recipe_suffix(recipe: GeneratorRecipeId) -> &'static str { + match recipe { + GeneratorRecipeId::RequestAuthority => "request_authority", + GeneratorRecipeId::RequestOrder => "request_order", + GeneratorRecipeId::StatusRejection => "status_rejection", + GeneratorRecipeId::MalformedDecode => "malformed_decode", + GeneratorRecipeId::ByteCeiling => "byte_ceiling", + GeneratorRecipeId::Timeout => "timeout", + GeneratorRecipeId::ProtocolVerification => "protocol_verification", + GeneratorRecipeId::AuthorizationBeforeSource => "authorization_before_source", + GeneratorRecipeId::OutputMinimization => "output_minimization", + } +} + +pub(crate) const fn change_suffix(kind: FixtureCoverageChangeKind) -> &'static str { + match kind { + FixtureCoverageChangeKind::ChangedInput => "changed-input", + FixtureCoverageChangeKind::ChangedOutput => "changed-output", + FixtureCoverageChangeKind::ChangedClaim => "changed-claim", + FixtureCoverageChangeKind::ChangedSourceContract => "changed-source-contract", + } +} + +fn is_report_identifier(value: &str) -> bool { + let mut bytes = value.bytes(); + !value.is_empty() + && value.len() <= 256 + && matches!(bytes.next(), Some(byte) if byte.is_ascii_alphanumeric()) + && bytes.all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'.' | b'_' | b'-')) +} + +fn is_sorted_unique_identifiers(values: &[String]) -> bool { + values.windows(2).all(|pair| pair[0] < pair[1]) + && values.iter().all(|value| is_report_identifier(value)) +} + +fn is_evidence_id(value: &str) -> bool { + let mut bytes = value.bytes(); + !value.is_empty() + && value.len() <= 800 + && !value.contains("//") + && matches!(bytes.next(), Some(byte) if byte.is_ascii_alphanumeric()) + && bytes.all(|byte| { + byte.is_ascii_alphanumeric() || matches!(byte, b'.' | b'_' | b'-' | b'/' | b':') + }) +} + +#[derive(Clone, Debug)] +pub(crate) struct GeneratedFixtureObservation { + pub integration: String, + pub source_fixture_id: String, + pub recipe_id: GeneratorRecipeId, + pub actual_safe_code: Option, + pub pass_state: FixturePassState, + pub actual_source_calls: Option, +} + +#[derive(Clone, Debug)] +pub(crate) struct AuthoredRequestBindingObservation { + pub integration: String, + pub source_fixture_id: String, + pub pass_state: FixturePassState, + pub consultations: Vec, + pub actual_safe_code: Option, + pub actual_relay_consultations: Option, +} diff --git a/crates/registryctl/src/project_authoring/fixture_diagnostics.rs b/crates/registryctl/src/project_authoring/fixture_diagnostics.rs new file mode 100644 index 000000000..ae79caee7 --- /dev/null +++ b/crates/registryctl/src/project_authoring/fixture_diagnostics.rs @@ -0,0 +1,156 @@ +// SPDX-License-Identifier: Apache-2.0 +//! Registryctl-owned metadata for the closed offline-fixture error catalog. + +use super::FixtureSafeCode; + +/// Static reference metadata for one offline fixture failure code. +/// +/// The immutable fixture-coverage set owns the closed code type. This module +/// owns the operator-safe prose used by generated references, so the +/// aggregation layer does not copy product metadata. +#[derive(Clone, Copy, Debug, Eq, PartialEq)] +pub(crate) struct FixtureDiagnosticDefinition { + pub code: FixtureSafeCode, + pub safe_meaning: &'static str, + pub rule: &'static str, + pub safe_remediation: &'static str, +} + +macro_rules! fixture_diagnostic { + ($code:ident, $meaning:literal, $rule:literal, $remediation:literal) => { + FixtureDiagnosticDefinition { + code: FixtureSafeCode::$code, + safe_meaning: $meaning, + rule: $rule, + safe_remediation: $remediation, + } + }; +} + +/// Complete Registryctl offline-fixture diagnostic catalog in lexical code +/// order. +pub(crate) const FIXTURE_DIAGNOSTIC_DEFINITIONS: &[FixtureDiagnosticDefinition] = &[ + fixture_diagnostic!( + AuthorizationDenied, + "Authorization denied fixture execution before source access.", + "authorization_before_source", + "Align the fixture identity and authorization expectation with the compiled policy." + ), + fixture_diagnostic!( + FailureSubjectMismatch, + "The source observation did not preserve the requested subject binding.", + "subject_binding", + "Correct the synthetic subject evidence or the reviewed subject comparison." + ), + fixture_diagnostic!( + FixtureExecutionContractInvalid, + "Fixture execution violated the compiled offline plan contract.", + "compiled_execution_contract", + "Align the fixture with the exact compiled integration plan." + ), + fixture_diagnostic!( + FixtureProfileNotFound, + "The fixture profile pin did not select one exact compiled plan.", + "profile_pin", + "Select one compiled integration profile." + ), + fixture_diagnostic!( + FixtureRequestMismatch, + "The rendered request or call order did not match the fixture expectation.", + "request_authority_and_order", + "Align the fixture request expectation with the compiled plan." + ), + fixture_diagnostic!( + FixtureSourceOperationUnknown, + "The fixture named a source operation outside the compiled plan.", + "source_operation_closure", + "Use only source operations declared by the compiled plan." + ), + fixture_diagnostic!( + InputPatternMismatch, + "A synthetic fixture input did not satisfy its compiled contract.", + "compiled_input_contract", + "Correct the synthetic input shape." + ), + fixture_diagnostic!( + RedactedUnclassifiedError, + "An error outside the reviewed safe allow-list was redacted.", + "safe_error_allow_list", + "Use classified fixture evidence or inspect private local logs without publishing values." + ), + fixture_diagnostic!( + SourceCallBudgetExceeded, + "Fixture execution exceeded the compiled source-call budget.", + "source_call_budget", + "Reduce source calls or revise the reviewed bounded plan." + ), + fixture_diagnostic!( + SourceCardinalityViolation, + "The synthetic source response violated the compiled cardinality contract.", + "source_cardinality", + "Correct the synthetic response cardinality." + ), + fixture_diagnostic!( + SourceDeadlineExceeded, + "The synthetic source interaction exceeded its deadline.", + "source_deadline", + "Align the timeout fixture with the compiled deadline behavior." + ), + fixture_diagnostic!( + SourceResponseMalformed, + "The synthetic source response violated its closed response contract.", + "source_response_contract", + "Correct the synthetic response shape." + ), + fixture_diagnostic!( + SourceResponseTooLarge, + "The synthetic source response exceeded its compiled byte bound.", + "source_response_byte_bound", + "Reduce the synthetic response below the compiled bound." + ), + fixture_diagnostic!( + SourceStatusRejected, + "The synthetic source returned a status outside the accepted mapping.", + "source_status_mapping", + "Use a reviewed status mapping or correct the fixture status." + ), + fixture_diagnostic!( + SourceUnavailable, + "The synthetic source was unavailable.", + "source_availability", + "Correct the offline source observation for the intended availability case." + ), + fixture_diagnostic!( + SourceUnavailableLegacy, + "The synthetic source was unavailable under the retained legacy code.", + "legacy_source_availability", + "Prefer source.unavailable for new fixtures while retaining compatible evidence." + ), +]; + +/// Return the single catalog definition for a closed fixture code. +/// +/// The exhaustive match makes a newly added fixture code a compile failure +/// until the product-owned reference catalog is updated. +pub(crate) const fn fixture_diagnostic_definition( + code: FixtureSafeCode, +) -> &'static FixtureDiagnosticDefinition { + match code { + FixtureSafeCode::AuthorizationDenied => &FIXTURE_DIAGNOSTIC_DEFINITIONS[0], + FixtureSafeCode::FailureSubjectMismatch => &FIXTURE_DIAGNOSTIC_DEFINITIONS[1], + FixtureSafeCode::FixtureExecutionContractInvalid => &FIXTURE_DIAGNOSTIC_DEFINITIONS[2], + FixtureSafeCode::FixtureProfileNotFound => &FIXTURE_DIAGNOSTIC_DEFINITIONS[3], + FixtureSafeCode::FixtureRequestMismatch => &FIXTURE_DIAGNOSTIC_DEFINITIONS[4], + FixtureSafeCode::FixtureSourceOperationUnknown => &FIXTURE_DIAGNOSTIC_DEFINITIONS[5], + FixtureSafeCode::InputPatternMismatch => &FIXTURE_DIAGNOSTIC_DEFINITIONS[6], + FixtureSafeCode::RedactedUnclassifiedError => &FIXTURE_DIAGNOSTIC_DEFINITIONS[7], + FixtureSafeCode::SourceCallBudgetExceeded => &FIXTURE_DIAGNOSTIC_DEFINITIONS[8], + FixtureSafeCode::SourceCardinalityViolation => &FIXTURE_DIAGNOSTIC_DEFINITIONS[9], + FixtureSafeCode::SourceDeadlineExceeded => &FIXTURE_DIAGNOSTIC_DEFINITIONS[10], + FixtureSafeCode::SourceResponseMalformed => &FIXTURE_DIAGNOSTIC_DEFINITIONS[11], + FixtureSafeCode::SourceResponseTooLarge => &FIXTURE_DIAGNOSTIC_DEFINITIONS[12], + FixtureSafeCode::SourceStatusRejected => &FIXTURE_DIAGNOSTIC_DEFINITIONS[13], + FixtureSafeCode::SourceUnavailable => &FIXTURE_DIAGNOSTIC_DEFINITIONS[14], + FixtureSafeCode::SourceUnavailableLegacy => &FIXTURE_DIAGNOSTIC_DEFINITIONS[15], + } +} diff --git a/crates/registryctl/src/project_authoring/fixtures.rs b/crates/registryctl/src/project_authoring/fixtures.rs index d1d3db28f..7e541ea09 100644 --- a/crates/registryctl/src/project_authoring/fixtures.rs +++ b/crates/registryctl/src/project_authoring/fixtures.rs @@ -88,22 +88,38 @@ fn rhai_diagnostic_source( )) } -fn execute_all_fixtures( +type FixtureExecutionObservations = ( + Vec, + Vec, + Vec, + Option, +); + +fn execute_all_fixtures_with_coverage_observations( loaded: &LoadedRegistryProject, compiled: &CompiledProject, integration_filter: Option<&str>, fixture_filter: Option<&str>, trace: bool, -) -> Result> { + execution_context: &ProjectExecutionContext, +) -> Result { + let call_budget_actual = + platform_call_budget_result(loaded, compiled, execution_context.worker_program())?; if loaded.integrations.is_empty() { - return Ok(Vec::new()); + return Ok((Vec::new(), Vec::new(), Vec::new(), call_budget_actual)); } let relay_config = compiled .relay_private .get(Path::new("config/relay.yaml")) .ok_or_else(|| anyhow!("generated Relay config is absent"))?; - let relay_fixture = compile_generated_relay_fixture(relay_config, &compiled.relay_private)?; + let relay_fixture = compile_generated_relay_fixture( + relay_config, + &compiled.relay_private, + Some(execution_context.worker_program()), + )?; let mut reports = Vec::new(); + let mut generated_observations = Vec::new(); + let mut request_observations = Vec::new(); for (alias, integration) in &loaded.integrations { if integration_filter.is_some_and(|selected| selected != alias) { continue; @@ -112,6 +128,35 @@ fn execute_all_fixtures( if fixture_filter.is_some_and(|selected| selected != fixture.name) { continue; } + if let Some(request) = fixture.request.as_ref() { + if validate_governed_request(loaded, request, false).is_err() { + request_observations.push(AuthoredRequestBindingObservation { + integration: alias.clone(), + source_fixture_id: fixture.name.clone(), + pass_state: FixturePassState::Failed, + consultations: Vec::new(), + actual_safe_code: Some(FixtureSafeCode::RedactedUnclassifiedError), + actual_relay_consultations: Some(0), + }); + reports.push(FixtureReport { + integration: alias.clone(), + fixture: fixture.name.clone(), + inputs: fixture.input.keys().cloned().collect(), + calls: Vec::new(), + outputs: Vec::new(), + claims: Vec::new(), + outcome: None, + expected_error: fixture.expect.error.clone(), + source_access: Some(false), + passed: false, + failure: Some( + "request_to_consultation_binding_invalid: relay_consultations=0" + .to_owned(), + ), + }); + continue; + } + } let mut actual_calls = Vec::new(); let relay = execute_fixture( compiled, @@ -137,13 +182,16 @@ fn execute_all_fixtures( Some((&outputs, outcome)), registry_notary_server::standalone::OfflineAuthentication::Valid, false, + execution_context.worker_program(), ) .with_context(|| { format!( "failed to evaluate product claims for fixture {}.{}", alias, fixture.name ) - })? { + })? + .result + { Ok(claims) => (Ok((outputs, outcome)), Some(claims)), Err(error) => (Err(error), None), } @@ -249,6 +297,88 @@ fn execute_all_fixtures( passed, failure, }); + if let Some(request) = fixture.request.as_ref() { + let binding = result.as_ref().map_err(|code| code.clone()).and_then( + |(outputs, outcome)| { + evaluate_authored_governed_request( + loaded, + compiled, + fixture, + request, + outputs, + outcome, + execution_context.worker_program(), + ) + .map_err(|_| "request.binding_evaluation_failed".to_owned()) + }, + ); + let (pass_state, consultations, actual_safe_code, actual_relay_consultations) = + match binding { + Ok(evaluation) + if evaluation.result.is_ok() && evaluation.relay_calls > 0 => + { + ( + FixturePassState::Passed, + evaluation.consultations, + None, + Some(u32::try_from(evaluation.relay_calls).unwrap_or(u32::MAX)), + ) + } + Ok(evaluation) => ( + FixturePassState::Failed, + Vec::new(), + evaluation + .result + .as_ref() + .err() + .map(|code| FixtureSafeCode::from_runtime_code(code)), + Some(u32::try_from(evaluation.relay_calls).unwrap_or(u32::MAX)), + ), + Err(_) => ( + FixturePassState::Failed, + Vec::new(), + Some(FixtureSafeCode::RedactedUnclassifiedError), + Some(0), + ), + }; + request_observations.push(AuthoredRequestBindingObservation { + integration: alias.clone(), + source_fixture_id: fixture.name.clone(), + pass_state, + consultations, + actual_safe_code, + actual_relay_consultations, + }); + reports.push(FixtureReport { + integration: alias.clone(), + fixture: format!( + "{}::derived/request_to_consultation_binding", + fixture.name + ), + inputs: fixture.input.keys().cloned().collect(), + calls: if actual_relay_consultations.unwrap_or_default() > 0 { + vec!["notary-relay-consultation".to_owned()] + } else { + Vec::new() + }, + outputs: Vec::new(), + claims: request + .claims + .iter() + .map(|claim| claim.id.clone()) + .collect(), + outcome: None, + expected_error: None, + source_access: Some(actual_relay_consultations.unwrap_or_default() > 0), + passed: pass_state == FixturePassState::Passed, + failure: (pass_state != FixturePassState::Passed).then(|| { + format!( + "request_to_consultation_binding_failed: relay_consultations={}", + actual_relay_consultations.unwrap_or_default() + ) + }), + }); + } reports.extend(derived_fixture_reports( loaded, compiled, @@ -256,15 +386,24 @@ fn execute_all_fixtures( alias, fixture, trace, + &mut generated_observations, + execution_context.worker_program(), )?); } } if reports.is_empty() && (integration_filter.is_some() || fixture_filter.is_some()) { bail!("the selected integration or fixture does not exist"); } - Ok(reports) + Ok(( + reports, + generated_observations, + request_observations, + call_budget_actual, + )) } +// The execution seam keeps each authority and observation channel explicit. +#[allow(clippy::too_many_arguments)] fn derived_fixture_reports( loaded: &LoadedRegistryProject, compiled: &CompiledProject, @@ -272,79 +411,129 @@ fn derived_fixture_reports( integration_alias: &str, fixture: &FixtureDocument, trace: bool, + generated_observations: &mut Vec, + worker_program: &Path, ) -> Result> { use registry_relay::offline_fixture::OfflineSourceResponse; let base = offline_fixture_interactions(fixture).map_err(|error| anyhow!(error))?; let input = offline_fixture_input(fixture).map_err(|error| anyhow!(error))?; let mut cases = Vec::<( - &str, + GeneratorRecipeId, Vec, &str, )>::new(); - - let mut request_mismatch = base.clone(); - if let Some(interaction) = request_mismatch.first_mut() { - interaction - .request - .path - .push_str("/__registry_fixture_mismatch"); - cases.push(( - "request_authority", - request_mismatch, - "fixture.request_mismatch", - )); - } - let mut malformed = base.clone(); - if let Some(interaction) = malformed.last_mut() { - interaction.response = OfflineSourceResponse::Http { - status: 200, - headers: BTreeMap::new(), - body: b"{".to_vec(), - }; - cases.push(("malformed_decode", malformed, "source.response_malformed")); - } - let mut oversized = base.clone(); - if let Some(interaction) = oversized.last_mut() { - interaction.response = OfflineSourceResponse::DeclaredBodyBytes { - status: 200, - body_bytes: u64::MAX, - }; - cases.push(("byte_ceiling", oversized, "source.response_too_large")); - } - let mut timeout = base.clone(); - if let Some(interaction) = timeout.last_mut() { - interaction.response = OfflineSourceResponse::Timeout; - cases.push(("timeout", timeout, "source.deadline_exceeded")); - } - if fixture.interactions.iter().any(|interaction| { - interaction - .expect - .body - .as_ref() - .is_some_and(contains_generated_fixture_matcher) - }) { - let mut protocol = base.clone(); - if let Some(registry_relay::offline_fixture::OfflineInteraction { - response: OfflineSourceResponse::Http { body, .. }, - .. - }) = protocol.last_mut() - { - if let Ok(Value::Object(mut object)) = serde_json::from_slice::(body) { - object.insert("__registry_protocol_mutation".to_owned(), Value::Bool(true)); - *body = serde_json::to_vec(&Value::Object(object))?; - cases.push(( - "protocol_verification", - protocol, - "source.response_malformed", - )); + let supports_remote_source = matches!( + loaded.integrations[integration_alias].document.capability, + CapabilityDeclaration::Http { .. } | CapabilityDeclaration::Script { .. } + ); + if supports_remote_source { + let mut request_mismatch = base.clone(); + if let Some(interaction) = request_mismatch.first_mut() { + interaction + .request + .path + .push_str("/__registry_fixture_mismatch"); + cases.push(( + GeneratorRecipeId::RequestAuthority, + request_mismatch, + "fixture.request_mismatch", + )); + } + let mut request_order = base.clone(); + if let Some((left, right)) = distinguishable_request_pair(&request_order) { + request_order.swap(left, right); + cases.push(( + GeneratorRecipeId::RequestOrder, + request_order, + "fixture.request_mismatch", + )); + } + let mut rejected_status = base.clone(); + if let Some(interaction) = rejected_status.last_mut() { + interaction.response = OfflineSourceResponse::Http { + status: 500, + headers: BTreeMap::new(), + // Keep the representation valid so script capabilities can + // classify the rejected status before body decoding can mask it. + body: b"{}".to_vec(), + }; + cases.push(( + GeneratorRecipeId::StatusRejection, + rejected_status, + "source.status_rejected", + )); + } + let mut malformed = base.clone(); + if let Some(interaction) = malformed.last_mut() { + interaction.response = OfflineSourceResponse::Http { + status: 200, + headers: BTreeMap::new(), + body: b"{".to_vec(), + }; + cases.push(( + GeneratorRecipeId::MalformedDecode, + malformed, + "source.response_malformed", + )); + } + let mut oversized = base.clone(); + if let Some(interaction) = oversized.last_mut() { + interaction.response = OfflineSourceResponse::DeclaredBodyBytes { + status: 200, + body_bytes: u64::MAX, + }; + cases.push(( + GeneratorRecipeId::ByteCeiling, + oversized, + "source.response_too_large", + )); + } + let mut timeout = base.clone(); + if let Some(interaction) = timeout.last_mut() { + interaction.response = OfflineSourceResponse::Timeout; + cases.push(( + GeneratorRecipeId::Timeout, + timeout, + "source.deadline_exceeded", + )); + } + if fixture.interactions.iter().any(|interaction| { + interaction + .expect + .body + .as_ref() + .is_some_and(contains_generated_fixture_matcher) + }) { + let mut protocol = base.clone(); + if let Some(registry_relay::offline_fixture::OfflineInteraction { + response: OfflineSourceResponse::Http { body, .. }, + .. + }) = protocol.last_mut() + { + if let Ok(Value::Object(mut object)) = serde_json::from_slice::(body) { + object.insert("__registry_protocol_mutation".to_owned(), Value::Bool(true)); + *body = serde_json::to_vec(&Value::Object(object))?; + cases.push(( + GeneratorRecipeId::ProtocolVerification, + protocol, + "source.response_malformed", + )); + } } } } + cases.retain(|(recipe_id, _, _)| { + matches!( + generated_recipe_applicability(loaded, integration_alias, fixture, *recipe_id), + GeneratedRecipeApplicability::Applicable {} + ) + }); + let mut reports = cases .into_iter() - .map(|(case, interactions, expected)| { + .map(|(recipe_id, interactions, expected)| { let mut calls = Vec::new(); let result = execute_offline_profiles( compiled, @@ -363,9 +552,25 @@ fn derived_fixture_reports( }); let actual = result.as_ref().err().map(String::as_str); let passed = actual == Some(expected); + generated_observations.push(GeneratedFixtureObservation { + integration: integration_alias.to_owned(), + source_fixture_id: fixture.name.clone(), + recipe_id, + actual_safe_code: actual.map(FixtureSafeCode::from_runtime_code), + pass_state: if passed { + FixturePassState::Passed + } else { + FixturePassState::Failed + }, + actual_source_calls: Some(u32::try_from(calls.len()).unwrap_or(u32::MAX)), + }); FixtureReport { integration: integration_alias.to_owned(), - fixture: format!("{}::derived/{case}", fixture.name), + fixture: format!( + "{}::derived/{}", + fixture.name, + generated_recipe_fixture_suffix(recipe_id) + ), inputs: fixture.input.keys().cloned().collect(), calls, outputs: Vec::new(), @@ -393,9 +598,26 @@ fn derived_fixture_reports( None, registry_notary_server::standalone::OfflineAuthentication::WrongCredential, true, + worker_program, )?; - let authorization_error = authorization.err(); + let authorization_error = authorization.result.err(); let authorization_passed = authorization_error.as_deref() == Some("authorization.denied"); + let actual_source_calls = u32::try_from(authorization.relay_calls).unwrap_or(u32::MAX); + let passed = authorization_passed && actual_source_calls == 0; + generated_observations.push(GeneratedFixtureObservation { + integration: integration_alias.to_owned(), + source_fixture_id: fixture.name.clone(), + recipe_id: GeneratorRecipeId::AuthorizationBeforeSource, + actual_safe_code: authorization_error + .as_deref() + .map(FixtureSafeCode::from_runtime_code), + pass_state: if passed { + FixturePassState::Passed + } else { + FixturePassState::Failed + }, + actual_source_calls: Some(actual_source_calls), + }); reports.push(FixtureReport { integration: integration_alias.to_owned(), fixture: format!("{}::derived/authorization_before_source", fixture.name), @@ -405,12 +627,12 @@ fn derived_fixture_reports( claims: Vec::new(), outcome: None, expected_error: Some("authorization.denied".to_owned()), - source_access: Some(false), - passed: authorization_passed, - failure: (!authorization_passed).then(|| { + source_access: Some(actual_source_calls != 0), + passed, + failure: (!passed).then(|| { format!( - "derived_authorization_mismatch: expected=authorization.denied, actual={}", - authorization_error.as_deref().unwrap_or("success") + "derived_authorization_mismatch: expected=authorization.denied, actual={}, source_calls={actual_source_calls}", + authorization_error.as_deref().unwrap_or("success"), ) }), }); @@ -420,11 +642,7 @@ fn derived_fixture_reports( // Ignoring unselected upstream members is a declarative HTTP projection // guarantee. Snapshot rows are the reviewed materialization contract, so // injecting an undeclared field there must remain a malformed response. - let is_declarative_http = matches!( - loaded.integrations[integration_alias].document.capability, - CapabilityDeclaration::Http { .. } - ); - if is_declarative_http + if supports_remote_source && !fixture.interactions.iter().any(|interaction| { interaction .expect @@ -454,8 +672,11 @@ fn derived_fixture_reports( trace, &mut trace_calls, ); - let (passed, calls, outputs, outcome, failure) = match result { - Ok(observation) => { + let evaluated = match result { + Ok(mut observation) => { + if trace_calls.is_empty() { + trace_calls = std::mem::take(&mut observation.calls); + } let outcome = match observation.outcome { registry_relay::offline_fixture::OfflineFixtureOutcome::Match => { "match" @@ -467,74 +688,1031 @@ fn derived_fixture_reports( "ambiguous" } }; - let passed = observation.outputs == fixture.expect.outputs - && fixture - .expect - .outcome - .as_deref() - .is_none_or(|expected| expected == outcome); - ( - passed, - if trace_calls.is_empty() { - observation.calls - } else { - trace_calls - }, - observation.outputs.keys().cloned().collect(), - Some(outcome.to_owned()), - (!passed) - .then(|| "derived_output_minimization_changed_result".to_owned()), - ) + let evaluated_claims = if matches!(outcome, "match" | "no_match") + && integration_has_product_claims(loaded, integration_alias) + { + evaluate_product_claims( + loaded, + compiled, + integration_alias, + fixture, + Some((&observation.outputs, outcome)), + registry_notary_server::standalone::OfflineAuthentication::Valid, + false, + worker_program, + )? + .result + .map(Some) + } else if matches!(outcome, "match" | "no_match") { + Ok(Some(BTreeMap::new())) + } else { + Ok(None) + }; + evaluated_claims + .map(|claims| (observation.outputs, outcome.to_owned(), claims)) } - Err(error) => ( - false, - trace_calls, - Vec::new(), - None, - Some(format!("derived_output_minimization_failed: {error}")), - ), + Err(error) => Err(error), }; + let passed = match (&evaluated, fixture.expect.error.as_deref()) { + (Ok((outputs, outcome, claims)), None) => { + let outcome_matches = fixture + .expect + .outcome + .as_deref() + .is_none_or(|expected| expected == outcome); + let claims_match = if outcome == "ambiguous" { + fixture.expect.claims.is_empty() + } else { + claims.as_ref() == Some(&fixture.expect.claims) + }; + outputs == &fixture.expect.outputs && outcome_matches && claims_match + } + (Err(actual), Some(expected)) => actual == expected, + _ => false, + }; + let actual_safe_code = evaluated + .as_ref() + .err() + .map(|code| FixtureSafeCode::from_runtime_code(code)); + let outputs = evaluated + .as_ref() + .ok() + .map(|(outputs, _, _)| outputs.keys().cloned().collect()) + .unwrap_or_default(); + let claims = evaluated + .as_ref() + .ok() + .and_then(|(_, _, claims)| claims.as_ref()) + .map(|claims| claims.keys().cloned().collect()) + .unwrap_or_default(); + let outcome = evaluated + .as_ref() + .ok() + .map(|(_, outcome, _)| outcome.clone()); + let actual_source_calls = u32::try_from(trace_calls.len()).unwrap_or(u32::MAX); reports.push(FixtureReport { integration: integration_alias.to_owned(), fixture: format!("{}::derived/output_minimization", fixture.name), inputs: fixture.input.keys().cloned().collect(), - calls, + calls: trace_calls, outputs, - claims: Vec::new(), + claims, outcome, - expected_error: None, - source_access: Some(true), + expected_error: fixture.expect.error.clone(), + source_access: evaluated + .as_ref() + .err() + .map(|code| error_implies_source_access(code)) + .or(Some(true)), passed, - failure, + failure: (!passed) + .then(|| "derived_output_minimization_changed_result".to_owned()), + }); + generated_observations.push(GeneratedFixtureObservation { + integration: integration_alias.to_owned(), + source_fixture_id: fixture.name.clone(), + recipe_id: GeneratorRecipeId::OutputMinimization, + actual_safe_code, + pass_state: if passed { + FixturePassState::Passed + } else { + FixturePassState::Failed + }, + actual_source_calls: Some(actual_source_calls), + }); + } + } + } + Ok(reports) +} + +fn integration_has_product_claims(loaded: &LoadedRegistryProject, integration_alias: &str) -> bool { + loaded.project.services.values().any(|service| { + service.kind == ServiceKind::Evidence + && service.claims.values().any(|claim| { + claim_consultation_name(service, claim).is_ok_and(|consultation| { + service.consultations[consultation].integration == integration_alias + }) + }) + }) +} + +fn contains_generated_fixture_matcher(value: &Value) -> bool { + match value { + Value::Array(values) => values.iter().any(contains_generated_fixture_matcher), + Value::Object(object) => { + object.contains_key("generated") + || object.values().any(contains_generated_fixture_matcher) + } + _ => false, + } +} + +fn generated_recipe_fixture_suffix(recipe: GeneratorRecipeId) -> &'static str { + match recipe { + GeneratorRecipeId::RequestAuthority => "request_authority", + GeneratorRecipeId::RequestOrder => "request_order", + GeneratorRecipeId::StatusRejection => "status_rejection", + GeneratorRecipeId::MalformedDecode => "malformed_decode", + GeneratorRecipeId::ByteCeiling => "byte_ceiling", + GeneratorRecipeId::Timeout => "timeout", + GeneratorRecipeId::ProtocolVerification => "protocol_verification", + GeneratorRecipeId::AuthorizationBeforeSource => "authorization_before_source", + GeneratorRecipeId::OutputMinimization => "output_minimization", + } +} + +/// Builds the value-free v1 coverage report from the authoritative loaded +/// project and the observations produced by the existing offline executor. +/// +/// Every integration is an isolated target with the same ordered requirement +/// matrix. The regular command has no baseline-to-candidate comparison, so the +/// four affected-fixture requirements remain honestly `not_evaluated`. +fn generate_fixture_coverage_report( + loaded: &LoadedRegistryProject, + fixture_reports: &[FixtureReport], + generated_observations: &[GeneratedFixtureObservation], + request_observations: &[AuthoredRequestBindingObservation], + call_budget_actual: Option, +) -> Result { + generate_fixture_coverage_report_with_comparison( + loaded, + fixture_reports, + generated_observations, + request_observations, + call_budget_actual, + None, + ) +} + +fn generate_fixture_coverage_report_with_comparison( + loaded: &LoadedRegistryProject, + fixture_reports: &[FixtureReport], + generated_observations: &[GeneratedFixtureObservation], + request_observations: &[AuthoredRequestBindingObservation], + call_budget_actual: Option, + comparison_input: Option<&FixtureCoverageComparisonInput>, +) -> Result { + validate_stable_id( + &loaded.project.registry.id, + "fixture coverage project identifier", + )?; + if let Some(environment) = loaded.environment_name.as_deref() { + validate_stable_id(environment, "fixture coverage environment identifier")?; + } + if let Some(comparison_input) = comparison_input { + comparison_input + .validate() + .map_err(|error| anyhow!(error))?; + } + + let mut authored_report_index = BTreeMap::<(&str, &str), &FixtureReport>::new(); + for report in fixture_reports + .iter() + .filter(|report| !report.fixture.contains("::derived/")) + { + if authored_report_index + .insert( + (report.integration.as_str(), report.fixture.as_str()), + report, + ) + .is_some() + { + bail!("fixture coverage received a duplicate authored observation"); + } + } + let mut observation_index = + BTreeMap::<(&str, &str, GeneratorRecipeId), &GeneratedFixtureObservation>::new(); + for observation in generated_observations { + let key = ( + observation.integration.as_str(), + observation.source_fixture_id.as_str(), + observation.recipe_id, + ); + if observation_index.insert(key, observation).is_some() { + bail!("fixture coverage received a duplicate generated observation"); + } + } + let mut request_observation_index = + BTreeMap::<(&str, &str), &AuthoredRequestBindingObservation>::new(); + for observation in request_observations { + let key = ( + observation.integration.as_str(), + observation.source_fixture_id.as_str(), + ); + if request_observation_index.insert(key, observation).is_some() { + bail!("fixture coverage received a duplicate governed request observation"); + } + } + + let platform_case = call_budget_actual + .map(build_platform_call_budget_case) + .transpose()?; + let mut targets = Vec::with_capacity(loaded.integrations.len()); + for (integration_alias, integration) in &loaded.integrations { + let mut fixture_inventory = Vec::with_capacity(integration.fixtures.len()); + let mut generated_cases = Vec::with_capacity( + integration + .fixtures + .len() + .checked_mul(GeneratorRecipeId::ALL.len()) + .ok_or_else(|| anyhow!("fixture coverage generated record count overflowed"))?, + ); + for (fixture_path, fixture) in &integration.fixtures { + let source = fixture_coverage_source(integration_alias, fixture_path, fixture)?; + let report = authored_report_index + .get(&(integration_alias.as_str(), fixture.name.as_str())) + .copied(); + let pass_state = report.map_or(FixturePassState::NotExecuted, |report| { + if report.passed { + FixturePassState::Passed + } else { + FixturePassState::Failed + } + }); + let expectation = authored_fixture_expectation(fixture)?; + let fixture_evidence = fixture_coverage_evidence( + FixtureCoverageEvidenceKind::AuthoredFixture, + format!("target/{integration_alias}/fixture/{}", fixture.name), + source.fixture_digest.clone(), + ) + .map_err(|error| anyhow!(error))?; + fixture_inventory.push(AuthoredSemanticFixtureCoverage { + evidence: fixture_evidence, + fixture_id: fixture.name.clone(), + fixture_digest: source.fixture_digest.clone(), + expectation, + semantic_null: fixture_has_semantic_null(fixture), + interaction_count: u32::try_from(fixture.interactions.len()) + .map_err(|_| anyhow!("fixture interaction count exceeds the report range"))?, + input_ids: fixture.input.keys().cloned().collect(), + output_ids: fixture.expect.outputs.keys().cloned().collect(), + claim_ids: fixture.expect.claims.keys().cloned().collect(), + exercised_status_mappings: fixture_exercised_status_mappings_for_fixture( + &integration.document, + fixture, + ), + classification: FixtureCoverageClassification::Synthetic, + pass_state, + request_to_consultation_binding: match ( + fixture.request.is_some(), + request_observation_index + .get(&(integration_alias.as_str(), fixture.name.as_str())) + .copied(), + ) { + (false, None) => FixtureRequestBindingCoverage { + state: FixtureRequestBindingState::NotAuthored, + consultations: Vec::new(), + actual_relay_consultations: None, + safe_error_code: None, + }, + (false, Some(_)) => { + bail!("fixture coverage observed a governed request that was not authored") + } + (true, None) => FixtureRequestBindingCoverage { + state: FixtureRequestBindingState::NotExecuted, + consultations: Vec::new(), + actual_relay_consultations: None, + safe_error_code: None, + }, + (true, Some(observation)) => FixtureRequestBindingCoverage { + state: if observation.pass_state == FixturePassState::Passed { + FixtureRequestBindingState::Passed + } else { + FixtureRequestBindingState::Failed + }, + consultations: observation.consultations.clone(), + actual_relay_consultations: observation.actual_relay_consultations, + safe_error_code: observation.actual_safe_code, + }, + }, + }); + + for recipe_id in GeneratorRecipeId::ALL { + let applicability = + generated_recipe_applicability(loaded, integration_alias, fixture, recipe_id); + let observation = observation_index + .get(&(integration_alias.as_str(), fixture.name.as_str(), recipe_id)) + .copied(); + if matches!( + applicability, + GeneratedRecipeApplicability::NotApplicable { .. } + ) && observation.is_some() + { + bail!( + "fixture coverage observed an inapplicable generated recipe {}", + generated_recipe_fixture_suffix(recipe_id) + ); + } + let pass_state = if matches!( + applicability, + GeneratedRecipeApplicability::NotApplicable { .. } + ) { + FixturePassState::NotExecuted + } else { + observation.map_or(FixturePassState::NotExecuted, |value| value.pass_state) + }; + let source_access_assertion = (recipe_id + == GeneratorRecipeId::AuthorizationBeforeSource + && matches!(applicability, GeneratedRecipeApplicability::Applicable {})) + .then(|| { + let actual_source_calls = + observation.and_then(|value| value.actual_source_calls); + SourceAccessAssertion { + expected_source_calls: SourceCallExpectation::Zero, + actual_source_calls, + passed: actual_source_calls == Some(0), + } }); + let actual_safe_code = if recipe_id == GeneratorRecipeId::OutputMinimization { + None + } else { + observation.and_then(|value| value.actual_safe_code) + }; + let evidence_digest = fixture_coverage_digest(&( + recipe_id, + &source, + &applicability, + recipe_id.mutation_target(), + recipe_id.expected_safe_code(), + actual_safe_code, + pass_state, + &source_access_assertion, + )) + .map_err(|error| anyhow!(error))?; + let evidence = fixture_coverage_evidence( + FixtureCoverageEvidenceKind::GeneratedCase, + format!( + "target/{integration_alias}/fixture/{}/generated/{}/v1", + fixture.name, + generated_recipe_fixture_suffix(recipe_id) + ), + evidence_digest, + ) + .map_err(|error| anyhow!(error))?; + generated_cases.push(GeneratedFixtureCoverage { + evidence, + recipe: GeneratorRecipe { + id: recipe_id, + version: GeneratorRecipeVersion::V1, + }, + source_fixture: source.clone(), + applicability, + mutation_target_class: recipe_id.mutation_target(), + expected_safe_code: recipe_id.expected_safe_code(), + actual_safe_code, + pass_state, + source_access_assertion, + }); + } + } + + fixture_inventory.sort_by(|left, right| left.fixture_id.cmp(&right.fixture_id)); + generated_cases.sort_by(|left, right| { + (&left.source_fixture.fixture_id, left.recipe.id) + .cmp(&(&right.source_fixture.fixture_id, right.recipe.id)) + }); + let target_platform_cases = if matches!( + integration.document.capability, + CapabilityDeclaration::Script { .. } + ) { + platform_case.clone().into_iter().collect() + } else { + Vec::new() + }; + let declared = fixture_target_declared_dimensions(loaded, integration_alias, integration); + let exercised = fixture_target_exercised_dimensions( + integration, + &fixture_inventory, + &generated_cases, + &target_platform_cases, + ); + let identity = FixtureCoverageTargetIdentity { + integration: integration_alias.clone(), + capability: fixture_coverage_capability(&integration.document.capability), + }; + let contract = + fixture_coverage_target_contract(loaded, integration_alias, integration)?; + let compiled_contract = target_compiled_contract_evidence(&identity, &contract, &declared) + .map_err(|error| anyhow!(error))?; + let mut target = FixtureCoverageTarget { + identity, + contract, + fixture_set_state: if fixture_inventory.is_empty() { + FixtureSetState::Fixtureless + } else { + FixtureSetState::FixtureBearing + }, + compiled_contract, + fixture_inventory, + generated_cases, + platform_cases: target_platform_cases, + declared, + exercised, + comparison: None, + requirements: Vec::new(), + }; + target.requirements = derive_fixture_coverage_requirements( + &target, + FixtureCoverageNotEvaluatedReason::ComparisonInputAbsent, + ); + targets.push(target); + } + targets.sort_by(|left, right| left.identity.integration.cmp(&right.identity.integration)); + let report = ProjectFixtureCoverageReportV1::from_targets( + loaded.project.registry.id.clone(), + loaded.environment_name.clone(), + targets, + ) + .map_err(|error| anyhow!(error))?; + match comparison_input { + Some(input) => report + .with_comparison(input) + .map_err(|error| anyhow!(error)), + None => Ok(report), + } +} + +fn build_platform_call_budget_case( + actual_safe_code: FixtureSafeCode, +) -> Result { + let pass_state = if actual_safe_code == FixtureSafeCode::SourceCallBudgetExceeded { + FixturePassState::Passed + } else { + FixturePassState::Failed + }; + let evidence_digest = fixture_coverage_digest(&( + PlatformGeneratedCaseId::RelayScriptCallBudget, + GeneratorRecipeVersion::V1, + PlatformCoverageComponent::RelayScriptWorker, + FixtureMutationTargetClass::SourceCallBudget, + FixtureSafeCode::SourceCallBudgetExceeded, + actual_safe_code, + pass_state, + )) + .map_err(|error| anyhow!(error))?; + Ok(PlatformGeneratedFixtureCoverage { + evidence: fixture_coverage_evidence( + FixtureCoverageEvidenceKind::PlatformCase, + "platform/relay-script-worker/call-budget/v1".to_owned(), + evidence_digest, + ) + .map_err(|error| anyhow!(error))?, + case_id: PlatformGeneratedCaseId::RelayScriptCallBudget, + version: GeneratorRecipeVersion::V1, + component: PlatformCoverageComponent::RelayScriptWorker, + mutation_target_class: FixtureMutationTargetClass::SourceCallBudget, + expected_safe_code: FixtureSafeCode::SourceCallBudgetExceeded, + actual_safe_code, + pass_state, + }) +} + +fn fixture_coverage_source( + integration_alias: &str, + fixture_path: &Path, + fixture: &FixtureDocument, +) -> Result { + validate_stable_id(integration_alias, "fixture coverage integration identifier")?; + validate_stable_id(&fixture.name, "fixture coverage fixture identifier")?; + let bytes = + fs::read(fixture_path).context("failed to read a fixture for coverage digesting")?; + Ok(GeneratedSourceFixture { + fixture_id: fixture.name.clone(), + fixture_digest: Sha256Digest::new(sha256_uri(&bytes)).map_err(|error| anyhow!(error))?, + }) +} + +fn fixture_coverage_capability(capability: &CapabilityDeclaration) -> FixtureCapability { + match capability { + CapabilityDeclaration::Http { .. } => FixtureCapability::DeclarativeHttp, + CapabilityDeclaration::Script { .. } => FixtureCapability::Script, + CapabilityDeclaration::Snapshot { .. } => FixtureCapability::Snapshot, + } +} + +fn fixture_coverage_target_contract( + loaded: &LoadedRegistryProject, + integration_alias: &str, + integration: &LoadedIntegration, +) -> Result { + let source_operation_count = match &integration.document.capability { + CapabilityDeclaration::Http { http } => Some( + u32::try_from(http.operations.len()) + .map_err(|_| anyhow!("compiled HTTP operation count exceeds report range"))?, + ), + CapabilityDeclaration::Script { .. } | CapabilityDeclaration::Snapshot { .. } => None, + }; + let mut reviewed_not_applicable = Vec::new(); + if integration.document.not_applicable.ambiguity.is_some() { + reviewed_not_applicable.push(FixtureCoverageReviewedNotApplicable::SemanticAmbiguity); + } + if integration + .document + .not_applicable + .subject_mismatch + .is_some() + { + reviewed_not_applicable.push(FixtureCoverageReviewedNotApplicable::SubjectMismatch); + } + Ok(FixtureCoverageTargetContract { + source_operation_count, + reviewed_not_applicable, + registry_backed_consultations: fixture_target_registry_backed_consultations( + loaded, + integration_alias, + )?, + }) +} + +fn fixture_target_registry_backed_consultations( + loaded: &LoadedRegistryProject, + integration_alias: &str, +) -> Result> { + let mut identities = BTreeSet::new(); + for (service_id, service) in &loaded.project.services { + if service.kind != ServiceKind::Evidence { + continue; + } + for claim in service.claims.values() { + if inferred_claim_evidence(service, claim)? != ClaimEvidence::RegistryBacked { + continue; + } + let consultation_id = claim_consultation_name(service, claim)?; + let consultation = service + .consultations + .get(consultation_id) + .ok_or_else(|| anyhow!("registry-backed claim consultation is absent"))?; + if consultation.integration == integration_alias { + identities.insert(FixtureConsultationIdentity { + service_id: service_id.clone(), + consultation_id: consultation_id.to_owned(), + }); + } + } + } + Ok(identities.into_iter().collect()) +} + +fn distinguishable_request_pair( + interactions: &[registry_relay::offline_fixture::OfflineInteraction], +) -> Option<(usize, usize)> { + for left in 0..interactions.len() { + for right in left + 1..interactions.len() { + if interactions[left].request != interactions[right].request { + return Some((left, right)); + } + } + } + None +} + +fn authored_fixture_expectation(fixture: &FixtureDocument) -> Result { + if let Some(code) = fixture.expect.error.as_deref() { + let code = FixtureSafeCode::from_runtime_code(code); + if code == FixtureSafeCode::RedactedUnclassifiedError { + bail!("authored fixture expects an unreportable error class"); + } + return Ok(FixtureSemanticExpectation::SafeErrorCode { code }); + } + let outcome = match fixture.expect.outcome.as_deref() { + Some("match") => FixtureSemanticOutcome::Match, + Some("no_match") => FixtureSemanticOutcome::NoMatch, + Some("ambiguous") => FixtureSemanticOutcome::Ambiguous, + None => FixtureSemanticOutcome::Successful, + Some(_) => bail!("authored fixture has an unreportable semantic expectation"), + }; + Ok(FixtureSemanticExpectation::Outcome { outcome }) +} + +fn generated_recipe_applicability( + loaded: &LoadedRegistryProject, + integration_alias: &str, + fixture: &FixtureDocument, + recipe_id: GeneratorRecipeId, +) -> GeneratedRecipeApplicability { + let has_interaction = !fixture.interactions.is_empty(); + let has_protocol_matcher = fixture.interactions.iter().any(|interaction| { + interaction + .expect + .body + .as_ref() + .is_some_and(contains_generated_fixture_matcher) + }); + let final_json_object = matches!( + fixture + .interactions + .last() + .map(|interaction| &interaction.respond), + Some(FixtureSourceResponse::Http { + body: Value::Object(_), + .. + }) + ); + match recipe_id { + GeneratorRecipeId::RequestAuthority + | GeneratorRecipeId::RequestOrder + | GeneratorRecipeId::StatusRejection + | GeneratorRecipeId::ProtocolVerification + | GeneratorRecipeId::MalformedDecode + | GeneratorRecipeId::ByteCeiling + | GeneratorRecipeId::Timeout + if matches!( + loaded.integrations[integration_alias].document.capability, + CapabilityDeclaration::Snapshot { .. } + ) => + { + GeneratedRecipeApplicability::NotApplicable { + reason: GeneratedNotApplicableReason::NoRemoteSourceCapability, + invariant: CoverageInvariant::RemoteMutationRequiresRemoteSourceCapability, + } + } + GeneratorRecipeId::RequestAuthority + | GeneratorRecipeId::StatusRejection + | GeneratorRecipeId::MalformedDecode + | GeneratorRecipeId::ByteCeiling + | GeneratorRecipeId::Timeout + if !has_interaction => + { + GeneratedRecipeApplicability::NotApplicable { + reason: GeneratedNotApplicableReason::NoSourceInteraction, + invariant: CoverageInvariant::MutationRequiresSourceInteraction, + } + } + GeneratorRecipeId::RequestOrder if fixture.interactions.len() < 2 => { + GeneratedRecipeApplicability::NotApplicable { + reason: GeneratedNotApplicableReason::SingleSourceInteraction, + invariant: CoverageInvariant::OrderMutationRequiresMultipleSourceInteractions, + } + } + GeneratorRecipeId::RequestOrder + if offline_fixture_interactions(fixture) + .ok() + .and_then(|interactions| distinguishable_request_pair(&interactions)) + .is_none() => + { + GeneratedRecipeApplicability::NotApplicable { + reason: GeneratedNotApplicableReason::NoDistinguishableRequestPair, + invariant: + CoverageInvariant::OrderMutationRequiresDistinguishableSourceInteractions, + } + } + GeneratorRecipeId::ProtocolVerification if !has_protocol_matcher => { + GeneratedRecipeApplicability::NotApplicable { + reason: GeneratedNotApplicableReason::NoGeneratedRequestMatcher, + invariant: CoverageInvariant::ProtocolMutationRequiresGeneratedRequestMatcher, + } + } + GeneratorRecipeId::ProtocolVerification if !final_json_object => { + GeneratedRecipeApplicability::NotApplicable { + reason: GeneratedNotApplicableReason::FinalResponseIsNotJsonObject, + invariant: CoverageInvariant::MutationRequiresFinalJsonObjectResponse, + } + } + GeneratorRecipeId::AuthorizationBeforeSource + if !integration_has_product_claims(loaded, integration_alias) => + { + GeneratedRecipeApplicability::NotApplicable { + reason: GeneratedNotApplicableReason::IntegrationHasNoProductClaims, + invariant: CoverageInvariant::AuthorizationCheckRequiresProductClaimEvaluation, + } + } + GeneratorRecipeId::OutputMinimization + if !matches!( + loaded.integrations[integration_alias].document.capability, + CapabilityDeclaration::Http { .. } | CapabilityDeclaration::Script { .. } + ) => + { + GeneratedRecipeApplicability::NotApplicable { + reason: GeneratedNotApplicableReason::SnapshotUsesClosedMaterialization, + invariant: CoverageInvariant::SnapshotOutputUsesClosedMaterializationProjection, } } + GeneratorRecipeId::OutputMinimization if has_protocol_matcher => { + GeneratedRecipeApplicability::NotApplicable { + reason: GeneratedNotApplicableReason::ProtocolMatcherOwnsResponseMutation, + invariant: CoverageInvariant::ProtocolMatcherFixtureUsesProtocolVerificationInstead, + } + } + GeneratorRecipeId::OutputMinimization if !final_json_object => { + GeneratedRecipeApplicability::NotApplicable { + reason: GeneratedNotApplicableReason::FinalResponseIsNotJsonObject, + invariant: CoverageInvariant::MutationRequiresFinalJsonObjectResponse, + } + } + _ => GeneratedRecipeApplicability::Applicable {}, } - Ok(reports) } -fn integration_has_product_claims(loaded: &LoadedRegistryProject, integration_alias: &str) -> bool { - loaded.project.services.values().any(|service| { - service.kind == ServiceKind::Evidence - && service.claims.values().any(|claim| { - claim_consultation_name(service, claim).is_ok_and(|consultation| { - service.consultations[consultation].integration == integration_alias +fn fixture_target_declared_dimensions( + loaded: &LoadedRegistryProject, + integration_alias: &str, + integration: &LoadedIntegration, +) -> FixtureCoverageDimensions { + let (claim_ids, disclosure_modes) = + fixture_target_claims_and_disclosures(loaded, integration_alias); + FixtureCoverageDimensions { + input_ids: integration.document.input.keys().cloned().collect(), + output_ids: integration.document.outputs.keys().cloned().collect(), + claim_ids, + disclosure_modes, + status_mappings: fixture_status_mappings(&integration.document), + protocol_helpers: fixture_protocol_helpers(&integration.document), + limits: fixture_declared_limits(&integration.document), + script_branch_ids: Vec::new(), + } +} + +fn fixture_target_exercised_dimensions( + integration: &LoadedIntegration, + inventory: &[AuthoredSemanticFixtureCoverage], + generated: &[GeneratedFixtureCoverage], + platform: &[PlatformGeneratedFixtureCoverage], +) -> FixtureCoverageDimensions { + let passed = inventory + .iter() + .filter(|fixture| fixture.pass_state == FixturePassState::Passed) + .collect::>(); + let input_ids = passed + .iter() + .flat_map(|fixture| fixture.input_ids.iter().cloned()) + .collect::>() + .into_iter() + .collect(); + let output_ids = passed + .iter() + .flat_map(|fixture| fixture.output_ids.iter().cloned()) + .collect::>() + .into_iter() + .collect(); + let claim_ids = passed + .iter() + .flat_map(|fixture| fixture.claim_ids.iter().cloned()) + .collect::>() + .into_iter() + .collect(); + let protocol_helpers = + if generated_recipe_complete(generated, GeneratorRecipeId::ProtocolVerification).0 { + fixture_protocol_helpers(&integration.document) + } else { + Vec::new() + }; + let mut limits = BTreeSet::new(); + if !matches!( + integration.document.capability, + CapabilityDeclaration::Snapshot { .. } + ) { + if generated_recipe_complete(generated, GeneratorRecipeId::ByteCeiling).0 { + limits.insert(FixtureLimit::ResponseBytes); + } + if generated_recipe_complete(generated, GeneratorRecipeId::Timeout).0 { + limits.insert(FixtureLimit::Deadline); + } + } + if platform + .iter() + .any(|case| case.pass_state == FixturePassState::Passed) + { + limits.insert(FixtureLimit::CallCount); + } + FixtureCoverageDimensions { + input_ids, + output_ids, + claim_ids, + // Claim evaluation does not exercise disclosure selection. + disclosure_modes: Vec::new(), + status_mappings: fixture_exercised_status_mappings(integration, inventory), + protocol_helpers, + limits: limits.into_iter().collect(), + // Semantic outcomes are not implementation branch identifiers. + script_branch_ids: Vec::new(), + } +} + +fn fixture_target_claims_and_disclosures( + loaded: &LoadedRegistryProject, + integration_alias: &str, +) -> (Vec, Vec) { + let mut claim_ids = BTreeSet::new(); + let mut modes = BTreeSet::new(); + for service in loaded.project.services.values() { + if service.kind != ServiceKind::Evidence { + continue; + } + for (claim_id, claim) in &service.claims { + let belongs_to_target = claim_consultation_name(service, claim) + .ok() + .and_then(|consultation| service.consultations.get(consultation)) + .is_some_and(|consultation| consultation.integration == integration_alias); + if !belongs_to_target { + continue; + } + claim_ids.insert(claim_id.clone()); + match &claim.disclosure { + DisclosureDeclaration::Mode(mode) => { + modes.insert(fixture_disclosure_mode(*mode)); + } + DisclosureDeclaration::Policy { default, allowed } => { + modes.insert(fixture_disclosure_mode(*default)); + modes.extend(allowed.iter().copied().map(fixture_disclosure_mode)); + } + } + } + } + (claim_ids.into_iter().collect(), modes.into_iter().collect()) +} + +fn fixture_disclosure_mode(mode: DisclosureMode) -> FixtureDisclosureMode { + match mode { + DisclosureMode::Value => FixtureDisclosureMode::Value, + DisclosureMode::Predicate => FixtureDisclosureMode::Predicate, + DisclosureMode::Redacted => FixtureDisclosureMode::Redacted, + } +} + +fn fixture_status_mappings(integration: &IntegrationDocument) -> Vec { + let CapabilityDeclaration::Http { http } = &integration.capability else { + return Vec::new(); + }; + let mut no_match = BTreeSet::new(); + let mut ambiguous = BTreeSet::new(); + for operation in http.operations.values() { + let Some(statuses) = operation.response.status_semantics.as_ref() else { + continue; + }; + no_match.extend(statuses.no_match.iter().copied()); + ambiguous.extend(statuses.ambiguous.iter().copied()); + } + [ + (FixtureStatusOutcome::Ambiguous, ambiguous), + (FixtureStatusOutcome::NoMatch, no_match), + ] + .into_iter() + .filter(|(_, statuses)| !statuses.is_empty()) + .map(|(outcome, statuses)| FixtureStatusMapping { + outcome, + statuses: statuses.into_iter().collect(), + }) + .collect() +} + +fn fixture_exercised_status_mappings( + integration: &LoadedIntegration, + inventory: &[AuthoredSemanticFixtureCoverage], +) -> Vec { + let declared = fixture_status_mappings(&integration.document); + declared + .into_iter() + .filter_map(|mapping| { + let statuses = mapping + .statuses + .iter() + .copied() + .filter(|status| { + inventory.iter().any(|fixture| { + fixture.pass_state == FixturePassState::Passed + && fixture.exercised_status_mappings.iter().any(|exercised| { + exercised.outcome == mapping.outcome + && exercised.statuses.binary_search(status).is_ok() + }) + }) }) + .collect::>(); + (!statuses.is_empty()).then_some(FixtureStatusMapping { + outcome: mapping.outcome, + statuses, }) - }) + }) + .collect() } -fn contains_generated_fixture_matcher(value: &Value) -> bool { - match value { - Value::Array(values) => values.iter().any(contains_generated_fixture_matcher), - Value::Object(object) => { - object.contains_key("generated") - || object.values().any(contains_generated_fixture_matcher) +fn fixture_exercised_status_mappings_for_fixture( + integration: &IntegrationDocument, + fixture: &FixtureDocument, +) -> Vec { + fixture_status_mappings(integration) + .into_iter() + .filter_map(|mapping| { + let outcome_matches = matches!( + (mapping.outcome, fixture.expect.outcome.as_deref()), + (FixtureStatusOutcome::NoMatch, Some("no_match")) + | (FixtureStatusOutcome::Ambiguous, Some("ambiguous")) + ); + let statuses = if outcome_matches { + mapping + .statuses + .into_iter() + .filter(|status| { + fixture.interactions.iter().any(|interaction| { + matches!( + interaction.respond, + FixtureSourceResponse::Http { status: actual, .. } + if actual == *status + ) + }) + }) + .collect() + } else { + Vec::new() + }; + (!statuses.is_empty()).then_some(FixtureStatusMapping { + outcome: mapping.outcome, + statuses, + }) + }) + .collect() +} + +fn fixture_protocol_helpers(integration: &IntegrationDocument) -> Vec { + let mut helpers = BTreeSet::new(); + match &integration.capability { + CapabilityDeclaration::Http { http } => { + for operation in http.operations.values() { + if operation.primitive.is_some() || operation.request.primitive.is_some() { + helpers.insert(FixtureProtocolHelper::RequestPrimitive); + } + if operation + .response + .codec + .as_deref() + .is_some_and(|codec| codec != "json_v1") + { + helpers.insert(FixtureProtocolHelper::ResponseCodec); + } + if operation.verification.is_some() { + helpers.insert(FixtureProtocolHelper::Verification); + } + } } - _ => false, + CapabilityDeclaration::Script { script } => { + if script.signed_dci.is_some() { + helpers.insert(FixtureProtocolHelper::SignedDci); + } + } + CapabilityDeclaration::Snapshot { .. } => {} + } + helpers.into_iter().collect() +} + +fn fixture_declared_limits(integration: &IntegrationDocument) -> Vec { + match integration.capability { + CapabilityDeclaration::Http { .. } | CapabilityDeclaration::Script { .. } => vec![ + FixtureLimit::AggregateSourceBytes, + FixtureLimit::CallCount, + FixtureLimit::Deadline, + FixtureLimit::OutputBytes, + FixtureLimit::RequestBytes, + FixtureLimit::ResponseBytes, + ], + CapabilityDeclaration::Snapshot { .. } => vec![ + FixtureLimit::AggregateSourceBytes, + FixtureLimit::OutputBytes, + ], } } +fn fixture_has_semantic_null(fixture: &FixtureDocument) -> bool { + fixture + .input + .values() + .chain(fixture.expect.outputs.values()) + .chain(fixture.expect.claims.values()) + .any(Value::is_null) +} + +fn generated_recipe_complete( + generated: &[GeneratedFixtureCoverage], + recipe_id: GeneratorRecipeId, +) -> (bool, Vec) { + let applicable = generated + .iter() + .filter(|case| { + case.recipe.id == recipe_id + && matches!( + case.applicability, + GeneratedRecipeApplicability::Applicable {} + ) + }) + .collect::>(); + let mut evidence = applicable + .iter() + .filter(|case| { + case.pass_state == FixturePassState::Passed + && case + .source_access_assertion + .as_ref() + .is_none_or(|assertion| assertion.passed) + }) + .map(|case| case.evidence.clone()) + .collect::>(); + evidence.sort(); + evidence.dedup(); + ( + !applicable.is_empty() && evidence.len() == applicable.len(), + evidence, + ) +} + fn invalid_fixture_input_field<'a>( integration: &'a IntegrationDocument, fixture: &FixtureDocument, @@ -577,6 +1755,211 @@ fn error_implies_source_access(code: &str) -> bool { code.starts_with("source.") || code == "failure.subject_mismatch" } +struct ProductClaimsFixtureEvaluation { + result: std::result::Result, String>, + relay_calls: u64, + consultations: Vec, +} + +/// Execute the independently authored governed request through the production +/// Notary request planner. The fixture input remains a separate oracle for the +/// exact Relay consultation key, so this path cannot derive a passing request +/// from the consultation mapping it is intended to verify. +fn evaluate_authored_governed_request( + loaded: &LoadedRegistryProject, + compiled: &CompiledProject, + fixture: &FixtureDocument, + request: &GovernedLiveRequest, + outputs: &BTreeMap, + outcome: &str, + worker_program: &Path, +) -> Result { + use registry_notary_server::standalone::{ + OfflineAuthentication, OfflineNotaryHarness, OfflineNotaryRequest, + OfflineRelayConsultation, OfflineRelayOutcome, + }; + + let expected_consultations = governed_request_consultation_identities(loaded, request)?; + let relay_outcome = match outcome { + "match" => OfflineRelayOutcome::Match, + "no_match" => OfflineRelayOutcome::NoMatch, + "ambiguous" => OfflineRelayOutcome::Ambiguous, + _ => bail!("offline Relay returned an unknown product outcome"), + }; + let relay_inputs = fixture + .input + .iter() + .map(|(name, value)| { + let value = match value { + Value::Null => "null".to_owned(), + Value::Bool(value) => value.to_string(), + Value::Number(value) => value.to_string(), + Value::String(value) => value.clone(), + Value::Array(_) | Value::Object(_) => { + bail!("fixture input is not a bounded scalar") + } + }; + Ok((name.clone(), value)) + }) + .collect::>>()?; + let relay_evidence = compiled + .fixture_profiles + .iter() + .map(|profile| { + let is_selected = loaded.project.services[&profile.service_id].purpose == request.purpose; + OfflineRelayConsultation::decoded_inputs( + profile.id.clone(), + profile.contract_hash.clone(), + loaded.project.services[&profile.service_id].purpose.clone(), + relay_inputs.clone(), + if is_selected { + relay_outcome + } else { + OfflineRelayOutcome::NoMatch + }, + if is_selected && relay_outcome == OfflineRelayOutcome::Match { + outputs.clone() + } else { + BTreeMap::new() + }, + ) + }) + .collect::>(); + if relay_evidence.is_empty() { + bail!("offline governed request has no exact Relay consultation profile"); + } + let notary_config = compiled + .notary_private + .get(Path::new("config/notary.yaml")) + .ok_or_else(|| anyhow!("generated Notary config is absent"))?; + let notary_config: StandaloneRegistryNotaryConfig = serde_norway::from_slice(notary_config) + .context("generated Notary config did not parse for offline governed request")?; + let harness = OfflineNotaryHarness::compile( + notary_config, + relay_evidence, + project_cel_worker_config(worker_program), + ) + .context("production Notary offline harness did not compile")?; + let runtime = tokio::runtime::Builder::new_current_thread() + .enable_all() + .build() + .context("failed to build the offline governed request runtime")?; + let evidence = runtime.block_on(harness.evaluate( + OfflineNotaryRequest::new(OfflineAuthentication::Valid, request.to_evaluate_request()) + .with_header_purpose(request.purpose.as_str()), + )); + let relay_calls = evidence.relay_calls(); + if let Some(error) = evidence.error_class() { + return Ok(ProductClaimsFixtureEvaluation { + result: Err(error.as_str().to_owned()), + relay_calls, + consultations: Vec::new(), + }); + } + let verified = (|| -> Result<_> { + if relay_calls != evidence.consultation_count() as u64 { + bail!("offline Notary did not reuse each governed consultation exactly once"); + } + let consultations = + runtime_consultation_identities(compiled, evidence.relay_profile_ids())?; + if evidence.consultation_count() != consultations.len() { + bail!("offline Notary selected a different governed consultation cardinality"); + } + if consultations != expected_consultations { + bail!("offline Notary selected a different governed consultation set"); + } + let mut claims = BTreeMap::new(); + for claim in evidence.claims() { + if claims + .insert(claim.claim_id().to_owned(), Value::Null) + .is_some() + { + bail!("offline governed request returned a duplicate claim id"); + } + } + let requested = request + .claims + .iter() + .map(|claim| claim.id.as_str()) + .collect::>(); + if claims.keys().map(String::as_str).collect::>() != requested { + bail!("offline governed request did not return the exact selected claim set"); + } + Ok((claims, consultations)) + })(); + Ok(match verified { + Ok((claims, consultations)) => ProductClaimsFixtureEvaluation { + result: Ok(claims), + relay_calls, + consultations, + }, + Err(_) => ProductClaimsFixtureEvaluation { + result: Err("request.binding_evaluation_failed".to_owned()), + relay_calls, + consultations: Vec::new(), + }, + }) +} + +fn runtime_consultation_identities( + compiled: &CompiledProject, + relay_profile_ids: &[String], +) -> Result> { + let mut identities = BTreeSet::new(); + for profile_id in relay_profile_ids { + let profile = compiled + .fixture_profiles + .iter() + .find(|profile| profile.id == *profile_id) + .ok_or_else(|| anyhow!("offline Notary selected an unknown Relay profile"))?; + if !identities.insert(FixtureConsultationIdentity { + service_id: profile.service_id.clone(), + consultation_id: profile.consultation_id.clone(), + }) { + bail!("offline Notary selected a duplicate governed consultation"); + } + } + Ok(identities.into_iter().collect()) +} + +fn governed_request_consultation_identities( + loaded: &LoadedRegistryProject, + request: &GovernedLiveRequest, +) -> Result> { + let mut identities = BTreeSet::new(); + for requested_claim in &request.claims { + let (service_id, service) = loaded + .project + .services + .iter() + .find(|(_, service)| { + service.kind == ServiceKind::Evidence + && service.purpose == request.purpose + && service.claims.contains_key(&requested_claim.id) + }) + .ok_or_else(|| anyhow!("governed request claim has no selected evidence service"))?; + let claim = service + .claims + .get(&requested_claim.id) + .ok_or_else(|| anyhow!("selected governed request claim is absent"))?; + if inferred_claim_evidence(service, claim)? != ClaimEvidence::RegistryBacked { + bail!("governed request claim is not registry-backed"); + } + let consultation_id = claim_consultation_name(service, claim)?; + identities.insert(FixtureConsultationIdentity { + service_id: service_id.clone(), + consultation_id: consultation_id.to_owned(), + }); + } + if identities.is_empty() { + bail!("governed request selected no registry-backed consultation"); + } + Ok(identities.into_iter().collect()) +} + +// Authentication and pre-source denial are independent security inputs and +// remain explicit at this offline product boundary. +#[allow(clippy::too_many_arguments)] fn evaluate_product_claims( loaded: &LoadedRegistryProject, compiled: &CompiledProject, @@ -585,7 +1968,8 @@ fn evaluate_product_claims( relay_result: Option<(&BTreeMap, &str)>, authentication: registry_notary_server::standalone::OfflineAuthentication, require_pre_source_denial: bool, -) -> Result, String>> { + worker_program: &Path, +) -> Result { use registry_notary_core::{ ClaimRef, EvaluateRequest, EvidenceEntity, EvidenceIdentifier, RequestVariables, FORMAT_CLAIM_RESULT_JSON, @@ -651,15 +2035,19 @@ fn evaluate_product_claims( .ok_or_else(|| anyhow!("generated Notary config is absent"))?; let notary_config: StandaloneRegistryNotaryConfig = serde_norway::from_slice(notary_config) .context("generated Notary config did not parse for offline evaluation")?; - let harness = - OfflineNotaryHarness::compile(notary_config, relay_evidence, project_cel_worker_config()?) - .context("production Notary offline harness did not compile")?; + let harness = OfflineNotaryHarness::compile( + notary_config, + relay_evidence, + project_cel_worker_config(worker_program), + ) + .context("production Notary offline harness did not compile")?; let runtime = tokio::runtime::Builder::new_current_thread() .enable_all() .build() .context("failed to build the offline Notary evaluation runtime")?; let mut claims = BTreeMap::new(); let mut evaluated_any = false; + let mut relay_calls = 0_u64; for service in loaded.project.services.values() { if service.kind != ServiceKind::Evidence { continue; @@ -715,9 +2103,7 @@ fn evaluate_product_claims( })? .to_string(), ); - } else if let Some(name) = - request_path.strip_prefix("request.target.attributes.") - { + } else if let Some(name) = request_path.strip_prefix("request.target.attributes.") { attributes.insert(name.to_string(), value.clone()); } else { bail!("compiled consultation input uses an unsupported target path"); @@ -771,11 +2157,16 @@ fn evaluate_product_claims( let evidence = runtime.block_on(harness.evaluate( OfflineNotaryRequest::new(authentication, request).with_header_purpose(purpose), )); + relay_calls = relay_calls.saturating_add(evidence.relay_calls()); if let Some(error) = evidence.error_class() { if require_pre_source_denial && evidence.relay_calls() != 0 { bail!("derived authorization denial occurred after Relay access"); } - return Ok(Err(error.as_str().to_string())); + return Ok(ProductClaimsFixtureEvaluation { + result: Err(error.as_str().to_string()), + relay_calls, + consultations: Vec::new(), + }); } if evidence.relay_calls() != evidence.consultation_count() as u64 { bail!("offline Notary did not reuse each request-scoped consultation exactly once"); @@ -799,13 +2190,19 @@ fn evaluate_product_claims( if !evaluated_any { bail!("offline fixture does not select a project Notary service"); } - Ok(Ok(claims)) + Ok(ProductClaimsFixtureEvaluation { + result: Ok(claims), + relay_calls, + consultations: Vec::new(), + }) } -fn project_cel_worker_config() -> Result { +fn project_cel_worker_config( + worker_program: &Path, +) -> registry_notary_server::cel_worker::CelWorkerConfig { let mut config = registry_notary_server::cel_worker::CelWorkerConfig::for_current_exe_subcommand(); - config.command = project_registryctl_program()?; + config.command = worker_program.to_path_buf(); config.command_args = vec![std::ffi::OsString::from("__registryctl-cel-worker-v1")]; config.command_envs.clear(); config.current_dir = None; @@ -814,29 +2211,123 @@ fn project_cel_worker_config() -> Result Result { - let current = std::env::current_exe().context("current executable is unavailable")?; - if current - .parent() - .and_then(Path::file_name) - .is_some_and(|name| name == "deps") - { - let mut candidate = current - .parent() - .and_then(Path::parent) - .ok_or_else(|| anyhow!("registryctl worker path is unavailable"))? - .join("registryctl"); - candidate.set_extension(std::env::consts::EXE_EXTENSION); - if !candidate.is_file() { - bail!("registryctl worker executable is unavailable"); - } - Ok(candidate) - } else { - Ok(current) +struct CallBudgetCoverageHost; + +#[async_trait::async_trait] +impl registry_relay::rhai_worker::SourceHost for CallBudgetCoverageHost { + async fn call( + &mut self, + _call: registry_relay::rhai_worker::SourceCall, + ) -> std::result::Result< + registry_relay::rhai_worker::SourceResponse, + registry_relay::rhai_worker::HostFailure, + > { + Ok(registry_relay::rhai_worker::SourceResponse { + status: 200, + body: Value::Object(Map::new()), + headers: BTreeMap::new(), + }) + } +} + +fn platform_call_budget_result( + loaded: &LoadedRegistryProject, + compiled: &CompiledProject, + worker_program: &Path, +) -> Result> { + use registry_relay::rhai_worker::{WorkerError, WorkerLimits, WorkerProcess, WorkerRequest}; + + let authored_script_call_bounds = loaded + .integrations + .iter() + .filter_map(|(alias, integration)| { + matches!( + integration.document.capability, + CapabilityDeclaration::Script { .. } + ) + .then_some((alias.clone(), u32::from(integration.document.bounds.calls))) + }) + .collect::>(); + if authored_script_call_bounds.is_empty() { + return Ok(None); + } + let compiled_script_call_bounds = compiled + .relay_private + .iter() + .filter(|(path, _)| path.to_string_lossy().contains("private-bindings")) + .filter_map(|(_, bytes)| serde_json::from_slice::(bytes).ok()) + .filter_map(|binding| { + let source_instance = binding.get("source_instance")?.as_str()?.to_owned(); + let call_bound = binding + .pointer("/capabilities/script/max_calls") + .and_then(Value::as_u64) + .and_then(|value| u32::try_from(value).ok())?; + Some((source_instance, call_bound)) + }) + .fold( + BTreeMap::>::new(), + |mut bounds, (source_instance, call_bound)| { + bounds + .entry(source_instance) + .or_default() + .insert(call_bound); + bounds + }, + ); + if !compiled_script_call_bounds_match( + &authored_script_call_bounds, + &compiled_script_call_bounds, + ) { + bail!("compiled private bindings did not preserve every authored Script limits.calls"); } + let runtime = tokio::runtime::Builder::new_current_thread() + .enable_all() + .build() + .context("failed to build the generated call-budget fixture runtime")?; + let all_bounds_enforced = authored_script_call_bounds + .values() + .copied() + .collect::>() + .into_iter() + .all(|compiled_call_bound| { + let source_calls = (0..=compiled_call_bound) + .map(|index| format!("source.get(\"/__registry_call_budget_{index}\");")) + .collect::(); + let script = format!("fn consult(ctx) {{ {source_calls} result.no_match() }}"); + let request = WorkerRequest::v1( + &script, + "consult", + WorkerLimits { + wall_time_ms: 5_000, + max_source_calls: compiled_call_bound, + ..WorkerLimits::default() + }, + ); + matches!( + runtime.block_on( + WorkerProcess::with_program(worker_program) + .evaluate_with_host(&request, &mut CallBudgetCoverageHost), + ), + Err(WorkerError::BudgetExceeded) + ) + }); + Ok(Some(if all_bounds_enforced { + FixtureSafeCode::SourceCallBudgetExceeded + } else { + FixtureSafeCode::RedactedUnclassifiedError + })) +} + +fn compiled_script_call_bounds_match( + authored: &BTreeMap, + compiled: &BTreeMap>, +) -> bool { + authored.iter().all(|(alias, authored_bound)| { + compiled.get(&format!("{alias}-source")) == Some(&BTreeSet::from([*authored_bound])) + }) } fn execute_fixture<'a>( @@ -1709,73 +3200,26 @@ mod fixture_interface_tests { use super::*; fn rhai_project() -> PathBuf { - Path::new(env!("CARGO_MANIFEST_DIR")) - .join("tests/fixtures/project-authoring/dhis2-script") - } - - fn compiled_project( - loaded: &LoadedRegistryProject, - ) -> Result<( - CompiledProject, - registry_relay::offline_fixture::OfflineRelayFixture, - )> { - let environment = offline_fixture_environment(loaded)?; - let compiled = - compile_project_for_environment(loaded, "offline-fixture", &environment, None)?; - let relay_config = compiled - .relay_private - .get(Path::new("config/relay.yaml")) - .ok_or_else(|| anyhow!("generated Relay config is absent"))?; - let fixture = compile_generated_relay_fixture(relay_config, &compiled.relay_private)?; - Ok((compiled, fixture)) + Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/fixtures/project-authoring/dhis2-script") } #[test] - fn trace_is_deterministic_material_and_value_free() { - let loaded = load_registry_project(&rhai_project(), None).expect("Rhai project loads"); - let (compiled, relay_fixture) = compiled_project(&loaded).expect("Rhai project compiles"); - let (_, fixture) = loaded.integrations["health-record"] - .fixtures - .iter() - .find(|(_, fixture)| fixture.name == "complete-child-health-evidence") - .expect("match fixture exists"); - let input = offline_fixture_input(fixture).expect("fixture input is valid"); - let interactions = - offline_fixture_interactions(fixture).expect("fixture interactions are valid"); - let mut ordinary_trace = Vec::new(); - let ordinary = execute_offline_profiles( - &compiled, - &relay_fixture, - "health-record", - input.clone(), - interactions.clone(), - false, - &mut ordinary_trace, - ) - .expect("ordinary fixture passes"); - assert_eq!(ordinary.calls, ["script-source-call"]); - assert!(ordinary_trace.is_empty()); - - let mut traced_calls = Vec::new(); - let traced = execute_offline_profiles( - &compiled, - &relay_fixture, - "health-record", - input, - interactions, - true, - &mut traced_calls, - ) - .expect("traced fixture passes"); - assert_eq!(traced.calls, traced_calls); - assert_eq!(traced_calls.len(), 1); - assert_eq!( - traced_calls[0], - "call=1 operation=script-source-call method=GET path=/api/tracker/trackedEntities/* query=[fields,includeDeleted] headers=[] body=none" - ); - for sensitive in ["A0000000001", "Nia", "REF-0001"] { - assert!(!traced_calls[0].contains(sensitive)); - } + fn compiled_call_budget_evidence_requires_every_script_integration_bound() { + let authored = BTreeMap::from([("first".to_owned(), 1_u32), ("second".to_owned(), 3_u32)]); + let complete = BTreeMap::from([ + ("first-source".to_owned(), BTreeSet::from([1_u32])), + ("second-source".to_owned(), BTreeSet::from([3_u32])), + ]); + assert!(compiled_script_call_bounds_match(&authored, &complete)); + + let missing = BTreeMap::from([("first-source".to_owned(), BTreeSet::from([1_u32]))]); + assert!(!compiled_script_call_bounds_match(&authored, &missing)); + + let wrong = BTreeMap::from([ + ("first-source".to_owned(), BTreeSet::from([1_u32])), + ("second-source".to_owned(), BTreeSet::from([1_u32])), + ]); + assert!(!compiled_script_call_bounds_match(&authored, &wrong)); } #[test] diff --git a/crates/registryctl/src/project_authoring/knowledge.rs b/crates/registryctl/src/project_authoring/knowledge.rs new file mode 100644 index 000000000..d7feefa1e --- /dev/null +++ b/crates/registryctl/src/project_authoring/knowledge.rs @@ -0,0 +1,897 @@ +// SPDX-License-Identifier: Apache-2.0 +//! Typed, deterministic knowledge attached to the published project-authoring schemas. +//! +//! This module deliberately does not interpret JSON Schema validation keywords. The schema is +//! the validation authority; `x-registry-field` only selects documentation, ownership, review, +//! migration, and redaction knowledge from the closed catalog. + +use std::collections::{BTreeMap, BTreeSet}; +use std::fmt; + +use serde::{Deserialize, Serialize}; +use serde_json::Value; + +pub const FIELD_ANNOTATION_KEY: &str = "x-registry-field"; +const FIELD_KNOWLEDGE_COVERAGE: &str = + include_str!("../../schemas/project-authoring/parity-coverage.json"); +const PROJECT_SCHEMA: &str = include_str!("../../schemas/project-authoring/project.schema.json"); +const ENVIRONMENT_SCHEMA: &str = + include_str!("../../schemas/project-authoring/environment.schema.json"); +const INTEGRATION_SCHEMA: &str = + include_str!("../../schemas/project-authoring/integration.schema.json"); +const FIXTURE_SCHEMA: &str = include_str!("../../schemas/project-authoring/fixture.schema.json"); +const ENTITY_SCHEMA: &str = include_str!("../../schemas/project-authoring/entity.schema.json"); + +#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum SchemaKind { + Project, + Environment, + Integration, + Fixture, + Entity, +} + +impl fmt::Display for SchemaKind { + fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result { + formatter.write_str(match self { + Self::Project => "project", + Self::Environment => "environment", + Self::Integration => "integration", + Self::Fixture => "fixture", + Self::Entity => "entity", + }) + } +} + +#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum FieldPathKind { + Root, + Property, + MapKey, + MapValue, + ArrayItem, + Branch, +} + +#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum SemanticOwner { + AuthoringContract, + DeploymentSecurity, + IntegrationContract, + FixtureHarness, + EntityContract, + RelayRuntime, + NotaryRuntime, +} + +#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)] +#[serde(rename_all = "snake_case")] +// The suffix is part of the published ownership vocabulary and keeps these +// roles distinct from product and semantic owners. +#[allow(clippy::enum_variant_names)] +pub enum HumanOwner { + RegistryMaintainers, + SecurityMaintainers, + IntegrationMaintainers, + TestMaintainers, + DataModelMaintainers, + RelayMaintainers, + NotaryMaintainers, +} + +#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum Sensitivity { + Public, + Internal, + Sensitive, + SecretReference, + SecretValue, + RedactedFixture, + Structural, +} + +impl Sensitivity { + /// Returns whether a classifier-safe value may enter a value-bearing report. + /// + /// Public values are reportable without an extra semantic decision. Internal and structural + /// values require explicit semantic approval from the producer. Approval can never override + /// sensitive, secret, or fixture-redaction classifications. Generated field-reference + /// documentation consumes schemas and this knowledge index, never country configuration + /// values. + pub const fn value_is_reportable(self, semantic_approved: bool) -> bool { + match self { + Self::Public => true, + Self::Internal | Self::Structural => semantic_approved, + Self::Sensitive | Self::SecretReference | Self::SecretValue | Self::RedactedFixture => { + false + } + } + } +} + +#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum Product { + Registryctl, + Relay, + Notary, + Editor, + Docs, +} + +#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum Availability { + Published, +} + +#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum Stability { + Experimental, + Stable, +} + +#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum Migration { + RegenerateEditorSchemas, + RebuildProject, + CoordinateDeployment, + UpdateFixtures, +} + +#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum Consumer { + RegistryctlAuthoring, + RegistryRelay, + RegistryNotary, + EditorTooling, + DocsGenerator, +} + +#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum GeneratedArtifact { + EditorSchemas, + ProjectBuild, + RelayConfig, + NotaryConfig, + FixtureReport, + FieldReference, +} + +#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum ReviewClass { + Contract, + Security, + Privacy, + Relay, + Notary, + Compatibility, + Documentation, + Testing, +} + +#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum SemanticRule { + KnowledgeOnly, + GeneratedDocsNeverLoadCountryValues, + SecretNeverReportable, + SyntheticFixtureValueRedacted, + SensitiveOperationalMetadata, + ArbitraryMapKeysNotFixedProperties, + ArrayItemsShareElementContract, + BranchHasNoAuthoredValue, +} + +#[derive(Clone, Debug, Deserialize)] +#[serde(deny_unknown_fields)] +pub struct FieldKnowledgeCatalog { + pub version: u8, + pub defaults: FieldKnowledgeDefaults, + pub schema_domains: Vec, + pub classifications: Vec, +} + +#[derive(Clone, Debug, Deserialize)] +#[serde(deny_unknown_fields)] +pub struct FieldKnowledgeDefaults { + pub introduced_in: String, + pub availability: Availability, + pub stability: Stability, + pub semantic_rules: Vec, +} + +#[derive(Clone, Debug, Deserialize)] +#[serde(deny_unknown_fields)] +pub struct SchemaDomain { + pub schema: SchemaKind, + pub semantic_owner: SemanticOwner, + pub human_owner: HumanOwner, + pub products: Vec, + pub migration: Migration, + pub consumers: Vec, + pub generated_artifacts: Vec, + pub review_classes: Vec, +} + +#[derive(Clone, Debug, Deserialize)] +#[serde(deny_unknown_fields)] +pub struct FieldClassification { + pub id: String, + pub path_kind: FieldPathKind, + pub sensitivity: Sensitivity, + pub review_classes: Vec, + pub semantic_rules: Vec, +} + +#[derive(Clone, Debug, Eq, PartialEq)] +pub struct FieldKnowledge { + pub path_kind: FieldPathKind, + pub semantic_owner: SemanticOwner, + pub human_owner: HumanOwner, + pub sensitivity: Sensitivity, + pub products: Vec, + pub introduced_in: String, + pub availability: Availability, + pub stability: Stability, + pub migration: Migration, + pub consumers: Vec, + pub generated_artifacts: Vec, + pub review_classes: Vec, + pub semantic_rules: Vec, +} + +#[derive(Clone, Debug, Eq, Ord, PartialEq, PartialOrd)] +pub struct FieldPath { + pub schema: SchemaKind, + /// RFC 6901 pointer to the annotated schema node. The empty string identifies the root. + pub pointer: String, +} + +impl fmt::Display for FieldPath { + fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result { + write!(formatter, "{}#{}", self.schema, self.pointer) + } +} + +#[derive(Debug)] +pub struct PublishedSchema<'a> { + pub kind: SchemaKind, + pub document: &'a Value, +} + +#[derive(Clone, Debug, Default)] +pub struct FieldKnowledgeIndex { + by_path: BTreeMap, + references: BTreeMap, +} + +impl FieldKnowledgeIndex { + pub fn by_path(&self) -> &BTreeMap { + &self.by_path + } + + pub fn references(&self) -> &BTreeMap { + &self.references + } + + pub fn coverage_by_schema(&self) -> BTreeMap { + let mut counts = BTreeMap::new(); + for path in self.by_path.keys() { + *counts.entry(path.schema).or_default() += 1; + } + counts + } + + pub fn coverage_by_path_kind(&self) -> BTreeMap { + let mut counts = BTreeMap::new(); + for knowledge in self.by_path.values() { + *counts.entry(knowledge.path_kind).or_default() += 1; + } + counts + } + + pub fn coverage_by_sensitivity(&self) -> BTreeMap { + let mut counts = BTreeMap::new(); + for knowledge in self.by_path.values() { + *counts.entry(knowledge.sensitivity).or_default() += 1; + } + counts + } +} + +#[derive(Clone, Debug, Eq, PartialEq)] +pub struct FieldKnowledgeError(String); + +impl fmt::Display for FieldKnowledgeError { + fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result { + formatter.write_str(&self.0) + } +} + +impl std::error::Error for FieldKnowledgeError {} + +fn knowledge_error(message: impl Into) -> FieldKnowledgeError { + FieldKnowledgeError(message.into()) +} + +/// Builds the deterministic field-knowledge index and fails closed on any catalog, annotation, +/// path, or local-reference inconsistency. +pub fn index_published_field_knowledge( + catalog: &FieldKnowledgeCatalog, + schemas: &[PublishedSchema<'_>], +) -> Result { + if catalog.version != 1 { + return Err(knowledge_error(format!( + "unsupported field-knowledge catalog version {}", + catalog.version + ))); + } + validate_introduced_in(&catalog.defaults.introduced_in)?; + if !catalog + .defaults + .semantic_rules + .contains(&SemanticRule::KnowledgeOnly) + { + return Err(knowledge_error( + "field-knowledge defaults must state that knowledge is not validation authority", + )); + } + if !catalog + .defaults + .semantic_rules + .contains(&SemanticRule::GeneratedDocsNeverLoadCountryValues) + { + return Err(knowledge_error( + "field-knowledge defaults must prohibit generated docs from loading country values", + )); + } + + let domains = unique_domains(&catalog.schema_domains)?; + let classifications = unique_classifications(&catalog.classifications)?; + let mut index = FieldKnowledgeIndex::default(); + let mut schema_kinds = BTreeSet::new(); + let mut used_classifications = BTreeSet::new(); + + for schema in schemas { + if !schema_kinds.insert(schema.kind) { + return Err(knowledge_error(format!( + "duplicate published schema kind: {}", + schema.kind + ))); + } + let domain = domains.get(&schema.kind).ok_or_else(|| { + knowledge_error(format!( + "published {} schema has no field-knowledge domain", + schema.kind + )) + })?; + validate_references(schema, &mut index.references)?; + walk_schema(schema.document, "", &mut |node, pointer| { + let path = FieldPath { + schema: schema.kind, + pointer: pointer.to_owned(), + }; + let expected_kind = published_path_kind(pointer); + let annotation = node.get(FIELD_ANNOTATION_KEY); + + if let Some(object) = node.as_object() { + if let Some(key) = object.keys().find(|key| { + key.starts_with(FIELD_ANNOTATION_KEY) && key.as_str() != FIELD_ANNOTATION_KEY + }) { + return Err(knowledge_error(format!( + "{path} uses unknown field annotation keyword {key}" + ))); + } + } + + match (expected_kind, annotation) { + (None, None) => Ok(()), + (None, Some(_)) => Err(knowledge_error(format!( + "{path} annotates a node that is not a published field, map key/value, array item, or branch" + ))), + (Some(kind), None) => Err(knowledge_error(format!( + "{path} is a published {kind:?} path without {FIELD_ANNOTATION_KEY}" + ))), + (Some(kind), Some(annotation)) => { + let classification_id = annotation.as_str().ok_or_else(|| { + knowledge_error(format!( + "{path} {FIELD_ANNOTATION_KEY} must be a classification string" + )) + })?; + let classification = + classifications.get(classification_id).ok_or_else(|| { + knowledge_error(format!( + "{path} uses unknown field classification {classification_id:?}" + )) + })?; + if classification.path_kind != kind { + return Err(knowledge_error(format!( + "{path} is {kind:?} but classification {classification_id:?} is {:?}", + classification.path_kind + ))); + } + validate_classification_rules(path.clone(), classification)?; + used_classifications.insert(classification_id.to_owned()); + let knowledge = + resolve_knowledge(&catalog.defaults, domain, classification); + if index.by_path.insert(path.clone(), knowledge).is_some() { + return Err(knowledge_error(format!( + "duplicate field-knowledge path: {path}" + ))); + } + Ok(()) + } + } + })?; + } + + let domain_kinds = domains.keys().copied().collect::>(); + if schema_kinds != domain_kinds { + return Err(knowledge_error(format!( + "field-knowledge domains and published schemas differ: schemas={schema_kinds:?}, domains={domain_kinds:?}" + ))); + } + let classification_ids = classifications + .keys() + .map(|id| (*id).to_owned()) + .collect::>(); + if used_classifications != classification_ids { + return Err(knowledge_error(format!( + "field classifications must be exact and used: used={used_classifications:?}, catalog={classification_ids:?}" + ))); + } + Ok(index) +} + +/// Parses the embedded release assets and returns the exact index used by report and docs +/// producers. No project or country configuration file is opened by this function. +pub fn published_field_knowledge_index() -> Result { + #[derive(Deserialize)] + struct CoverageAsset { + field_knowledge: FieldKnowledgeCatalog, + } + + let coverage: CoverageAsset = serde_json::from_str(FIELD_KNOWLEDGE_COVERAGE) + .map_err(|error| knowledge_error(format!("embedded field-knowledge catalog: {error}")))?; + let documents = [ + (SchemaKind::Project, PROJECT_SCHEMA), + (SchemaKind::Environment, ENVIRONMENT_SCHEMA), + (SchemaKind::Integration, INTEGRATION_SCHEMA), + (SchemaKind::Fixture, FIXTURE_SCHEMA), + (SchemaKind::Entity, ENTITY_SCHEMA), + ] + .into_iter() + .map(|(kind, document)| { + serde_json::from_str(document) + .map(|document| (kind, document)) + .map_err(|error| knowledge_error(format!("embedded {kind} authoring schema: {error}"))) + }) + .collect::, _>>()?; + let schemas = documents + .iter() + .map(|(kind, document)| PublishedSchema { + kind: *kind, + document, + }) + .collect::>(); + index_published_field_knowledge(&coverage.field_knowledge, &schemas) +} + +/// Returns canonical schema locations reachable from the document root, following only safe local +/// references. Definitions are not treated as authored fields merely because they are declared; +/// they become reachable through a published `$ref`. +pub fn reachable_published_field_paths( + schema: &PublishedSchema<'_>, +) -> Result, FieldKnowledgeError> { + let mut paths = BTreeSet::new(); + let mut visited = BTreeSet::new(); + walk_reachable_schema(schema, schema.document, "", &mut visited, &mut paths)?; + Ok(paths) +} + +fn walk_reachable_schema( + schema: &PublishedSchema<'_>, + node: &Value, + pointer: &str, + visited: &mut BTreeSet, + paths: &mut BTreeSet, +) -> Result<(), FieldKnowledgeError> { + if !visited.insert(pointer.to_owned()) { + return Ok(()); + } + if published_path_kind(pointer).is_some() { + paths.insert(FieldPath { + schema: schema.kind, + pointer: pointer.to_owned(), + }); + } + let Some(object) = node.as_object() else { + return Ok(()); + }; + if let Some(reference) = object.get("$ref") { + let reference = reference.as_str().ok_or_else(|| { + knowledge_error(format!("{}#{pointer} has a non-string $ref", schema.kind)) + })?; + let target_pointer = reference.strip_prefix('#').ok_or_else(|| { + knowledge_error(format!( + "{}#{pointer} uses external $ref {reference:?}", + schema.kind + )) + })?; + let target = schema.document.pointer(target_pointer).ok_or_else(|| { + knowledge_error(format!( + "{}#{pointer} has unresolved local $ref {reference:?}", + schema.kind + )) + })?; + walk_reachable_schema(schema, target, target_pointer, visited, paths)?; + } + for container in ["properties", "dependentSchemas"] { + if let Some(children) = object.get(container).and_then(Value::as_object) { + for (name, child) in children { + let child_pointer = + format!("{pointer}/{container}/{}", escape_pointer_segment(name)); + walk_reachable_schema(schema, child, &child_pointer, visited, paths)?; + } + } + } + for keyword in [ + "additionalProperties", + "contains", + "else", + "if", + "items", + "not", + "propertyNames", + "then", + ] { + if let Some(child) = object.get(keyword).filter(|child| child.is_object()) { + let child_pointer = format!("{pointer}/{keyword}"); + walk_reachable_schema(schema, child, &child_pointer, visited, paths)?; + } + } + for keyword in ["allOf", "anyOf", "oneOf", "prefixItems"] { + if let Some(children) = object.get(keyword).and_then(Value::as_array) { + for (index, child) in children.iter().enumerate() { + let child_pointer = format!("{pointer}/{keyword}/{index}"); + walk_reachable_schema(schema, child, &child_pointer, visited, paths)?; + } + } + } + Ok(()) +} + +fn unique_domains( + domains: &[SchemaDomain], +) -> Result, FieldKnowledgeError> { + let mut indexed = BTreeMap::new(); + for domain in domains { + if domain.products.is_empty() + || domain.consumers.is_empty() + || domain.generated_artifacts.is_empty() + || domain.review_classes.is_empty() + { + return Err(knowledge_error(format!( + "{} field-knowledge domain has an empty required knowledge set", + domain.schema + ))); + } + if indexed.insert(domain.schema, domain).is_some() { + return Err(knowledge_error(format!( + "duplicate field-knowledge domain for {}", + domain.schema + ))); + } + } + Ok(indexed) +} + +fn unique_classifications( + classifications: &[FieldClassification], +) -> Result, FieldKnowledgeError> { + let mut indexed = BTreeMap::new(); + for classification in classifications { + if classification.id.is_empty() + || classification.review_classes.is_empty() + || classification.semantic_rules.is_empty() + { + return Err(knowledge_error( + "field classification id, review_classes, and semantic_rules are required", + )); + } + if indexed + .insert(classification.id.as_str(), classification) + .is_some() + { + return Err(knowledge_error(format!( + "duplicate field classification: {}", + classification.id + ))); + } + } + Ok(indexed) +} + +fn validate_introduced_in(version: &str) -> Result<(), FieldKnowledgeError> { + let parts = version.split('.').collect::>(); + if parts.len() != 3 + || parts + .iter() + .any(|part| part.is_empty() || !part.bytes().all(|byte| byte.is_ascii_digit())) + { + return Err(knowledge_error(format!( + "introduced_in must be a numeric major.minor.patch version, got {version:?}" + ))); + } + Ok(()) +} + +fn validate_classification_rules( + path: FieldPath, + classification: &FieldClassification, +) -> Result<(), FieldKnowledgeError> { + let rules = classification + .semantic_rules + .iter() + .copied() + .collect::>(); + let required = match classification.path_kind { + FieldPathKind::MapKey | FieldPathKind::MapValue => { + Some(SemanticRule::ArbitraryMapKeysNotFixedProperties) + } + FieldPathKind::ArrayItem => Some(SemanticRule::ArrayItemsShareElementContract), + FieldPathKind::Branch => Some(SemanticRule::BranchHasNoAuthoredValue), + FieldPathKind::Root | FieldPathKind::Property => None, + }; + if required.is_some_and(|rule| !rules.contains(&rule)) { + return Err(knowledge_error(format!( + "{path} classification is missing its path-kind semantic rule" + ))); + } + let sensitivity_rule = match classification.sensitivity { + Sensitivity::SecretReference | Sensitivity::SecretValue => { + Some(SemanticRule::SecretNeverReportable) + } + Sensitivity::RedactedFixture => Some(SemanticRule::SyntheticFixtureValueRedacted), + Sensitivity::Sensitive => Some(SemanticRule::SensitiveOperationalMetadata), + Sensitivity::Public | Sensitivity::Internal | Sensitivity::Structural => None, + }; + if sensitivity_rule.is_some_and(|rule| !rules.contains(&rule)) { + return Err(knowledge_error(format!( + "{path} classification is missing its sensitivity semantic rule" + ))); + } + Ok(()) +} + +fn resolve_knowledge( + defaults: &FieldKnowledgeDefaults, + domain: &SchemaDomain, + classification: &FieldClassification, +) -> FieldKnowledge { + let mut review_classes = domain + .review_classes + .iter() + .chain(&classification.review_classes) + .copied() + .collect::>() + .into_iter() + .collect::>(); + review_classes.sort(); + let mut semantic_rules = defaults + .semantic_rules + .iter() + .chain(&classification.semantic_rules) + .copied() + .collect::>() + .into_iter() + .collect::>(); + semantic_rules.sort(); + FieldKnowledge { + path_kind: classification.path_kind, + semantic_owner: domain.semantic_owner, + human_owner: domain.human_owner, + sensitivity: classification.sensitivity, + products: sorted_unique(&domain.products), + introduced_in: defaults.introduced_in.clone(), + availability: defaults.availability, + stability: defaults.stability, + migration: domain.migration, + consumers: sorted_unique(&domain.consumers), + generated_artifacts: sorted_unique(&domain.generated_artifacts), + review_classes, + semantic_rules, + } +} + +fn sorted_unique(values: &[T]) -> Vec { + values + .iter() + .copied() + .collect::>() + .into_iter() + .collect() +} + +fn published_path_kind(pointer: &str) -> Option { + if pointer.is_empty() { + return Some(FieldPathKind::Root); + } + let segments = pointer.split('/').skip(1).collect::>(); + if segments.len() >= 2 && segments[segments.len() - 2] == "properties" { + return Some(FieldPathKind::Property); + } + match segments.last().copied() { + Some("propertyNames") => Some(FieldPathKind::MapKey), + Some("additionalProperties") => Some(FieldPathKind::MapValue), + Some("items") => Some(FieldPathKind::ArrayItem), + Some("if" | "then" | "else" | "not") => Some(FieldPathKind::Branch), + Some(_) if segments.len() >= 2 => match segments[segments.len() - 2] { + "prefixItems" => Some(FieldPathKind::ArrayItem), + "allOf" | "anyOf" | "oneOf" => Some(FieldPathKind::Branch), + _ => None, + }, + _ => None, + } +} + +fn validate_references( + schema: &PublishedSchema<'_>, + references: &mut BTreeMap, +) -> Result<(), FieldKnowledgeError> { + let mut local = BTreeMap::::new(); + walk_schema(schema.document, "", &mut |node, pointer| { + let Some(reference) = node.get("$ref") else { + return Ok(()); + }; + let reference = reference.as_str().ok_or_else(|| { + knowledge_error(format!("{}#{pointer} has a non-string $ref", schema.kind)) + })?; + let target_pointer = reference.strip_prefix('#').ok_or_else(|| { + knowledge_error(format!( + "{}#{pointer} uses external $ref {reference:?}; published authoring schemas permit local references only", + schema.kind + )) + })?; + if !target_pointer.is_empty() && !target_pointer.starts_with('/') { + return Err(knowledge_error(format!( + "{}#{pointer} has malformed local $ref {reference:?}", + schema.kind + ))); + } + let target = schema.document.pointer(target_pointer).ok_or_else(|| { + knowledge_error(format!( + "{}#{pointer} has unresolved local $ref {reference:?}", + schema.kind + )) + })?; + if !target.is_object() { + return Err(knowledge_error(format!( + "{}#{pointer} local $ref {reference:?} does not resolve to a schema object", + schema.kind + ))); + } + if local + .insert(pointer.to_owned(), target_pointer.to_owned()) + .is_some() + { + return Err(knowledge_error(format!( + "{}#{pointer} records a duplicate local reference path", + schema.kind + ))); + } + let from = FieldPath { + schema: schema.kind, + pointer: pointer.to_owned(), + }; + let to = FieldPath { + schema: schema.kind, + pointer: target_pointer.to_owned(), + }; + if references.insert(from.clone(), to).is_some() { + return Err(knowledge_error(format!( + "duplicate resolved reference path: {from}" + ))); + } + Ok(()) + })?; + + for start in local.keys() { + let mut seen = BTreeSet::new(); + let mut current = start.as_str(); + while let Some(target) = local.get(current) { + if !seen.insert(current.to_owned()) { + return Err(knowledge_error(format!( + "{}#{start} participates in a cyclic direct $ref chain", + schema.kind + ))); + } + current = target; + } + } + Ok(()) +} + +fn escape_pointer_segment(segment: &str) -> String { + segment.replace('~', "~0").replace('/', "~1") +} + +fn walk_schema( + schema: &Value, + pointer: &str, + visit: &mut impl FnMut(&Value, &str) -> Result<(), FieldKnowledgeError>, +) -> Result<(), FieldKnowledgeError> { + visit(schema, pointer)?; + let Some(object) = schema.as_object() else { + return Ok(()); + }; + for container in ["$defs", "properties", "dependentSchemas"] { + if let Some(children) = object.get(container).and_then(Value::as_object) { + for (name, child) in children { + walk_schema( + child, + &format!("{pointer}/{container}/{}", escape_pointer_segment(name)), + visit, + )?; + } + } + } + for keyword in [ + "additionalProperties", + "contains", + "else", + "if", + "items", + "not", + "propertyNames", + "then", + ] { + if object.get(keyword).is_some_and(Value::is_object) { + walk_schema(&object[keyword], &format!("{pointer}/{keyword}"), visit)?; + } + } + for keyword in ["allOf", "anyOf", "oneOf", "prefixItems"] { + if let Some(children) = object.get(keyword).and_then(Value::as_array) { + for (index, child) in children.iter().enumerate() { + walk_schema(child, &format!("{pointer}/{keyword}/{index}"), visit)?; + } + } + } + Ok(()) +} + +#[cfg(test)] +mod tests { + use super::Sensitivity; + + #[test] + fn reportability_requires_both_safe_sensitivity_and_semantic_approval() { + assert!(Sensitivity::Public.value_is_reportable(false)); + assert!(Sensitivity::Public.value_is_reportable(true)); + + for sensitivity in [Sensitivity::Internal, Sensitivity::Structural] { + assert!(!sensitivity.value_is_reportable(false)); + assert!(sensitivity.value_is_reportable(true)); + } + + for sensitivity in [ + Sensitivity::Sensitive, + Sensitivity::SecretReference, + Sensitivity::SecretValue, + Sensitivity::RedactedFixture, + ] { + assert!(!sensitivity.value_is_reportable(false)); + assert!(!sensitivity.value_is_reportable(true)); + } + } +} diff --git a/crates/registryctl/src/project_authoring/migration.rs b/crates/registryctl/src/project_authoring/migration.rs new file mode 100644 index 000000000..cb869f9c2 --- /dev/null +++ b/crates/registryctl/src/project_authoring/migration.rs @@ -0,0 +1,3039 @@ +// SPDX-License-Identifier: Apache-2.0 +//! Strict, value-free project authoring migration report contract. +//! +//! [`build_project_migration_report`] is a pure decision boundary. The command +//! adapter detects authoring contract versions, applies a reviewed migration +//! catalog in memory, and supplies only closed classifications to that +//! builder. The report cannot carry authored values, country identifiers, +//! file-system paths, secret names, hashes, or generated product inputs. With +//! explicit authority, the adapter may atomically emit a separate review +//! candidate; neither the builder nor the adapter can apply a migration or +//! overwrite an authored project file. + +use std::collections::{BTreeMap, BTreeSet}; +use std::fs; +use std::io::ErrorKind; +use std::path::{Path, PathBuf}; + +use anyhow::{anyhow, bail, Context, Result}; +use serde::{de, Deserialize, Deserializer, Serialize}; +use serde_json::Value; + +pub const PROJECT_MIGRATION_SCHEMA_VERSION_V1: &str = "registry.project.migration.v1"; +pub(crate) const MAX_MIGRATION_CHANGES: usize = 256; +pub(crate) const MAX_MIGRATION_DECISIONS: usize = 64; +pub(crate) const MAX_MIGRATION_DIAGNOSTICS: usize = 32; +pub(crate) const MAX_MIGRATION_AFFECTED_COUNT: u32 = 1_000_000; +pub(crate) const MAX_AUTHORING_VERSION: u32 = 65_535; + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +pub enum ProjectMigrationSchemaVersion { + #[serde(rename = "registry.project.migration.v1")] + V1, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum MigrationEvidenceGrade { + OfflineStatic, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum MigrationExecution { + NotPerformed, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum MigrationDisposition { + NoMigrationRequired, + ReviewRequired, + CheckedSafe, + ReadyForExplicitWrite, + Blocked, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum AuthoringContract { + Project, + Integration, + Entity, + Fixture, + Environment, +} + +impl AuthoringContract { + const ALL: [Self; 5] = [ + Self::Project, + Self::Integration, + Self::Entity, + Self::Fixture, + Self::Environment, + ]; +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq)] +pub struct AuthoringVersionSet { + pub project: Option, + pub integration: Option, + pub entity: Option, + pub fixture: Option, + pub environment: Option, +} + +impl AuthoringVersionSet { + const fn get(self, contract: AuthoringContract) -> Option { + match contract { + AuthoringContract::Project => self.project, + AuthoringContract::Integration => self.integration, + AuthoringContract::Entity => self.entity, + AuthoringContract::Fixture => self.fixture, + AuthoringContract::Environment => self.environment, + } + } + + fn from_transitions(transitions: &[MigrationVersionTransition], source: bool) -> Self { + let version = |contract| { + transitions + .iter() + .find(|transition| transition.contract == contract) + .and_then(|transition| { + if source { + transition.source_version + } else { + transition.target_version + } + }) + }; + Self { + project: version(AuthoringContract::Project), + integration: version(AuthoringContract::Integration), + entity: version(AuthoringContract::Entity), + fixture: version(AuthoringContract::Fixture), + environment: version(AuthoringContract::Environment), + } + } +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum MigrationVersionDirection { + Absent, + Same, + Upgrade, + Downgrade, + AddedContract, + RemovedContract, + UnsupportedTarget, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct MigrationVersionTransition { + pub contract: AuthoringContract, + pub source_version: Option, + pub target_version: Option, + pub direction: MigrationVersionDirection, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum MigrationVersionSupport { + Supported, + Unsupported, + NotEvaluated, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct MigrationVersionSupportAssessment { + pub source: MigrationVersionSupport, + pub target: MigrationVersionSupport, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum MigrationDocument { + Project, + Integration, + Entity, + Fixture, + Environment, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +pub enum MigrationFieldPath { + #[serde(rename = "")] + Root, + #[serde(rename = "/version")] + Version, + #[serde(rename = "/registry")] + ProjectRegistry, + #[serde(rename = "/integrations/*")] + ProjectIntegrations, + #[serde(rename = "/entities/*")] + ProjectEntities, + #[serde(rename = "/services/*")] + ProjectServices, + #[serde(rename = "/services/*/access")] + ServicePolicy, + #[serde(rename = "/services/*/consultations/*")] + Consultation, + #[serde(rename = "/services/*/claims/*")] + Claim, + #[serde(rename = "/services/*/api/attribute_release_profiles/*/subject/input")] + AttributeReleaseSubjectInput, + #[serde(rename = "/services/*/api/attribute_release_profiles/*/response")] + AttributeReleaseResponse, + #[serde(rename = "/services/*/api/attribute_release_profiles/*/response/max_age_seconds")] + AttributeReleaseResponseMaxAge, + #[serde(rename = "/input")] + Input, + #[serde(rename = "/capability")] + IntegrationCapability, + #[serde(rename = "/outputs/*")] + IntegrationOutputs, + #[serde(rename = "/primary_key")] + EntityPrimaryKey, + #[serde(rename = "/schema")] + EntitySchema, + #[serde(rename = "/materialization")] + EntityMaterialization, + #[serde(rename = "/classification")] + FixtureClassification, + #[serde(rename = "/interactions/*")] + FixtureInteractions, + #[serde(rename = "/expect")] + FixtureExpectation, + #[serde(rename = "/integrations/*/source/origin")] + EnvironmentOrigin, + #[serde(rename = "/integrations/*/source/credential")] + EnvironmentCredentials, + #[serde(rename = "/relay")] + EnvironmentTrust, + #[serde(rename = "/deployment")] + EnvironmentDeployment, + #[serde(rename = "/notary_cel")] + EnvironmentWorkerLimits, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct MigrationFieldAddress { + pub document: MigrationDocument, + pub path: MigrationFieldPath, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd)] +pub enum MigrationField { + ProjectDocument, + ProjectVersion, + ProjectRegistry, + ProjectIntegrations, + ProjectEntities, + ProjectServices, + ServicePolicy, + Consultation, + Claim, + AttributeReleaseSubjectInput, + AttributeReleaseResponse, + AttributeReleaseResponseMaxAge, + IntegrationDocument, + IntegrationVersion, + IntegrationInput, + IntegrationCapability, + IntegrationOutputs, + EntityDocument, + EntityVersion, + EntityPrimaryKey, + EntitySchema, + EntityMaterialization, + FixtureDocument, + FixtureClassification, + FixtureInput, + FixtureInteractions, + FixtureExpectation, + EnvironmentDocument, + EnvironmentVersion, + EnvironmentOrigin, + EnvironmentCredentials, + EnvironmentTrust, + EnvironmentDeployment, + EnvironmentWorkerLimits, +} + +impl MigrationField { + pub const ALL: [Self; 34] = [ + Self::ProjectDocument, + Self::ProjectVersion, + Self::ProjectRegistry, + Self::ProjectIntegrations, + Self::ProjectEntities, + Self::ProjectServices, + Self::ServicePolicy, + Self::Consultation, + Self::Claim, + Self::AttributeReleaseSubjectInput, + Self::AttributeReleaseResponse, + Self::AttributeReleaseResponseMaxAge, + Self::IntegrationDocument, + Self::IntegrationVersion, + Self::IntegrationInput, + Self::IntegrationCapability, + Self::IntegrationOutputs, + Self::EntityDocument, + Self::EntityVersion, + Self::EntityPrimaryKey, + Self::EntitySchema, + Self::EntityMaterialization, + Self::FixtureDocument, + Self::FixtureClassification, + Self::FixtureInput, + Self::FixtureInteractions, + Self::FixtureExpectation, + Self::EnvironmentDocument, + Self::EnvironmentVersion, + Self::EnvironmentOrigin, + Self::EnvironmentCredentials, + Self::EnvironmentTrust, + Self::EnvironmentDeployment, + Self::EnvironmentWorkerLimits, + ]; + + pub const fn address(self) -> MigrationFieldAddress { + use MigrationDocument as Document; + use MigrationFieldPath as Path; + let (document, path) = match self { + Self::ProjectDocument => (Document::Project, Path::Root), + Self::ProjectVersion => (Document::Project, Path::Version), + Self::ProjectRegistry => (Document::Project, Path::ProjectRegistry), + Self::ProjectIntegrations => (Document::Project, Path::ProjectIntegrations), + Self::ProjectEntities => (Document::Project, Path::ProjectEntities), + Self::ProjectServices => (Document::Project, Path::ProjectServices), + Self::ServicePolicy => (Document::Project, Path::ServicePolicy), + Self::Consultation => (Document::Project, Path::Consultation), + Self::Claim => (Document::Project, Path::Claim), + Self::AttributeReleaseSubjectInput => { + (Document::Project, Path::AttributeReleaseSubjectInput) + } + Self::AttributeReleaseResponse => (Document::Project, Path::AttributeReleaseResponse), + Self::AttributeReleaseResponseMaxAge => { + (Document::Project, Path::AttributeReleaseResponseMaxAge) + } + Self::IntegrationDocument => (Document::Integration, Path::Root), + Self::IntegrationVersion => (Document::Integration, Path::Version), + Self::IntegrationInput => (Document::Integration, Path::Input), + Self::IntegrationCapability => (Document::Integration, Path::IntegrationCapability), + Self::IntegrationOutputs => (Document::Integration, Path::IntegrationOutputs), + Self::EntityDocument => (Document::Entity, Path::Root), + Self::EntityVersion => (Document::Entity, Path::Version), + Self::EntityPrimaryKey => (Document::Entity, Path::EntityPrimaryKey), + Self::EntitySchema => (Document::Entity, Path::EntitySchema), + Self::EntityMaterialization => (Document::Entity, Path::EntityMaterialization), + Self::FixtureDocument => (Document::Fixture, Path::Root), + Self::FixtureClassification => (Document::Fixture, Path::FixtureClassification), + Self::FixtureInput => (Document::Fixture, Path::Input), + Self::FixtureInteractions => (Document::Fixture, Path::FixtureInteractions), + Self::FixtureExpectation => (Document::Fixture, Path::FixtureExpectation), + Self::EnvironmentDocument => (Document::Environment, Path::Root), + Self::EnvironmentVersion => (Document::Environment, Path::Version), + Self::EnvironmentOrigin => (Document::Environment, Path::EnvironmentOrigin), + Self::EnvironmentCredentials => (Document::Environment, Path::EnvironmentCredentials), + Self::EnvironmentTrust => (Document::Environment, Path::EnvironmentTrust), + Self::EnvironmentDeployment => (Document::Environment, Path::EnvironmentDeployment), + Self::EnvironmentWorkerLimits => (Document::Environment, Path::EnvironmentWorkerLimits), + }; + MigrationFieldAddress { document, path } + } + + pub fn from_address(address: MigrationFieldAddress) -> Option { + Self::ALL + .into_iter() + .find(|field| field.address() == address) + } + + const fn owner(self) -> MigrationOwner { + match self { + Self::ProjectDocument + | Self::IntegrationDocument + | Self::EntityDocument + | Self::FixtureDocument + | Self::ProjectServices + | Self::ServicePolicy + | Self::Consultation + | Self::Claim + | Self::AttributeReleaseSubjectInput + | Self::AttributeReleaseResponse + | Self::AttributeReleaseResponseMaxAge + | Self::FixtureInput + | Self::FixtureInteractions + | Self::FixtureExpectation => MigrationOwner::CountryAuthor, + Self::EnvironmentDocument + | Self::EnvironmentVersion + | Self::EnvironmentOrigin + | Self::EnvironmentCredentials + | Self::EnvironmentTrust + | Self::EnvironmentDeployment + | Self::EnvironmentWorkerLimits => MigrationOwner::Operator, + _ => MigrationOwner::Registryctl, + } + } + + const fn is_reviewed_retired_attribute_release_field(self) -> bool { + matches!( + self, + Self::AttributeReleaseSubjectInput + | Self::AttributeReleaseResponse + | Self::AttributeReleaseResponseMaxAge + ) + } + + const fn classification(self) -> MigrationFieldClassification { + match self { + Self::EnvironmentCredentials => MigrationFieldClassification::SecretReference, + Self::EnvironmentDocument | Self::EnvironmentOrigin | Self::EnvironmentTrust => { + MigrationFieldClassification::Sensitive + } + Self::FixtureDocument + | Self::FixtureInput + | Self::FixtureInteractions + | Self::FixtureExpectation => MigrationFieldClassification::RedactedFixture, + Self::ProjectVersion + | Self::IntegrationVersion + | Self::EntityVersion + | Self::EnvironmentVersion => MigrationFieldClassification::Public, + Self::ProjectDocument + | Self::IntegrationDocument + | Self::EntityDocument + | Self::ProjectRegistry + | Self::ProjectIntegrations + | Self::ProjectEntities + | Self::IntegrationCapability + | Self::EntityPrimaryKey + | Self::FixtureClassification + | Self::EnvironmentDeployment => MigrationFieldClassification::Structural, + _ => MigrationFieldClassification::Internal, + } + } +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum MigrationOwner { + Registryctl, + CountryAuthor, + Operator, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum MigrationFieldClassification { + Public, + Structural, + Internal, + Sensitive, + SecretReference, + RedactedFixture, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum MigrationOperation { + NormalizeField, + AddField, + RemoveField, + RenameField, + ChangeSemantics, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum MigrationSemanticEffect { + Preserved, + Changed, + Unresolved, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum MigrationSafety { + Safe, + Unsafe, + Unresolved, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd)] +pub enum MigrationReplacementInput { + NotApplicable, + Field(MigrationField), + NoReplacement, + Unresolved, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum MigrationReplacementDisposition { + NotApplicable, + Field, + NoReplacement, + Unresolved, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct MigrationReplacement { + pub disposition: MigrationReplacementDisposition, + pub address: Option, +} + +impl MigrationReplacement { + const fn from_input(input: MigrationReplacementInput) -> Self { + match input { + MigrationReplacementInput::NotApplicable => Self { + disposition: MigrationReplacementDisposition::NotApplicable, + address: None, + }, + MigrationReplacementInput::Field(field) => Self { + disposition: MigrationReplacementDisposition::Field, + address: Some(field.address()), + }, + MigrationReplacementInput::NoReplacement => Self { + disposition: MigrationReplacementDisposition::NoReplacement, + address: None, + }, + MigrationReplacementInput::Unresolved => Self { + disposition: MigrationReplacementDisposition::Unresolved, + address: None, + }, + } + } + + fn to_input(self) -> Result { + match (self.disposition, self.address) { + (MigrationReplacementDisposition::NotApplicable, None) => { + Ok(MigrationReplacementInput::NotApplicable) + } + (MigrationReplacementDisposition::Field, Some(address)) => { + MigrationField::from_address(address) + .map(MigrationReplacementInput::Field) + .ok_or("migration replacement address is not a catalogued field") + } + (MigrationReplacementDisposition::NoReplacement, None) => { + Ok(MigrationReplacementInput::NoReplacement) + } + (MigrationReplacementDisposition::Unresolved, None) => { + Ok(MigrationReplacementInput::Unresolved) + } + _ => Err("migration replacement disposition and address disagree"), + } + } +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd)] +pub struct MigrationChangeInput { + pub field: MigrationField, + pub operation: MigrationOperation, + pub semantic_effect: MigrationSemanticEffect, + pub safety: MigrationSafety, + pub replacement: MigrationReplacementInput, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct MigrationChange { + pub address: MigrationFieldAddress, + pub operation: MigrationOperation, + pub semantic_effect: MigrationSemanticEffect, + pub safety: MigrationSafety, + pub replacement: MigrationReplacement, + pub owner: MigrationOwner, + pub classification: MigrationFieldClassification, +} + +impl MigrationChange { + fn is_compatible_normalization(self) -> bool { + self.semantic_effect == MigrationSemanticEffect::Preserved + && self.safety == MigrationSafety::Safe + } + + fn to_input(self) -> Result { + let field = MigrationField::from_address(self.address) + .ok_or("migration change address is not a catalogued field")?; + if self.owner != field.owner() || self.classification != field.classification() { + return Err("migration field owner or classification disagrees with the catalog"); + } + Ok(MigrationChangeInput { + field, + operation: self.operation, + semantic_effect: self.semantic_effect, + safety: self.safety, + replacement: self.replacement.to_input()?, + }) + } +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum MigrationCompatibility { + NoMigrationRequired, + CompatibleNormalizationOnly, + SemanticReviewRequired, + UnsafeOrUnresolved, + UnsupportedTransition, + CatalogIncomplete, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum MigrationAffectedState { + NotAffected, + Affected, + Unresolved, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct MigrationAffectedCount { + pub state: MigrationAffectedState, + pub count: Option, +} + +impl MigrationAffectedCount { + pub const fn known(count: u32) -> Self { + Self { + state: if count == 0 { + MigrationAffectedState::NotAffected + } else { + MigrationAffectedState::Affected + }, + count: Some(count), + } + } + + pub const fn unresolved() -> Self { + Self { + state: MigrationAffectedState::Unresolved, + count: None, + } + } + + const fn is_affected(self) -> bool { + matches!(self.state, MigrationAffectedState::Affected) + } + + const fn is_unresolved(self) -> bool { + matches!(self.state, MigrationAffectedState::Unresolved) + } +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum MigrationArtifact { + RelayConfig, + RelayEnvironmentContract, + NotaryConfig, + NotaryEnvironmentContract, + ProjectExplanation, + ProjectSemanticImpact, + ProjectFixtureCoverage, + ProjectArtifactManifest, + GeneratedConfigurationReference, + ReleaseReadinessEvidence, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct MigrationAffectedSurfaces { + pub fixtures: MigrationAffectedCount, + pub services: MigrationAffectedCount, + pub consultations: MigrationAffectedCount, + pub claims: MigrationAffectedCount, + pub environments: MigrationAffectedCount, + pub generated_artifacts: Vec, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum MigrationReviewClass { + Authoring, + Compatibility, + Migration, + Fixtures, + Relay, + Notary, + Interoperability, + Privacy, + Security, + Operations, + Documentation, + CountryGovernance, + Release, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum MigrationReviewStatus { + RequiredPending, + Approved, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct MigrationReviewAssessment { + pub class: MigrationReviewClass, + pub status: MigrationReviewStatus, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum MigrationDecisionOwner { + CountryAuthority, + ProjectOperator, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum MigrationDecisionKind { + CountrySemanticIntent, + CountryLegalBasis, + FieldReplacement, + DataMinimization, + ServicePolicy, + ClaimSemantics, + OperatorTrust, + OperatorSecretBinding, + OperatorDeployment, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum MigrationDecisionScope { + Project, + Service, + Consultation, + Claim, + Environment, + GeneratedArtifacts, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct UnresolvedMigrationDecision { + pub owner: MigrationDecisionOwner, + pub kind: MigrationDecisionKind, + pub scope: MigrationDecisionScope, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum MigrationRerunGate { + Schema, + Fixture, + Check, + Build, + GeneratedReference, +} + +impl MigrationRerunGate { + const ALL: [Self; 5] = [ + Self::Schema, + Self::Fixture, + Self::Check, + Self::Build, + Self::GeneratedReference, + ]; +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum MigrationGateStatus { + Passed, + Failed, + NotRun, + NotRequired, + NotApplicable, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq)] +pub struct MigrationGateResults { + pub schema: MigrationGateStatus, + pub fixture: MigrationGateStatus, + pub check: MigrationGateStatus, + pub build: MigrationGateStatus, + pub generated_reference: MigrationGateStatus, +} + +impl MigrationGateResults { + const fn get(self, gate: MigrationRerunGate) -> MigrationGateStatus { + match gate { + MigrationRerunGate::Schema => self.schema, + MigrationRerunGate::Fixture => self.fixture, + MigrationRerunGate::Check => self.check, + MigrationRerunGate::Build => self.build, + MigrationRerunGate::GeneratedReference => self.generated_reference, + } + } + + fn from_assessments(assessments: &[MigrationGateAssessment]) -> Result { + if assessments.len() != MigrationRerunGate::ALL.len() + || assessments + .iter() + .zip(MigrationRerunGate::ALL) + .any(|(assessment, expected)| assessment.gate != expected) + { + return Err( + "migration rerun gates must contain schema, fixture, check, build, and generated reference in canonical order", + ); + } + Ok(Self { + schema: assessments[0].status, + fixture: assessments[1].status, + check: assessments[2].status, + build: assessments[3].status, + generated_reference: assessments[4].status, + }) + } +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct MigrationGateAssessment { + pub gate: MigrationRerunGate, + pub status: MigrationGateStatus, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum MigrationDiagnosticCode { + SourceYamlMalformed, + SourceVersionMissing, + SourceVersionMalformed, + SourceVersionZero, + SourceVersionOutOfBounds, + SourceVersionUnsupported, + SourceVersionsMixed, + TargetVersionOutOfBounds, + TargetVersionUnsupported, + RerunGateFailed, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum MigrationDiagnosticPhase { + SourceInspection, + VersionInspection, + SchemaGate, + FixtureGate, + CheckGate, + BuildGate, + GeneratedReferenceGate, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum MigrationDiagnosticRemediation { + CorrectSourceYaml, + DeclareSupportedVersion, + AlignContractVersions, + SelectSupportedTargetVersion, + InspectCandidateSchema, + RepairFixtures, + ResolveProjectCheck, + ResolveProjectBuild, + RegenerateConfigurationReference, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct MigrationDiagnostic { + pub code: MigrationDiagnosticCode, + pub phase: MigrationDiagnosticPhase, + pub contract: Option, + pub remediation: MigrationDiagnosticRemediation, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum MigrationOutputMode { + CheckOnly, + ReviewablePatch, + SeparateOutputDirectory, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum MigrationWriteAuthority { + NotGranted, + ExplicitCandidateWriteGranted, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum MigrationCandidateArtifact { + None, + ReviewablePatch, + SeparateOutputDirectory, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum MigrationCandidateEligibility { + NotRequested, + EligibleToEmit, + Blocked, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum MigrationAuthoredFilePolicy { + NeverOverwriteAuthoredFiles, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum MigrationApplicationPolicy { + ExplicitOperatorApplyRequired, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum MigrationCandidateEmission { + NotEmitted, + ReviewablePatchCandidateEmitted, + SeparateOutputCandidateEmitted, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq)] +pub struct MigrationOutputRequest { + pub mode: MigrationOutputMode, + pub write_authority: MigrationWriteAuthority, + pub candidate_emission: MigrationCandidateEmission, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct MigrationOutputPlan { + pub mode: MigrationOutputMode, + pub write_authority: MigrationWriteAuthority, + pub candidate_artifact: MigrationCandidateArtifact, + pub candidate_eligibility: MigrationCandidateEligibility, + pub authored_file_policy: MigrationAuthoredFilePolicy, + pub application_policy: MigrationApplicationPolicy, + pub candidate_emission: MigrationCandidateEmission, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum MigrationBlockingReason { + SourceInspectionFailed, + SourceVersionUnsupported, + TargetVersionUnsupported, + VersionSupportNotEvaluated, + DowngradeOrContractRemoval, + MigrationCatalogIncomplete, + UnsafeChange, + UnresolvedChange, + RemovedFieldWithoutReplacement, + AffectedSurfaceUnresolved, + UnresolvedCountryOrOperatorDecision, + RerunGateFailed, + RerunGateNotRun, + ExplicitWriteAuthorityMissing, + WriteAuthorityScopeMismatch, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum MigrationEvidenceLimitation { + OfflineStaticOnly, + MigrationNotPerformed, + CandidateDoesNotApplyMigration, + AuthoredFilesNeverOverwritten, + SecretMaterialNotInspected, + RawAuthoredValuesOmitted, + RuntimeNotEvaluated, + DeploymentNotPerformed, + CountryApprovalNotInferred, +} + +#[derive(Clone, Debug, Eq, PartialEq)] +pub struct ProjectMigrationInput { + pub source_versions: AuthoringVersionSet, + pub target_versions: AuthoringVersionSet, + pub version_support: MigrationVersionSupportAssessment, + pub changes: Vec, + pub affected: MigrationAffectedSurfaces, + pub approved_reviews: Vec, + pub output: MigrationOutputRequest, + pub rerun_gates: MigrationGateResults, + pub diagnostics: Vec, + pub unresolved_decisions: Vec, +} + +#[derive(Clone, Debug, Eq, PartialEq, Serialize)] +#[serde(deny_unknown_fields)] +pub struct ProjectMigrationReportV1 { + pub schema_version: ProjectMigrationSchemaVersion, + pub evidence_grade: MigrationEvidenceGrade, + pub migration_execution: MigrationExecution, + pub disposition: MigrationDisposition, + pub version_support: MigrationVersionSupportAssessment, + pub version_transitions: Vec, + pub compatibility: MigrationCompatibility, + pub compatible_normalizations: Vec, + pub semantic_changes: Vec, + pub affected: MigrationAffectedSurfaces, + pub reviews: Vec, + pub output: MigrationOutputPlan, + pub rerun_gates: Vec, + pub diagnostics: Vec, + pub unresolved_decisions: Vec, + pub blocking_reasons: Vec, + pub evidence_limitations: Vec, +} + +#[derive(Deserialize)] +#[serde(deny_unknown_fields)] +struct ProjectMigrationReportWire { + schema_version: ProjectMigrationSchemaVersion, + evidence_grade: MigrationEvidenceGrade, + migration_execution: MigrationExecution, + disposition: MigrationDisposition, + version_support: MigrationVersionSupportAssessment, + version_transitions: Vec, + compatibility: MigrationCompatibility, + compatible_normalizations: Vec, + semantic_changes: Vec, + affected: MigrationAffectedSurfaces, + reviews: Vec, + output: MigrationOutputPlan, + rerun_gates: Vec, + diagnostics: Vec, + unresolved_decisions: Vec, + blocking_reasons: Vec, + evidence_limitations: Vec, +} + +impl<'de> Deserialize<'de> for ProjectMigrationReportV1 { + fn deserialize(deserializer: D) -> Result + where + D: Deserializer<'de>, + { + let wire = ProjectMigrationReportWire::deserialize(deserializer)?; + let candidate = Self { + schema_version: wire.schema_version, + evidence_grade: wire.evidence_grade, + migration_execution: wire.migration_execution, + disposition: wire.disposition, + version_support: wire.version_support, + version_transitions: wire.version_transitions, + compatibility: wire.compatibility, + compatible_normalizations: wire.compatible_normalizations, + semantic_changes: wire.semantic_changes, + affected: wire.affected, + reviews: wire.reviews, + output: wire.output, + rerun_gates: wire.rerun_gates, + diagnostics: wire.diagnostics, + unresolved_decisions: wire.unresolved_decisions, + blocking_reasons: wire.blocking_reasons, + evidence_limitations: wire.evidence_limitations, + }; + let expected = rebuild_report_from_wire(&candidate).map_err(de::Error::custom)?; + if candidate != expected { + return Err(de::Error::custom( + "migration report decisions do not match its classified migration evidence", + )); + } + Ok(candidate) + } +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq)] +pub enum ProjectMigrationBuildError { + MissingProjectVersion, + InvalidAuthoringVersion, + InvalidVersionSupportEvidence, + InvalidPreMigrationEvidence, + InvalidGateStatus, + TooManyChanges, + InvalidChange, + TooManyAffectedItems, + InvalidAffectedCount, + TooManyReviewApprovals, + ApprovalNotRequired, + TooManyDecisions, + TooManyDiagnostics, + InvalidDiagnostic, + InvalidCandidateEmission, +} + +fn rebuild_report_from_wire( + report: &ProjectMigrationReportV1, +) -> Result { + if report.version_transitions.len() != AuthoringContract::ALL.len() + || report + .version_transitions + .iter() + .zip(AuthoringContract::ALL) + .any(|(transition, expected)| transition.contract != expected) + { + return Err("migration version transitions are not in canonical order"); + } + + let changes = report + .compatible_normalizations + .iter() + .chain(&report.semantic_changes) + .copied() + .map(MigrationChange::to_input) + .collect::, _>>()?; + let approved_reviews = report + .reviews + .iter() + .filter(|review| review.status == MigrationReviewStatus::Approved) + .map(|review| review.class) + .collect::>(); + let output = MigrationOutputRequest { + mode: report.output.mode, + write_authority: report.output.write_authority, + candidate_emission: report.output.candidate_emission, + }; + build_project_migration_report(ProjectMigrationInput { + source_versions: AuthoringVersionSet::from_transitions(&report.version_transitions, true), + target_versions: AuthoringVersionSet::from_transitions(&report.version_transitions, false), + version_support: report.version_support, + changes, + affected: report.affected.clone(), + approved_reviews, + output, + rerun_gates: MigrationGateResults::from_assessments(&report.rerun_gates)?, + diagnostics: report.diagnostics.clone(), + unresolved_decisions: report.unresolved_decisions.clone(), + }) + .map_err(|_| "migration report evidence cannot be rebuilt") +} + +pub fn build_project_migration_report( + input: ProjectMigrationInput, +) -> Result { + validate_versions(input.source_versions)?; + validate_versions(input.target_versions)?; + validate_version_support_evidence( + input.source_versions, + input.target_versions, + input.version_support, + )?; + validate_pre_migration_evidence(&input)?; + if (input.source_versions.project.is_none() + && input.version_support.source == MigrationVersionSupport::Supported) + || (input.target_versions.project.is_none() + && input.version_support.target != MigrationVersionSupport::Unsupported) + { + return Err(ProjectMigrationBuildError::MissingProjectVersion); + } + if input.changes.len() > MAX_MIGRATION_CHANGES { + return Err(ProjectMigrationBuildError::TooManyChanges); + } + if input.unresolved_decisions.len() > MAX_MIGRATION_DECISIONS { + return Err(ProjectMigrationBuildError::TooManyDecisions); + } + if input.diagnostics.len() > MAX_MIGRATION_DIAGNOSTICS { + return Err(ProjectMigrationBuildError::TooManyDiagnostics); + } + if input.approved_reviews.len() > MigrationReviewClass::COUNT { + return Err(ProjectMigrationBuildError::TooManyReviewApprovals); + } + validate_affected(&input.affected)?; + + let version_transitions = AuthoringContract::ALL + .into_iter() + .map(|contract| { + let source_version = input.source_versions.get(contract); + let target_version = input.target_versions.get(contract); + MigrationVersionTransition { + contract, + source_version, + target_version, + direction: version_direction( + source_version, + target_version, + input.version_support.target, + ), + } + }) + .collect::>(); + let version_changed = version_transitions.iter().any(|transition| { + transition.direction != MigrationVersionDirection::Same + && transition.direction != MigrationVersionDirection::Absent + }); + + let mut changes = input + .changes + .into_iter() + .map(classify_change) + .collect::, _>>()?; + changes.sort_unstable(); + changes.dedup(); + let (mut compatible_normalizations, mut semantic_changes): (Vec<_>, Vec<_>) = changes + .into_iter() + .partition(|change| change.is_compatible_normalization()); + compatible_normalizations.sort_unstable(); + semantic_changes.sort_unstable(); + + let mut affected = input.affected; + affected.generated_artifacts.sort_unstable(); + affected.generated_artifacts.dedup(); + + let mut unresolved_decisions = input.unresolved_decisions; + unresolved_decisions.sort_unstable(); + unresolved_decisions.dedup(); + let mut diagnostics = input.diagnostics; + diagnostics.sort_unstable(); + diagnostics.dedup(); + validate_diagnostics(&diagnostics, input.version_support, input.rerun_gates)?; + + let transition_supported = input.version_support.source == MigrationVersionSupport::Supported + && input.version_support.target == MigrationVersionSupport::Supported; + let required_reviews = required_reviews( + transition_supported && version_changed, + &compatible_normalizations, + &semantic_changes, + &affected, + ); + let approved_reviews = input.approved_reviews.into_iter().collect::>(); + if approved_reviews + .iter() + .any(|review| !required_reviews.contains(review)) + { + return Err(ProjectMigrationBuildError::ApprovalNotRequired); + } + let reviews = required_reviews + .iter() + .map(|class| MigrationReviewAssessment { + class: *class, + status: if approved_reviews.contains(class) { + MigrationReviewStatus::Approved + } else { + MigrationReviewStatus::RequiredPending + }, + }) + .collect::>(); + + let rerun_gates = MigrationRerunGate::ALL + .into_iter() + .map(|gate| MigrationGateAssessment { + gate, + status: input.rerun_gates.get(gate), + }) + .collect::>(); + + let no_changes = compatible_normalizations.is_empty() && semantic_changes.is_empty(); + let compatibility = migration_compatibility( + input.version_support, + &version_transitions, + version_changed, + no_changes, + &semantic_changes, + ); + + let mut blocking_reasons = BTreeSet::new(); + add_version_blockers( + input.version_support, + &version_transitions, + version_changed, + no_changes, + &mut blocking_reasons, + ); + if diagnostics + .iter() + .any(|diagnostic| diagnostic.phase == MigrationDiagnosticPhase::SourceInspection) + { + blocking_reasons.insert(MigrationBlockingReason::SourceInspectionFailed); + } + for change in compatible_normalizations.iter().chain(&semantic_changes) { + if change.safety == MigrationSafety::Unsafe { + blocking_reasons.insert(MigrationBlockingReason::UnsafeChange); + } + if change.safety == MigrationSafety::Unresolved + || change.semantic_effect == MigrationSemanticEffect::Unresolved + || change.replacement.disposition == MigrationReplacementDisposition::Unresolved + { + blocking_reasons.insert(MigrationBlockingReason::UnresolvedChange); + } + let field = MigrationField::from_address(change.address) + .expect("builder only emits catalogued migration fields"); + if change.operation == MigrationOperation::RemoveField + && change.replacement.disposition == MigrationReplacementDisposition::NoReplacement + && !field.is_reviewed_retired_attribute_release_field() + { + blocking_reasons.insert(MigrationBlockingReason::RemovedFieldWithoutReplacement); + } + } + if affected_counts(&affected).any(MigrationAffectedCount::is_unresolved) { + blocking_reasons.insert(MigrationBlockingReason::AffectedSurfaceUnresolved); + } + if !unresolved_decisions.is_empty() { + blocking_reasons.insert(MigrationBlockingReason::UnresolvedCountryOrOperatorDecision); + } + + let migration_required = transition_supported && (version_changed || !no_changes); + if migration_required { + if rerun_gates + .iter() + .any(|gate| gate.status == MigrationGateStatus::Failed) + { + blocking_reasons.insert(MigrationBlockingReason::RerunGateFailed); + } + if rerun_gates.iter().any(|gate| { + matches!( + gate.status, + MigrationGateStatus::NotRun | MigrationGateStatus::NotRequired + ) + }) { + blocking_reasons.insert(MigrationBlockingReason::RerunGateNotRun); + } + } + + if migration_required { + match (input.output.mode, input.output.write_authority) { + (MigrationOutputMode::CheckOnly, MigrationWriteAuthority::NotGranted) => {} + ( + MigrationOutputMode::CheckOnly, + MigrationWriteAuthority::ExplicitCandidateWriteGranted, + ) => { + blocking_reasons.insert(MigrationBlockingReason::WriteAuthorityScopeMismatch); + } + ( + MigrationOutputMode::ReviewablePatch | MigrationOutputMode::SeparateOutputDirectory, + MigrationWriteAuthority::NotGranted, + ) => { + blocking_reasons.insert(MigrationBlockingReason::ExplicitWriteAuthorityMissing); + } + ( + MigrationOutputMode::ReviewablePatch | MigrationOutputMode::SeparateOutputDirectory, + MigrationWriteAuthority::ExplicitCandidateWriteGranted, + ) => {} + } + } + + let blocking_reasons = blocking_reasons.into_iter().collect::>(); + let reviews_pending = reviews + .iter() + .any(|review| review.status == MigrationReviewStatus::RequiredPending); + let disposition = if !blocking_reasons.is_empty() { + MigrationDisposition::Blocked + } else if !migration_required { + MigrationDisposition::NoMigrationRequired + } else if reviews_pending { + MigrationDisposition::ReviewRequired + } else { + match input.output.mode { + MigrationOutputMode::CheckOnly => MigrationDisposition::CheckedSafe, + MigrationOutputMode::ReviewablePatch | MigrationOutputMode::SeparateOutputDirectory => { + MigrationDisposition::ReadyForExplicitWrite + } + } + }; + let candidate_artifact = match (migration_required, input.output.mode) { + (false, _) | (_, MigrationOutputMode::CheckOnly) => MigrationCandidateArtifact::None, + (true, MigrationOutputMode::ReviewablePatch) => MigrationCandidateArtifact::ReviewablePatch, + (true, MigrationOutputMode::SeparateOutputDirectory) => { + MigrationCandidateArtifact::SeparateOutputDirectory + } + }; + let candidate_eligibility = match (migration_required, input.output.mode) { + (false, _) | (_, MigrationOutputMode::CheckOnly) => { + MigrationCandidateEligibility::NotRequested + } + _ if blocking_reasons.is_empty() => MigrationCandidateEligibility::EligibleToEmit, + _ => MigrationCandidateEligibility::Blocked, + }; + let candidate_emission_valid = matches!( + ( + candidate_artifact, + candidate_eligibility, + input.output.write_authority, + input.output.candidate_emission, + ), + ( + MigrationCandidateArtifact::None, + MigrationCandidateEligibility::NotRequested, + _, + MigrationCandidateEmission::NotEmitted, + ) | ( + MigrationCandidateArtifact::ReviewablePatch, + MigrationCandidateEligibility::EligibleToEmit, + MigrationWriteAuthority::ExplicitCandidateWriteGranted, + MigrationCandidateEmission::NotEmitted + | MigrationCandidateEmission::ReviewablePatchCandidateEmitted, + ) | ( + MigrationCandidateArtifact::SeparateOutputDirectory, + MigrationCandidateEligibility::EligibleToEmit, + MigrationWriteAuthority::ExplicitCandidateWriteGranted, + MigrationCandidateEmission::NotEmitted + | MigrationCandidateEmission::SeparateOutputCandidateEmitted, + ) | ( + MigrationCandidateArtifact::ReviewablePatch + | MigrationCandidateArtifact::SeparateOutputDirectory, + MigrationCandidateEligibility::Blocked, + _, + MigrationCandidateEmission::NotEmitted, + ) + ); + if !candidate_emission_valid { + return Err(ProjectMigrationBuildError::InvalidCandidateEmission); + } + + Ok(ProjectMigrationReportV1 { + schema_version: ProjectMigrationSchemaVersion::V1, + evidence_grade: MigrationEvidenceGrade::OfflineStatic, + migration_execution: MigrationExecution::NotPerformed, + disposition, + version_support: input.version_support, + version_transitions, + compatibility, + compatible_normalizations, + semantic_changes, + affected, + reviews, + output: MigrationOutputPlan { + mode: input.output.mode, + write_authority: input.output.write_authority, + candidate_artifact, + candidate_eligibility, + authored_file_policy: MigrationAuthoredFilePolicy::NeverOverwriteAuthoredFiles, + application_policy: MigrationApplicationPolicy::ExplicitOperatorApplyRequired, + candidate_emission: input.output.candidate_emission, + }, + rerun_gates, + diagnostics, + unresolved_decisions, + blocking_reasons, + evidence_limitations: vec![ + MigrationEvidenceLimitation::OfflineStaticOnly, + MigrationEvidenceLimitation::MigrationNotPerformed, + MigrationEvidenceLimitation::CandidateDoesNotApplyMigration, + MigrationEvidenceLimitation::AuthoredFilesNeverOverwritten, + MigrationEvidenceLimitation::SecretMaterialNotInspected, + MigrationEvidenceLimitation::RawAuthoredValuesOmitted, + MigrationEvidenceLimitation::RuntimeNotEvaluated, + MigrationEvidenceLimitation::DeploymentNotPerformed, + MigrationEvidenceLimitation::CountryApprovalNotInferred, + ], + }) +} + +impl MigrationReviewClass { + pub const ALL: [Self; 13] = [ + Self::Authoring, + Self::Compatibility, + Self::Migration, + Self::Fixtures, + Self::Relay, + Self::Notary, + Self::Interoperability, + Self::Privacy, + Self::Security, + Self::Operations, + Self::Documentation, + Self::CountryGovernance, + Self::Release, + ]; + const COUNT: usize = Self::ALL.len(); +} + +fn validate_versions(versions: AuthoringVersionSet) -> Result<(), ProjectMigrationBuildError> { + for contract in AuthoringContract::ALL { + if matches!(versions.get(contract), Some(0)) + || versions + .get(contract) + .is_some_and(|version| version > MAX_AUTHORING_VERSION) + { + return Err(ProjectMigrationBuildError::InvalidAuthoringVersion); + } + } + Ok(()) +} + +fn validate_version_support_evidence( + source: AuthoringVersionSet, + target: AuthoringVersionSet, + support: MigrationVersionSupportAssessment, +) -> Result<(), ProjectMigrationBuildError> { + if source.project.is_none() && support.source == MigrationVersionSupport::Supported { + return Err(ProjectMigrationBuildError::MissingProjectVersion); + } + if target.project.is_none() && support.target != MigrationVersionSupport::Unsupported { + return Err(ProjectMigrationBuildError::MissingProjectVersion); + } + if support.target == MigrationVersionSupport::Unsupported + && AuthoringContract::ALL + .into_iter() + .any(|contract| target.get(contract).is_some()) + { + return Err(ProjectMigrationBuildError::InvalidVersionSupportEvidence); + } + Ok(()) +} + +fn validate_pre_migration_evidence( + input: &ProjectMigrationInput, +) -> Result<(), ProjectMigrationBuildError> { + let rejected = input.version_support.source != MigrationVersionSupport::Supported + || input.version_support.target != MigrationVersionSupport::Supported; + let gates_not_applicable = MigrationRerunGate::ALL + .into_iter() + .all(|gate| input.rerun_gates.get(gate) == MigrationGateStatus::NotApplicable); + if rejected != gates_not_applicable { + return Err(ProjectMigrationBuildError::InvalidGateStatus); + } + if rejected + && (!input.changes.is_empty() + || input.affected != unaffected_surfaces() + || !input.approved_reviews.is_empty() + || !input.unresolved_decisions.is_empty()) + { + return Err(ProjectMigrationBuildError::InvalidPreMigrationEvidence); + } + Ok(()) +} + +fn validate_diagnostics( + diagnostics: &[MigrationDiagnostic], + support: MigrationVersionSupportAssessment, + gates: MigrationGateResults, +) -> Result<(), ProjectMigrationBuildError> { + for diagnostic in diagnostics { + let valid = matches!( + ( + diagnostic.code, + diagnostic.phase, + diagnostic.contract, + diagnostic.remediation, + ), + ( + MigrationDiagnosticCode::SourceYamlMalformed, + MigrationDiagnosticPhase::SourceInspection, + Some(_), + MigrationDiagnosticRemediation::CorrectSourceYaml, + ) | ( + MigrationDiagnosticCode::SourceVersionMissing + | MigrationDiagnosticCode::SourceVersionMalformed + | MigrationDiagnosticCode::SourceVersionZero + | MigrationDiagnosticCode::SourceVersionOutOfBounds + | MigrationDiagnosticCode::SourceVersionUnsupported, + MigrationDiagnosticPhase::VersionInspection, + Some(_), + MigrationDiagnosticRemediation::DeclareSupportedVersion, + ) | ( + MigrationDiagnosticCode::SourceVersionsMixed, + MigrationDiagnosticPhase::VersionInspection, + Some(_), + MigrationDiagnosticRemediation::AlignContractVersions, + ) | ( + MigrationDiagnosticCode::TargetVersionOutOfBounds + | MigrationDiagnosticCode::TargetVersionUnsupported, + MigrationDiagnosticPhase::VersionInspection, + None, + MigrationDiagnosticRemediation::SelectSupportedTargetVersion, + ) | ( + MigrationDiagnosticCode::RerunGateFailed, + MigrationDiagnosticPhase::SchemaGate, + None, + MigrationDiagnosticRemediation::InspectCandidateSchema, + ) | ( + MigrationDiagnosticCode::RerunGateFailed, + MigrationDiagnosticPhase::FixtureGate, + None, + MigrationDiagnosticRemediation::RepairFixtures, + ) | ( + MigrationDiagnosticCode::RerunGateFailed, + MigrationDiagnosticPhase::CheckGate, + None, + MigrationDiagnosticRemediation::ResolveProjectCheck, + ) | ( + MigrationDiagnosticCode::RerunGateFailed, + MigrationDiagnosticPhase::BuildGate, + None, + MigrationDiagnosticRemediation::ResolveProjectBuild, + ) | ( + MigrationDiagnosticCode::RerunGateFailed, + MigrationDiagnosticPhase::GeneratedReferenceGate, + None, + MigrationDiagnosticRemediation::RegenerateConfigurationReference, + ) + ); + if !valid { + return Err(ProjectMigrationBuildError::InvalidDiagnostic); + } + } + + let has_source_diagnostic = diagnostics.iter().any(|diagnostic| { + matches!( + diagnostic.phase, + MigrationDiagnosticPhase::SourceInspection + | MigrationDiagnosticPhase::VersionInspection + ) && !matches!( + diagnostic.code, + MigrationDiagnosticCode::TargetVersionOutOfBounds + | MigrationDiagnosticCode::TargetVersionUnsupported + ) + }); + let has_target_diagnostic = diagnostics.iter().any(|diagnostic| { + matches!( + diagnostic.code, + MigrationDiagnosticCode::TargetVersionOutOfBounds + | MigrationDiagnosticCode::TargetVersionUnsupported + ) + }); + if (support.source == MigrationVersionSupport::Supported && has_source_diagnostic) + || (support.source != MigrationVersionSupport::Supported && !has_source_diagnostic) + || (support.target == MigrationVersionSupport::Supported && has_target_diagnostic) + || (support.target != MigrationVersionSupport::Supported && !has_target_diagnostic) + { + return Err(ProjectMigrationBuildError::InvalidDiagnostic); + } + + for gate in MigrationRerunGate::ALL { + let phase = diagnostic_phase_for_gate(gate); + let diagnostic_count = diagnostics + .iter() + .filter(|diagnostic| diagnostic.phase == phase) + .count(); + let expected = usize::from(gates.get(gate) == MigrationGateStatus::Failed); + if diagnostic_count != expected { + return Err(ProjectMigrationBuildError::InvalidDiagnostic); + } + } + Ok(()) +} + +const fn diagnostic_phase_for_gate(gate: MigrationRerunGate) -> MigrationDiagnosticPhase { + match gate { + MigrationRerunGate::Schema => MigrationDiagnosticPhase::SchemaGate, + MigrationRerunGate::Fixture => MigrationDiagnosticPhase::FixtureGate, + MigrationRerunGate::Check => MigrationDiagnosticPhase::CheckGate, + MigrationRerunGate::Build => MigrationDiagnosticPhase::BuildGate, + MigrationRerunGate::GeneratedReference => MigrationDiagnosticPhase::GeneratedReferenceGate, + } +} + +fn version_direction( + source: Option, + target: Option, + target_support: MigrationVersionSupport, +) -> MigrationVersionDirection { + if target_support == MigrationVersionSupport::Unsupported { + return MigrationVersionDirection::UnsupportedTarget; + } + match (source, target) { + (None, None) => MigrationVersionDirection::Absent, + (Some(source), Some(target)) if source == target => MigrationVersionDirection::Same, + (Some(source), Some(target)) if source < target => MigrationVersionDirection::Upgrade, + (Some(_), Some(_)) => MigrationVersionDirection::Downgrade, + (None, Some(_)) => MigrationVersionDirection::AddedContract, + (Some(_), None) => MigrationVersionDirection::RemovedContract, + } +} + +fn classify_change( + input: MigrationChangeInput, +) -> Result { + let replacement = MigrationReplacement::from_input(input.replacement); + let replacement_valid = match input.operation { + MigrationOperation::NormalizeField + | MigrationOperation::AddField + | MigrationOperation::ChangeSemantics => { + replacement.disposition == MigrationReplacementDisposition::NotApplicable + } + MigrationOperation::RemoveField => matches!( + replacement.disposition, + MigrationReplacementDisposition::Field + | MigrationReplacementDisposition::NoReplacement + | MigrationReplacementDisposition::Unresolved + ), + MigrationOperation::RenameField => matches!( + replacement.disposition, + MigrationReplacementDisposition::Field | MigrationReplacementDisposition::Unresolved + ), + }; + let effect_valid = match input.operation { + MigrationOperation::NormalizeField => { + input.semantic_effect == MigrationSemanticEffect::Preserved + && input.safety == MigrationSafety::Safe + } + MigrationOperation::ChangeSemantics => { + input.semantic_effect != MigrationSemanticEffect::Preserved + } + MigrationOperation::RemoveField + if replacement.disposition == MigrationReplacementDisposition::NoReplacement + && !input.field.is_reviewed_retired_attribute_release_field() => + { + input.semantic_effect != MigrationSemanticEffect::Preserved + } + _ => true, + }; + let distinct_replacement = replacement + .address + .map(|address| address != input.field.address()) + .unwrap_or(true); + if !replacement_valid || !effect_valid || !distinct_replacement { + return Err(ProjectMigrationBuildError::InvalidChange); + } + Ok(MigrationChange { + address: input.field.address(), + operation: input.operation, + semantic_effect: input.semantic_effect, + safety: input.safety, + replacement, + owner: input.field.owner(), + classification: input.field.classification(), + }) +} + +fn validate_affected( + affected: &MigrationAffectedSurfaces, +) -> Result<(), ProjectMigrationBuildError> { + if affected.generated_artifacts.len() > MigrationArtifact::COUNT { + return Err(ProjectMigrationBuildError::TooManyAffectedItems); + } + for count in affected_counts(affected) { + if count + .count + .is_some_and(|value| value > MAX_MIGRATION_AFFECTED_COUNT) + { + return Err(ProjectMigrationBuildError::TooManyAffectedItems); + } + let valid = match count.state { + MigrationAffectedState::NotAffected => count.count == Some(0), + MigrationAffectedState::Affected => { + matches!(count.count, Some(value) if value > 0) + } + MigrationAffectedState::Unresolved => count.count.is_none(), + }; + if !valid { + return Err(ProjectMigrationBuildError::InvalidAffectedCount); + } + } + Ok(()) +} + +impl MigrationArtifact { + pub const ALL: [Self; 10] = [ + Self::RelayConfig, + Self::RelayEnvironmentContract, + Self::NotaryConfig, + Self::NotaryEnvironmentContract, + Self::ProjectExplanation, + Self::ProjectSemanticImpact, + Self::ProjectFixtureCoverage, + Self::ProjectArtifactManifest, + Self::GeneratedConfigurationReference, + Self::ReleaseReadinessEvidence, + ]; + const COUNT: usize = Self::ALL.len(); +} + +fn affected_counts( + affected: &MigrationAffectedSurfaces, +) -> impl Iterator { + [ + affected.fixtures, + affected.services, + affected.consultations, + affected.claims, + affected.environments, + ] + .into_iter() +} + +fn migration_compatibility( + support: MigrationVersionSupportAssessment, + transitions: &[MigrationVersionTransition], + version_changed: bool, + no_changes: bool, + semantic_changes: &[MigrationChange], +) -> MigrationCompatibility { + if support.source != MigrationVersionSupport::Supported + || support.target != MigrationVersionSupport::Supported + { + MigrationCompatibility::UnsupportedTransition + } else if transitions.iter().any(|transition| { + matches!( + transition.direction, + MigrationVersionDirection::Downgrade | MigrationVersionDirection::RemovedContract + ) + }) { + MigrationCompatibility::UnsafeOrUnresolved + } else if version_changed && no_changes { + MigrationCompatibility::CatalogIncomplete + } else if !version_changed && no_changes { + MigrationCompatibility::NoMigrationRequired + } else if semantic_changes.is_empty() { + MigrationCompatibility::CompatibleNormalizationOnly + } else if semantic_changes.iter().any(|change| { + change.safety != MigrationSafety::Safe + || change.semantic_effect == MigrationSemanticEffect::Unresolved + || change.replacement.disposition == MigrationReplacementDisposition::Unresolved + }) { + MigrationCompatibility::UnsafeOrUnresolved + } else { + MigrationCompatibility::SemanticReviewRequired + } +} + +fn add_version_blockers( + support: MigrationVersionSupportAssessment, + transitions: &[MigrationVersionTransition], + version_changed: bool, + no_changes: bool, + blocking: &mut BTreeSet, +) { + match support.source { + MigrationVersionSupport::Supported => {} + MigrationVersionSupport::Unsupported => { + blocking.insert(MigrationBlockingReason::SourceVersionUnsupported); + } + MigrationVersionSupport::NotEvaluated => { + blocking.insert(MigrationBlockingReason::VersionSupportNotEvaluated); + } + } + match support.target { + MigrationVersionSupport::Supported => {} + MigrationVersionSupport::Unsupported => { + blocking.insert(MigrationBlockingReason::TargetVersionUnsupported); + } + MigrationVersionSupport::NotEvaluated => { + blocking.insert(MigrationBlockingReason::VersionSupportNotEvaluated); + } + } + if support.source != MigrationVersionSupport::Supported + || support.target != MigrationVersionSupport::Supported + { + return; + } + if transitions.iter().any(|transition| { + matches!( + transition.direction, + MigrationVersionDirection::Downgrade | MigrationVersionDirection::RemovedContract + ) + }) { + blocking.insert(MigrationBlockingReason::DowngradeOrContractRemoval); + } + if version_changed && no_changes { + blocking.insert(MigrationBlockingReason::MigrationCatalogIncomplete); + } +} + +fn required_reviews( + version_changed: bool, + compatible: &[MigrationChange], + semantic: &[MigrationChange], + affected: &MigrationAffectedSurfaces, +) -> BTreeSet { + let mut reviews = BTreeSet::new(); + if version_changed || !compatible.is_empty() || !semantic.is_empty() { + reviews.extend([ + MigrationReviewClass::Authoring, + MigrationReviewClass::Compatibility, + MigrationReviewClass::Migration, + ]); + } + if affected.fixtures.is_affected() { + reviews.insert(MigrationReviewClass::Fixtures); + } + if affected.services.is_affected() { + reviews.insert(MigrationReviewClass::Relay); + } + if affected.consultations.is_affected() { + reviews.extend([ + MigrationReviewClass::Relay, + MigrationReviewClass::Notary, + MigrationReviewClass::Interoperability, + ]); + } + if affected.claims.is_affected() { + reviews.extend([ + MigrationReviewClass::Notary, + MigrationReviewClass::Privacy, + MigrationReviewClass::Security, + ]); + } + if affected.environments.is_affected() { + reviews.extend([ + MigrationReviewClass::Operations, + MigrationReviewClass::Security, + ]); + } + for artifact in &affected.generated_artifacts { + reviews.insert(MigrationReviewClass::Release); + match artifact { + MigrationArtifact::RelayConfig | MigrationArtifact::RelayEnvironmentContract => { + reviews.insert(MigrationReviewClass::Relay); + } + MigrationArtifact::NotaryConfig | MigrationArtifact::NotaryEnvironmentContract => { + reviews.insert(MigrationReviewClass::Notary); + } + MigrationArtifact::GeneratedConfigurationReference => { + reviews.insert(MigrationReviewClass::Documentation); + } + _ => {} + } + } + for change in compatible.iter().chain(semantic) { + let field = MigrationField::from_address(change.address) + .expect("builder only emits catalogued migration fields"); + match field { + MigrationField::ProjectServices + | MigrationField::ServicePolicy + | MigrationField::Consultation + | MigrationField::Claim + | MigrationField::AttributeReleaseSubjectInput + | MigrationField::AttributeReleaseResponse + | MigrationField::AttributeReleaseResponseMaxAge => { + reviews.insert(MigrationReviewClass::CountryGovernance); + } + _ => {} + } + match field { + MigrationField::ServicePolicy | MigrationField::Claim => { + reviews.extend([ + MigrationReviewClass::Privacy, + MigrationReviewClass::Security, + ]); + } + MigrationField::AttributeReleaseResponse + | MigrationField::AttributeReleaseResponseMaxAge => { + reviews.extend([ + MigrationReviewClass::Relay, + MigrationReviewClass::Privacy, + MigrationReviewClass::Security, + ]); + } + MigrationField::Consultation => { + reviews.extend([ + MigrationReviewClass::Relay, + MigrationReviewClass::Notary, + MigrationReviewClass::Interoperability, + ]); + } + MigrationField::EnvironmentCredentials | MigrationField::EnvironmentTrust => { + reviews.extend([ + MigrationReviewClass::Security, + MigrationReviewClass::Operations, + ]); + } + MigrationField::EnvironmentVersion + | MigrationField::EnvironmentOrigin + | MigrationField::EnvironmentDeployment + | MigrationField::EnvironmentWorkerLimits => { + reviews.insert(MigrationReviewClass::Operations); + } + _ => {} + } + } + reviews +} + +/// Options for a local, offline authoring migration check. +/// +/// Candidate publication is deliberately a two-part opt in: callers must name +/// a separate destination and grant candidate-write authority. The source +/// project is never a destination. +#[derive(Clone, Debug)] +pub struct ProjectMigrationOptions { + pub project_directory: PathBuf, + pub target_version: u32, + pub output_directory: Option, + pub write_candidate: bool, +} + +/// Checks a project migration using the current `registryctl` executable for +/// the same offline fixture workers used by `project test`, `check`, and +/// `build`. +pub fn migrate_registry_project( + options: &ProjectMigrationOptions, +) -> Result { + let execution_context = super::ProjectExecutionContext::for_current_executable()?; + migrate_registry_project_with_context(options, &execution_context) +} + +/// Checks a project migration with an explicitly reviewed worker executable. +/// +/// Only the reviewed v1-to-v1 normalization catalog is implemented. Unknown +/// source or target versions produce a blocked, value-free report. A requested +/// candidate is published atomically to a separate absent directory only +/// after the schema, semantic, fixture, check, build, and generated-reference +/// gates pass. +pub fn migrate_registry_project_with_context( + options: &ProjectMigrationOptions, + execution_context: &super::ProjectExecutionContext, +) -> Result { + validate_candidate_options(options)?; + let root = super::canonical_root(&options.project_directory)?; + let candidate_destination = options + .output_directory + .as_deref() + .map(|destination| resolve_candidate_destination(&root, destination)) + .transpose()?; + let inspection = inspect_authoring_contract_versions(&root)?; + let mut diagnostics = inspection.diagnostics.clone(); + let source_support = if diagnostics + .iter() + .any(|diagnostic| diagnostic.phase == MigrationDiagnosticPhase::SourceInspection) + { + MigrationVersionSupport::NotEvaluated + } else if diagnostics.is_empty() { + MigrationVersionSupport::Supported + } else { + MigrationVersionSupport::Unsupported + }; + let (target_versions, target_support) = target_version_set( + options.target_version, + inspection.presence, + &mut diagnostics, + ); + let version_support = MigrationVersionSupportAssessment { + source: source_support, + target: target_support, + }; + if version_support.source != MigrationVersionSupport::Supported + || version_support.target != MigrationVersionSupport::Supported + { + return build_migration_report(ProjectMigrationInput { + source_versions: inspection.versions, + target_versions, + version_support, + changes: Vec::new(), + affected: unaffected_surfaces(), + approved_reviews: Vec::new(), + output: migration_output_request(options, MigrationCandidateEmission::NotEmitted), + rerun_gates: not_applicable_gates(), + diagnostics, + unresolved_decisions: Vec::new(), + }); + } + + let project_document = inspection + .project_document + .as_ref() + .ok_or_else(|| anyhow!("supported source inspection must retain the project document"))?; + let project_bytes = inspection + .project_bytes + .as_ref() + .ok_or_else(|| anyhow!("supported source inspection must retain the project bytes"))?; + let transform = apply_same_v1_attribute_release_catalog(project_document, project_bytes)?; + if transform.changed.changes.is_empty() { + // A current project is already canonical. Loading proves it still + // satisfies the current contract, but migration never rewrites it for + // formatting alone. + super::load_registry_project(&root, None)?; + for environment in &inspection.environments { + super::load_registry_project(&root, Some(environment))?; + } + return build_migration_report(ProjectMigrationInput { + source_versions: inspection.versions, + target_versions, + version_support: supported_versions(), + changes: Vec::new(), + affected: unaffected_surfaces(), + approved_reviews: Vec::new(), + output: migration_output_request(options, MigrationCandidateEmission::NotEmitted), + rerun_gates: not_required_gates(), + diagnostics: Vec::new(), + unresolved_decisions: Vec::new(), + }); + } + + let validation = tempfile::Builder::new() + .prefix("registryctl-migration-validation-") + .tempdir() + .context("failed to create private migration validation directory")?; + tighten_private_directory(validation.path())?; + stage_catalog_candidate(&root, validation.path(), &transform.project_bytes)?; + let validation_root = super::canonical_root(validation.path())?; + let candidate = super::load_registry_project(&validation_root, None)?; + let mut candidate_environments = Vec::with_capacity(inspection.environments.len()); + for environment in &inspection.environments { + candidate_environments.push(( + environment.clone(), + super::load_registry_project(&validation_root, Some(environment))?, + )); + } + let candidate_files = + collect_authored_files(&validation_root, &candidate, &candidate_environments)?; + let gate_run = run_migration_gates( + &validation_root, + &inspection.environments, + execution_context, + ); + let affected = affected_surfaces( + &candidate, + &transform.changed, + inspection.environments.len(), + )?; + let requested_output = + migration_output_request(options, MigrationCandidateEmission::NotEmitted); + let preliminary = build_migration_report(ProjectMigrationInput { + source_versions: inspection.versions, + target_versions, + version_support: supported_versions(), + changes: transform.changed.changes.clone(), + affected: affected.clone(), + approved_reviews: Vec::new(), + output: requested_output, + rerun_gates: gate_run.results, + diagnostics: gate_run.diagnostics.clone(), + unresolved_decisions: Vec::new(), + })?; + + let Some(destination) = candidate_destination else { + return Ok(preliminary); + }; + if preliminary.output.candidate_eligibility != MigrationCandidateEligibility::EligibleToEmit { + return Ok(preliminary); + } + + let parent = destination + .parent() + .ok_or_else(|| anyhow!("migration candidate destination has no parent"))?; + let staging = tempfile::Builder::new() + .prefix(".registryctl-migration-") + .tempdir_in(parent) + .context("failed to create private migration candidate staging directory")?; + tighten_private_directory(staging.path())?; + write_candidate_tree(staging.path(), &candidate_files)?; + let final_report = build_migration_report(ProjectMigrationInput { + source_versions: inspection.versions, + target_versions, + version_support: supported_versions(), + changes: transform.changed.changes, + affected, + approved_reviews: Vec::new(), + output: migration_output_request( + options, + MigrationCandidateEmission::SeparateOutputCandidateEmitted, + ), + rerun_gates: gate_run.results, + diagnostics: gate_run.diagnostics, + unresolved_decisions: Vec::new(), + })?; + let report_bytes = + serde_json::to_vec_pretty(&final_report).context("failed to serialize migration report")?; + super::write_private_file(&staging.path().join("migration-report.json"), &report_bytes)?; + super::rename_project_init_noreplace(staging.path(), &destination)?; + Ok(final_report) +} + +fn validate_candidate_options(options: &ProjectMigrationOptions) -> Result<()> { + match (options.output_directory.is_some(), options.write_candidate) { + (false, false) | (true, true) => Ok(()), + (true, false) => { + bail!("--output requires explicit --write-candidate authority") + } + (false, true) => { + bail!("--write-candidate requires a separate --output destination") + } + } +} + +#[derive(Clone, Copy)] +struct AuthoringContractPresence { + project: bool, + integration: bool, + entity: bool, + fixture: bool, + environment: bool, +} + +#[derive(Clone)] +struct AuthoringVersionInspection { + versions: AuthoringVersionSet, + presence: AuthoringContractPresence, + environments: Vec, + project_document: Option, + project_bytes: Option>, + diagnostics: Vec, +} + +fn inspect_authoring_contract_versions(root: &Path) -> Result { + let project_path = root.join(super::PROJECT_FILE); + let project_bytes = super::read_authored_file(root, &project_path)?; + let project: Value = match serde_norway::from_slice(&project_bytes) { + Ok(project) => project, + Err(_) => { + return Ok(AuthoringVersionInspection { + versions: empty_versions(), + presence: AuthoringContractPresence { + project: true, + integration: false, + entity: false, + fixture: false, + environment: false, + }, + environments: Vec::new(), + project_document: None, + project_bytes: None, + diagnostics: vec![source_yaml_diagnostic(AuthoringContract::Project)], + }) + } + }; + let mut diagnostics = Vec::new(); + let project_version = + inspect_document_version(&project, AuthoringContract::Project, &mut diagnostics); + let integration_documents = inspect_referenced_contracts(root, &project, "integrations")?; + let entity_documents = inspect_referenced_contracts(root, &project, "entities")?; + let mut integration_versions = Vec::with_capacity(integration_documents.len()); + let mut fixture_versions = Vec::new(); + for (document, relative) in &integration_documents { + let Some(document) = document.as_ref() else { + diagnostics.push(source_yaml_diagnostic(AuthoringContract::Integration)); + integration_versions.push(None); + continue; + }; + let version = + inspect_document_version(document, AuthoringContract::Integration, &mut diagnostics); + integration_versions.push(version); + if integration_has_fixtures(root, relative)? { + fixture_versions.push(version); + } + } + let mut entity_versions = Vec::with_capacity(entity_documents.len()); + for (document, _) in &entity_documents { + let Some(document) = document.as_ref() else { + diagnostics.push(source_yaml_diagnostic(AuthoringContract::Entity)); + entity_versions.push(None); + continue; + }; + entity_versions.push(inspect_document_version( + document, + AuthoringContract::Entity, + &mut diagnostics, + )); + } + let environments = migration_environment_names(root)?; + let mut environment_versions = Vec::with_capacity(environments.len()); + for environment in &environments { + let relative = PathBuf::from("environments").join(format!("{environment}.yaml")); + let path = super::resolve_authored_path(root, &relative)?; + let bytes = super::read_authored_file(root, &path)?; + let document: Value = match serde_norway::from_slice(&bytes) { + Ok(document) => document, + Err(_) => { + diagnostics.push(source_yaml_diagnostic(AuthoringContract::Environment)); + continue; + } + }; + environment_versions.push(inspect_document_version( + &document, + AuthoringContract::Environment, + &mut diagnostics, + )); + } + let integration = representative_contract_version( + &integration_versions, + AuthoringContract::Integration, + &mut diagnostics, + ); + let entity = representative_contract_version( + &entity_versions, + AuthoringContract::Entity, + &mut diagnostics, + ); + let fixture = representative_contract_version( + &fixture_versions, + AuthoringContract::Fixture, + &mut diagnostics, + ); + let environment = representative_contract_version( + &environment_versions, + AuthoringContract::Environment, + &mut diagnostics, + ); + diagnostics.sort_unstable(); + diagnostics.dedup(); + Ok(AuthoringVersionInspection { + versions: AuthoringVersionSet { + project: project_version, + integration, + entity, + // Fixture documents deliberately have no independent version. + // Presence is real fixture YAML, and their version follows the + // integration contract that owns them. + fixture, + environment, + }, + presence: AuthoringContractPresence { + project: true, + integration: !integration_documents.is_empty(), + entity: !entity_documents.is_empty(), + fixture: !fixture_versions.is_empty(), + environment: !environments.is_empty(), + }, + environments, + project_document: Some(project), + project_bytes: Some(project_bytes), + diagnostics, + }) +} + +fn inspect_document_version( + document: &Value, + contract: AuthoringContract, + diagnostics: &mut Vec, +) -> Option { + let Some(version) = document + .as_object() + .and_then(|object| object.get("version")) + else { + diagnostics.push(version_diagnostic( + MigrationDiagnosticCode::SourceVersionMissing, + contract, + MigrationDiagnosticRemediation::DeclareSupportedVersion, + )); + return None; + }; + let Some(version) = version.as_u64() else { + diagnostics.push(version_diagnostic( + MigrationDiagnosticCode::SourceVersionMalformed, + contract, + MigrationDiagnosticRemediation::DeclareSupportedVersion, + )); + return None; + }; + if version == 0 { + diagnostics.push(version_diagnostic( + MigrationDiagnosticCode::SourceVersionZero, + contract, + MigrationDiagnosticRemediation::DeclareSupportedVersion, + )); + return None; + } + let Ok(version) = u32::try_from(version) else { + diagnostics.push(version_diagnostic( + MigrationDiagnosticCode::SourceVersionOutOfBounds, + contract, + MigrationDiagnosticRemediation::DeclareSupportedVersion, + )); + return None; + }; + if version > MAX_AUTHORING_VERSION { + diagnostics.push(version_diagnostic( + MigrationDiagnosticCode::SourceVersionOutOfBounds, + contract, + MigrationDiagnosticRemediation::DeclareSupportedVersion, + )); + return None; + } + if version != 1 { + diagnostics.push(version_diagnostic( + MigrationDiagnosticCode::SourceVersionUnsupported, + contract, + MigrationDiagnosticRemediation::DeclareSupportedVersion, + )); + } + Some(version) +} + +fn inspect_referenced_contracts( + root: &Path, + project: &Value, + field: &str, +) -> Result, PathBuf)>> { + let Some(references) = project + .as_object() + .and_then(|object| object.get(field)) + .and_then(Value::as_object) + else { + return Ok(Vec::new()); + }; + let mut documents = Vec::with_capacity(references.len()); + for reference in references.values() { + let relative = reference + .as_object() + .and_then(|object| object.get("file")) + .and_then(Value::as_str) + .ok_or_else(|| anyhow!("authoring file reference is missing or invalid"))?; + let relative = PathBuf::from(relative); + let path = super::resolve_authored_path(root, &relative)?; + let bytes = super::read_authored_file(root, &path)?; + let document = serde_norway::from_slice(&bytes).ok(); + documents.push((document, relative)); + } + Ok(documents) +} + +fn representative_contract_version( + versions: &[Option], + contract: AuthoringContract, + diagnostics: &mut Vec, +) -> Option { + let representative = versions.iter().flatten().copied().min()?; + if versions + .iter() + .flatten() + .any(|version| *version != representative) + { + diagnostics.push(version_diagnostic( + MigrationDiagnosticCode::SourceVersionsMixed, + contract, + MigrationDiagnosticRemediation::AlignContractVersions, + )); + } + Some(representative) +} + +fn integration_has_fixtures(root: &Path, relative: &Path) -> Result { + let parent = relative.parent().unwrap_or_else(|| Path::new("")); + let directory_relative = parent.join("fixtures"); + super::validate_relative_authored_path(&directory_relative)?; + let directory = root.join(&directory_relative); + super::reject_symlink_components(root, &directory)?; + let metadata = match fs::symlink_metadata(&directory) { + Ok(metadata) => metadata, + Err(error) if error.kind() == std::io::ErrorKind::NotFound => return Ok(false), + Err(error) => return Err(error).context("failed to inspect integration fixture directory"), + }; + if !metadata.is_dir() { + bail!("integration fixture path must be a real directory"); + } + for entry in fs::read_dir(&directory).context("failed to inspect integration fixtures")? { + let entry = entry.context("failed to inspect integration fixture entry")?; + let metadata = + fs::symlink_metadata(entry.path()).context("failed to inspect integration fixture")?; + if metadata.file_type().is_symlink() { + bail!("symlinks are forbidden at the project authoring boundary"); + } + if metadata.is_file() + && entry.path().extension().and_then(|value| value.to_str()) == Some("yaml") + { + return Ok(true); + } + } + Ok(false) +} + +const fn empty_versions() -> AuthoringVersionSet { + AuthoringVersionSet { + project: None, + integration: None, + entity: None, + fixture: None, + environment: None, + } +} + +const fn source_yaml_diagnostic(contract: AuthoringContract) -> MigrationDiagnostic { + MigrationDiagnostic { + code: MigrationDiagnosticCode::SourceYamlMalformed, + phase: MigrationDiagnosticPhase::SourceInspection, + contract: Some(contract), + remediation: MigrationDiagnosticRemediation::CorrectSourceYaml, + } +} + +const fn version_diagnostic( + code: MigrationDiagnosticCode, + contract: AuthoringContract, + remediation: MigrationDiagnosticRemediation, +) -> MigrationDiagnostic { + MigrationDiagnostic { + code, + phase: MigrationDiagnosticPhase::VersionInspection, + contract: Some(contract), + remediation, + } +} + +fn target_version_set( + target_version: u32, + presence: AuthoringContractPresence, + diagnostics: &mut Vec, +) -> (AuthoringVersionSet, MigrationVersionSupport) { + if target_version == 0 || target_version > MAX_AUTHORING_VERSION { + diagnostics.push(MigrationDiagnostic { + code: MigrationDiagnosticCode::TargetVersionOutOfBounds, + phase: MigrationDiagnosticPhase::VersionInspection, + contract: None, + remediation: MigrationDiagnosticRemediation::SelectSupportedTargetVersion, + }); + return (empty_versions(), MigrationVersionSupport::Unsupported); + } + if target_version != 1 { + diagnostics.push(MigrationDiagnostic { + code: MigrationDiagnosticCode::TargetVersionUnsupported, + phase: MigrationDiagnosticPhase::VersionInspection, + contract: None, + remediation: MigrationDiagnosticRemediation::SelectSupportedTargetVersion, + }); + (empty_versions(), MigrationVersionSupport::Unsupported) + } else { + let versions = AuthoringVersionSet { + project: presence.project.then_some(target_version), + integration: presence.integration.then_some(target_version), + entity: presence.entity.then_some(target_version), + fixture: presence.fixture.then_some(target_version), + environment: presence.environment.then_some(target_version), + }; + (versions, MigrationVersionSupport::Supported) + } +} + +struct CatalogTransform { + project_bytes: Vec, + changed: ChangedDocuments, +} + +fn apply_same_v1_attribute_release_catalog( + source: &Value, + source_bytes: &[u8], +) -> Result { + let mut candidate = source.clone(); + let mut changes = BTreeSet::new(); + let mut affected_services = 0; + let Some(services) = candidate + .as_object_mut() + .and_then(|project| project.get_mut("services")) + .and_then(Value::as_object_mut) + else { + return Ok(CatalogTransform { + project_bytes: source_bytes.to_vec(), + changed: ChangedDocuments::default(), + }); + }; + + for service in services.values_mut() { + let Some(profiles) = service + .as_object_mut() + .and_then(|service| service.get_mut("api")) + .and_then(Value::as_object_mut) + .and_then(|api| api.get_mut("attribute_release_profiles")) + .and_then(Value::as_object_mut) + else { + continue; + }; + let mut service_changed = false; + for profile in profiles.values_mut() { + let Some(profile) = profile.as_object_mut() else { + continue; + }; + if let Some(subject) = profile.get_mut("subject").and_then(Value::as_object_mut) { + let removable_input = subject + .get("input") + .and_then(Value::as_str) + .is_some_and(|input| super::validate_input_name(input).is_ok()); + if removable_input { + subject.remove("input"); + changes.insert(retired_field_removal( + MigrationField::AttributeReleaseSubjectInput, + MigrationSemanticEffect::Preserved, + )); + service_changed = true; + } + } + + let mut remove_response = false; + let mut response_effect = None; + if let Some(response) = profile.get_mut("response").and_then(Value::as_object_mut) { + let removable_max_age = response + .get("max_age_seconds") + .and_then(Value::as_u64) + .is_some_and(|seconds| (1..=3600).contains(&seconds)); + if removable_max_age { + response.remove("max_age_seconds"); + changes.insert(retired_field_removal( + MigrationField::AttributeReleaseResponseMaxAge, + MigrationSemanticEffect::Changed, + )); + response_effect = Some(MigrationSemanticEffect::Changed); + service_changed = true; + } + if response.is_empty() { + remove_response = true; + response_effect.get_or_insert(MigrationSemanticEffect::Preserved); + } + } + if remove_response { + profile.remove("response"); + changes.insert(retired_field_removal( + MigrationField::AttributeReleaseResponse, + response_effect.expect("empty response has a classified effect"), + )); + service_changed = true; + } + } + affected_services += usize::from(service_changed); + } + + if changes.is_empty() { + return Ok(CatalogTransform { + project_bytes: source_bytes.to_vec(), + changed: ChangedDocuments::default(), + }); + } + let project_bytes = serde_norway::to_string(&candidate) + .context("failed to serialize the reviewed same-v1 migration candidate")? + .into_bytes(); + let reparsed: Value = serde_norway::from_slice(&project_bytes) + .context("reviewed same-v1 migration candidate did not roundtrip")?; + if reparsed != candidate { + bail!("reviewed same-v1 migration candidate changed outside the catalog"); + } + Ok(CatalogTransform { + project_bytes, + changed: ChangedDocuments { + changes: changes.into_iter().collect(), + fixtures: 0, + services: affected_services, + environments: 0, + }, + }) +} + +const fn retired_field_removal( + field: MigrationField, + semantic_effect: MigrationSemanticEffect, +) -> MigrationChangeInput { + MigrationChangeInput { + field, + operation: MigrationOperation::RemoveField, + semantic_effect, + safety: MigrationSafety::Safe, + replacement: MigrationReplacementInput::NoReplacement, + } +} + +fn stage_catalog_candidate(root: &Path, candidate: &Path, project_bytes: &[u8]) -> Result<()> { + const MAX_STAGE_FILES: usize = 4096; + const MAX_STAGE_FILE_BYTES: u64 = 8 * 1024 * 1024; + const MAX_STAGE_BYTES: u64 = 64 * 1024 * 1024; + + // The compatibility adapter never follows links. This temporary full-tree + // staging is needed only because the old project cannot pass the current + // strict loader before its retired fields are removed. Final candidates + // are reduced back to the loader's exact artifact-input closure. + fn visit( + root: &Path, + directory: &Path, + candidate: &Path, + files: &mut usize, + bytes: &mut u64, + ) -> Result<()> { + let mut entries = fs::read_dir(directory) + .context("failed to inspect migration source directory")? + .collect::, _>>() + .context("failed to inspect migration source entry")?; + entries.sort_by_key(|entry| entry.file_name()); + for entry in entries { + let path = entry.path(); + let relative = path + .strip_prefix(root) + .map_err(|_| anyhow!("migration source entry escaped its root"))?; + if relative == Path::new(super::PROJECT_FILE) { + continue; + } + if relative.components().count() == 1 + && matches!( + relative.file_name().and_then(|name| name.to_str()), + Some(".git" | ".registry-stack") + ) + { + continue; + } + let metadata = + fs::symlink_metadata(&path).context("failed to inspect migration source entry")?; + if metadata.file_type().is_symlink() { + bail!("symlinks are forbidden at the migration source boundary"); + } + if metadata.is_dir() { + visit(root, &path, candidate, files, bytes)?; + continue; + } + if !metadata.is_file() || metadata.len() > MAX_STAGE_FILE_BYTES { + bail!("migration source contains an unsupported or oversized file"); + } + *files += 1; + *bytes = bytes + .checked_add(metadata.len()) + .ok_or_else(|| anyhow!("migration source closure exceeds its size bound"))?; + if *files > MAX_STAGE_FILES || *bytes > MAX_STAGE_BYTES { + bail!("migration source closure exceeds its bounded staging capacity"); + } + let content = fs::read(&path).context("failed to read migration source entry")?; + super::write_private_file(&candidate.join(relative), &content)?; + } + Ok(()) + } + + super::create_dir_owner_only(candidate)?; + let mut files = 0; + let mut bytes = 0; + visit(root, root, candidate, &mut files, &mut bytes)?; + super::write_private_file(&candidate.join(super::PROJECT_FILE), project_bytes) +} + +fn migration_environment_names(root: &Path) -> Result> { + let directory = root.join("environments"); + if !directory.exists() { + return Ok(Vec::new()); + } + super::reject_symlink_components(root, &directory)?; + let metadata = fs::symlink_metadata(&directory) + .context("failed to inspect project environments directory")?; + if !metadata.is_dir() { + bail!("project environments path must be a real directory"); + } + let mut names = Vec::new(); + for entry in fs::read_dir(&directory).context("failed to read project environments")? { + let entry = entry.context("failed to read project environment entry")?; + let path = entry.path(); + let metadata = + fs::symlink_metadata(&path).context("failed to inspect project environment entry")?; + if metadata.file_type().is_symlink() { + bail!("symlinks are forbidden at the project authoring boundary"); + } + if !metadata.is_file() || path.extension().and_then(|value| value.to_str()) != Some("yaml") + { + continue; + } + let name = path + .file_stem() + .and_then(|value| value.to_str()) + .ok_or_else(|| anyhow!("environment file name is not Unicode"))?; + super::validate_stable_id(name, "environment")?; + names.push(name.to_owned()); + if names.len() > super::MAX_ENVIRONMENTS { + bail!("project contains too many environments"); + } + } + names.sort(); + names.dedup(); + Ok(names) +} + +fn collect_authored_files( + root: &Path, + base: &super::LoadedRegistryProject, + environments: &[(String, super::LoadedRegistryProject)], +) -> Result>> { + let mut paths = BTreeSet::new(); + for input in base.artifact_inputs.iter().chain( + environments + .iter() + .flat_map(|(_, loaded)| &loaded.artifact_inputs), + ) { + paths.insert(PathBuf::from(input.path.as_str())); + } + let mut files = BTreeMap::new(); + for relative in paths { + let path = super::resolve_authored_path(root, &relative)?; + files.insert(relative, super::read_authored_file(root, &path)?); + } + Ok(files) +} + +#[derive(Clone, Default)] +struct ChangedDocuments { + changes: Vec, + fixtures: usize, + services: usize, + environments: usize, +} + +fn write_candidate_tree(root: &Path, files: &BTreeMap>) -> Result<()> { + super::create_dir_owner_only(root)?; + for (relative, bytes) in files { + super::validate_relative_authored_path(relative)?; + super::write_private_file(&root.join(relative), bytes)?; + } + Ok(()) +} + +#[cfg(unix)] +fn tighten_private_directory(path: &Path) -> Result<()> { + use std::os::unix::fs::PermissionsExt as _; + + fs::set_permissions(path, fs::Permissions::from_mode(0o700)) + .context("failed to make migration directory owner-only") +} + +#[cfg(not(unix))] +fn tighten_private_directory(_path: &Path) -> Result<()> { + Ok(()) +} + +struct MigrationGateRun { + results: MigrationGateResults, + diagnostics: Vec, +} + +fn run_migration_gates( + candidate_root: &Path, + environments: &[String], + execution_context: &super::ProjectExecutionContext, +) -> MigrationGateRun { + let mut diagnostics = Vec::new(); + let schema = gate_status( + MigrationRerunGate::Schema, + (|| -> Result<()> { + super::load_registry_project(candidate_root, None)?; + for environment in environments { + super::load_registry_project(candidate_root, Some(environment))?; + } + Ok(()) + })(), + &mut diagnostics, + ); + let fixture = gate_status( + MigrationRerunGate::Fixture, + super::test_registry_project_with_context( + &super::ProjectTestOptions { + project_directory: candidate_root.to_path_buf(), + environment: None, + live: false, + }, + execution_context, + ) + .map(|_| ()), + &mut diagnostics, + ); + let check = if environments.is_empty() { + MigrationGateStatus::NotRun + } else { + gate_status( + MigrationRerunGate::Check, + (|| -> Result<()> { + for environment in environments { + super::check_registry_project_with_context( + &super::ProjectCheckOptions { + project_directory: candidate_root.to_path_buf(), + environment: environment.clone(), + explain: false, + against: None, + anchor: None, + }, + execution_context, + )?; + } + Ok(()) + })(), + &mut diagnostics, + ) + }; + let build = if environments.is_empty() { + MigrationGateStatus::NotRun + } else { + gate_status( + MigrationRerunGate::Build, + (|| -> Result<()> { + for environment in environments { + super::build_registry_project_with_context( + &super::ProjectBuildOptions { + project_directory: candidate_root.to_path_buf(), + environment: environment.clone(), + against: None, + anchor: None, + }, + execution_context, + )?; + } + Ok(()) + })(), + &mut diagnostics, + ) + }; + let generated_reference = gate_status( + MigrationRerunGate::GeneratedReference, + (|| -> Result<()> { + super::embedded_configuration_reference().map_err(anyhow::Error::from)?; + let coverage = + super::embedded_configuration_reference_coverage().map_err(anyhow::Error::from)?; + if coverage.status != super::CoverageStatus::Complete { + bail!("generated configuration reference coverage is incomplete"); + } + Ok(()) + })(), + &mut diagnostics, + ); + MigrationGateRun { + results: MigrationGateResults { + schema, + fixture, + check, + build, + generated_reference, + }, + diagnostics, + } +} + +fn gate_status( + gate: MigrationRerunGate, + result: Result<()>, + diagnostics: &mut Vec, +) -> MigrationGateStatus { + if result.is_ok() { + return MigrationGateStatus::Passed; + } + let (phase, remediation) = match gate { + MigrationRerunGate::Schema => ( + MigrationDiagnosticPhase::SchemaGate, + MigrationDiagnosticRemediation::InspectCandidateSchema, + ), + MigrationRerunGate::Fixture => ( + MigrationDiagnosticPhase::FixtureGate, + MigrationDiagnosticRemediation::RepairFixtures, + ), + MigrationRerunGate::Check => ( + MigrationDiagnosticPhase::CheckGate, + MigrationDiagnosticRemediation::ResolveProjectCheck, + ), + MigrationRerunGate::Build => ( + MigrationDiagnosticPhase::BuildGate, + MigrationDiagnosticRemediation::ResolveProjectBuild, + ), + MigrationRerunGate::GeneratedReference => ( + MigrationDiagnosticPhase::GeneratedReferenceGate, + MigrationDiagnosticRemediation::RegenerateConfigurationReference, + ), + }; + diagnostics.push(MigrationDiagnostic { + code: MigrationDiagnosticCode::RerunGateFailed, + phase, + contract: None, + remediation, + }); + MigrationGateStatus::Failed +} + +fn affected_surfaces( + loaded: &super::LoadedRegistryProject, + changed: &ChangedDocuments, + environment_count: usize, +) -> Result { + let (relay, notary) = super::project_product_topology(&loaded.project); + let mut generated_artifacts = vec![ + MigrationArtifact::ProjectExplanation, + MigrationArtifact::ProjectSemanticImpact, + MigrationArtifact::ProjectFixtureCoverage, + MigrationArtifact::ProjectArtifactManifest, + MigrationArtifact::GeneratedConfigurationReference, + MigrationArtifact::ReleaseReadinessEvidence, + ]; + if relay { + generated_artifacts.extend([ + MigrationArtifact::RelayConfig, + MigrationArtifact::RelayEnvironmentContract, + ]); + } + if notary { + generated_artifacts.extend([ + MigrationArtifact::NotaryConfig, + MigrationArtifact::NotaryEnvironmentContract, + ]); + } + Ok(MigrationAffectedSurfaces { + fixtures: MigrationAffectedCount::known(bounded_count(changed.fixtures)?), + services: MigrationAffectedCount::known(bounded_count(changed.services)?), + consultations: MigrationAffectedCount::known(0), + claims: MigrationAffectedCount::known(0), + environments: MigrationAffectedCount::known(bounded_count( + changed.environments.min(environment_count), + )?), + generated_artifacts, + }) +} + +fn bounded_count(value: usize) -> Result { + u32::try_from(value).context("migration affected count exceeds the supported bound") +} + +fn resolve_candidate_destination(root: &Path, requested: &Path) -> Result { + match fs::symlink_metadata(requested) { + Ok(_) => bail!("migration candidate destination must not already exist"), + Err(error) if error.kind() == ErrorKind::NotFound => {} + Err(error) => { + return Err(error).context("failed to inspect migration candidate destination") + } + } + let file_name = requested + .file_name() + .ok_or_else(|| anyhow!("migration candidate destination must name a directory"))?; + let requested_parent = requested.parent().unwrap_or_else(|| Path::new(".")); + let parent = super::canonical_root(requested_parent) + .context("migration candidate parent must be an existing real directory")?; + let destination = parent.join(file_name); + if destination.starts_with(root) { + bail!("migration candidate destination must be outside the source project"); + } + Ok(destination) +} + +fn migration_output_request( + options: &ProjectMigrationOptions, + candidate_emission: MigrationCandidateEmission, +) -> MigrationOutputRequest { + if options.output_directory.is_some() { + MigrationOutputRequest { + mode: MigrationOutputMode::SeparateOutputDirectory, + write_authority: MigrationWriteAuthority::ExplicitCandidateWriteGranted, + candidate_emission, + } + } else { + check_only_output() + } +} + +const fn check_only_output() -> MigrationOutputRequest { + MigrationOutputRequest { + mode: MigrationOutputMode::CheckOnly, + write_authority: MigrationWriteAuthority::NotGranted, + candidate_emission: MigrationCandidateEmission::NotEmitted, + } +} + +const fn supported_versions() -> MigrationVersionSupportAssessment { + MigrationVersionSupportAssessment { + source: MigrationVersionSupport::Supported, + target: MigrationVersionSupport::Supported, + } +} + +const fn unaffected_surfaces() -> MigrationAffectedSurfaces { + MigrationAffectedSurfaces { + fixtures: MigrationAffectedCount::known(0), + services: MigrationAffectedCount::known(0), + consultations: MigrationAffectedCount::known(0), + claims: MigrationAffectedCount::known(0), + environments: MigrationAffectedCount::known(0), + generated_artifacts: Vec::new(), + } +} + +const fn not_required_gates() -> MigrationGateResults { + MigrationGateResults { + schema: MigrationGateStatus::NotRequired, + fixture: MigrationGateStatus::NotRequired, + check: MigrationGateStatus::NotRequired, + build: MigrationGateStatus::NotRequired, + generated_reference: MigrationGateStatus::NotRequired, + } +} + +const fn not_applicable_gates() -> MigrationGateResults { + MigrationGateResults { + schema: MigrationGateStatus::NotApplicable, + fixture: MigrationGateStatus::NotApplicable, + check: MigrationGateStatus::NotApplicable, + build: MigrationGateStatus::NotApplicable, + generated_reference: MigrationGateStatus::NotApplicable, + } +} + +fn build_migration_report(input: ProjectMigrationInput) -> Result { + build_project_migration_report(input) + .map_err(|error| anyhow!("migration report evidence is invalid: {error:?}")) +} diff --git a/crates/registryctl/src/project_authoring/model.rs b/crates/registryctl/src/project_authoring/model.rs index 9158dbad3..8c983bea3 100644 --- a/crates/registryctl/src/project_authoring/model.rs +++ b/crates/registryctl/src/project_authoring/model.rs @@ -72,6 +72,148 @@ pub struct ProjectCheckOptions { pub anchor: Option, } +/// The result of an explicitly requested trusted-local check. +/// +/// This type deliberately does not implement `Serialize` or `Debug`. +/// `authored_values` may contain project-sensitive metadata and is only for +/// direct, human-readable terminal review. It must not enter portable reports, +/// logs, generated artifacts, comparison output, or promotion evidence. +pub struct ProjectTrustedLocalCheck { + pub report: ProjectCommandReport, + pub authored_values: Vec, +} + +/// One directly authored, non-secret scalar for trusted-local human review. +/// +/// Values classified as secret references, secret values, or redacted fixture +/// data are never constructible through this surface. Runtime secret-file +/// locators, raw parser text, and derived and defaulted values are also +/// excluded. +pub struct ProjectTrustedLocalAuthoredValue { + address: ProjectFieldAddress, + source: FieldSourceKind, + sensitivity: FieldSensitivity, + value: Value, +} + +impl ProjectTrustedLocalAuthoredValue { + /// Render one bounded, single-line terminal entry. + /// + /// No raw value accessor is exposed because this surface is not a + /// machine-report or export contract. + pub fn terminal_line(&self) -> Result { + if !matches!( + self.source, + FieldSourceKind::Authored | FieldSourceKind::EnvironmentBound + ) { + bail!("only authored values can enter trusted-local authored output"); + } + if !matches!( + self.sensitivity, + FieldSensitivity::Public + | FieldSensitivity::Internal + | FieldSensitivity::Structural + | FieldSensitivity::Sensitive + ) { + bail!("secret or fixture data cannot enter trusted-local authored output"); + } + if matches!(&self.address, ProjectFieldAddress::Fixture { .. }) { + bail!("fixture data cannot enter trusted-local authored output"); + } + if trusted_local_value_path_is_prohibited(&self.address) { + bail!("secret locator or parser input cannot enter trusted-local authored output"); + } + let address = match &self.address { + ProjectFieldAddress::Project { path } => { + format!("project:{}", trusted_local_terminal_escape(path.as_str())) + } + ProjectFieldAddress::Integration { integration, path } => format!( + "integration {}:{}", + trusted_local_terminal_escape(integration), + trusted_local_terminal_escape(path.as_str()) + ), + ProjectFieldAddress::Entity { entity, path } => format!( + "entity {}:{}", + trusted_local_terminal_escape(entity), + trusted_local_terminal_escape(path.as_str()) + ), + ProjectFieldAddress::Environment { environment, path } => format!( + "environment {}:{}", + trusted_local_terminal_escape(environment), + trusted_local_terminal_escape(path.as_str()) + ), + // Constructors exclude fixtures. Fail closed if a future internal + // change violates that invariant. + ProjectFieldAddress::Fixture { .. } => { + bail!("fixture data cannot enter trusted-local authored output") + } + }; + let value = serde_json::to_string(&self.value) + .context("trusted-local authored scalar could not be rendered")?; + Ok(format!( + "{address} = {} ({}, {})", + trusted_local_terminal_escape(&value), + match self.source { + FieldSourceKind::Authored => "authored", + FieldSourceKind::EnvironmentBound => "environment-bound", + FieldSourceKind::Defaulted => "defaulted", + FieldSourceKind::Detected => "detected", + FieldSourceKind::Derived => "derived", + FieldSourceKind::Generated => "generated", + FieldSourceKind::Runtime => "runtime", + FieldSourceKind::Absent => "absent", + }, + match self.sensitivity { + FieldSensitivity::Public => "public", + FieldSensitivity::Internal => "internal", + FieldSensitivity::Sensitive => "sensitive", + FieldSensitivity::SecretReference => "secret-reference", + FieldSensitivity::SecretValue => "secret-value", + FieldSensitivity::RedactedFixture => "redacted-fixture", + FieldSensitivity::Structural => "structural", + } + )) + } +} + +fn trusted_local_terminal_escape(value: &str) -> String { + let mut escaped = String::with_capacity(value.len()); + for character in value.chars() { + match character { + '\n' => escaped.push_str("\\n"), + '\r' => escaped.push_str("\\r"), + '\t' => escaped.push_str("\\t"), + character if character.is_control() => { + use std::fmt::Write as _; + write!(escaped, "\\u{:04x}", character as u32) + .expect("writing to a String cannot fail"); + } + character => escaped.push(character), + } + } + escaped +} + +fn trusted_local_value_path_is_prohibited(address: &ProjectFieldAddress) -> bool { + let path = match address { + ProjectFieldAddress::Project { path } + | ProjectFieldAddress::Integration { path, .. } + | ProjectFieldAddress::Entity { path, .. } + | ProjectFieldAddress::Environment { path, .. } + | ProjectFieldAddress::Fixture { path, .. } => path.as_str(), + }; + let field_name = path.rsplit('/').next().unwrap_or_default(); + matches!( + field_name, + "token_file" + | "workload_token_file" + | "secret_file" + | "private_key_file" + | "cel" + | "x-registry-source" + ) || path == "/starter/content_digest" +} + #[derive(Debug, Clone)] pub struct ProjectBuildOptions { pub project_directory: PathBuf, @@ -80,6 +222,50 @@ pub struct ProjectBuildOptions { pub anchor: Option, } +/// Product-labelled approved baselines for a project build. +/// +/// Relay and Notary remain independently signed product inputs. A combined +/// project comparison therefore supplies both pairs, while a single-product +/// project supplies only its product pair. The legacy `against` and `anchor` +/// fields on [`ProjectBuildOptions`] remain available for single-product +/// callers. +#[derive(Debug, Clone, Default)] +pub struct ProjectBuildBaselineSetOptions { + pub relay_against: Option, + pub relay_anchor: Option, + pub notary_against: Option, + pub notary_anchor: Option, +} + +#[derive(Debug, Clone)] +pub struct ProjectPreflightOptions { + pub project_directory: PathBuf, + pub environment: String, +} + +#[derive(Debug, Clone)] +pub struct ProjectCapabilityOptions { + pub project_directory: PathBuf, + pub environment: String, +} + +/// Options for an offline promotion decision. The comparison baseline must be +/// a verified product bundle so the decision never treats an unauthenticated +/// local artifact as reviewed authority. +#[derive(Debug, Clone)] +pub struct ProjectPromotionOptions { + pub project_directory: PathBuf, + pub environment: String, + /// One verified product baseline for Relay-only or Notary-only projects. + /// Combined projects should use the product-specific pairs below. + pub against: Option, + pub anchor: Option, + pub relay_against: Option, + pub relay_anchor: Option, + pub notary_against: Option, + pub notary_anchor: Option, +} + #[derive(Debug, Clone, Serialize)] #[serde(deny_unknown_fields)] pub struct ProjectCommandReport { @@ -94,7 +280,13 @@ pub struct ProjectCommandReport { #[serde(skip_serializing_if = "Option::is_none")] pub output: Option, #[serde(skip_serializing_if = "Option::is_none")] - pub explanation: Option, + pub semantic_impact: Option, + #[serde(skip_serializing_if = "Option::is_none")] + pub artifact_manifest: Option, + #[serde(skip_serializing_if = "Option::is_none")] + pub fixture_coverage: Option, + #[serde(skip_serializing_if = "Option::is_none")] + pub explanation: Option, } #[derive(Debug, Clone, Serialize, PartialEq, Eq)] @@ -120,10 +312,32 @@ pub struct ProjectAuthoringDiagnostic { pub schema_hint: Option<&'static str>, #[serde(skip_serializing_if = "Option::is_none")] pub suggestion: Option<&'static str>, + /// Machine-readable project-relative locations. `file` and `field` stay + /// available as the stable compatibility projection used by existing CLI + /// renderers and integrations. + pub addresses: Vec, + pub phase: &'static str, + pub rule: &'static str, + pub accepted: &'static str, + pub safe_summary_policy: &'static str, + pub received_summary: &'static str, + pub documentation: &'static str, + #[serde(skip_serializing_if = "Option::is_none")] + pub replacement: Option<&'static str>, + #[serde(skip_serializing_if = "Option::is_none")] + pub changed_behavior: Option<&'static str>, pub cause: &'static str, pub remediation: &'static str, } +#[derive(Debug, Clone, Serialize, PartialEq, Eq)] +#[serde(deny_unknown_fields)] +pub struct ProjectAuthoringDiagnosticAddress { + pub file: String, + /// An RFC 6901 JSON Pointer. The empty pointer identifies the document. + pub pointer: String, +} + #[derive(Debug, Clone, Serialize)] #[serde(deny_unknown_fields)] pub struct FixtureReport { @@ -150,6 +364,7 @@ pub struct SemanticChange { pub dimension: &'static str, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct RegistryProject { @@ -164,6 +379,7 @@ struct RegistryProject { services: BTreeMap, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct StarterProvenance { @@ -172,24 +388,28 @@ struct StarterProvenance { content_digest: String, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct RegistryDeclaration { id: String, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct IntegrationReference { file: PathBuf, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct EntityReference { file: PathBuf, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct ServiceDeclaration { @@ -232,6 +452,7 @@ struct ServiceDeclaration { api: Option, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Clone, Copy, Deserialize, Serialize, PartialEq, Eq)] #[serde(rename_all = "snake_case")] enum ServiceKind { @@ -243,6 +464,7 @@ fn default_consent() -> ConsentDeclaration { ConsentDeclaration::NotRequired } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize, PartialEq, Eq)] #[serde(rename_all = "snake_case")] enum ConsentDeclaration { @@ -250,6 +472,7 @@ enum ConsentDeclaration { Required, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Clone, Default, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct AccessDeclaration { @@ -257,6 +480,7 @@ struct AccessDeclaration { scopes: Vec, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct EntityDefinition { @@ -268,6 +492,7 @@ struct EntityDefinition { materialization: EntityMaterialization, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct EntityObjectSchema { @@ -279,12 +504,14 @@ struct EntityObjectSchema { properties: BTreeMap, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Clone, Copy, Deserialize, Serialize, PartialEq, Eq)] #[serde(rename_all = "lowercase")] enum EntityObjectType { Object, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct EntityFieldSchema { @@ -308,6 +535,7 @@ struct EntityFieldSchema { maximum: Option, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct EntityMaterialization { @@ -317,6 +545,7 @@ struct EntityMaterialization { retain_generations: u8, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Clone, Copy, Deserialize, Serialize, PartialEq, Eq)] #[serde(rename_all = "snake_case")] enum RecordSensitivity { @@ -327,6 +556,7 @@ enum RecordSensitivity { Secret, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Clone, Copy, Deserialize, Serialize)] #[serde(rename_all = "snake_case")] enum RecordAccessRights { @@ -335,6 +565,7 @@ enum RecordAccessRights { NonPublic, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Clone, Copy, Deserialize, Serialize)] #[serde(rename_all = "snake_case")] enum RecordUpdateFrequency { @@ -350,6 +581,7 @@ enum RecordUpdateFrequency { Unknown, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct RecordField { @@ -369,6 +601,7 @@ struct RecordField { language: Option, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Clone, Copy, Deserialize, Serialize, PartialEq, Eq)] #[serde(rename_all = "snake_case")] enum RecordFieldType { @@ -380,6 +613,7 @@ enum RecordFieldType { Timestamp, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct RecordsApiDeclaration { @@ -405,6 +639,7 @@ struct RecordsApiDeclaration { /// deliberately exposes only the minimizing subset used by Registry Relay: /// exact-one subject resolution, purpose binding, and typed claim selection. /// Source metadata disclosure and response caching are not authoring options. +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct RecordAttributeReleaseProfile { @@ -420,6 +655,7 @@ struct RecordAttributeReleaseProfile { claims: BTreeMap, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct RecordAttributeReleaseSubject { @@ -427,18 +663,21 @@ struct RecordAttributeReleaseSubject { id_type: String, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct RecordAttributeReleaseConditions { expression: RecordAttributeReleaseExpression, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct RecordAttributeReleaseExpression { cel: String, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct RecordAttributeReleaseClaim { @@ -450,6 +689,7 @@ struct RecordAttributeReleaseClaim { sensitivity: RecordAttributeReleaseSensitivity, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Clone, Copy, Deserialize, Serialize)] #[serde(rename_all = "snake_case")] enum RecordAttributeReleaseSensitivity { @@ -459,6 +699,7 @@ enum RecordAttributeReleaseSensitivity { Pseudonymous, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct RecordScopes { @@ -470,6 +711,7 @@ struct RecordScopes { evidence_verification: Option, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct RecordPagination { @@ -477,6 +719,7 @@ struct RecordPagination { max_limit: u32, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Clone, Copy, Deserialize, Serialize, PartialEq, Eq, PartialOrd, Ord)] #[serde(rename_all = "snake_case")] enum RecordFilterOperator { @@ -487,6 +730,7 @@ enum RecordFilterOperator { Between, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct RecordRelationship { @@ -497,6 +741,7 @@ struct RecordRelationship { concept_uri: Option, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Clone, Copy, Deserialize, Serialize)] #[serde(rename_all = "snake_case")] enum RecordRelationshipKind { @@ -505,6 +750,7 @@ enum RecordRelationshipKind { HasOne, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct RecordAggregate { @@ -536,6 +782,7 @@ struct RecordAggregate { disclosure_control: RecordDisclosureControl, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct RecordAggregateDimension { @@ -546,6 +793,7 @@ struct RecordAggregateDimension { codelist: Option, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct RecordAggregateIndicator { @@ -564,6 +812,7 @@ struct RecordAggregateIndicator { definition_uri: Option, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct RecordAggregateAccess { @@ -575,6 +824,7 @@ struct RecordAggregateAccess { aggregate_only_execution: bool, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(tag = "mode", rename_all = "snake_case", deny_unknown_fields)] enum RecordAggregateSpatial { @@ -592,6 +842,7 @@ enum RecordAggregateSpatial { }, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct RecordAggregateMeasure { @@ -600,6 +851,7 @@ struct RecordAggregateMeasure { column: String, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Clone, Copy, Deserialize, Serialize)] #[serde(rename_all = "snake_case")] enum RecordAggregateFunction { @@ -613,6 +865,7 @@ enum RecordAggregateFunction { Stddev, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct RecordDisclosureControl { @@ -626,6 +879,7 @@ fn default_record_min_group_size() -> u32 { 5 } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Default, Clone, Copy, Deserialize, Serialize)] #[serde(rename_all = "snake_case")] enum RecordSuppression { @@ -635,6 +889,7 @@ enum RecordSuppression { Null, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct RecordStandards { @@ -642,6 +897,7 @@ struct RecordStandards { sp_dci: RecordStandard, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(untagged)] enum RecordStandard { @@ -649,6 +905,7 @@ enum RecordStandard { Disabled(bool), } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct RecordSpatial { @@ -677,6 +934,7 @@ fn default_record_max_geometry_vertices() -> u32 { 10_000 } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(tag = "kind", rename_all = "snake_case", deny_unknown_fields)] enum RecordSpatialGeometry { @@ -699,6 +957,7 @@ enum RecordSpatialGeometry { }, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct RecordSpatialBbox { @@ -708,6 +967,7 @@ struct RecordSpatialBbox { max_y: String, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct RecordSpdci { @@ -720,6 +980,7 @@ struct RecordSpdci { response_fields: BTreeMap, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct RequestVariable { @@ -728,6 +989,7 @@ struct RequestVariable { value_type: OutputType, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct ConsultationDeclaration { @@ -735,6 +997,7 @@ struct ConsultationDeclaration { input: BTreeMap, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct ClaimDeclaration { @@ -747,6 +1010,7 @@ struct ClaimDeclaration { disclosure: DisclosureDeclaration, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Clone, Copy, Deserialize, Serialize, PartialEq, Eq)] #[serde(rename_all = "snake_case")] enum ClaimEvidence { @@ -754,6 +1018,7 @@ enum ClaimEvidence { SelfAttested, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct ClaimValueDeclaration { @@ -765,6 +1030,7 @@ struct ClaimValueDeclaration { max_bytes: Option, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(untagged)] enum DisclosureDeclaration { @@ -775,6 +1041,7 @@ enum DisclosureDeclaration { }, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Clone, Copy, Deserialize, Serialize, PartialEq, Eq, PartialOrd, Ord)] #[serde(rename_all = "snake_case")] enum DisclosureMode { @@ -783,6 +1050,7 @@ enum DisclosureMode { Redacted, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct CredentialProfileDeclaration { @@ -793,6 +1061,7 @@ struct CredentialProfileDeclaration { claims: Vec, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct IntegrationDocument { @@ -810,6 +1079,7 @@ struct IntegrationDocument { fixtures: PathBuf, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Default, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct NotApplicableDeclaration { @@ -819,6 +1089,7 @@ struct NotApplicableDeclaration { subject_mismatch: Option, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct NotApplicableReason { @@ -830,6 +1101,7 @@ fn default_integration_revision() -> u32 { 1 } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct SourceDeclaration { @@ -837,6 +1109,7 @@ struct SourceDeclaration { versions: SourceVersions, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Clone, Default, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct SourceVersions { @@ -846,6 +1119,7 @@ struct SourceVersions { unverified: Vec, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct InputDeclaration { @@ -871,6 +1145,7 @@ struct InputDeclaration { maximum: Option, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize, PartialEq, Eq)] #[serde(rename_all = "snake_case")] enum InputType { @@ -880,6 +1155,7 @@ enum InputType { Integer, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Clone, Deserialize, Serialize)] #[serde(rename_all = "snake_case")] enum Canonicalization { @@ -887,6 +1163,7 @@ enum Canonicalization { AsciiLowercase, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Clone, Copy, Deserialize, Serialize, PartialEq, Eq)] #[serde(rename_all = "snake_case")] enum CredentialType { @@ -898,6 +1175,7 @@ enum CredentialType { ApiKeyQuery, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Clone, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct CredentialInterface { @@ -919,6 +1197,7 @@ struct CredentialInterface { refresh_skew: Option, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Clone, Copy, Deserialize, Serialize, PartialEq, Eq)] #[serde(rename_all = "snake_case")] enum OAuthRequestFormat { @@ -926,12 +1205,14 @@ enum OAuthRequestFormat { Json, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Clone, Copy, Deserialize, Serialize, PartialEq, Eq)] #[serde(rename_all = "snake_case")] enum OAuthResponseProfile { Oauth2Bearer, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(untagged)] enum CapabilityDeclaration { @@ -940,6 +1221,7 @@ enum CapabilityDeclaration { Script { script: Box }, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct HttpDeclaration { @@ -949,6 +1231,7 @@ struct HttpDeclaration { response_max_bytes_authored: bool, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct ScriptDeclaration { @@ -964,6 +1247,7 @@ struct ScriptDeclaration { modules: Vec, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Clone, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct ScriptAllowRule { @@ -973,6 +1257,7 @@ struct ScriptAllowRule { semantics: Option, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Clone, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct ScriptResponseDeclaration { @@ -982,12 +1267,14 @@ struct ScriptResponseDeclaration { max_bytes_authored: bool, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Clone, Copy, Deserialize, Serialize, PartialEq, Eq)] #[serde(rename_all = "snake_case")] enum ScriptRuntime { RhaiV1, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct SnapshotDeclaration { @@ -998,6 +1285,7 @@ struct SnapshotDeclaration { materialization: SnapshotFootprint, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct SnapshotFootprint { @@ -1005,6 +1293,7 @@ struct SnapshotFootprint { max_source_bytes: u64, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct OperationDeclaration { @@ -1022,6 +1311,7 @@ struct OperationDeclaration { when: Option, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct VerificationDeclaration { @@ -1029,6 +1319,7 @@ struct VerificationDeclaration { jwks: String, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Default, Deserialize, Serialize, PartialEq, Eq)] #[serde(rename_all = "snake_case")] enum OperationRole { @@ -1038,6 +1329,7 @@ enum OperationRole { Verification, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct RequestDeclaration { @@ -1060,6 +1352,7 @@ struct RequestDeclaration { authorization: Option, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Clone, Copy, Deserialize, Serialize, PartialEq, Eq)] #[serde(rename_all = "UPPERCASE")] enum ReadMethod { @@ -1067,6 +1360,7 @@ enum ReadMethod { Post, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(untagged, deny_unknown_fields)] enum ValueSource { @@ -1075,6 +1369,7 @@ enum ValueSource { Prior { prior: String }, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct ConditionDeclaration { @@ -1082,6 +1377,7 @@ struct ConditionDeclaration { equals: Value, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct ResponseDeclaration { @@ -1096,6 +1392,7 @@ struct ResponseDeclaration { status_semantics: Option, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Default, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct StatusSemanticsDeclaration { @@ -1105,6 +1402,7 @@ struct StatusSemanticsDeclaration { ambiguous: Vec, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct CardinalityDeclaration { @@ -1113,6 +1411,7 @@ struct CardinalityDeclaration { mode: CardinalityMode, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Clone, Copy, Deserialize, Serialize, PartialEq, Eq)] #[serde(rename_all = "snake_case")] enum CardinalityMode { @@ -1120,6 +1419,7 @@ enum CardinalityMode { ProbeTwo, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(tag = "type", rename_all = "snake_case", deny_unknown_fields)] enum SchemaNode { @@ -1147,6 +1447,7 @@ fn reject_additional() -> AdditionalFields { AdditionalFields::Reject } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize, PartialEq, Eq)] #[serde(rename_all = "snake_case")] enum AdditionalFields { @@ -1160,6 +1461,65 @@ struct SchemaField { schema: SchemaNode, } +// `SchemaField` has a deliberate hand-written deserializer because `required` +// is flattened into each tagged `SchemaNode` object. Keep its mechanically +// derived structural schema tied to that exact wire shape instead of allowing +// schemars to infer the private storage shape above. +#[cfg(test)] +#[allow( + dead_code, + reason = "schema-only wire variants describe a custom deserializer and are never constructed" +)] +#[derive(schemars::JsonSchema)] +#[serde(tag = "type", rename_all = "snake_case", deny_unknown_fields)] +enum SchemaFieldWireShape { + Object { + #[serde(default)] + required: bool, + #[serde(default = "reject_additional")] + additional_fields: AdditionalFields, + fields: BTreeMap, + }, + Array { + #[serde(default)] + required: bool, + max_items: u16, + items: Box, + }, + String { + #[serde(default)] + required: bool, + max_bytes: u32, + }, + Integer { + #[serde(default)] + required: bool, + min: i64, + max: i64, + }, + Boolean { + #[serde(default)] + required: bool, + }, + Date { + #[serde(default)] + required: bool, + }, +} + +#[cfg(test)] +impl schemars::JsonSchema for SchemaField { + fn schema_name() -> std::borrow::Cow<'static, str> { + "SchemaField".into() + } + + fn json_schema( + generator: &mut schemars::SchemaGenerator, + ) -> schemars::Schema { + ::json_schema(generator) + } +} + impl<'de> Deserialize<'de> for SchemaField { fn deserialize(deserializer: D) -> std::result::Result where @@ -1197,6 +1557,7 @@ impl Serialize for SchemaField { } } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Clone, Copy, Deserialize, Serialize, PartialEq, Eq)] #[serde(rename_all = "snake_case")] enum OutputType { @@ -1207,6 +1568,7 @@ enum OutputType { Presence, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct OutputDeclaration { @@ -1226,6 +1588,7 @@ struct OutputDeclaration { source_pointer: Option, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct BoundsDeclaration { @@ -1244,6 +1607,7 @@ struct BoundsDeclaration { concurrency: u16, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct EnvironmentDocument { @@ -1271,12 +1635,14 @@ struct EnvironmentDocument { deployment: DeploymentBinding, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct EnvironmentIntegration { source: EnvironmentSourceBinding, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct EnvironmentSourceBinding { @@ -1301,6 +1667,7 @@ struct EnvironmentSourceBinding { timeout: Option, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct CertificateAuthorityBinding { @@ -1308,6 +1675,7 @@ struct CertificateAuthorityBinding { generation: u64, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct MutualTlsBinding { @@ -1316,6 +1684,7 @@ struct MutualTlsBinding { generation: u64, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct PrivateEndpointBinding { @@ -1330,6 +1699,7 @@ struct PrivateEndpointBinding { generation: u64, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct SourceRateBinding { @@ -1337,6 +1707,7 @@ struct SourceRateBinding { burst: u16, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct EnvironmentCredential { @@ -1355,12 +1726,14 @@ struct EnvironmentCredential { generation: u64, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct SecretReference { secret: String, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct EnvironmentEntityBinding { @@ -1370,6 +1743,7 @@ struct EnvironmentEntityBinding { generation: String, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(tag = "type", rename_all = "snake_case", deny_unknown_fields)] enum RecordProvider { @@ -1400,6 +1774,7 @@ enum RecordProvider { }, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct IssuanceBinding { @@ -1411,6 +1786,7 @@ struct IssuanceBinding { generation: u64, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Clone, Copy, Default, Deserialize, Serialize)] enum IssuanceSigningAlgorithm { #[default] @@ -1429,6 +1805,7 @@ impl IssuanceSigningAlgorithm { } } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct CallerBinding { @@ -1436,6 +1813,7 @@ struct CallerBinding { scopes: Vec, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct RelayBinding { @@ -1446,6 +1824,7 @@ struct RelayBinding { allowed_clients: Vec, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct NotaryRelayBinding { @@ -1454,36 +1833,42 @@ struct NotaryRelayBinding { token_file: PathBuf, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct RelayStateBinding { postgresql: RelayPostgresqlBinding, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct RelayPostgresqlBinding { root_certificate_path: PathBuf, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct NotaryStateBinding { postgresql: NotaryPostgresqlBinding, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct NotaryPostgresqlBinding { root_certificate_path: PathBuf, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct NotaryCelBinding { worker_memory_bytes: u64, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct Oid4vciBinding { @@ -1500,6 +1885,7 @@ struct Oid4vciBinding { tx_code: Oid4vciTxCodeBinding, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct Oid4vciTxCodeBinding { @@ -1519,6 +1905,7 @@ const fn default_oid4vci_tx_code_required() -> bool { true } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct Oid4vciCredentialBinding { @@ -1526,6 +1913,7 @@ struct Oid4vciCredentialBinding { profile: String, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct Oid4vciAuthorizationServerBinding { @@ -1536,6 +1924,7 @@ struct Oid4vciAuthorizationServerBinding { token_url: String, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct Oid4vciClientBinding { @@ -1544,6 +1933,7 @@ struct Oid4vciClientBinding { signing_kid: String, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct Oid4vciSigningKeyBinding { @@ -1551,6 +1941,7 @@ struct Oid4vciSigningKeyBinding { signing_kid: String, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct Oid4vciSubjectBinding { @@ -1558,6 +1949,7 @@ struct Oid4vciSubjectBinding { id_type: String, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct DeploymentBinding { @@ -1568,6 +1960,7 @@ struct DeploymentBinding { notary: Option, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Clone, Copy, Deserialize, Serialize)] #[serde(rename_all = "snake_case")] enum DeploymentProfile { @@ -1588,6 +1981,7 @@ impl DeploymentProfile { } } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct ServiceBinding { @@ -1598,6 +1992,8 @@ struct ServiceBinding { struct FixtureDocument { name: String, classification: AuthoredFixtureClassification, + #[serde(default)] + request: Option, input: BTreeMap, #[serde(default)] variables: BTreeMap, @@ -1605,6 +2001,85 @@ struct FixtureDocument { expect: FixtureExpectation, } +/// The closed governed request accepted by both `project test --live` and an +/// independently authored synthetic fixture witness. +/// +/// Keeping one internal request type prevents fixture authoring from drifting +/// into a looser contract than the live Notary boundary. +#[cfg_attr(test, derive(schemars::JsonSchema))] +#[derive(Clone, Debug, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +struct GovernedLiveRequest { + target: GovernedLiveTarget, + #[cfg_attr(test, schemars(with = "BTreeMap"))] + #[serde( + default, + skip_serializing_if = "registry_notary_core::RequestVariables::is_empty" + )] + variables: registry_notary_core::RequestVariables, + claims: Vec, + #[serde(default, skip_serializing_if = "Option::is_none")] + disclosure: Option, + #[serde(default, skip_serializing_if = "Option::is_none")] + format: Option, + purpose: String, +} + +impl GovernedLiveRequest { + fn to_evaluate_request(&self) -> registry_notary_core::EvaluateRequest { + registry_notary_core::EvaluateRequest { + requester: None, + target: Some(registry_notary_core::EvidenceEntity { + entity_type: self.target.entity_type.clone(), + id: self.target.id.clone(), + identifiers: self + .target + .identifiers + .iter() + .map(|identifier| registry_notary_core::EvidenceIdentifier { + scheme: identifier.scheme.clone(), + value: identifier.value.clone(), + issuer: None, + country: None, + }) + .collect(), + attributes: self.target.attributes.clone(), + assurance: None, + profile: None, + }), + relationship: None, + on_behalf_of: None, + variables: self.variables.clone(), + claims: self.claims.clone(), + disclosure: self.disclosure.clone(), + format: self.format.clone(), + purpose: Some(self.purpose.clone()), + } + } +} + +#[cfg_attr(test, derive(schemars::JsonSchema))] +#[derive(Clone, Debug, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +struct GovernedLiveTarget { + #[serde(rename = "type")] + entity_type: String, + #[serde(default, skip_serializing_if = "Option::is_none")] + id: Option, + #[serde(default, skip_serializing_if = "Vec::is_empty")] + identifiers: Vec, + #[serde(default, skip_serializing_if = "BTreeMap::is_empty")] + attributes: BTreeMap, +} + +#[cfg_attr(test, derive(schemars::JsonSchema))] +#[derive(Clone, Debug, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +struct GovernedLiveIdentifier { + scheme: String, + value: String, +} + #[derive(Debug, Clone, Serialize)] struct FixtureInteraction { expect: FixtureRequestExpectation, @@ -1632,6 +2107,7 @@ enum FixtureSourceResponse { }, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Deserialize, Serialize)] #[serde(deny_unknown_fields)] struct FixtureExpectation { @@ -1653,6 +2129,7 @@ struct LoadedRegistryProject { integrations: BTreeMap, entities: BTreeMap, authored_hash: String, + artifact_inputs: Vec, project_content_digest: String, semantic_digests: SemanticDigests, } @@ -1674,22 +2151,33 @@ struct CompiledProject { notary_private: BTreeMap>, review: Value, approval_state: Value, - explanation: Value, + explanation: ProjectExplanationReportV1, fixture_profiles: Vec, semantic_changes: Vec, + semantic_impact: ProjectSemanticImpactReportV1, } struct FixtureProfile { service_id: String, + consultation_id: String, integration_alias: String, id: String, version: String, contract_hash: String, } +#[derive(Clone)] struct VerifiedBaseline { approval_state: Value, + approval_state_digest: String, verified_manifest: Value, + review_digest: String, +} + +#[derive(Default)] +struct VerifiedBaselineSet { + relay: Option, + notary: Option, } #[derive(Debug, Clone, Serialize)] @@ -1701,6 +2189,7 @@ struct SemanticDigests { operator_security: String, } +#[cfg_attr(test, derive(schemars::JsonSchema))] #[derive(Debug, Clone, Deserialize, Serialize, PartialEq, Eq)] #[serde(deny_unknown_fields)] struct DisclosureReviewProfile { diff --git a/crates/registryctl/src/project_authoring/output.rs b/crates/registryctl/src/project_authoring/output.rs index 0ae4d5bd2..044c2ecc2 100644 --- a/crates/registryctl/src/project_authoring/output.rs +++ b/crates/registryctl/src/project_authoring/output.rs @@ -1,5 +1,110 @@ // SPDX-License-Identifier: Apache-2.0 +include!("artifact_manifest.rs"); + +/// Trusted process-local dependencies used while executing project fixtures. +/// +/// The worker executable is supplied only by reviewed Rust callers. It is not +/// derived from authored project state, CLI options, or environment variables. +#[derive(Clone, Debug)] +pub struct ProjectExecutionContext { + worker_program: PathBuf, +} + +impl ProjectExecutionContext { + /// Uses the currently running `registryctl` executable for fixture workers. + pub fn for_current_executable() -> Result { + let worker_program = + std::env::current_exe().context("current executable is unavailable")?; + Self::new(worker_program) + } + + /// Creates a context with an explicitly injected worker executable. + /// + /// The path must be absolute and identify an existing, non-symlink regular + /// file with executable permissions. Validation happens before the path can + /// reach either Relay or Notary worker configuration. + pub fn new(worker_program: impl AsRef) -> Result { + let worker_program = worker_program.as_ref(); + if !worker_program.is_absolute() { + bail!("project worker executable path must be absolute"); + } + let metadata = fs::symlink_metadata(worker_program) + .context("project worker executable is unavailable")?; + if metadata.file_type().is_symlink() { + bail!("project worker executable must not be a symlink"); + } + if !metadata.file_type().is_file() { + bail!("project worker executable is not a regular file"); + } + validate_project_worker_executable_permissions(&metadata)?; + Ok(Self { + worker_program: worker_program.to_path_buf(), + }) + } + + fn worker_program(&self) -> &Path { + &self.worker_program + } +} + +#[cfg(unix)] +fn validate_project_worker_executable_permissions(metadata: &fs::Metadata) -> Result<()> { + use std::os::unix::fs::PermissionsExt as _; + + if metadata.permissions().mode() & 0o111 == 0 { + bail!("project worker executable is not executable"); + } + Ok(()) +} + +#[cfg(not(unix))] +fn validate_project_worker_executable_permissions(_metadata: &fs::Metadata) -> Result<()> { + Ok(()) +} + +#[cfg(test)] +mod project_execution_context_tests { + use super::*; + + #[test] + fn current_executable_is_a_valid_default_worker_program() { + ProjectExecutionContext::for_current_executable() + .expect("the current executable is an absolute real executable"); + } + + #[test] + fn explicit_worker_program_rejects_missing_relative_and_directory_paths() { + let temporary = tempfile::tempdir().expect("temporary directory"); + let missing = temporary.path().join("missing-worker"); + assert!(ProjectExecutionContext::new(&missing).is_err()); + assert!(ProjectExecutionContext::new(Path::new("relative-worker")).is_err()); + assert!(ProjectExecutionContext::new(temporary.path()).is_err()); + } + + #[cfg(unix)] + #[test] + fn explicit_worker_program_rejects_symlinks_and_non_executable_files() { + use std::os::unix::fs::{symlink, PermissionsExt as _}; + + let temporary = tempfile::tempdir().expect("temporary directory"); + let non_executable = temporary.path().join("non-executable-worker"); + fs::write(&non_executable, b"not executable").expect("worker file writes"); + fs::set_permissions(&non_executable, fs::Permissions::from_mode(0o600)) + .expect("worker permissions update"); + assert!(ProjectExecutionContext::new(&non_executable).is_err()); + + let executable = temporary.path().join("worker"); + fs::write(&executable, b"#!/bin/sh\nexit 0\n").expect("worker file writes"); + fs::set_permissions(&executable, fs::Permissions::from_mode(0o700)) + .expect("worker permissions update"); + let link = temporary.path().join("worker-link"); + symlink(&executable, &link).expect("worker symlink creates"); + assert!(ProjectExecutionContext::new(&link).is_err()); + ProjectExecutionContext::new(&executable).expect("real executable is accepted"); + } +} + fn validate_generated_product_configs(compiled: &CompiledProject) -> Result<()> { if compiled.relay_private.is_empty() && compiled.notary_private.is_empty() { bail!("generated deployment has no product configuration"); @@ -42,7 +147,7 @@ fn validate_generated_relay( .and_then(Value::as_array) .is_some_and(|contracts| !contracts.is_empty()) { - compile_generated_relay_fixture(relay_config, files).map(drop)?; + compile_generated_relay_fixture(relay_config, files, None).map(drop)?; } Ok(()) } @@ -117,6 +222,7 @@ impl Drop for GeneratedValidationDirectory { fn compile_generated_relay_fixture( relay_config: &[u8], files: &BTreeMap>, + worker_program: Option<&Path>, ) -> Result { let runtime: registry_relay::config::Config = serde_norway::from_slice(relay_config) .context("generated Relay config did not parse with the production model")?; @@ -148,11 +254,16 @@ fn compile_generated_relay_fixture( .collect::>(); let bundle = SourcePlanArtifactBundle::new(&public_refs, &pack_refs, &binding_refs) .with_evidence(&evidence_refs); - registry_relay::offline_fixture::OfflineRelayFixture::compile_with_worker_program( - &bundle, - project_registryctl_program()?, - ) - .context("generated Relay artifacts failed the production source-plan compiler") + match worker_program { + Some(worker_program) => { + registry_relay::offline_fixture::OfflineRelayFixture::compile_with_worker_program( + &bundle, + worker_program.to_path_buf(), + ) + } + None => registry_relay::offline_fixture::OfflineRelayFixture::compile(&bundle), + } + .context("generated Relay artifacts failed the production source-plan compiler") } fn generated_pinned_artifacts( @@ -270,7 +381,10 @@ fn write_compiled_project( output: &Path, compiled: &CompiledProject, runtime_identity: Option, -) -> Result<()> { + project: &str, + environment: &str, + artifact_inputs: &[ArtifactInputDigest], +) -> Result { let expected_parent = root.join(BUILD_ROOT); let parent = output .parent() @@ -303,10 +417,7 @@ fn write_compiled_project( create_dir_owner_only(&relay_root)?; write_file_map(&relay_root, &compiled.relay_private)?; write_private_file(&relay_root.join(APPROVAL_REVIEW_PATH), &review_bytes)?; - write_private_file( - &relay_root.join(APPROVAL_STATE_PATH), - &approval_state_bytes, - )?; + write_private_file(&relay_root.join(APPROVAL_STATE_PATH), &approval_state_bytes)?; } if !compiled.notary_private.is_empty() { let notary_root = temporary.join("private/notary"); @@ -327,6 +438,8 @@ fn write_compiled_project( assign_unpublished_runtime_input_owner(&temporary.join(relative), identity)?; } } + let artifact_manifest = + write_artifact_manifest(&temporary, project, environment, artifact_inputs)?; let backup = expected_parent.join(format!(".{name}.previous-{}", std::process::id())); if backup.exists() { @@ -348,7 +461,7 @@ fn write_compiled_project( fs::remove_dir_all(&backup) .with_context(|| format!("failed to remove prior build {}", backup.display()))?; } - Ok(()) + Ok(artifact_manifest) } #[cfg(unix)] @@ -358,8 +471,12 @@ fn assign_unpublished_runtime_input_owner( ) -> Result<()> { use std::os::unix::fs::{lchown, MetadataExt}; - let metadata = fs::symlink_metadata(path) - .with_context(|| format!("failed to inspect unpublished runtime input {}", path.display()))?; + let metadata = fs::symlink_metadata(path).with_context(|| { + format!( + "failed to inspect unpublished runtime input {}", + path.display() + ) + })?; if metadata.file_type().is_symlink() || (!metadata.is_dir() && !metadata.is_file()) { bail!( "unpublished runtime input contains an unsupported file type: {}", @@ -367,12 +484,18 @@ fn assign_unpublished_runtime_input_owner( ); } if metadata.is_dir() { - for entry in fs::read_dir(path) - .with_context(|| format!("failed to read unpublished runtime input {}", path.display()))? - { + for entry in fs::read_dir(path).with_context(|| { + format!( + "failed to read unpublished runtime input {}", + path.display() + ) + })? { let child = entry .with_context(|| { - format!("failed to read an entry under unpublished runtime input {}", path.display()) + format!( + "failed to read an entry under unpublished runtime input {}", + path.display() + ) })? .path(); assign_unpublished_runtime_input_owner(&child, identity)?; @@ -460,6 +583,185 @@ fn validate_baseline_pair(against: Option<&Path>, anchor: Option<&Path>) -> Resu Ok(()) } +#[derive(Clone, Copy)] +struct ApprovedBaselineSetPaths<'a> { + against: Option<&'a Path>, + anchor: Option<&'a Path>, + relay_against: Option<&'a Path>, + relay_anchor: Option<&'a Path>, + notary_against: Option<&'a Path>, + notary_anchor: Option<&'a Path>, +} + +impl<'a> ApprovedBaselineSetPaths<'a> { + fn legacy(against: Option<&'a Path>, anchor: Option<&'a Path>) -> Self { + Self { + against, + anchor, + relay_against: None, + relay_anchor: None, + notary_against: None, + notary_anchor: None, + } + } + + fn build( + options: &'a ProjectBuildOptions, + baselines: Option<&'a ProjectBuildBaselineSetOptions>, + ) -> Self { + Self { + against: options.against.as_deref(), + anchor: options.anchor.as_deref(), + relay_against: baselines.and_then(|set| set.relay_against.as_deref()), + relay_anchor: baselines.and_then(|set| set.relay_anchor.as_deref()), + notary_against: baselines.and_then(|set| set.notary_against.as_deref()), + notary_anchor: baselines.and_then(|set| set.notary_anchor.as_deref()), + } + } + + fn promotion(options: &'a ProjectPromotionOptions) -> Self { + Self { + against: options.against.as_deref(), + anchor: options.anchor.as_deref(), + relay_against: options.relay_against.as_deref(), + relay_anchor: options.relay_anchor.as_deref(), + notary_against: options.notary_against.as_deref(), + notary_anchor: options.notary_anchor.as_deref(), + } + } +} + +#[derive(Clone, Copy)] +enum BaselineSetCompleteness { + AnyVerifiedProduct, + CompleteTopologyWhenPresent, +} + +impl VerifiedBaselineSet { + fn is_empty(&self) -> bool { + self.relay.is_none() && self.notary.is_none() + } + + fn iter(&self) -> impl Iterator { + [self.relay.as_ref(), self.notary.as_ref()] + .into_iter() + .flatten() + } + + fn common(&self) -> Option<&VerifiedBaseline> { + self.relay.as_ref().or(self.notary.as_ref()) + } + + fn predecessor_manifest_identities(&self) -> Value { + json!({ + "relay": self.relay.as_ref().map(|baseline| &baseline.verified_manifest), + "notary": self.notary.as_ref().map(|baseline| &baseline.verified_manifest), + }) + } + + fn insert(&mut self, baseline: VerifiedBaseline) -> Result<()> { + match verified_baseline_product(&baseline)? { + PromotionProjectedProduct::Relay if self.relay.is_none() => { + self.relay = Some(baseline); + } + PromotionProjectedProduct::Notary if self.notary.is_none() => { + self.notary = Some(baseline); + } + PromotionProjectedProduct::Relay | PromotionProjectedProduct::Notary => { + bail!("approved baseline set contains a duplicate product") + } + } + Ok(()) + } + + fn validate_common_signed_state(&self) -> Result<()> { + let Some(common) = self.common() else { + return Ok(()); + }; + if self.iter().any(|baseline| { + baseline.approval_state != common.approval_state + || baseline.approval_state_digest != common.approval_state_digest + || baseline.review_digest != common.review_digest + }) { + bail!("approved product baselines do not share one signed project approval state"); + } + Ok(()) + } +} + +fn validate_approved_baseline_set_paths(paths: ApprovedBaselineSetPaths<'_>) -> Result<()> { + validate_named_baseline_pair("--against", paths.against, "--anchor", paths.anchor)?; + validate_named_baseline_pair( + "--relay-against", + paths.relay_against, + "--relay-anchor", + paths.relay_anchor, + )?; + validate_named_baseline_pair( + "--notary-against", + paths.notary_against, + "--notary-anchor", + paths.notary_anchor, + )?; + if paths.against.is_some() && (paths.relay_against.is_some() || paths.notary_against.is_some()) + { + bail!("--against cannot be combined with product-specific baselines"); + } + Ok(()) +} + +fn load_verified_approved_baseline_set( + paths: ApprovedBaselineSetPaths<'_>, + loaded: &LoadedRegistryProject, + completeness: BaselineSetCompleteness, +) -> Result { + validate_approved_baseline_set_paths(paths)?; + let mut baselines = VerifiedBaselineSet::default(); + if let Some(baseline) = load_verified_baseline(paths.against, paths.anchor, loaded)? { + baselines.insert(baseline)?; + } else { + for (against, anchor, expected_product) in [ + ( + paths.relay_against, + paths.relay_anchor, + PromotionProjectedProduct::Relay, + ), + ( + paths.notary_against, + paths.notary_anchor, + PromotionProjectedProduct::Notary, + ), + ] { + if let Some(baseline) = load_verified_baseline(against, anchor, loaded)? { + if verified_baseline_product(&baseline)? != expected_product { + bail!("product-specific approved baseline has the wrong product"); + } + baselines.insert(baseline)?; + } + } + } + baselines.validate_common_signed_state()?; + if matches!( + completeness, + BaselineSetCompleteness::CompleteTopologyWhenPresent + ) && !baselines.is_empty() + { + let environment = loaded + .environment + .as_ref() + .ok_or_else(|| anyhow!("approved baseline comparison requires an environment"))?; + let products = project_promotion_products(environment); + let requires_relay = products.contains(&PromotionProjectedProduct::Relay); + let requires_notary = products.contains(&PromotionProjectedProduct::Notary); + if baselines.relay.is_some() != requires_relay + || baselines.notary.is_some() != requires_notary + { + bail!("approved baseline set is incomplete for the selected product topology"); + } + } + Ok(baselines) +} + fn load_verified_baseline( against: Option<&Path>, anchor: Option<&Path>, @@ -481,20 +783,16 @@ fn load_verified_baseline( { bail!("verified baseline manifest is not bound to this product environment"); } - let review_bytes = read_verified_bundle_payload( - bundle, - &verified.manifest, - APPROVAL_REVIEW_PATH, - "review", - )?; + let review_bytes = + read_verified_bundle_payload(bundle, &verified.manifest, APPROVAL_REVIEW_PATH, "review")?; let approval_state_bytes = read_verified_bundle_payload( bundle, &verified.manifest, APPROVAL_STATE_PATH, "approval state", )?; - let review = parse_json_strict(&review_bytes) - .context("baseline review record is not strict JSON")?; + let review = + parse_json_strict(&review_bytes).context("baseline review record is not strict JSON")?; let approval_state = parse_json_strict(&approval_state_bytes) .context("baseline approval state is not strict JSON")?; validate_signed_review_record(&review)?; @@ -502,7 +800,10 @@ fn load_verified_baseline( if review.get("schema").and_then(Value::as_str) != Some(REVIEW_SCHEMA) { bail!("baseline review record has the wrong schema"); } - if approval_state.get("schema").and_then(Value::as_str) != Some(APPROVAL_STATE_SCHEMA) { + if !matches!( + approval_state.get("schema").and_then(Value::as_str), + Some(APPROVAL_STATE_SCHEMA_V1 | APPROVAL_STATE_SCHEMA_V2 | APPROVAL_STATE_SCHEMA) + ) { bail!("baseline approval state has the wrong schema"); } for value in [&review, &approval_state] { @@ -516,17 +817,15 @@ fn load_verified_baseline( if approval_state.get("compiler_version") != review.get("compiler_version") { bail!("verified baseline review and approval state disagree on compiler version"); } - let review_has_baseline = review.get("baseline").and_then(Value::as_str) - == Some("verified_signed_bundle"); + let review_has_baseline = + review.get("baseline").and_then(Value::as_str) == Some("verified_signed_bundle"); let state_has_baseline = approval_state .get("baseline") .is_some_and(|baseline| !baseline.is_null()); if review_has_baseline != state_has_baseline { bail!("verified baseline review and approval state disagree on baseline status"); } - if approval_state - .get("report_digest") - .and_then(Value::as_str) + if approval_state.get("report_digest").and_then(Value::as_str) != Some(sha256_uri(&review_bytes).as_str()) { bail!("verified baseline approval state does not bind the signed review"); @@ -555,8 +854,10 @@ fn load_verified_baseline( validate_verified_product_closure(&approval_state, &verified.manifest)?; Ok(Some(VerifiedBaseline { approval_state, + approval_state_digest: sha256_uri(&approval_state_bytes), verified_manifest: serde_json::to_value(verified.manifest) .context("failed to retain verified baseline manifest identity")?, + review_digest: sha256_uri(&review_bytes), })) } @@ -567,8 +868,8 @@ fn read_verified_bundle_payload( label: &str, ) -> Result> { let path = bundle.join(relative); - let bytes = fs::read(&path) - .with_context(|| format!("verified baseline lacks {}", path.display()))?; + let bytes = + fs::read(&path).with_context(|| format!("verified baseline lacks {}", path.display()))?; let digest = sha256_uri(&bytes); if manifest .files @@ -594,7 +895,9 @@ fn validate_verified_product_closure( let expected = approval_state .pointer(&format!("/generated_closure_digests/{product}")) .and_then(Value::as_str) - .ok_or_else(|| anyhow!("verified baseline approval state lacks its {product} closure digest"))?; + .ok_or_else(|| { + anyhow!("verified baseline approval state lacks its {product} closure digest") + })?; let mut files = manifest .files .iter() @@ -678,9 +981,12 @@ fn validate_signed_review_record(value: &Value) -> Result<()> { } fn validate_signed_approval_state(value: &Value) -> Result<()> { - let state = exact_review_object( - value, - &[ + let schema = value + .get("schema") + .and_then(Value::as_str) + .ok_or_else(|| anyhow!("baseline approval state schema must be a string"))?; + let expected = match schema { + APPROVAL_STATE_SCHEMA_V1 => &[ "schema", "registry", "environment", @@ -692,27 +998,83 @@ fn validate_signed_approval_state(value: &Value) -> Result<()> { "generated_closure_digests", "baseline", "entity_materializations", - ], - "baseline approval state", - )?; + ][..], + APPROVAL_STATE_SCHEMA_V2 => &[ + "schema", + "registry", + "environment", + "compiler_version", + "report_digest", + "authored_input_digest", + "semantic_digests", + "disclosure_digest", + "promotion_projection", + "generated_closure_digests", + "baseline", + "entity_materializations", + ][..], + APPROVAL_STATE_SCHEMA => &[ + "schema", + "registry", + "environment", + "compiler_version", + "report_digest", + "authored_input_digest", + "semantic_digests", + "disclosure_digest", + "promotion_projection", + "generated_closure_digests", + "baseline", + "entity_materializations", + ][..], + _ => bail!("baseline approval state has the wrong schema"), + }; + let state = exact_review_object(value, expected, "baseline approval state")?; for field in ["schema", "registry", "environment", "compiler_version"] { if state.get(field).and_then(Value::as_str).is_none() { bail!("baseline approval state field {field} must be a string"); } } - for field in ["report_digest", "authored_input_digest", "disclosure_digest"] { + for field in [ + "report_digest", + "authored_input_digest", + "disclosure_digest", + ] { validate_review_sha256(state.get(field), field, false)?; } let semantic = exact_review_object( state .get("semantic_digests") .ok_or_else(|| anyhow!("baseline approval state lacks semantic_digests"))?, - &["claim", "integration", "service_policy", "operator_security"], + &[ + "claim", + "integration", + "service_policy", + "operator_security", + ], "baseline approval semantic_digests", )?; - for field in ["claim", "integration", "service_policy", "operator_security"] { + for field in [ + "claim", + "integration", + "service_policy", + "operator_security", + ] { validate_review_sha256(semantic.get(field), field, false)?; } + let promotion_products = + if matches!(schema, APPROVAL_STATE_SCHEMA_V2 | APPROVAL_STATE_SCHEMA) { + let promotion_projection: ProjectPromotionProjectionV1 = + serde_json::from_value(state.get("promotion_projection").cloned().ok_or_else( + || anyhow!("baseline approval state lacks promotion_projection"), + )?) + .context("baseline approval promotion_projection is invalid")?; + validate_project_promotion_projection_structure(&promotion_projection) + .map_err(|error| anyhow!(error))?; + Some(promotion_projection.products) + } else { + None + }; let closure = exact_review_object( state .get("generated_closure_digests") @@ -726,7 +1088,28 @@ fn validate_signed_approval_state(value: &Value) -> Result<()> { validate_review_sha256(closure.get(field), field, false)?; } } - validate_approval_baseline(state.get("baseline"))?; + if let Some(products) = promotion_products.as_ref() { + for (field, product) in [ + ("relay", PromotionProjectedProduct::Relay), + ("notary", PromotionProjectedProduct::Notary), + ] { + let has_closure = closure.get(field).is_some_and(Value::is_string); + if has_closure != products.contains(&product) { + bail!( + "baseline approval promotion_projection product inventory disagrees with generated_closure_digests" + ); + } + } + } + validate_approval_baseline( + state.get("baseline"), + schema, + state + .get("environment") + .and_then(Value::as_str) + .ok_or_else(|| anyhow!("baseline approval state environment must be a string"))?, + promotion_products.as_deref(), + )?; if !state .get("entity_materializations") .is_some_and(Value::is_object) @@ -802,11 +1185,7 @@ fn validate_semantic_changes(value: &Value) -> Result<()> { .ok_or_else(|| anyhow!("baseline semantic_changes must be an array"))?; let mut dimensions = BTreeSet::new(); for change in changes { - let change = exact_review_object( - change, - &["dimension"], - "baseline semantic change", - )?; + let change = exact_review_object(change, &["dimension"], "baseline semantic change")?; let dimension = change .get("dimension") .and_then(Value::as_str) @@ -827,28 +1206,89 @@ fn validate_semantic_changes(value: &Value) -> Result<()> { Ok(()) } -fn validate_approval_baseline(value: Option<&Value>) -> Result<()> { +fn validate_approval_baseline( + value: Option<&Value>, + schema: &str, + environment: &str, + promotion_products: Option<&[PromotionProjectedProduct]>, +) -> Result<()> { let Some(value) = value else { bail!("baseline approval state lacks baseline"); }; if value.is_null() { return Ok(()); } - let baseline = exact_review_object( - value, - &["verified_manifest"], - "baseline approval state baseline", - )?; - let manifest: registry_platform_config::ConfigBundleManifest = serde_json::from_value( - baseline - .get("verified_manifest") - .cloned() - .ok_or_else(|| anyhow!("baseline approval state lacks verified_manifest"))?, - ) - .context("baseline approval verified_manifest is invalid")?; - manifest - .validate() + if schema == APPROVAL_STATE_SCHEMA { + let baseline = exact_review_object( + value, + &["verified_manifests"], + "baseline approval state baseline", + )?; + let manifests = exact_review_object( + baseline + .get("verified_manifests") + .ok_or_else(|| anyhow!("baseline approval state lacks verified_manifests"))?, + &["relay", "notary"], + "baseline approval verified_manifests", + )?; + let mut present = 0_usize; + for (field, expected_product, projected_product) in [ + ("relay", "registry-relay", PromotionProjectedProduct::Relay), + ( + "notary", + "registry-notary", + PromotionProjectedProduct::Notary, + ), + ] { + let Some(value) = manifests.get(field) else { + bail!("baseline approval state lacks a product manifest identity"); + }; + if value.is_null() { + continue; + } + let manifest: registry_platform_config::ConfigBundleManifest = + serde_json::from_value(value.clone()) + .context("baseline approval product manifest identity is invalid")?; + manifest + .validate() + .context("baseline approval product manifest identity is invalid")?; + if manifest.product != expected_product || manifest.environment != environment { + bail!("baseline approval product manifest identity has the wrong product"); + } + if !promotion_products.is_some_and(|products| products.contains(&projected_product)) { + bail!("baseline approval product manifest identity is outside project topology"); + } + present += 1; + } + if present == 0 { + bail!("baseline approval state has no predecessor product manifest identity"); + } + if promotion_products.is_some_and(|products| products.len() != present) { + bail!("baseline approval product manifest identity set is incomplete"); + } + } else { + // v1 and v2 recorded one predecessor manifest because build accepted + // only one unlabelled product baseline. Readers retain that exact + // shape, while v3 writes the closed Relay/Notary identity set above. + let baseline = exact_review_object( + value, + &["verified_manifest"], + "baseline approval state baseline", + )?; + let manifest: registry_platform_config::ConfigBundleManifest = serde_json::from_value( + baseline + .get("verified_manifest") + .cloned() + .ok_or_else(|| anyhow!("baseline approval state lacks verified_manifest"))?, + ) .context("baseline approval verified_manifest is invalid")?; + manifest + .validate() + .context("baseline approval verified_manifest is invalid")?; + if manifest.environment != environment { + bail!("baseline approval verified_manifest has the wrong environment"); + } + } Ok(()) } @@ -1017,6 +1457,7 @@ fn load_fixtures( root: &Path, directory: &Path, hasher: &mut Sha256, + artifact_inputs: &mut BTreeMap, ) -> Result> { const MAX_FIXTURE_BODY_BYTES: u64 = 8 * 1024 * 1024; const MAX_FIXTURE_BODY_CLOSURE_BYTES: u64 = 16 * 1024 * 1024; @@ -1065,15 +1506,12 @@ fn load_fixtures( let relative = path .strip_prefix(root) .map_err(|_| anyhow!("fixture escapes project root"))?; - hash_authored_file( - hasher, - relative - .to_str() - .ok_or_else(|| anyhow!("fixture path is not Unicode"))?, - &bytes, - ); - let authored: AuthoredFixtureDocument = - parse_yaml(&bytes, &relative.display().to_string())?; + let relative = relative + .to_str() + .ok_or_else(|| anyhow!("fixture path is not Unicode"))?; + record_artifact_input(artifact_inputs, relative, &bytes)?; + hash_authored_file(hasher, relative, &bytes); + let authored: AuthoredFixtureDocument = parse_yaml(&bytes, relative)?; let fixture = lower_authored_fixture( root, directory, @@ -1099,13 +1537,11 @@ fn load_fixtures( let relative = path .strip_prefix(root) .map_err(|_| anyhow!("fixture body escapes project root"))?; - hash_authored_file( - hasher, - relative - .to_str() - .ok_or_else(|| anyhow!("fixture body path is not Unicode"))?, - &bytes, - ); + let relative = relative + .to_str() + .ok_or_else(|| anyhow!("fixture body path is not Unicode"))?; + record_artifact_input(artifact_inputs, relative, &bytes)?; + hash_authored_file(hasher, relative, &bytes); } fixtures.sort_by(|left, right| left.1.name.as_bytes().cmp(right.1.name.as_bytes())); Ok(fixtures) @@ -1118,6 +1554,18 @@ fn lower_authored_fixture( body_cache: &mut BTreeMap, max_body_bytes: u64, ) -> Result { + if let Some(request) = authored.request.as_ref() { + if authored.classification != AuthoredFixtureClassification::Synthetic { + bail!("fixture governed requests require classification: synthetic"); + } + let request = serde_json::to_value(request) + .context("failed to inspect the governed synthetic fixture request")?; + if contains_sensitive_request_key(&request) + || contains_fixture_secret_reference(&request) + { + bail!("fixture governed request contains a forbidden credential-like field"); + } + } let interactions = authored .interactions .into_iter() @@ -1130,11 +1578,11 @@ fn lower_authored_fixture( }) .transpose()?; let respond = match interaction.respond { - AuthoredFixtureResponse::Http { + AuthoredFixtureResponse::Http(AuthoredFixtureHttpResponse { status, headers, body, - } => FixtureSourceResponse::Http { + }) => FixtureSourceResponse::Http { status, headers, body: body @@ -1150,7 +1598,7 @@ fn lower_authored_fixture( .transpose()? .unwrap_or(Value::Null), }, - AuthoredFixtureResponse::Timeout { timeout } => { + AuthoredFixtureResponse::Timeout(AuthoredFixtureTimeoutResponse { timeout }) => { FixtureSourceResponse::Timeout { timeout } } }; @@ -1169,6 +1617,7 @@ fn lower_authored_fixture( Ok(FixtureDocument { name: authored.name, classification: authored.classification, + request: authored.request, input: authored.input, variables: authored.variables, interactions, @@ -1176,6 +1625,21 @@ fn lower_authored_fixture( }) } +fn contains_fixture_secret_reference(value: &Value) -> bool { + match value { + Value::String(value) => { + let lower = value.to_ascii_lowercase(); + value.starts_with("${") + || lower.starts_with("secret://") + || lower.starts_with("env://") + || lower.starts_with("vault://") + } + Value::Array(values) => values.iter().any(contains_fixture_secret_reference), + Value::Object(object) => object.values().any(contains_fixture_secret_reference), + Value::Null | Value::Bool(_) | Value::Number(_) => false, + } +} + fn resolve_fixture_body( root: &Path, fixture_directory: &Path, @@ -1185,7 +1649,7 @@ fn resolve_fixture_body( ) -> Result { match body { AuthoredFixtureBody::Inline(value) => Ok(value), - AuthoredFixtureBody::File { file } => { + AuthoredFixtureBody::File(AuthoredFixtureBodyFile { file }) => { let mut components = file.components(); if components.next() != Some(Component::Normal(std::ffi::OsStr::new("bodies"))) || components.next().is_none() @@ -1226,40 +1690,16 @@ fn read_bounded_fixture_body(root: &Path, path: &Path, max_bytes: u64) -> Result Ok(bytes) } -fn parse_yaml Deserialize<'de>>(bytes: &[u8], label: &str) -> Result { - serde_norway::from_slice(bytes).map_err(|error| { - let location = error - .location() - .map(|location| format!(":{}:{}", location.line(), location.column())) - .unwrap_or_default(); - let schema = authored_schema_kind(label) - .map(|kind| { - format!( - "; schema hint: registryctl authoring schema --kind {kind} > {kind}.schema.json" - ) - }) - .unwrap_or_default(); - anyhow!("{label}{location}: invalid authored YAML: {error}{schema}") +fn parse_yaml(bytes: &[u8], label: &str) -> Result { + parse_current_authoring_document(bytes).map_err(|error| { + anyhow!( + "{label}: {error}; schema hint: registryctl authoring schema --kind {} > {}.schema.json", + T::KIND.name(), + T::KIND.name(), + ) }) } -fn authored_schema_kind(label: &str) -> Option<&'static str> { - let normalized = label.replace('\\', "/"); - if normalized == PROJECT_FILE || normalized.ends_with("/registry-stack.yaml") { - Some("project") - } else if normalized.contains("/environments/") || normalized.starts_with("environments/") { - Some("environment") - } else if normalized.ends_with("/integration.yaml") { - Some("integration") - } else if normalized.contains("/fixtures/") || normalized.starts_with("fixtures/") { - Some("fixture") - } else if normalized.contains("/entities/") || normalized.starts_with("entities/") { - Some("entity") - } else { - None - } -} - fn hash_authored_file(hasher: &mut Sha256, relative: &str, bytes: &[u8]) { hasher.update((relative.len() as u64).to_be_bytes()); hasher.update(relative.as_bytes()); @@ -1436,9 +1876,8 @@ fn validate_https_or_local_loopback_origin( ) -> Result<()> { let origin = url::Url::parse(value).with_context(|| format!("{field} is not a URL"))?; let secure = origin.scheme() == "https"; - let local_loopback = allow_local_loopback - && origin.scheme() == "http" - && url_host_is_ip_loopback(&origin); + let local_loopback = + allow_local_loopback && origin.scheme() == "http" && url_host_is_ip_loopback(&origin); if (!secure && !local_loopback) || origin.host().is_none() || !origin.username().is_empty() @@ -1478,9 +1917,8 @@ fn validate_https_or_local_loopback_resource( ) -> Result<()> { let resource = url::Url::parse(value).with_context(|| format!("{field} is invalid"))?; let secure = resource.scheme() == "https"; - let local_loopback = allow_local_loopback - && resource.scheme() == "http" - && url_host_is_ip_loopback(&resource); + let local_loopback = + allow_local_loopback && resource.scheme() == "http" && url_host_is_ip_loopback(&resource); if (!secure && !local_loopback) || resource.host().is_none() || !resource.username().is_empty() @@ -1662,9 +2100,9 @@ mod fixture_body_security_tests { let result = resolve_fixture_body( &root, &fixture_directory, - AuthoredFixtureBody::File { + AuthoredFixtureBody::File(AuthoredFixtureBodyFile { file: PathBuf::from("../outside.json"), - }, + }), &mut cache, 8 * 1024 * 1024, ); diff --git a/crates/registryctl/src/project_authoring/preflight.rs b/crates/registryctl/src/project_authoring/preflight.rs new file mode 100644 index 000000000..04289db77 --- /dev/null +++ b/crates/registryctl/src/project_authoring/preflight.rs @@ -0,0 +1,1436 @@ +// SPDX-License-Identifier: Apache-2.0 +//! Offline-only project preflight primitives. +//! +//! This module deliberately has no network, process-launch, fixture, compiler-output, or +//! product-service dependency. The command adapter must construct [`OfflinePreflightInput`] only +//! after the existing project loader, environment validator, compiler, and linked product +//! validators have completed. That keeps their bounds and topology decisions authoritative. + +use std::collections::{BTreeMap, BTreeSet}; +use std::ffi::{OsStr, OsString}; +use std::fmt; +use std::fs; +use std::path::{Component, Path, PathBuf}; + +use serde::{de, Deserialize, Deserializer, Serialize, Serializer}; + +pub const PROJECT_PREFLIGHT_SCHEMA_VERSION_V1: &str = "registryctl.project_preflight.v1"; +pub(crate) const MAX_PREFLIGHT_CHECKS: usize = 256; +pub(crate) const MAX_PREFLIGHT_DIAGNOSTICS: usize = 256; +const MAX_RUNTIME_FILE_BYTES: u64 = 1024 * 1024; +// Relay accepts source files up to 256 MiB by default. Preflight uses the same ceiling so a +// Relay-compatible country dataset is not rejected before startup while still bounding local +// metadata checks deterministically. +const MAX_ENTITY_PROVIDER_FILE_BYTES: u64 = 256 * 1024 * 1024; +const MAX_REPORT_STRING_BYTES: usize = 4096; + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +pub enum ProjectPreflightSchemaVersion { + #[serde(rename = "registryctl.project_preflight.v1")] + V1, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum PreflightStatus { + Ready, + NotReady, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum PreflightCheckState { + Available, + Missing, + Empty, + NotRegular, + UnsafeOwner, + UnsafeMode, + NotChecked, + StaticValid, + LocallyAvailable, +} + +impl PreflightCheckState { + const fn is_success(self) -> bool { + matches!( + self, + Self::Available | Self::StaticValid | Self::LocallyAvailable + ) + } +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum PreflightGenerationState { + Declared, + NotDeclared, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum PreflightStaticCapability { + ProjectModel, + EnvironmentCompleteness, + OriginRelationships, + NonWideningBounds, +} + +const REQUIRED_STATIC_CAPABILITIES: [PreflightStaticCapability; 4] = [ + PreflightStaticCapability::ProjectModel, + PreflightStaticCapability::EnvironmentCompleteness, + PreflightStaticCapability::OriginRelationships, + PreflightStaticCapability::NonWideningBounds, +]; + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum PreflightProduct { + RegistryRelay, + RegistryNotary, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum PreflightProductCapability { + ConfigurationValidation, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum PreflightSecretConsumer { + SourceBasicUsername, + SourceBasicPassword, + SourceBearerToken, + SourceOauthClientId, + SourceOauthClientSecret, + SourceApiKeyValue, + SourceMtlsPrivateKey, + SourceOauthMtlsPrivateKey, + SourceJwksMtlsPrivateKey, + EntityPostgresConnection, + IssuanceSigningKey, + CallerApiKeyFingerprint, + Oid4vciClientSigningKey, + Oid4vciAccessTokenSigningKey, + Oid4vciSensitiveStateKey, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum PreflightRuntimeFileKind { + SourceCa, + SourceMtlsCertificate, + SourceOauthCa, + SourceOauthMtlsCertificate, + SourceJwksCa, + SourceJwksMtlsCertificate, + EntityCsv, + EntityXlsx, + EntityParquet, + RelayStateRootCertificate, + NotaryStateRootCertificate, + NotaryToRelayToken, +} + +impl PreflightRuntimeFileKind { + const fn posture(self) -> RuntimeFilePosture { + match self { + // Entity source files can contain country-held person data, so they retain the same + // owner-only posture as private credential material. + Self::EntityCsv | Self::EntityXlsx | Self::EntityParquet | Self::NotaryToRelayToken => { + RuntimeFilePosture::PrivateMaterial + } + Self::SourceCa + | Self::SourceMtlsCertificate + | Self::SourceOauthCa + | Self::SourceOauthMtlsCertificate + | Self::SourceJwksCa + | Self::SourceJwksMtlsCertificate + | Self::RelayStateRootCertificate + | Self::NotaryStateRootCertificate => RuntimeFilePosture::PublicTrustMaterial, + } + } + + const fn max_bytes(self) -> u64 { + match self { + Self::EntityCsv | Self::EntityXlsx | Self::EntityParquet => { + MAX_ENTITY_PROVIDER_FILE_BYTES + } + Self::SourceCa + | Self::SourceMtlsCertificate + | Self::SourceOauthCa + | Self::SourceOauthMtlsCertificate + | Self::SourceJwksCa + | Self::SourceJwksMtlsCertificate + | Self::RelayStateRootCertificate + | Self::NotaryStateRootCertificate + | Self::NotaryToRelayToken => MAX_RUNTIME_FILE_BYTES, + } + } + + const fn generation(self) -> PreflightGenerationState { + match self { + Self::RelayStateRootCertificate + | Self::NotaryStateRootCertificate + | Self::NotaryToRelayToken => PreflightGenerationState::NotDeclared, + Self::SourceCa + | Self::SourceMtlsCertificate + | Self::SourceOauthCa + | Self::SourceOauthMtlsCertificate + | Self::SourceJwksCa + | Self::SourceJwksMtlsCertificate + | Self::EntityCsv + | Self::EntityXlsx + | Self::EntityParquet => PreflightGenerationState::Declared, + } + } +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd)] +enum RuntimeFilePosture { + PublicTrustMaterial, + PrivateMaterial, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum PreflightSeverity { + Error, + Warning, + Information, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum PreflightPhase { + StaticValidation, + SecretAvailability, + RuntimeFilePosture, + ProductCapability, + ReportBoundary, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +pub enum PreflightDiagnosticCode { + #[serde(rename = "registryctl.preflight.static_validation_not_checked")] + StaticValidationNotChecked, + #[serde(rename = "registryctl.preflight.product_validator_not_checked")] + ProductValidatorNotChecked, + #[serde(rename = "registryctl.preflight.secret_missing")] + SecretMissing, + #[serde(rename = "registryctl.preflight.secret_empty")] + SecretEmpty, + #[serde(rename = "registryctl.preflight.runtime_file_missing")] + RuntimeFileMissing, + #[serde(rename = "registryctl.preflight.runtime_file_empty")] + RuntimeFileEmpty, + #[serde(rename = "registryctl.preflight.runtime_file_not_regular")] + RuntimeFileNotRegular, + #[serde(rename = "registryctl.preflight.runtime_file_unsafe_owner")] + RuntimeFileUnsafeOwner, + #[serde(rename = "registryctl.preflight.runtime_file_unsafe_mode")] + RuntimeFileUnsafeMode, + #[serde(rename = "registryctl.preflight.runtime_file_not_checked")] + RuntimeFileNotChecked, + #[serde(rename = "registryctl.preflight.report_capacity_exceeded")] + ReportCapacityExceeded, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +pub enum PreflightRuleId { + #[serde(rename = "registryctl.preflight.authoritative_static_validation")] + AuthoritativeStaticValidation, + #[serde(rename = "registryctl.preflight.product_validator_locally_available")] + ProductValidatorLocallyAvailable, + #[serde(rename = "registryctl.preflight.secret_reference_available")] + SecretReferenceAvailable, + #[serde(rename = "registryctl.preflight.runtime_file_bounded_regular")] + RuntimeFileBoundedRegular, + #[serde(rename = "registryctl.preflight.runtime_file_safe_owner")] + RuntimeFileSafeOwner, + #[serde(rename = "registryctl.preflight.runtime_file_safe_mode")] + RuntimeFileSafeMode, + #[serde(rename = "registryctl.preflight.runtime_file_posture_supported")] + RuntimeFilePostureSupported, + #[serde(rename = "registryctl.preflight.report_capacity")] + ReportCapacity, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +pub enum PreflightDiagnosticMessage { + #[serde(rename = "Required authoritative static validation was not completed.")] + StaticValidationNotCompleted, + #[serde(rename = "A required linked product validator was not checked locally.")] + ProductValidatorNotChecked, + #[serde(rename = "A required secret reference is unavailable to this process.")] + SecretMissing, + #[serde(rename = "A required secret reference contains only whitespace.")] + SecretEmpty, + #[serde(rename = "A declared runtime file is missing.")] + RuntimeFileMissing, + #[serde(rename = "A declared runtime file is empty.")] + RuntimeFileEmpty, + #[serde(rename = "A declared runtime file is not an acceptable bounded regular file.")] + RuntimeFileNotRegular, + #[serde(rename = "A declared runtime file has an unsafe owner.")] + RuntimeFileUnsafeOwner, + #[serde(rename = "A declared runtime file has unsafe local access permissions.")] + RuntimeFileUnsafeMode, + #[serde( + rename = "Runtime file posture could not be checked with the required local invariant." + )] + RuntimeFileNotChecked, + #[serde(rename = "The preflight report reached its deterministic safety cap.")] + ReportCapacityExceeded, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum PreflightRemediation { + CompleteAuthoritativeStaticValidation, + EnableLinkedProductValidator, + ProvideSecretToProcessEnvironment, + ReplaceRuntimeFile, + SetRuntimeFileOwner, + TightenRuntimeFilePermissions, + RunOnSupportedUnix, + ReduceDeclaredPreflightInputs, +} + +/// Registryctl-owned static metadata for one operator-preflight failure code. +/// +/// Runtime reports and generated references share these closed enum members; +/// the reference aggregator consumes this table without copying its prose. +#[derive(Clone, Copy, Debug, Eq, PartialEq)] +pub(crate) struct PreflightDiagnosticDefinition { + pub code: PreflightDiagnosticCode, + pub phase: PreflightPhase, + pub rule: PreflightRuleId, + pub safe_meaning: PreflightDiagnosticMessage, + pub safe_remediation: &'static str, + pub field_address_pattern: Option<&'static str>, +} + +macro_rules! preflight_diagnostic { + ( + $code:ident, + $phase:ident, + $rule:ident, + $meaning:ident, + $remediation:literal, + $address:expr + ) => { + PreflightDiagnosticDefinition { + code: PreflightDiagnosticCode::$code, + phase: PreflightPhase::$phase, + rule: PreflightRuleId::$rule, + safe_meaning: PreflightDiagnosticMessage::$meaning, + safe_remediation: $remediation, + field_address_pattern: $address, + } + }; +} + +/// Complete Registryctl operator-preflight diagnostic catalog in lexical code +/// order. +pub(crate) const PREFLIGHT_DIAGNOSTIC_DEFINITIONS: &[PreflightDiagnosticDefinition] = &[ + preflight_diagnostic!( + ProductValidatorNotChecked, + ProductCapability, + ProductValidatorLocallyAvailable, + ProductValidatorNotChecked, + "Enable the linked product validator.", + None + ), + preflight_diagnostic!( + ReportCapacityExceeded, + ReportBoundary, + ReportCapacity, + ReportCapacityExceeded, + "Reduce declared preflight inputs.", + None + ), + preflight_diagnostic!( + RuntimeFileEmpty, + RuntimeFilePosture, + RuntimeFileBoundedRegular, + RuntimeFileEmpty, + "Replace the runtime file.", + Some("") + ), + preflight_diagnostic!( + RuntimeFileMissing, + RuntimeFilePosture, + RuntimeFileBoundedRegular, + RuntimeFileMissing, + "Replace the runtime file.", + Some("") + ), + preflight_diagnostic!( + RuntimeFileNotChecked, + RuntimeFilePosture, + RuntimeFilePostureSupported, + RuntimeFileNotChecked, + "Run preflight on a supported Unix platform.", + Some("") + ), + preflight_diagnostic!( + RuntimeFileNotRegular, + RuntimeFilePosture, + RuntimeFileBoundedRegular, + RuntimeFileNotRegular, + "Replace the runtime file.", + Some("") + ), + preflight_diagnostic!( + RuntimeFileUnsafeMode, + RuntimeFilePosture, + RuntimeFileSafeMode, + RuntimeFileUnsafeMode, + "Tighten runtime file permissions.", + Some("") + ), + preflight_diagnostic!( + RuntimeFileUnsafeOwner, + RuntimeFilePosture, + RuntimeFileSafeOwner, + RuntimeFileUnsafeOwner, + "Set the runtime file owner.", + Some("") + ), + preflight_diagnostic!( + SecretEmpty, + SecretAvailability, + SecretReferenceAvailable, + SecretEmpty, + "Provide a non-empty secret to the process environment.", + Some("") + ), + preflight_diagnostic!( + SecretMissing, + SecretAvailability, + SecretReferenceAvailable, + SecretMissing, + "Provide the secret to the process environment.", + Some("") + ), + preflight_diagnostic!( + StaticValidationNotChecked, + StaticValidation, + AuthoritativeStaticValidation, + StaticValidationNotCompleted, + "Complete authoritative static validation.", + Some("") + ), +]; + +/// Return the single catalog definition for a closed preflight code. +/// +/// The exhaustive match makes a newly added preflight code a compile failure +/// until its product-owned reference metadata is added. +pub(crate) const fn preflight_diagnostic_definition( + code: PreflightDiagnosticCode, +) -> &'static PreflightDiagnosticDefinition { + match code { + PreflightDiagnosticCode::ProductValidatorNotChecked => &PREFLIGHT_DIAGNOSTIC_DEFINITIONS[0], + PreflightDiagnosticCode::ReportCapacityExceeded => &PREFLIGHT_DIAGNOSTIC_DEFINITIONS[1], + PreflightDiagnosticCode::RuntimeFileEmpty => &PREFLIGHT_DIAGNOSTIC_DEFINITIONS[2], + PreflightDiagnosticCode::RuntimeFileMissing => &PREFLIGHT_DIAGNOSTIC_DEFINITIONS[3], + PreflightDiagnosticCode::RuntimeFileNotChecked => &PREFLIGHT_DIAGNOSTIC_DEFINITIONS[4], + PreflightDiagnosticCode::RuntimeFileNotRegular => &PREFLIGHT_DIAGNOSTIC_DEFINITIONS[5], + PreflightDiagnosticCode::RuntimeFileUnsafeMode => &PREFLIGHT_DIAGNOSTIC_DEFINITIONS[6], + PreflightDiagnosticCode::RuntimeFileUnsafeOwner => &PREFLIGHT_DIAGNOSTIC_DEFINITIONS[7], + PreflightDiagnosticCode::SecretEmpty => &PREFLIGHT_DIAGNOSTIC_DEFINITIONS[8], + PreflightDiagnosticCode::SecretMissing => &PREFLIGHT_DIAGNOSTIC_DEFINITIONS[9], + PreflightDiagnosticCode::StaticValidationNotChecked => { + &PREFLIGHT_DIAGNOSTIC_DEFINITIONS[10] + } + } +} + +#[derive(Clone, Eq, Ord, PartialEq, PartialOrd)] +pub struct PreflightProjectRelativeFile(String); + +impl PreflightProjectRelativeFile { + pub(crate) fn new(value: impl Into) -> Result { + let value = value.into(); + if !is_project_relative_file(&value) { + return Err(PreflightInputError::ProjectRelativeFile); + } + Ok(Self(value)) + } + + pub fn as_str(&self) -> &str { + &self.0 + } +} + +impl fmt::Debug for PreflightProjectRelativeFile { + fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result { + formatter + .debug_tuple("PreflightProjectRelativeFile") + .field(&self.0) + .finish() + } +} + +impl Serialize for PreflightProjectRelativeFile { + fn serialize(&self, serializer: S) -> Result + where + S: Serializer, + { + serializer.serialize_str(&self.0) + } +} + +impl<'de> Deserialize<'de> for PreflightProjectRelativeFile { + fn deserialize(deserializer: D) -> Result + where + D: Deserializer<'de>, + { + Self::new(String::deserialize(deserializer)?).map_err(de::Error::custom) + } +} + +#[derive(Clone, Eq, Ord, PartialEq, PartialOrd)] +pub struct PreflightJsonPointer(String); + +impl PreflightJsonPointer { + pub(crate) fn new(value: impl Into) -> Result { + let value = value.into(); + if !is_json_pointer(&value) { + return Err(PreflightInputError::JsonPointer); + } + Ok(Self(value)) + } + + pub fn as_str(&self) -> &str { + &self.0 + } +} + +impl fmt::Debug for PreflightJsonPointer { + fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result { + formatter + .debug_tuple("PreflightJsonPointer") + .field(&self.0) + .finish() + } +} + +impl Serialize for PreflightJsonPointer { + fn serialize(&self, serializer: S) -> Result + where + S: Serializer, + { + serializer.serialize_str(&self.0) + } +} + +impl<'de> Deserialize<'de> for PreflightJsonPointer { + fn deserialize(deserializer: D) -> Result + where + D: Deserializer<'de>, + { + Self::new(String::deserialize(deserializer)?).map_err(de::Error::custom) + } +} + +#[derive(Clone, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct PreflightFieldAddress { + pub file: PreflightProjectRelativeFile, + pub pointer: PreflightJsonPointer, +} + +impl PreflightFieldAddress { + pub(crate) fn new( + file: impl Into, + pointer: impl Into, + ) -> Result { + Ok(Self { + file: PreflightProjectRelativeFile::new(file)?, + pointer: PreflightJsonPointer::new(pointer)?, + }) + } +} + +#[derive(Clone, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct PreflightDiagnostic { + pub code: PreflightDiagnosticCode, + pub severity: PreflightSeverity, + pub phase: PreflightPhase, + pub addresses: Vec, + pub rule_id: PreflightRuleId, + pub message: PreflightDiagnosticMessage, + pub remediation: PreflightRemediation, +} + +impl PreflightDiagnostic { + fn new( + code: PreflightDiagnosticCode, + phase: PreflightPhase, + mut addresses: Vec, + rule_id: PreflightRuleId, + message: PreflightDiagnosticMessage, + remediation: PreflightRemediation, + ) -> Self { + addresses.sort(); + addresses.dedup(); + Self { + code, + severity: PreflightSeverity::Error, + phase, + addresses, + rule_id, + message, + remediation, + } + } +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct PreflightStaticCheck { + pub capability: PreflightStaticCapability, + pub addresses: Vec, + pub state: PreflightCheckState, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct PreflightProductValidatorCheck { + pub product: PreflightProduct, + pub capability: PreflightProductCapability, + pub state: PreflightCheckState, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct PreflightSecretCheck { + pub consumers: Vec, + pub addresses: Vec, + pub state: PreflightCheckState, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct PreflightRuntimeFileCheck { + pub kind: PreflightRuntimeFileKind, + pub addresses: Vec, + pub generation: PreflightGenerationState, + pub state: PreflightCheckState, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum PreflightMode { + Offline, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum PreflightContact { + None, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum PreflightAttemptState { + NotAttempted, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum PreflightWriteState { + NotWritten, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct PreflightExecutionBoundary { + pub mode: PreflightMode, + pub contact: PreflightContact, + pub network: PreflightAttemptState, + pub live_reachability: PreflightAttemptState, + pub fixture_execution: PreflightAttemptState, + pub external_processes: PreflightAttemptState, + pub build_output: PreflightWriteState, +} + +impl Default for PreflightExecutionBoundary { + fn default() -> Self { + Self { + mode: PreflightMode::Offline, + contact: PreflightContact::None, + network: PreflightAttemptState::NotAttempted, + live_reachability: PreflightAttemptState::NotAttempted, + fixture_execution: PreflightAttemptState::NotAttempted, + external_processes: PreflightAttemptState::NotAttempted, + build_output: PreflightWriteState::NotWritten, + } + } +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum PreflightRuntimeScope { + CurrentMountNamespaceAndEffectiveIdentity, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum PreflightPermissionInvariant { + UnixOwnerAndModeEnforced, + NotCheckedNonUnix, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct PreflightRuntimeBoundary { + pub posture_scope: PreflightRuntimeScope, + pub permission_invariant: PreflightPermissionInvariant, +} + +impl Default for PreflightRuntimeBoundary { + fn default() -> Self { + Self { + posture_scope: PreflightRuntimeScope::CurrentMountNamespaceAndEffectiveIdentity, + permission_invariant: permission_invariant(), + } + } +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct PreflightReportLimits { + pub max_checks: usize, + pub max_diagnostics: usize, + pub truncated: bool, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct ProjectPreflightReportV1 { + pub schema_version: ProjectPreflightSchemaVersion, + pub status: PreflightStatus, + pub project: String, + pub environment: String, + pub execution: PreflightExecutionBoundary, + pub runtime_boundary: PreflightRuntimeBoundary, + pub static_checks: Vec, + pub product_validators: Vec, + pub secret_checks: Vec, + pub runtime_files: Vec, + pub diagnostics: Vec, + pub limits: PreflightReportLimits, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq)] +pub(crate) enum PreflightInputError { + Identifier, + ProjectRelativeFile, + JsonPointer, + SecretReference, + RuntimePath, +} + +impl fmt::Display for PreflightInputError { + fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result { + formatter.write_str(match self { + Self::Identifier => "preflight identifier is invalid", + Self::ProjectRelativeFile => "preflight project-relative file is invalid", + Self::JsonPointer => "preflight JSON pointer is invalid", + Self::SecretReference => "preflight secret reference is invalid", + Self::RuntimePath => "preflight runtime path is invalid", + }) + } +} + +impl std::error::Error for PreflightInputError {} + +#[derive(Clone, Eq, Ord, PartialEq, PartialOrd)] +struct SecretReferenceName(String); + +impl SecretReferenceName { + fn new(value: impl Into) -> Result { + let value = value.into(); + if !is_secret_reference(&value) { + return Err(PreflightInputError::SecretReference); + } + Ok(Self(value)) + } +} + +impl fmt::Debug for SecretReferenceName { + fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result { + formatter.write_str("") + } +} + +#[derive(Clone, Eq, Ord, PartialEq, PartialOrd)] +struct RuntimePath(PathBuf); + +impl RuntimePath { + fn new(value: impl Into) -> Result { + let value = value.into(); + if !is_normalized_absolute_runtime_path(&value) { + return Err(PreflightInputError::RuntimePath); + } + Ok(Self(value)) + } +} + +impl fmt::Debug for RuntimePath { + fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result { + formatter.write_str("") + } +} + +#[derive(Clone)] +struct SecretRequirement { + name: SecretReferenceName, + consumer: PreflightSecretConsumer, + address: PreflightFieldAddress, +} + +impl fmt::Debug for SecretRequirement { + fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result { + formatter + .debug_struct("SecretRequirement") + .field("name", &self.name) + .field("consumer", &self.consumer) + .field("address", &self.address) + .finish() + } +} + +#[derive(Clone)] +struct RuntimeFileRequirement { + path: RuntimePath, + kind: PreflightRuntimeFileKind, + address: PreflightFieldAddress, +} + +impl fmt::Debug for RuntimeFileRequirement { + fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result { + formatter + .debug_struct("RuntimeFileRequirement") + .field("path", &self.path) + .field("kind", &self.kind) + .field("address", &self.address) + .finish() + } +} + +#[derive(Clone)] +pub(crate) struct OfflinePreflightInput { + project: String, + environment: String, + static_checks: BTreeMap>, + required_products: BTreeSet, + available_product_validators: BTreeSet, + secrets: Vec, + runtime_files: Vec, +} + +impl fmt::Debug for OfflinePreflightInput { + fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result { + formatter + .debug_struct("OfflinePreflightInput") + .field("project", &self.project) + .field("environment", &self.environment) + .field("static_checks", &self.static_checks) + .field("required_products", &self.required_products) + .field( + "available_product_validators", + &self.available_product_validators, + ) + .field("secret_requirement_count", &self.secrets.len()) + .field("runtime_file_requirement_count", &self.runtime_files.len()) + .finish() + } +} + +impl OfflinePreflightInput { + pub(crate) fn new( + project: impl Into, + environment: impl Into, + ) -> Result { + let project = project.into(); + let environment = environment.into(); + if !is_identifier(&project) || !is_identifier(&environment) { + return Err(PreflightInputError::Identifier); + } + Ok(Self { + project, + environment, + static_checks: BTreeMap::new(), + required_products: BTreeSet::new(), + available_product_validators: BTreeSet::new(), + secrets: Vec::new(), + runtime_files: Vec::new(), + }) + } + + /// Records evidence from the existing authoritative project/environment validation path. + /// + /// The preflight module does not perform or substitute for that validation. + pub(crate) fn record_static_validation( + &mut self, + capability: PreflightStaticCapability, + evidence_addresses: impl IntoIterator, + ) { + let addresses = self.static_checks.entry(capability).or_default(); + addresses.extend(evidence_addresses); + addresses.sort(); + addresses.dedup(); + } + + pub(crate) fn require_product(&mut self, product: PreflightProduct) { + self.required_products.insert(product); + } + + /// Records that the command adapter reached the linked product configuration validator. + pub(crate) fn record_product_validator_available(&mut self, product: PreflightProduct) { + self.available_product_validators.insert(product); + } + + pub(crate) fn add_secret_reference( + &mut self, + name: impl Into, + consumer: PreflightSecretConsumer, + address: PreflightFieldAddress, + ) -> Result<(), PreflightInputError> { + self.secrets.push(SecretRequirement { + name: SecretReferenceName::new(name)?, + consumer, + address, + }); + Ok(()) + } + + pub(crate) fn add_runtime_file( + &mut self, + path: impl Into, + kind: PreflightRuntimeFileKind, + address: PreflightFieldAddress, + ) -> Result<(), PreflightInputError> { + self.runtime_files.push(RuntimeFileRequirement { + path: RuntimePath::new(path)?, + kind, + address, + }); + Ok(()) + } +} + +pub(crate) trait PreflightSecretLookup { + fn get(&self, name: &str) -> Option; +} + +impl PreflightSecretLookup for F +where + F: Fn(&str) -> Option, +{ + fn get(&self, name: &str) -> Option { + self(name) + } +} + +struct ProcessEnvironment; + +impl PreflightSecretLookup for ProcessEnvironment { + fn get(&self, name: &str) -> Option { + std::env::var_os(name) + } +} + +pub(crate) fn run_offline_preflight(input: OfflinePreflightInput) -> ProjectPreflightReportV1 { + run_offline_preflight_with_secret_lookup(input, &ProcessEnvironment) +} + +pub(crate) fn run_offline_preflight_with_secret_lookup( + input: OfflinePreflightInput, + secrets: &impl PreflightSecretLookup, +) -> ProjectPreflightReportV1 { + let root_address = PreflightFieldAddress::new("registry-stack.yaml", "") + .expect("the fixed preflight root address is valid"); + let mut diagnostics = Vec::new(); + let mut truncated = false; + + let static_checks = REQUIRED_STATIC_CAPABILITIES + .into_iter() + .filter_map(|capability| { + if let Some(addresses) = input + .static_checks + .get(&capability) + .filter(|addresses| !addresses.is_empty()) + { + Some(PreflightStaticCheck { + capability, + addresses: sorted_addresses(addresses.clone()), + state: PreflightCheckState::StaticValid, + }) + } else { + diagnostics.push(PreflightDiagnostic::new( + PreflightDiagnosticCode::StaticValidationNotChecked, + PreflightPhase::StaticValidation, + vec![root_address.clone()], + PreflightRuleId::AuthoritativeStaticValidation, + PreflightDiagnosticMessage::StaticValidationNotCompleted, + PreflightRemediation::CompleteAuthoritativeStaticValidation, + )); + None + } + }) + .collect::>(); + + let product_validators = input + .required_products + .iter() + .copied() + .map(|product| { + let state = if input.available_product_validators.contains(&product) { + PreflightCheckState::LocallyAvailable + } else { + diagnostics.push(PreflightDiagnostic::new( + PreflightDiagnosticCode::ProductValidatorNotChecked, + PreflightPhase::ProductCapability, + vec![root_address.clone()], + PreflightRuleId::ProductValidatorLocallyAvailable, + PreflightDiagnosticMessage::ProductValidatorNotChecked, + PreflightRemediation::EnableLinkedProductValidator, + )); + PreflightCheckState::NotChecked + }; + PreflightProductValidatorCheck { + product, + capability: PreflightProductCapability::ConfigurationValidation, + state, + } + }) + .collect::>(); + + let (secret_checks, secret_truncated) = + collect_secret_checks(input.secrets, secrets, &mut diagnostics); + truncated |= secret_truncated; + let (runtime_files, runtime_truncated) = + collect_runtime_file_checks(input.runtime_files, &mut diagnostics); + truncated |= runtime_truncated; + + diagnostics.sort(); + diagnostics.dedup(); + if diagnostics.len() > MAX_PREFLIGHT_DIAGNOSTICS { + diagnostics.truncate(MAX_PREFLIGHT_DIAGNOSTICS - 1); + truncated = true; + } + if truncated { + let capacity_diagnostic = PreflightDiagnostic::new( + PreflightDiagnosticCode::ReportCapacityExceeded, + PreflightPhase::ReportBoundary, + vec![root_address], + PreflightRuleId::ReportCapacity, + PreflightDiagnosticMessage::ReportCapacityExceeded, + PreflightRemediation::ReduceDeclaredPreflightInputs, + ); + if diagnostics.len() == MAX_PREFLIGHT_DIAGNOSTICS { + diagnostics.truncate(MAX_PREFLIGHT_DIAGNOSTICS - 1); + } + diagnostics.push(capacity_diagnostic); + } + + let checks_succeed = static_checks.len() == REQUIRED_STATIC_CAPABILITIES.len() + && product_validators + .iter() + .all(|check| check.state.is_success()) + && secret_checks.iter().all(|check| check.state.is_success()) + && runtime_files.iter().all(|check| check.state.is_success()); + let status = if checks_succeed && diagnostics.is_empty() && !truncated { + PreflightStatus::Ready + } else { + PreflightStatus::NotReady + }; + + ProjectPreflightReportV1 { + schema_version: ProjectPreflightSchemaVersion::V1, + status, + project: input.project, + environment: input.environment, + execution: PreflightExecutionBoundary::default(), + runtime_boundary: PreflightRuntimeBoundary::default(), + static_checks, + product_validators, + secret_checks, + runtime_files, + diagnostics, + limits: PreflightReportLimits { + max_checks: MAX_PREFLIGHT_CHECKS, + max_diagnostics: MAX_PREFLIGHT_DIAGNOSTICS, + truncated, + }, + } +} + +#[derive(Default)] +struct GroupedSecret { + consumers: BTreeSet, + addresses: BTreeSet, +} + +fn collect_secret_checks( + requirements: Vec, + lookup: &impl PreflightSecretLookup, + diagnostics: &mut Vec, +) -> (Vec, bool) { + let mut grouped = BTreeMap::::new(); + for requirement in requirements { + let entry = grouped.entry(requirement.name).or_default(); + entry.consumers.insert(requirement.consumer); + entry.addresses.insert(requirement.address); + } + let mut grouped = grouped.into_iter().collect::>(); + grouped.sort_by(|left, right| { + left.1 + .addresses + .cmp(&right.1.addresses) + .then_with(|| left.1.consumers.cmp(&right.1.consumers)) + }); + let truncated = grouped.len() > MAX_PREFLIGHT_CHECKS; + grouped.truncate(MAX_PREFLIGHT_CHECKS); + + let mut checks = Vec::with_capacity(grouped.len()); + for (name, grouped) in grouped { + let state = match lookup.get(&name.0) { + None => PreflightCheckState::Missing, + Some(value) if os_string_is_whitespace(&value) => PreflightCheckState::Empty, + Some(_) => PreflightCheckState::Available, + }; + let consumers = grouped.consumers.into_iter().collect::>(); + let addresses = grouped.addresses.into_iter().collect::>(); + match state { + PreflightCheckState::Missing => diagnostics.push(PreflightDiagnostic::new( + PreflightDiagnosticCode::SecretMissing, + PreflightPhase::SecretAvailability, + addresses.clone(), + PreflightRuleId::SecretReferenceAvailable, + PreflightDiagnosticMessage::SecretMissing, + PreflightRemediation::ProvideSecretToProcessEnvironment, + )), + PreflightCheckState::Empty => diagnostics.push(PreflightDiagnostic::new( + PreflightDiagnosticCode::SecretEmpty, + PreflightPhase::SecretAvailability, + addresses.clone(), + PreflightRuleId::SecretReferenceAvailable, + PreflightDiagnosticMessage::SecretEmpty, + PreflightRemediation::ProvideSecretToProcessEnvironment, + )), + PreflightCheckState::Available => {} + _ => unreachable!("secret availability has a closed state mapping"), + } + checks.push(PreflightSecretCheck { + consumers, + addresses, + state, + }); + } + checks.sort_by(|left, right| { + left.addresses + .cmp(&right.addresses) + .then_with(|| left.consumers.cmp(&right.consumers)) + }); + (checks, truncated) +} + +#[derive(Default)] +struct GroupedRuntimeFile { + addresses: BTreeSet, +} + +fn collect_runtime_file_checks( + requirements: Vec, + diagnostics: &mut Vec, +) -> (Vec, bool) { + let mut grouped = + BTreeMap::<(RuntimePath, PreflightRuntimeFileKind), GroupedRuntimeFile>::new(); + for requirement in requirements { + grouped + .entry((requirement.path, requirement.kind)) + .or_default() + .addresses + .insert(requirement.address); + } + let mut grouped = grouped.into_iter().collect::>(); + grouped.sort_by( + |((_, left_kind), left_group), ((_, right_kind), right_group)| { + left_kind + .cmp(right_kind) + .then_with(|| left_group.addresses.cmp(&right_group.addresses)) + }, + ); + let truncated = grouped.len() > MAX_PREFLIGHT_CHECKS; + grouped.truncate(MAX_PREFLIGHT_CHECKS); + + let mut inspection_cache = + BTreeMap::<(RuntimePath, RuntimeFilePosture, u64), PreflightCheckState>::new(); + let mut checks = Vec::with_capacity(grouped.len()); + for ((path, kind), grouped) in grouped { + let posture = kind.posture(); + let max_bytes = kind.max_bytes(); + let state = *inspection_cache + .entry((path.clone(), posture, max_bytes)) + .or_insert_with(|| inspect_runtime_file(&path.0, posture, max_bytes)); + let addresses = grouped.addresses.into_iter().collect::>(); + if let Some(diagnostic) = runtime_file_diagnostic(state, addresses.clone()) { + diagnostics.push(diagnostic); + } + checks.push(PreflightRuntimeFileCheck { + kind, + addresses, + generation: kind.generation(), + state, + }); + } + checks.sort_by(|left, right| { + left.kind + .cmp(&right.kind) + .then_with(|| left.addresses.cmp(&right.addresses)) + }); + (checks, truncated) +} + +fn runtime_file_diagnostic( + state: PreflightCheckState, + addresses: Vec, +) -> Option { + let fields = match state { + PreflightCheckState::Available => return None, + PreflightCheckState::Missing => ( + PreflightDiagnosticCode::RuntimeFileMissing, + PreflightRuleId::RuntimeFileBoundedRegular, + PreflightDiagnosticMessage::RuntimeFileMissing, + PreflightRemediation::ReplaceRuntimeFile, + ), + PreflightCheckState::Empty => ( + PreflightDiagnosticCode::RuntimeFileEmpty, + PreflightRuleId::RuntimeFileBoundedRegular, + PreflightDiagnosticMessage::RuntimeFileEmpty, + PreflightRemediation::ReplaceRuntimeFile, + ), + PreflightCheckState::NotRegular => ( + PreflightDiagnosticCode::RuntimeFileNotRegular, + PreflightRuleId::RuntimeFileBoundedRegular, + PreflightDiagnosticMessage::RuntimeFileNotRegular, + PreflightRemediation::ReplaceRuntimeFile, + ), + PreflightCheckState::UnsafeOwner => ( + PreflightDiagnosticCode::RuntimeFileUnsafeOwner, + PreflightRuleId::RuntimeFileSafeOwner, + PreflightDiagnosticMessage::RuntimeFileUnsafeOwner, + PreflightRemediation::SetRuntimeFileOwner, + ), + PreflightCheckState::UnsafeMode => ( + PreflightDiagnosticCode::RuntimeFileUnsafeMode, + PreflightRuleId::RuntimeFileSafeMode, + PreflightDiagnosticMessage::RuntimeFileUnsafeMode, + PreflightRemediation::TightenRuntimeFilePermissions, + ), + PreflightCheckState::NotChecked => ( + PreflightDiagnosticCode::RuntimeFileNotChecked, + PreflightRuleId::RuntimeFilePostureSupported, + PreflightDiagnosticMessage::RuntimeFileNotChecked, + PreflightRemediation::RunOnSupportedUnix, + ), + PreflightCheckState::StaticValid | PreflightCheckState::LocallyAvailable => { + unreachable!("runtime files have a closed posture state mapping") + } + }; + Some(PreflightDiagnostic::new( + fields.0, + PreflightPhase::RuntimeFilePosture, + addresses, + fields.1, + fields.2, + fields.3, + )) +} + +#[cfg(unix)] +fn inspect_runtime_file( + path: &Path, + posture: RuntimeFilePosture, + max_bytes: u64, +) -> PreflightCheckState { + use rustix::fs::{Mode, OFlags}; + use std::os::unix::fs::MetadataExt as _; + + let before = match fs::symlink_metadata(path) { + Ok(metadata) => metadata, + Err(error) if error.kind() == std::io::ErrorKind::NotFound => { + return PreflightCheckState::Missing; + } + Err(_) => return PreflightCheckState::NotChecked, + }; + if before.file_type().is_symlink() || !before.is_file() { + return PreflightCheckState::NotRegular; + } + + let descriptor = match rustix::fs::open( + path, + OFlags::RDONLY | OFlags::CLOEXEC | OFlags::NOFOLLOW | OFlags::NONBLOCK, + Mode::empty(), + ) { + Ok(descriptor) => descriptor, + Err(error) => { + let error = std::io::Error::from(error); + return if error.kind() == std::io::ErrorKind::NotFound { + PreflightCheckState::Missing + } else { + PreflightCheckState::NotChecked + }; + } + }; + let file = fs::File::from(descriptor); + let metadata = match file.metadata() { + Ok(metadata) => metadata, + Err(_) => return PreflightCheckState::NotChecked, + }; + if !metadata.is_file() { + return PreflightCheckState::NotRegular; + } + if before.dev() != metadata.dev() || before.ino() != metadata.ino() { + return PreflightCheckState::NotChecked; + } + if metadata.len() == 0 { + return PreflightCheckState::Empty; + } + if metadata.len() > max_bytes { + return PreflightCheckState::NotRegular; + } + + let owner = metadata.uid(); + let effective_user = rustix::process::geteuid().as_raw(); + if owner != 0 && owner != effective_user { + return PreflightCheckState::UnsafeOwner; + } + let unsafe_bits = match posture { + RuntimeFilePosture::PublicTrustMaterial => 0o022, + RuntimeFilePosture::PrivateMaterial => 0o077, + }; + if metadata.mode() & unsafe_bits != 0 { + return PreflightCheckState::UnsafeMode; + } + PreflightCheckState::Available +} + +#[cfg(not(unix))] +fn inspect_runtime_file( + _path: &Path, + _posture: RuntimeFilePosture, + _max_bytes: u64, +) -> PreflightCheckState { + // The Unix ownership and access-bit invariant cannot be proved portably. Do not silently + // weaken it or report a pass on another platform. + PreflightCheckState::NotChecked +} + +#[cfg(unix)] +const fn permission_invariant() -> PreflightPermissionInvariant { + PreflightPermissionInvariant::UnixOwnerAndModeEnforced +} + +#[cfg(not(unix))] +const fn permission_invariant() -> PreflightPermissionInvariant { + PreflightPermissionInvariant::NotCheckedNonUnix +} + +fn sorted_addresses(mut addresses: Vec) -> Vec { + addresses.sort(); + addresses.dedup(); + addresses +} + +fn is_identifier(value: &str) -> bool { + let mut bytes = value.bytes(); + matches!(bytes.next(), Some(first) if first.is_ascii_alphanumeric()) + && value.len() <= 96 + && bytes.all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'.' | b'_' | b'-')) +} + +fn is_project_relative_file(value: &str) -> bool { + !value.is_empty() + && value.len() <= MAX_REPORT_STRING_BYTES + && !value.starts_with('/') + && !value.contains('\\') + && value.split('/').all(|component| { + !component.is_empty() + && component != "." + && component != ".." + && component + .bytes() + .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'.' | b'_' | b'-')) + }) +} + +fn is_json_pointer(value: &str) -> bool { + if value.len() > MAX_REPORT_STRING_BYTES + || (!value.is_empty() && !value.starts_with('/')) + || value.chars().any(char::is_control) + { + return false; + } + let mut bytes = value.bytes(); + while let Some(byte) = bytes.next() { + if byte == b'~' && !matches!(bytes.next(), Some(b'0' | b'1')) { + return false; + } + } + true +} + +fn is_secret_reference(value: &str) -> bool { + let mut bytes = value.bytes(); + matches!(bytes.next(), Some(first) if first == b'_' || first.is_ascii_uppercase()) + && value.len() <= 128 + && bytes.all(|byte| byte == b'_' || byte.is_ascii_uppercase() || byte.is_ascii_digit()) +} + +fn is_normalized_absolute_runtime_path(path: &Path) -> bool { + let Some(value) = path.to_str() else { + return false; + }; + if value.len() < 2 + || value.len() > MAX_REPORT_STRING_BYTES + || !value.starts_with('/') + || value.contains("//") + { + return false; + } + let mut components = path.components(); + matches!(components.next(), Some(Component::RootDir)) + && components.all(|component| matches!(component, Component::Normal(_))) +} + +fn os_string_is_whitespace(value: &OsStr) -> bool { + if value.is_empty() { + return true; + } + match value.to_str() { + Some(value) => value.chars().all(char::is_whitespace), + None => os_string_bytes_are_ascii_whitespace(value), + } +} + +#[cfg(unix)] +fn os_string_bytes_are_ascii_whitespace(value: &OsStr) -> bool { + use std::os::unix::ffi::OsStrExt as _; + + value.as_bytes().iter().all(u8::is_ascii_whitespace) +} + +#[cfg(not(unix))] +fn os_string_bytes_are_ascii_whitespace(_value: &OsStr) -> bool { + false +} diff --git a/crates/registryctl/src/project_authoring/project.rs b/crates/registryctl/src/project_authoring/project.rs index 23892a263..d4a9a4f64 100644 --- a/crates/registryctl/src/project_authoring/project.rs +++ b/crates/registryctl/src/project_authoring/project.rs @@ -8,6 +8,8 @@ fn load_registry_project(root: &Path, environment: Option<&str>) -> Result) -> Result) -> Result) -> Result) -> Result), anyhow::Error>(( @@ -96,11 +105,13 @@ fn load_registry_project(root: &Path, environment: Option<&str>) -> Result) -> Result) -> Result, + relative: &str, + bytes: &[u8], +) -> Result<()> { + let path = ProjectRelativePath::new(relative.to_owned()) + .map_err(|error| anyhow!("authored input path is invalid: {error}"))?; + let digest = Sha256Digest::new(sha256_uri(bytes)) + .map_err(|error| anyhow!("authored input digest is invalid: {error}"))?; + if artifact_inputs + .insert( + relative.to_owned(), + ArtifactInputDigest { path, digest }, + ) + .is_some() + { + bail!("one authored input cannot be loaded more than once"); + } + Ok(()) +} + fn project_content_digest(root: &Path, authored_hasher: &Sha256) -> Result { let directory = root.join("environments"); if !directory.exists() { @@ -216,7 +251,9 @@ fn lower_project_integration( authored: &AuthoredIntegrationDocument, entities: &BTreeMap, ) -> Result { - let AuthoredCapabilityDeclaration::Snapshot { snapshot } = &authored.capability else { + let AuthoredCapabilityDeclaration::Snapshot(AuthoredSnapshotCapability { snapshot }) = + &authored.capability + else { return lower_authored_integration(authored); }; validate_authored_integration_contract(authored)?; @@ -864,6 +901,741 @@ fn semantic_digests( }) } +// This reviewed revision binds every currently published field-knowledge path, +// its ownership/classification metadata, and its explicit promotion mapping. +// A schema or knowledge change must therefore be reviewed for promotion +// semantics before a new projection can be emitted. +const PROMOTION_FIELD_KNOWLEDGE_REVISION: &str = + "sha256:043707b6702aad55ba7a0697be3d551cd445e16f768b6f632da479a02c5d537c"; + +fn project_promotion_projection( + loaded: &LoadedRegistryProject, + environment: &EnvironmentDocument, +) -> Result { + let field_knowledge_revision = validate_promotion_field_knowledge_mapping()?; + + let products = project_promotion_products(environment); + let capabilities = project_promotion_capabilities(loaded, environment); + let origins = environment + .integrations + .iter() + .map(|(alias, binding)| { + ( + alias, + json!({ + "source": binding.source.origin, + "oauth": binding.source.oauth.as_ref().map(|endpoint| &endpoint.origin), + "jwks": binding.source.jwks.as_ref().map(|endpoint| &endpoint.origin), + }), + ) + }) + .collect::>(); + let origin_state = json!({ "integrations": origins }); + + let integration_credentials = environment + .integrations + .iter() + .map(|(alias, binding)| { + ( + alias, + json!({ + "credential": binding.source.credential, + "source_mtls_private_key": binding.source.mtls.as_ref().map(|mtls| &mtls.private_key), + "oauth_mtls_private_key": binding.source.oauth.as_ref() + .and_then(|endpoint| endpoint.mtls.as_ref()) + .map(|mtls| &mtls.private_key), + "jwks_mtls_private_key": binding.source.jwks.as_ref() + .and_then(|endpoint| endpoint.mtls.as_ref()) + .map(|mtls| &mtls.private_key), + }), + ) + }) + .collect::>(); + let credential_state = json!({ "integrations": integration_credentials }); + + let integration_trust = environment + .integrations + .iter() + .map(|(alias, binding)| { + ( + alias, + json!({ + "allowed_private_cidrs": binding.source.allowed_private_cidrs, + "ca": binding.source.ca, + "mtls": binding.source.mtls.as_ref().map(|mtls| json!({ + "certificate_file": mtls.certificate_file, + "generation": mtls.generation, + })), + "oauth": binding.source.oauth.as_ref().map(promotion_private_endpoint_trust), + "jwks": binding.source.jwks.as_ref().map(promotion_private_endpoint_trust), + }), + ) + }) + .collect::>(); + let trust_state = json!({ + "integrations": integration_trust, + "relay": environment.relay, + "oid4vci_authorization_server": environment.oid4vci.as_ref().map(|binding| json!({ + "issuer": binding.authorization_server.issuer, + })), + }); + let trust_members = environment + .integrations + .iter() + .flat_map(|(alias, binding)| { + let mut values = binding + .source + .allowed_private_cidrs + .iter() + .map(|cidr| json!(["source", alias, cidr])) + .collect::>(); + for (label, endpoint) in [ + ("oauth", binding.source.oauth.as_ref()), + ("jwks", binding.source.jwks.as_ref()), + ] { + if let Some(endpoint) = endpoint { + values.extend( + endpoint + .allowed_private_cidrs + .iter() + .map(|cidr| json!([label, alias, cidr])), + ); + } + } + values + }) + .chain( + environment + .relay + .iter() + .flat_map(|relay| relay.allowed_clients.iter()) + .map(|client| json!(["relay_client", client])), + ) + .collect::>(); + + let caller_state = environment + .callers + .iter() + .collect::>(); + let caller_members = environment + .callers + .iter() + .flat_map(|(id, caller)| { + std::iter::once(json!(["caller", id])).chain( + caller + .scopes + .iter() + .map(move |scope| json!(["caller_scope", id, scope])), + ) + }) + .collect::>(); + + let operational_integrations = environment + .integrations + .iter() + .map(|(alias, binding)| { + ( + alias, + json!({ + "rate": binding.source.rate, + "concurrency": binding.source.concurrency, + "timeout": binding.source.timeout, + }), + ) + }) + .collect::>(); + let operational_state = json!({ + "integrations": operational_integrations, + "entities": environment.entities, + "relay_state": environment.relay_state, + "notary_state": environment.notary_state, + "notary_cel": environment.notary_cel, + "issuance": environment.issuance, + "notary_relay": environment.notary_relay, + "oid4vci": environment.oid4vci, + "deployment_profile": environment.deployment.profile, + "deployment_relay_service": environment.deployment.relay.as_ref().map(|binding| &binding.service), + "deployment_notary_service": environment.deployment.notary.as_ref().map(|binding| &binding.service), + "oid4vci_subject": environment.oid4vci.as_ref().map(|binding| &binding.subject), + "oid4vci_tx_code": environment.oid4vci.as_ref().map(|binding| &binding.tx_code), + }); + + let purpose_state = loaded + .project + .services + .iter() + .map(|(id, service)| (id, &service.purpose)) + .collect::>(); + let service_policy_state = loaded + .project + .services + .iter() + .map(|(id, service)| { + ( + id, + json!({ + "legal_basis": service.legal_basis, + "consent": service.consent, + "access": service.access, + "variables": service.variables, + "records": { + "entity": service.entity, + "title": service.title, + "description": service.description, + "owner": service.owner, + "sensitivity": service.sensitivity, + "access_rights": service.access_rights, + "update_frequency": service.update_frequency, + "conforms_to": service.conforms_to, + "api": service.api, + }, + }), + ) + }) + .collect::>(); + let service_policy_members = loaded + .project + .services + .iter() + .flat_map(|(id, service)| { + let consent = (service.consent == ConsentDeclaration::NotRequired) + .then(|| json!(["consent_not_required", id])); + service + .access + .scopes + .iter() + .map(|scope| json!(["service_scope", id, scope])) + .chain(consent) + .collect::>() + }) + .collect::>(); + + let claim_state = loaded + .project + .services + .iter() + .map(|(service_id, service)| { + let claims = service + .claims + .iter() + .map(|(claim_id, claim)| { + ( + claim_id, + json!({ + "output": claim.output, + "cel": claim.cel, + "value": claim.value, + }), + ) + }) + .collect::>(); + ( + service_id, + json!({ + "claims": claims, + "credential_profiles": service.credential_profiles, + }), + ) + }) + .collect::>(); + let claim_members = loaded + .project + .services + .iter() + .flat_map(|(service_id, service)| { + service + .claims + .keys() + .map(|claim_id| json!(["claim", service_id, claim_id])) + .chain( + service + .credential_profiles + .keys() + .map(|profile| json!(["credential_profile", service_id, profile])), + ) + .collect::>() + }) + .collect::>(); + + let disclosure_state = disclosure_review_profiles(&loaded.project); + let disclosure_members = disclosure_state + .iter() + .flat_map(|(service_id, claims)| { + claims.iter().flat_map(move |(claim_id, profile)| { + profile + .allowed + .iter() + .map(move |mode| json!(["disclosure", service_id, claim_id, mode])) + }) + }) + .collect::>(); + + let product_state = json!({ "products": products }); + let product_members = products + .iter() + .map(|product| json!(["product", product])) + .collect::>(); + + let capability_state = loaded + .integrations + .iter() + .map(|(alias, integration)| { + let enabled = project_promotion_capability_enabled( + alias, + &integration.document.capability, + environment, + ); + ( + alias, + json!({ + "capability": promotion_capability_kind(&integration.document.capability), + "enabled": enabled, + }), + ) + }) + .collect::>(); + let capability_members = capabilities + .iter() + .map(|capability| json!(["capability", capability])) + .collect::>(); + + let ceiling_integrations = loaded + .integrations + .iter() + .map(|(alias, integration)| { + let capability_contract = match &integration.document.capability { + CapabilityDeclaration::Http { http } => json!({ + "operations": http.operations, + }), + CapabilityDeclaration::Script { script } => json!({ + "allow": script.allow, + "request_headers": script.request_headers, + "response_headers": script.response_headers, + "response": script.response, + "signed_dci": script.signed_dci, + "script_digest": integration.script.as_ref().map(|(_, bytes)| sha256_uri(bytes)), + "module_digests": integration.script_modules.iter() + .map(|(_, bytes)| sha256_uri(bytes)) + .collect::>(), + }), + CapabilityDeclaration::Snapshot { snapshot } => json!({ + "snapshot": snapshot, + }), + }; + ( + alias, + json!({ + "version": integration.document.version, + "revision": integration.document.revision, + "source": integration.document.source, + "input": integration.document.input, + "contract": capability_contract, + "outputs": integration.document.outputs, + "not_applicable": integration.document.not_applicable, + "bounds": integration.document.bounds, + }), + ) + }) + .collect::>(); + let consultations = loaded + .project + .services + .iter() + .map(|(service, declaration)| (service, &declaration.consultations)) + .collect::>(); + let entity_state = loaded + .entities + .iter() + .map(|(id, entity)| (id, &entity.document)) + .collect::>(); + let ceiling_state = json!({ + "integrations": ceiling_integrations, + "consultations": consultations, + "entities": entity_state, + }); + let ceiling_members = loaded + .integrations + .iter() + .flat_map(|(alias, integration)| { + let mut members = vec![json!(["integration", alias])]; + members.extend( + integration + .document + .input + .keys() + .map(|id| json!(["integration_input", alias, id])), + ); + members.extend( + integration + .document + .outputs + .keys() + .map(|id| json!(["integration_output", alias, id])), + ); + if let CapabilityDeclaration::Http { http } = &integration.document.capability { + members.extend( + http.operations + .keys() + .map(|id| json!(["integration_operation", alias, id])), + ); + } + members + }) + .chain(loaded.entities.keys().map(|id| json!(["entity", id]))) + .chain( + loaded + .project + .services + .iter() + .flat_map(|(service, declaration)| { + declaration + .consultations + .keys() + .map(move |consultation| json!(["consultation", service, consultation])) + }), + ) + .collect::>(); + + let field_inputs = [ + ( + PromotionChangeKind::Origin, + PromotionFieldClassification::Sensitive, + origin_state, + Vec::new(), + ), + ( + PromotionChangeKind::CredentialBinding, + PromotionFieldClassification::SecretReference, + credential_state, + Vec::new(), + ), + ( + PromotionChangeKind::Trust, + PromotionFieldClassification::Sensitive, + trust_state, + trust_members, + ), + ( + PromotionChangeKind::Caller, + PromotionFieldClassification::Sensitive, + json!(caller_state), + caller_members, + ), + ( + PromotionChangeKind::Operational, + PromotionFieldClassification::Internal, + operational_state, + Vec::new(), + ), + ( + PromotionChangeKind::Purpose, + PromotionFieldClassification::Internal, + json!(purpose_state), + Vec::new(), + ), + ( + PromotionChangeKind::ServicePolicy, + PromotionFieldClassification::Internal, + json!(service_policy_state), + service_policy_members, + ), + ( + PromotionChangeKind::Claim, + PromotionFieldClassification::Internal, + json!(claim_state), + claim_members, + ), + ( + PromotionChangeKind::Disclosure, + PromotionFieldClassification::Internal, + json!(disclosure_state), + disclosure_members, + ), + ( + PromotionChangeKind::ProductEnablement, + PromotionFieldClassification::Structural, + product_state, + product_members, + ), + ( + PromotionChangeKind::CapabilityEnablement, + PromotionFieldClassification::Structural, + json!(capability_state), + capability_members, + ), + ( + PromotionChangeKind::IntegrationCeiling, + PromotionFieldClassification::Structural, + ceiling_state, + ceiling_members, + ), + ]; + let fields = field_inputs + .into_iter() + .map(|(kind, classification, state, authority_members)| { + promotion_projected_field(kind, classification, &state, authority_members) + }) + .collect::>>()?; + + let projection = ProjectPromotionProjectionV1 { + schema_version: ProjectPromotionProjectionSchemaVersion::V1, + field_knowledge_revision, + authoring_schemas: project_promotion_authoring_schemas(loaded, environment), + products, + capabilities, + fields, + }; + validate_project_promotion_projection(&projection, PROMOTION_FIELD_KNOWLEDGE_REVISION) + .map_err(|error| anyhow!(error))?; + Ok(projection) +} + +fn project_promotion_authoring_schemas( + loaded: &LoadedRegistryProject, + environment: &EnvironmentDocument, +) -> PromotionAuthoringSchemaVersions { + PromotionAuthoringSchemaVersions { + project: loaded.project.version, + environment: environment.version, + integrations: loaded + .integrations + .values() + .map(|integration| integration.document.version) + .collect::>() + .into_iter() + .collect(), + entities: loaded + .entities + .values() + .map(|entity| entity.document.version) + .collect::>() + .into_iter() + .collect(), + } +} + +fn promotion_private_endpoint_trust(binding: &PrivateEndpointBinding) -> Value { + json!({ + "allowed_private_cidrs": binding.allowed_private_cidrs, + "ca": binding.ca, + "mtls": binding.mtls.as_ref().map(|mtls| json!({ + "certificate_file": mtls.certificate_file, + "generation": mtls.generation, + })), + "generation": binding.generation, + }) +} + +fn project_promotion_products(environment: &EnvironmentDocument) -> Vec { + let mut products = Vec::new(); + if environment.deployment.relay.is_some() { + products.push(PromotionProjectedProduct::Relay); + } + if environment.deployment.notary.is_some() { + products.push(PromotionProjectedProduct::Notary); + } + products +} + +fn project_promotion_capabilities( + loaded: &LoadedRegistryProject, + environment: &EnvironmentDocument, +) -> Vec { + loaded + .integrations + .iter() + .filter(|(alias, integration)| { + project_promotion_capability_enabled( + alias, + &integration.document.capability, + environment, + ) + }) + .map(|(_, integration)| promotion_capability_kind(&integration.document.capability)) + .collect::>() + .into_iter() + .collect() +} + +fn project_promotion_capability_enabled( + alias: &str, + capability: &CapabilityDeclaration, + environment: &EnvironmentDocument, +) -> bool { + match capability { + CapabilityDeclaration::Http { .. } | CapabilityDeclaration::Script { .. } => { + environment.integrations.contains_key(alias) + } + CapabilityDeclaration::Snapshot { snapshot } => { + environment.entities.contains_key(&snapshot.entity) + } + } +} + +const fn promotion_capability_kind( + capability: &CapabilityDeclaration, +) -> PromotionProjectedCapability { + match capability { + CapabilityDeclaration::Http { .. } => PromotionProjectedCapability::Http, + CapabilityDeclaration::Script { .. } => PromotionProjectedCapability::Script, + CapabilityDeclaration::Snapshot { .. } => PromotionProjectedCapability::Snapshot, + } +} + +fn promotion_projected_field( + kind: PromotionChangeKind, + classification: PromotionFieldClassification, + state: &Value, + authority_members: Vec, +) -> Result { + let mut authority_members = authority_members + .iter() + .map(digest_json) + .collect::>>()?; + authority_members.sort(); + authority_members.dedup(); + Ok(PromotionProjectedField { + address: kind.address(), + kind, + classification, + ownership: kind.expected_ownership(), + digest: digest_json(state)?, + authority_members, + }) +} + +fn validate_promotion_field_knowledge_mapping() -> Result { + let index = knowledge::published_field_knowledge_index() + .map_err(|error| anyhow!("published field knowledge is invalid: {error}"))?; + let mut mapped_kinds = BTreeSet::new(); + let records = index + .by_path() + .iter() + .map(|(path, field)| { + let kind = promotion_kind_for_field_path(path); + if let Some(kind) = kind { + mapped_kinds.insert(kind); + if kind.expected_ownership() != promotion_ownership_for_schema(path.schema) { + bail!("published field knowledge has an invalid promotion owner"); + } + } else if path.schema != knowledge::SchemaKind::Fixture { + bail!("published runtime field lacks a closed promotion mapping"); + } + Ok(json!({ + "schema": path.schema, + "pointer": path.pointer, + "path_kind": field.path_kind, + "semantic_owner": field.semantic_owner, + "human_owner": field.human_owner, + "sensitivity": field.sensitivity, + "products": field.products, + "introduced_in": field.introduced_in, + "availability": field.availability, + "stability": field.stability, + "migration": field.migration, + "consumers": field.consumers, + "generated_artifacts": field.generated_artifacts, + "review_classes": field.review_classes, + "semantic_rules": field.semantic_rules, + "promotion_kind": kind, + })) + }) + .collect::>>()?; + if mapped_kinds != PromotionChangeKind::ALL.into_iter().collect() { + bail!("published field knowledge does not exercise every closed promotion mapping"); + } + let revision = digest_json(&Value::Array(records))?; + if revision != PROMOTION_FIELD_KNOWLEDGE_REVISION { + bail!( + "promotion field-knowledge mapping revision requires review: expected {}, observed {}", + PROMOTION_FIELD_KNOWLEDGE_REVISION, + revision + ); + } + Ok(revision) +} + +fn promotion_ownership_for_schema(schema: knowledge::SchemaKind) -> PromotionFieldOwnership { + match schema { + knowledge::SchemaKind::Environment => PromotionFieldOwnership::EnvironmentOwned, + knowledge::SchemaKind::Project + | knowledge::SchemaKind::Integration + | knowledge::SchemaKind::Entity => PromotionFieldOwnership::ReviewedProjectOwned, + knowledge::SchemaKind::Fixture => PromotionFieldOwnership::Unclassified, + } +} + +fn promotion_kind_for_field_path(path: &knowledge::FieldPath) -> Option { + use knowledge::SchemaKind; + use PromotionChangeKind as Kind; + + let pointer = path.pointer.as_str(); + match path.schema { + SchemaKind::Fixture => None, + SchemaKind::Entity => Some(Kind::ServicePolicy), + SchemaKind::Integration => Some(Kind::IntegrationCeiling), + SchemaKind::Environment => { + let integration_field = pointer.contains("/integrations") + || pointer.contains("/$defs/integration") + || pointer.contains("/$defs/source") + || pointer.contains("/$defs/credential") + || pointer.contains("/$defs/endpoint") + || pointer.contains("/$defs/ca") + || pointer.contains("/$defs/mtls") + || pointer.contains("/$defs/privateCidrs") + || pointer.contains("/$defs/origin"); + if pointer.contains("/callers") { + Some(Kind::Caller) + } else if integration_field + && (pointer.contains("/$defs/credential") + || pointer.contains("credential") + || pointer.contains("private_key")) + { + Some(Kind::CredentialBinding) + } else if integration_field + && (pointer.contains("origin") + || pointer.contains("_url") + || pointer.contains("base_url")) + { + Some(Kind::Origin) + } else if pointer.contains("allowed_private_cidrs") + || pointer.contains("/$defs/privateCidrs") + || pointer.contains("/ca") + || pointer.contains("/mtls") + || pointer.contains("audience") + || pointer.contains("allowed_clients") + || pointer.contains("/issuer") + { + Some(Kind::Trust) + } else if pointer.ends_with("/properties/relay") + || pointer.ends_with("/properties/notary") + { + Some(Kind::ProductEnablement) + } else if integration_field { + Some(Kind::CapabilityEnablement) + } else { + Some(Kind::Operational) + } + } + SchemaKind::Project => { + if pointer.contains("/purpose") { + Some(Kind::Purpose) + } else if pointer.contains("/disclosure") { + Some(Kind::Disclosure) + } else if pointer.contains("/claims") || pointer.contains("/credential_profiles") { + Some(Kind::Claim) + } else if pointer.contains("/integrations") + || pointer.contains("/entities") + || pointer.contains("/consultations") + { + Some(Kind::IntegrationCeiling) + } else { + Some(Kind::ServicePolicy) + } + } + } +} + fn digest_json(value: &Value) -> Result { Ok(sha256_uri( &canonicalize_json(value).context("failed to canonicalize semantic review input")?, diff --git a/crates/registryctl/src/project_authoring/promotion.rs b/crates/registryctl/src/project_authoring/promotion.rs new file mode 100644 index 000000000..c5a789903 --- /dev/null +++ b/crates/registryctl/src/project_authoring/promotion.rs @@ -0,0 +1,1010 @@ +// SPDX-License-Identifier: Apache-2.0 +//! Value-free environment comparison and promotion decision contract. +//! +//! This module is deliberately a pure boundary. A command adapter must first +//! compare authoritative, normalized project semantics and then translate only +//! closed classifications into [`ProjectPromotionInput`]. Raw authored values, +//! environment names, origins, credential identifiers, paths, hashes, and +//! runtime observations have no representation here. + +use std::collections::{BTreeMap, BTreeSet}; + +use serde::{de, Deserialize, Deserializer, Serialize}; + +pub const PROJECT_PROMOTION_SCHEMA_VERSION_V1: &str = "registry.project.promotion.v1"; +pub(crate) const MAX_PROMOTION_CHANGES: usize = 256; +// The largest current valid projection is disclosure authority: +// 32 services × 64 claims × 3 disclosure modes = 6,144 members. +// Keep a finite review-evidence bound with headroom for the other closed +// authoring collections. +pub(crate) const MAX_PROMOTION_AUTHORITY_MEMBERS: usize = 8_192; + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +pub enum ProjectPromotionSchemaVersion { + #[serde(rename = "registry.project.promotion.v1")] + V1, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum PromotionEvidenceGrade { + OfflineStatic, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum PromotionDeploymentEvaluation { + NotPerformed, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum PromotionActivationEvaluation { + NotEvaluated, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum PromotionDisposition { + Ready, + ReadyAfterRequiredActions, + Blocked, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum ReviewedRevisionComparison { + SameReviewedSemanticRevision, + DifferentReviewedSemanticRevision, + NotProven, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum PromotionDocument { + Project, + Environment, +} + +/// Closed field paths prevent a promotion report from becoming a carrier for +/// country identifiers or values. The adapter maps catalogued field addresses +/// to these semantic address families after normalized comparison. +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +pub enum PromotionFieldPath { + #[serde(rename = "/integrations/*/origin")] + IntegrationOrigin, + #[serde(rename = "/integrations/*/credentials")] + IntegrationCredentials, + #[serde(rename = "/integrations/*/trust")] + IntegrationTrust, + #[serde(rename = "/notary/callers/*")] + NotaryCaller, + #[serde(rename = "/operations")] + OperationalSettings, + #[serde(rename = "/purposes/*")] + Purpose, + #[serde(rename = "/service_policy")] + ServicePolicy, + #[serde(rename = "/notary/claims/*")] + Claim, + #[serde(rename = "/notary/disclosures/*")] + Disclosure, + #[serde(rename = "/products/*")] + ProductEnablement, + #[serde(rename = "/integrations/*/capabilities/*")] + CapabilityEnablement, + #[serde(rename = "/integrations/*/limits")] + IntegrationCeiling, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct PromotionFieldAddress { + pub document: PromotionDocument, + pub path: PromotionFieldPath, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum PromotionChangeKind { + Origin, + CredentialBinding, + Trust, + Caller, + Operational, + Purpose, + ServicePolicy, + Claim, + Disclosure, + ProductEnablement, + CapabilityEnablement, + IntegrationCeiling, +} + +impl PromotionChangeKind { + pub(crate) const ALL: [Self; 12] = [ + Self::Origin, + Self::CredentialBinding, + Self::Trust, + Self::Caller, + Self::Operational, + Self::Purpose, + Self::ServicePolicy, + Self::Claim, + Self::Disclosure, + Self::ProductEnablement, + Self::CapabilityEnablement, + Self::IntegrationCeiling, + ]; + + pub(crate) const fn address(self) -> PromotionFieldAddress { + let (document, path) = match self { + Self::Origin => ( + PromotionDocument::Environment, + PromotionFieldPath::IntegrationOrigin, + ), + Self::CredentialBinding => ( + PromotionDocument::Environment, + PromotionFieldPath::IntegrationCredentials, + ), + Self::Trust => ( + PromotionDocument::Environment, + PromotionFieldPath::IntegrationTrust, + ), + Self::Caller => ( + PromotionDocument::Environment, + PromotionFieldPath::NotaryCaller, + ), + Self::Operational => ( + PromotionDocument::Environment, + PromotionFieldPath::OperationalSettings, + ), + Self::ProductEnablement => ( + PromotionDocument::Environment, + PromotionFieldPath::ProductEnablement, + ), + Self::CapabilityEnablement => ( + PromotionDocument::Environment, + PromotionFieldPath::CapabilityEnablement, + ), + Self::IntegrationCeiling => ( + PromotionDocument::Project, + PromotionFieldPath::IntegrationCeiling, + ), + Self::Purpose => (PromotionDocument::Project, PromotionFieldPath::Purpose), + Self::ServicePolicy => ( + PromotionDocument::Project, + PromotionFieldPath::ServicePolicy, + ), + Self::Claim => (PromotionDocument::Project, PromotionFieldPath::Claim), + Self::Disclosure => (PromotionDocument::Project, PromotionFieldPath::Disclosure), + }; + PromotionFieldAddress { document, path } + } + + const fn is_environment_owned(self) -> bool { + matches!( + self, + Self::Origin + | Self::CredentialBinding + | Self::Trust + | Self::Caller + | Self::Operational + | Self::ProductEnablement + | Self::CapabilityEnablement + ) + } + + const fn is_policy(self) -> bool { + matches!( + self, + Self::Caller + | Self::Purpose + | Self::ServicePolicy + | Self::Claim + | Self::Disclosure + | Self::IntegrationCeiling + ) + } + + pub(crate) const fn expected_ownership(self) -> PromotionFieldOwnership { + if self.is_environment_owned() { + PromotionFieldOwnership::EnvironmentOwned + } else { + PromotionFieldOwnership::ReviewedProjectOwned + } + } + + pub(crate) const fn expected_classification(self) -> PromotionFieldClassification { + match self { + Self::CredentialBinding => PromotionFieldClassification::SecretReference, + Self::Origin | Self::Trust | Self::Caller => PromotionFieldClassification::Sensitive, + Self::Operational + | Self::Purpose + | Self::ServicePolicy + | Self::Claim + | Self::Disclosure => PromotionFieldClassification::Internal, + Self::ProductEnablement | Self::CapabilityEnablement | Self::IntegrationCeiling => { + PromotionFieldClassification::Structural + } + } + } + + pub(crate) const fn projection_effect_strategy(self) -> PromotionProjectionEffectStrategy { + match self { + Self::Origin | Self::CredentialBinding | Self::Operational | Self::Purpose => { + PromotionProjectionEffectStrategy::ChangedWithinReviewedAuthority + } + Self::IntegrationCeiling => { + PromotionProjectionEffectStrategy::AuthorityMembersRequireDirection + } + Self::Trust + | Self::Caller + | Self::ServicePolicy + | Self::Claim + | Self::Disclosure + | Self::ProductEnablement + | Self::CapabilityEnablement => { + PromotionProjectionEffectStrategy::AuthorityMembersWithSafeReplacement + } + } + } +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum PromotionFieldClassification { + Public, + Internal, + Sensitive, + SecretReference, + SecretValue, + RedactedFixture, + Structural, + Unclassified, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum PromotionFieldOwnership { + EnvironmentOwned, + ReviewedProjectOwned, + Unclassified, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum PromotionChangeEffect { + ChangedWithinReviewedAuthority, + Narrowed, + Widened, + Unresolved, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd)] +pub(crate) enum PromotionProjectionEffectStrategy { + ChangedWithinReviewedAuthority, + AuthorityMembersWithSafeReplacement, + AuthorityMembersRequireDirection, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum PromotionBoundaryAssessment { + AllowedEnvironmentOwned, + ReviewedProjectRevisionDifference, + Violation, + Unclassified, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd)] +pub struct PromotionChangeInput { + pub kind: PromotionChangeKind, + pub classification: Option, + pub ownership: PromotionFieldOwnership, + pub effect: PromotionChangeEffect, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct PromotionChange { + pub address: PromotionFieldAddress, + pub kind: PromotionChangeKind, + pub classification: PromotionFieldClassification, + pub ownership: PromotionFieldOwnership, + pub boundary: PromotionBoundaryAssessment, + pub effect: PromotionChangeEffect, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq)] +pub enum ReviewedCeilingInput { + WithinReviewedCeiling, + Narrowed, + Widened, + Unresolved, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum ReviewedCeilingAssessment { + WithinReviewedCeiling, + Narrowed, + WidenedBlocked, + UnresolvedBlocked, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq)] +pub enum TrustResolutionInput { + Resolved, + Unresolved, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum TrustResolutionAssessment { + Resolved, + UnresolvedBlocked, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum PromotionCompatibilityComponent { + Product, + Capability, + Schema, + Abi, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum PromotionCompatibilityState { + Compatible, + Missing, + Incompatible, + Unresolved, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq)] +pub struct PromotionCompatibilityInput { + pub product: PromotionCompatibilityState, + pub capability: PromotionCompatibilityState, + pub schema: PromotionCompatibilityState, + pub abi: PromotionCompatibilityState, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct PromotionCompatibilityAssessment { + pub component: PromotionCompatibilityComponent, + pub state: PromotionCompatibilityState, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum PromotionReviewClass { + Authoring, + Contract, + Semantics, + Interoperability, + Privacy, + Security, + Compatibility, + Operations, + Release, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum PromotionProductAction { + None, + Relay, + Notary, + RelayAndNotary, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct PromotionRequiredActions { + pub review_classes: Vec, + pub re_sign: PromotionProductAction, + pub reactivate: PromotionProductAction, + pub restart: PromotionProductAction, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum PromotionBlockingReason { + ReviewedRevisionNotProven, + ComparisonEvidenceIncomplete, + EnvironmentOwnershipViolation, + UnclassifiedChange, + UnresolvedChange, + PolicyWidening, + AuthorityWidening, + ReviewedCeilingWidening, + ReviewedCeilingUnresolved, + TrustUnresolved, + MissingProduct, + MissingCapability, + MissingSchema, + MissingAbi, + IncompatibleProduct, + IncompatibleCapability, + IncompatibleSchema, + IncompatibleAbi, + CompatibilityUnresolved, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum PromotionEvidenceLimitation { + OfflineStaticOnly, + RuntimeActivationNotEvaluated, + DeploymentNotPerformed, + LiveEndpointReachabilityNotEvaluated, + SecretMaterialNotInspected, + RawAuthoredValuesOmitted, + SeparateRelayAndNotaryBundleLifecycle, +} + +#[derive(Clone, Debug, Eq, PartialEq)] +pub struct ProjectPromotionInput { + pub reviewed_revision: ReviewedRevisionComparison, + pub changes: Vec, + pub reviewed_ceiling: ReviewedCeilingInput, + pub trust: TrustResolutionInput, + pub compatibility: PromotionCompatibilityInput, +} + +#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)] +pub(crate) enum ProjectPromotionProjectionSchemaVersion { + #[serde(rename = "registry.project.promotion-projection.v1")] + V1, +} + +#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)] +#[serde(rename_all = "snake_case")] +pub(crate) enum PromotionProjectedProduct { + Relay, + Notary, +} + +#[derive(Clone, Copy, Debug, Deserialize, Eq, Ord, PartialEq, PartialOrd, Serialize)] +#[serde(rename_all = "snake_case")] +pub(crate) enum PromotionProjectedCapability { + Http, + Script, + Snapshot, +} + +#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)] +#[serde(deny_unknown_fields)] +pub(crate) struct PromotionAuthoringSchemaVersions { + pub project: u8, + pub environment: u8, + pub integrations: Vec, + pub entities: Vec, +} + +#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)] +#[serde(deny_unknown_fields)] +pub(crate) struct PromotionProjectedField { + pub address: PromotionFieldAddress, + pub kind: PromotionChangeKind, + pub classification: PromotionFieldClassification, + pub ownership: PromotionFieldOwnership, + pub digest: String, + pub authority_members: Vec, +} + +#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)] +#[serde(deny_unknown_fields)] +pub(crate) struct ProjectPromotionProjectionV1 { + pub schema_version: ProjectPromotionProjectionSchemaVersion, + pub field_knowledge_revision: String, + pub authoring_schemas: PromotionAuthoringSchemaVersions, + pub products: Vec, + pub capabilities: Vec, + pub fields: Vec, +} + +impl ProjectPromotionProjectionV1 { + pub(crate) fn fields_by_kind(&self) -> BTreeMap { + self.fields + .iter() + .map(|field| (field.kind, field)) + .collect() + } +} + +pub(crate) fn validate_project_promotion_projection( + projection: &ProjectPromotionProjectionV1, + expected_field_knowledge_revision: &str, +) -> Result<(), &'static str> { + validate_project_promotion_projection_structure(projection)?; + if projection.field_knowledge_revision != expected_field_knowledge_revision { + return Err("promotion projection field-knowledge revision is not current"); + } + Ok(()) +} + +pub(crate) fn validate_project_promotion_projection_structure( + projection: &ProjectPromotionProjectionV1, +) -> Result<(), &'static str> { + if projection.schema_version != ProjectPromotionProjectionSchemaVersion::V1 { + return Err("promotion projection has an unsupported schema version"); + } + if !is_sha256_uri(&projection.field_knowledge_revision) { + return Err("promotion projection field-knowledge revision is invalid"); + } + if projection.authoring_schemas.project == 0 + || projection.authoring_schemas.environment == 0 + || projection.authoring_schemas.integrations.contains(&0) + || projection.authoring_schemas.entities.contains(&0) + || !is_strictly_sorted_unique(&projection.authoring_schemas.integrations) + || !is_strictly_sorted_unique(&projection.authoring_schemas.entities) + { + return Err("promotion projection authoring schema versions are invalid"); + } + if projection.products.is_empty() + || !is_strictly_sorted_unique(&projection.products) + || !is_strictly_sorted_unique(&projection.capabilities) + { + return Err("promotion projection product or capability inventory is invalid"); + } + if projection.fields.len() != PromotionChangeKind::ALL.len() { + return Err("promotion projection must cover every classified field address exactly once"); + } + + for (expected_kind, field) in PromotionChangeKind::ALL.iter().zip(&projection.fields) { + if field.kind != *expected_kind + || field.address != field.kind.address() + || field.ownership != field.kind.expected_ownership() + || field.classification != field.kind.expected_classification() + || !is_sha256_uri(&field.digest) + || field.authority_members.len() > MAX_PROMOTION_AUTHORITY_MEMBERS + || field + .authority_members + .iter() + .any(|member| !is_sha256_uri(member)) + || !is_strictly_sorted_unique(&field.authority_members) + { + return Err("promotion projection field evidence is incomplete or non-canonical"); + } + } + Ok(()) +} + +pub(crate) fn classify_projected_change_effect( + kind: PromotionChangeKind, + previous: &PromotionProjectedField, + current: &PromotionProjectedField, +) -> PromotionChangeEffect { + if previous.digest == current.digest { + return PromotionChangeEffect::ChangedWithinReviewedAuthority; + } + match kind.projection_effect_strategy() { + PromotionProjectionEffectStrategy::ChangedWithinReviewedAuthority => { + PromotionChangeEffect::ChangedWithinReviewedAuthority + } + PromotionProjectionEffectStrategy::AuthorityMembersWithSafeReplacement + | PromotionProjectionEffectStrategy::AuthorityMembersRequireDirection => { + let previous = previous.authority_members.iter().collect::>(); + let current = current.authority_members.iter().collect::>(); + if current != previous && current.is_subset(&previous) { + PromotionChangeEffect::Narrowed + } else if current != previous && previous.is_subset(¤t) { + PromotionChangeEffect::Widened + } else if current == previous + && kind.projection_effect_strategy() + == PromotionProjectionEffectStrategy::AuthorityMembersWithSafeReplacement + { + PromotionChangeEffect::ChangedWithinReviewedAuthority + } else { + PromotionChangeEffect::Unresolved + } + } + } +} + +fn is_strictly_sorted_unique(values: &[T]) -> bool { + values.windows(2).all(|pair| pair[0] < pair[1]) +} + +fn is_sha256_uri(value: &str) -> bool { + value.strip_prefix("sha256:").is_some_and(|hex| { + hex.len() == 64 + && hex + .bytes() + .all(|byte| byte.is_ascii_digit() || matches!(byte, b'a'..=b'f')) + }) +} + +#[derive(Clone, Debug, Eq, PartialEq, Serialize)] +#[serde(deny_unknown_fields)] +pub struct ProjectPromotionReportV1 { + pub schema_version: ProjectPromotionSchemaVersion, + pub evidence_grade: PromotionEvidenceGrade, + pub deployment: PromotionDeploymentEvaluation, + pub runtime_activation: PromotionActivationEvaluation, + pub disposition: PromotionDisposition, + pub reviewed_revision: ReviewedRevisionComparison, + pub changes: Vec, + pub reviewed_ceiling: ReviewedCeilingAssessment, + pub trust: TrustResolutionAssessment, + pub compatibility: Vec, + pub required_actions: PromotionRequiredActions, + pub blocking_reasons: Vec, + pub evidence_limitations: Vec, +} + +#[derive(Deserialize)] +#[serde(deny_unknown_fields)] +struct ProjectPromotionReportWire { + schema_version: ProjectPromotionSchemaVersion, + evidence_grade: PromotionEvidenceGrade, + deployment: PromotionDeploymentEvaluation, + runtime_activation: PromotionActivationEvaluation, + disposition: PromotionDisposition, + reviewed_revision: ReviewedRevisionComparison, + changes: Vec, + reviewed_ceiling: ReviewedCeilingAssessment, + trust: TrustResolutionAssessment, + compatibility: Vec, + required_actions: PromotionRequiredActions, + blocking_reasons: Vec, + evidence_limitations: Vec, +} + +impl<'de> Deserialize<'de> for ProjectPromotionReportV1 { + fn deserialize(deserializer: D) -> Result + where + D: Deserializer<'de>, + { + let wire = ProjectPromotionReportWire::deserialize(deserializer)?; + let candidate = Self { + schema_version: wire.schema_version, + evidence_grade: wire.evidence_grade, + deployment: wire.deployment, + runtime_activation: wire.runtime_activation, + disposition: wire.disposition, + reviewed_revision: wire.reviewed_revision, + changes: wire.changes, + reviewed_ceiling: wire.reviewed_ceiling, + trust: wire.trust, + compatibility: wire.compatibility, + required_actions: wire.required_actions, + blocking_reasons: wire.blocking_reasons, + evidence_limitations: wire.evidence_limitations, + }; + let expected = rebuild_report_from_wire(&candidate).map_err(de::Error::custom)?; + if candidate != expected { + return Err(de::Error::custom( + "promotion report decisions do not match its classified comparison evidence", + )); + } + Ok(candidate) + } +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq)] +pub enum ProjectPromotionBuildError { + TooManyChanges, +} + +fn rebuild_report_from_wire( + report: &ProjectPromotionReportV1, +) -> Result { + if report.compatibility.len() != 4 + || report.compatibility[0].component != PromotionCompatibilityComponent::Product + || report.compatibility[1].component != PromotionCompatibilityComponent::Capability + || report.compatibility[2].component != PromotionCompatibilityComponent::Schema + || report.compatibility[3].component != PromotionCompatibilityComponent::Abi + { + return Err("promotion compatibility evidence must contain product, capability, schema, and ABI exactly once in canonical order"); + } + let reviewed_ceiling = match report.reviewed_ceiling { + ReviewedCeilingAssessment::WithinReviewedCeiling => { + ReviewedCeilingInput::WithinReviewedCeiling + } + ReviewedCeilingAssessment::Narrowed => ReviewedCeilingInput::Narrowed, + ReviewedCeilingAssessment::WidenedBlocked => ReviewedCeilingInput::Widened, + ReviewedCeilingAssessment::UnresolvedBlocked => ReviewedCeilingInput::Unresolved, + }; + let trust = match report.trust { + TrustResolutionAssessment::Resolved => TrustResolutionInput::Resolved, + TrustResolutionAssessment::UnresolvedBlocked => TrustResolutionInput::Unresolved, + }; + let compatibility = PromotionCompatibilityInput { + product: report.compatibility[0].state, + capability: report.compatibility[1].state, + schema: report.compatibility[2].state, + abi: report.compatibility[3].state, + }; + build_project_promotion_report(ProjectPromotionInput { + reviewed_revision: report.reviewed_revision, + changes: report + .changes + .iter() + .map(|change| PromotionChangeInput { + kind: change.kind, + classification: Some(change.classification), + ownership: change.ownership, + effect: change.effect, + }) + .collect(), + reviewed_ceiling, + trust, + compatibility, + }) + .map_err(|_| "promotion report exceeds the bounded change capacity") +} + +pub fn build_project_promotion_report( + input: ProjectPromotionInput, +) -> Result { + if input.changes.len() > MAX_PROMOTION_CHANGES { + return Err(ProjectPromotionBuildError::TooManyChanges); + } + + let mut blocking_reasons = BTreeSet::new(); + if input.reviewed_revision == ReviewedRevisionComparison::NotProven { + blocking_reasons.insert(PromotionBlockingReason::ReviewedRevisionNotProven); + } + + let mut review_classes = BTreeSet::new(); + let mut action_products = ProductActionSet::default(); + if input.reviewed_revision == ReviewedRevisionComparison::DifferentReviewedSemanticRevision { + review_classes.extend([ + PromotionReviewClass::Authoring, + PromotionReviewClass::Contract, + PromotionReviewClass::Semantics, + ]); + } + + let has_reviewed_project_change = input + .changes + .iter() + .any(|change| !change.kind.is_environment_owned()); + let has_ceiling_change = input + .changes + .iter() + .any(|change| change.kind == PromotionChangeKind::IntegrationCeiling); + if input.reviewed_revision == ReviewedRevisionComparison::DifferentReviewedSemanticRevision + && !has_reviewed_project_change + { + blocking_reasons.insert(PromotionBlockingReason::ComparisonEvidenceIncomplete); + } + if input.reviewed_ceiling != ReviewedCeilingInput::WithinReviewedCeiling && !has_ceiling_change + { + blocking_reasons.insert(PromotionBlockingReason::ComparisonEvidenceIncomplete); + } + + let mut changes = input + .changes + .into_iter() + .map(|change| { + let classification = change + .classification + .unwrap_or(PromotionFieldClassification::Unclassified); + if classification == PromotionFieldClassification::Unclassified + || change.ownership == PromotionFieldOwnership::Unclassified + { + blocking_reasons.insert(PromotionBlockingReason::UnclassifiedChange); + } + if change.effect == PromotionChangeEffect::Unresolved { + blocking_reasons.insert(PromotionBlockingReason::UnresolvedChange); + } + if change.effect == PromotionChangeEffect::Widened && change.kind.is_policy() { + blocking_reasons.insert(PromotionBlockingReason::PolicyWidening); + } else if change.effect == PromotionChangeEffect::Widened { + blocking_reasons.insert(PromotionBlockingReason::AuthorityWidening); + } + + let boundary = if classification == PromotionFieldClassification::Unclassified + || change.ownership == PromotionFieldOwnership::Unclassified + { + PromotionBoundaryAssessment::Unclassified + } else if change.kind.is_environment_owned() + && change.ownership == PromotionFieldOwnership::EnvironmentOwned + { + PromotionBoundaryAssessment::AllowedEnvironmentOwned + } else if !change.kind.is_environment_owned() + && change.ownership == PromotionFieldOwnership::ReviewedProjectOwned + && input.reviewed_revision + == ReviewedRevisionComparison::DifferentReviewedSemanticRevision + { + PromotionBoundaryAssessment::ReviewedProjectRevisionDifference + } else { + blocking_reasons.insert(PromotionBlockingReason::EnvironmentOwnershipViolation); + PromotionBoundaryAssessment::Violation + }; + + add_change_actions(change.kind, &mut review_classes, &mut action_products); + PromotionChange { + address: change.kind.address(), + kind: change.kind, + classification, + ownership: change.ownership, + boundary, + effect: change.effect, + } + }) + .collect::>(); + changes.sort_unstable(); + changes.dedup(); + + let reviewed_ceiling = match input.reviewed_ceiling { + ReviewedCeilingInput::WithinReviewedCeiling => { + ReviewedCeilingAssessment::WithinReviewedCeiling + } + ReviewedCeilingInput::Narrowed => ReviewedCeilingAssessment::Narrowed, + ReviewedCeilingInput::Widened => { + blocking_reasons.insert(PromotionBlockingReason::ReviewedCeilingWidening); + ReviewedCeilingAssessment::WidenedBlocked + } + ReviewedCeilingInput::Unresolved => { + blocking_reasons.insert(PromotionBlockingReason::ReviewedCeilingUnresolved); + ReviewedCeilingAssessment::UnresolvedBlocked + } + }; + + let trust = match input.trust { + TrustResolutionInput::Resolved => TrustResolutionAssessment::Resolved, + TrustResolutionInput::Unresolved => { + blocking_reasons.insert(PromotionBlockingReason::TrustUnresolved); + TrustResolutionAssessment::UnresolvedBlocked + } + }; + + let compatibility = [ + ( + PromotionCompatibilityComponent::Product, + input.compatibility.product, + ), + ( + PromotionCompatibilityComponent::Capability, + input.compatibility.capability, + ), + ( + PromotionCompatibilityComponent::Schema, + input.compatibility.schema, + ), + ( + PromotionCompatibilityComponent::Abi, + input.compatibility.abi, + ), + ] + .into_iter() + .map(|(component, state)| { + if state != PromotionCompatibilityState::Compatible { + blocking_reasons.insert(compatibility_reason(component, state)); + } + PromotionCompatibilityAssessment { component, state } + }) + .collect::>(); + + let required_actions = PromotionRequiredActions { + review_classes: review_classes.into_iter().collect(), + re_sign: action_products.action(), + reactivate: action_products.action(), + restart: action_products.action(), + }; + let blocking_reasons = blocking_reasons.into_iter().collect::>(); + let disposition = if !blocking_reasons.is_empty() { + PromotionDisposition::Blocked + } else if changes.is_empty() + && input.reviewed_revision == ReviewedRevisionComparison::SameReviewedSemanticRevision + { + PromotionDisposition::Ready + } else { + PromotionDisposition::ReadyAfterRequiredActions + }; + + Ok(ProjectPromotionReportV1 { + schema_version: ProjectPromotionSchemaVersion::V1, + evidence_grade: PromotionEvidenceGrade::OfflineStatic, + deployment: PromotionDeploymentEvaluation::NotPerformed, + runtime_activation: PromotionActivationEvaluation::NotEvaluated, + disposition, + reviewed_revision: input.reviewed_revision, + changes, + reviewed_ceiling, + trust, + compatibility, + required_actions, + blocking_reasons, + evidence_limitations: vec![ + PromotionEvidenceLimitation::OfflineStaticOnly, + PromotionEvidenceLimitation::RuntimeActivationNotEvaluated, + PromotionEvidenceLimitation::DeploymentNotPerformed, + PromotionEvidenceLimitation::LiveEndpointReachabilityNotEvaluated, + PromotionEvidenceLimitation::SecretMaterialNotInspected, + PromotionEvidenceLimitation::RawAuthoredValuesOmitted, + PromotionEvidenceLimitation::SeparateRelayAndNotaryBundleLifecycle, + ], + }) +} + +fn compatibility_reason( + component: PromotionCompatibilityComponent, + state: PromotionCompatibilityState, +) -> PromotionBlockingReason { + use PromotionBlockingReason as Reason; + use PromotionCompatibilityComponent as Component; + use PromotionCompatibilityState as State; + match (component, state) { + (Component::Product, State::Missing) => Reason::MissingProduct, + (Component::Capability, State::Missing) => Reason::MissingCapability, + (Component::Schema, State::Missing) => Reason::MissingSchema, + (Component::Abi, State::Missing) => Reason::MissingAbi, + (Component::Product, State::Incompatible) => Reason::IncompatibleProduct, + (Component::Capability, State::Incompatible) => Reason::IncompatibleCapability, + (Component::Schema, State::Incompatible) => Reason::IncompatibleSchema, + (Component::Abi, State::Incompatible) => Reason::IncompatibleAbi, + (_, State::Unresolved) => Reason::CompatibilityUnresolved, + (_, State::Compatible) => unreachable!("compatible components have no blocking reason"), + } +} + +fn add_change_actions( + kind: PromotionChangeKind, + reviews: &mut BTreeSet, + products: &mut ProductActionSet, +) { + match kind { + PromotionChangeKind::Origin | PromotionChangeKind::CredentialBinding => { + reviews.insert(PromotionReviewClass::Security); + reviews.insert(PromotionReviewClass::Interoperability); + products.add(ProductActionSet::RELAY); + } + PromotionChangeKind::Trust => { + reviews.insert(PromotionReviewClass::Security); + reviews.insert(PromotionReviewClass::Interoperability); + products.add(ProductActionSet::BOTH); + } + PromotionChangeKind::Caller + | PromotionChangeKind::Purpose + | PromotionChangeKind::ServicePolicy + | PromotionChangeKind::Claim + | PromotionChangeKind::Disclosure => { + reviews.insert(PromotionReviewClass::Privacy); + reviews.insert(PromotionReviewClass::Security); + products.add(ProductActionSet::NOTARY); + } + PromotionChangeKind::Operational => { + reviews.insert(PromotionReviewClass::Operations); + reviews.insert(PromotionReviewClass::Security); + products.add(ProductActionSet::BOTH); + } + PromotionChangeKind::ProductEnablement + | PromotionChangeKind::CapabilityEnablement + | PromotionChangeKind::IntegrationCeiling => { + reviews.insert(PromotionReviewClass::Compatibility); + reviews.insert(PromotionReviewClass::Release); + products.add(ProductActionSet::BOTH); + } + } +} + +#[derive(Clone, Copy, Debug, Default, Eq, PartialEq)] +struct ProductActionSet(u8); + +impl ProductActionSet { + const RELAY: u8 = 0b01; + const NOTARY: u8 = 0b10; + const BOTH: u8 = Self::RELAY | Self::NOTARY; + + fn add(&mut self, product: u8) { + self.0 |= product; + } + + const fn action(self) -> PromotionProductAction { + match self.0 { + Self::RELAY => PromotionProductAction::Relay, + Self::NOTARY => PromotionProductAction::Notary, + Self::BOTH => PromotionProductAction::RelayAndNotary, + _ => PromotionProductAction::None, + } + } +} diff --git a/crates/registryctl/src/project_authoring/report_contract.rs b/crates/registryctl/src/project_authoring/report_contract.rs new file mode 100644 index 000000000..07d25058c --- /dev/null +++ b/crates/registryctl/src/project_authoring/report_contract.rs @@ -0,0 +1,1095 @@ +// SPDX-License-Identifier: Apache-2.0 +// Strict, versioned machine-report contracts for project authoring. +// +// These DTOs report decisions made by the authoritative authoring model and +// compiler. They deliberately do not restate authoring validation rules. + +use std::fmt; + +use serde::{de, Deserialize, Deserializer, Serialize}; +use serde_json::Value; + +pub use super::knowledge::{ + Availability as FieldKnowledgeAvailability, Consumer as FieldKnowledgeConsumer, FieldPathKind, + GeneratedArtifact as FieldGeneratedArtifact, HumanOwner as FieldHumanOwner, + Migration as FieldMigration, Product as FieldKnowledgeProduct, + ReviewClass as FieldKnowledgeReviewClass, SemanticOwner as FieldSemanticOwner, + SemanticRule as FieldKnowledgeSemanticRule, Sensitivity as FieldSensitivity, + Stability as FieldKnowledgeStability, +}; + +pub const PROJECT_COMMAND_REPORT_SCHEMA_VERSION_V1: &str = "registryctl.project_command.v1"; +pub const PROJECT_EXPLANATION_SCHEMA_VERSION_V1: &str = "registry.project.explanation.v1"; +pub const PROJECT_SEMANTIC_IMPACT_SCHEMA_VERSION_V1: &str = "registry.project.semantic_impact.v1"; +pub const PROJECT_ARTIFACT_MANIFEST_SCHEMA_VERSION_V1: &str = + "registry.project.artifact_manifest.v1"; +pub const PROJECT_ARTIFACT_MANIFEST_FORMAT_VERSION_V1: &str = + "registry.project.artifact_manifest.format.v1"; + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +pub enum ProjectCommandSchemaVersion { + #[serde(rename = "registryctl.project_command.v1")] + V1, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +pub enum ProjectExplanationSchemaVersion { + #[serde(rename = "registry.project.explanation.v1")] + V1, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +pub enum ProjectSemanticImpactSchemaVersion { + #[serde(rename = "registry.project.semantic_impact.v1")] + V1, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +pub enum ProjectArtifactManifestSchemaVersion { + #[serde(rename = "registry.project.artifact_manifest.v1")] + V1, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +pub enum ProjectArtifactManifestFormatVersion { + #[serde(rename = "registry.project.artifact_manifest.format.v1")] + V1, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum ProjectCommandStatus { + Passed, + Valid, + Built, +} + +impl ProjectCommandStatus { + pub const fn as_str(self) -> &'static str { + match self { + Self::Passed => "passed", + Self::Valid => "valid", + Self::Built => "built", + } + } +} + +impl fmt::Display for ProjectCommandStatus { + fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result { + formatter.write_str(self.as_str()) + } +} + +impl PartialEq<&str> for ProjectCommandStatus { + fn eq(&self, other: &&str) -> bool { + self.as_str() == *other + } +} + +impl PartialEq for &str { + fn eq(&self, other: &ProjectCommandStatus) -> bool { + *self == other.as_str() + } +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum ProjectBaseline { + InitialWithoutBaseline, + VerifiedSignedBundle, +} + +impl ProjectBaseline { + pub const fn as_str(self) -> &'static str { + match self { + Self::InitialWithoutBaseline => "initial_without_baseline", + Self::VerifiedSignedBundle => "verified_signed_bundle", + } + } +} + +impl fmt::Display for ProjectBaseline { + fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result { + formatter.write_str(self.as_str()) + } +} + +impl PartialEq<&str> for ProjectBaseline { + fn eq(&self, other: &&str) -> bool { + self.as_str() == *other + } +} + +impl PartialEq for &str { + fn eq(&self, other: &ProjectBaseline) -> bool { + *self == other.as_str() + } +} + +#[derive(Clone, Debug, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct ProjectCommandReportV1 { + pub schema_version: ProjectCommandSchemaVersion, + pub status: ProjectCommandStatus, + pub project: String, + pub environment: Option, + pub fixtures: Vec, + #[serde(default, skip_serializing_if = "Vec::is_empty")] + pub semantic_changes: Vec, + pub baseline: ProjectBaseline, + #[serde(skip_serializing_if = "Option::is_none")] + pub output: Option, + #[serde(skip_serializing_if = "Option::is_none")] + pub semantic_impact: Option, + #[serde(skip_serializing_if = "Option::is_none")] + pub artifact_manifest: Option, + #[serde(skip_serializing_if = "Option::is_none")] + pub fixture_coverage: Option, + #[serde(skip_serializing_if = "Option::is_none")] + pub explanation: Option, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct ProjectFixtureReport { + pub integration: String, + pub fixture: ProjectFixtureReportId, + pub inputs: Vec, + pub calls: Vec, + pub outputs: Vec, + pub claims: Vec, + #[serde(skip_serializing_if = "Option::is_none")] + pub outcome: Option, + #[serde(skip_serializing_if = "Option::is_none")] + pub expected_error: Option, + #[serde(skip_serializing_if = "Option::is_none")] + pub source_access: Option, + pub passed: bool, + #[serde(skip_serializing_if = "Option::is_none")] + pub failure: Option, +} + +#[derive(Clone, Debug, Eq, PartialEq, Serialize)] +#[serde(transparent)] +pub struct ProjectFixtureReportId(String); + +impl<'de> Deserialize<'de> for ProjectFixtureReportId { + fn deserialize(deserializer: D) -> Result + where + D: Deserializer<'de>, + { + let value = String::deserialize(deserializer)?; + if valid_project_fixture_report_id(&value) { + Ok(Self(value)) + } else { + Err(de::Error::custom("invalid project fixture report id")) + } + } +} + +impl ProjectFixtureReportId { + pub fn as_str(&self) -> &str { + &self.0 + } +} + +fn valid_project_fixture_report_id(value: &str) -> bool { + let (fixture, recipe) = value + .split_once("::derived/") + .map_or((value, None), |(fixture, recipe)| (fixture, Some(recipe))); + let mut fixture_bytes = fixture.bytes(); + if !matches!(fixture_bytes.next(), Some(first) if first.is_ascii_alphanumeric()) + || !fixture_bytes + .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'.' | b'_' | b'-')) + { + return false; + } + recipe.is_none_or(|recipe| { + let mut recipe_bytes = recipe.bytes(); + matches!(recipe_bytes.next(), Some(first) if first.is_ascii_lowercase()) + && recipe_bytes + .all(|byte| byte.is_ascii_lowercase() || byte.is_ascii_digit() || byte == b'_') + }) +} + +/// Compatibility projection retained for existing command consumers. +/// +/// Serializing this type always produces the legacy byte shape +/// `{"dimension":"..."}` with no impact details mixed into the record. +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct DimensionOnlySemanticChange { + pub dimension: SemanticDimension, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct ProjectArtifactManifestRef { + pub path: ProjectRelativePath, + pub digest: Sha256Digest, +} + +#[derive(Clone, Debug, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct ProjectExplanationReportV1 { + pub schema_version: ProjectExplanationSchemaVersion, + pub project: String, + pub environment: String, + pub fields: Vec, +} + +#[derive(Clone, Debug, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct ProjectFieldExplanation { + pub address: ProjectFieldAddress, + pub source: ProjectFieldSource, + pub state: ProjectFieldState, + #[serde(skip_serializing_if = "Option::is_none")] + pub default: Option, + pub constraints: ProjectFieldConstraints, + pub knowledge: ProjectFieldKnowledge, + pub reported_value: ClassifierSafeReportedValue, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(tag = "document", rename_all = "snake_case", deny_unknown_fields)] +pub enum ProjectFieldAddress { + Project { + path: JsonPointer, + }, + Integration { + integration: String, + path: JsonPointer, + }, + Entity { + entity: String, + path: JsonPointer, + }, + Environment { + environment: String, + path: JsonPointer, + }, + Fixture { + integration: String, + fixture: String, + path: JsonPointer, + }, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum FieldSourceKind { + Authored, + Defaulted, + Detected, + Derived, + EnvironmentBound, + Generated, + Runtime, + Absent, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct ProjectFieldSource { + pub kind: FieldSourceKind, + #[serde(skip_serializing_if = "Option::is_none")] + pub address: Option, + #[serde(skip_serializing_if = "Option::is_none")] + pub semantic_rule_id: Option, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum FieldPresence { + Authored, + Defaulted, + Detected, + Derived, + EnvironmentBound, + Generated, + Runtime, + Absent, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum FieldEffect { + Effective, + Shadowed, + Inactive, + NotApplicable, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct ProjectFieldState { + pub presence: FieldPresence, + pub effect: FieldEffect, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum FieldDefaultSource { + AuthoringSchema, + SemanticRule, + Compiler, + Product, +} + +#[derive(Clone, Debug, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct ProjectFieldDefault { + pub source: FieldDefaultSource, + pub applied: bool, + #[serde(skip_serializing_if = "Option::is_none")] + pub reported_value: Option, +} + +/// References constraints without duplicating their validation facts. +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct ProjectFieldConstraints { + pub schema_refs: Vec, + pub semantic_rule_ids: Vec, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum ProjectAuthoringSchema { + Project, + Integration, + Entity, + Environment, + Fixture, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct ProjectSchemaRef { + pub schema: ProjectAuthoringSchema, + pub path: JsonPointer, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum ImpactConsumer { + RegistryctlAuthoring, + RegistryRelay, + RegistryNotary, + EditorTooling, + DocsGenerator, + BundleSigner, + DeploymentTooling, + Operator, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum ImpactReviewClass { + Contract, + Authoring, + Semantics, + Interoperability, + Privacy, + Security, + Relay, + Notary, + Compatibility, + Documentation, + Testing, + Operations, + Release, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct ProjectFieldKnowledge { + pub path_kind: FieldPathKind, + pub semantic_owner: FieldSemanticOwner, + pub human_owner: FieldHumanOwner, + pub sensitivity: FieldSensitivity, + pub products: Vec, + pub introduced_in: String, + pub availability: FieldKnowledgeAvailability, + pub stability: FieldKnowledgeStability, + pub migration: FieldMigration, + pub consumers: Vec, + pub generated_artifacts: Vec, + pub review_classes: Vec, + pub semantic_rules: Vec, +} + +/// A report value after the classifier/redaction boundary has been applied. +/// +/// Only the `public` variant carries JSON. The private +/// [`ClassifierApprovedJson`] field prevents callers from constructing it +/// accidentally; producer code must opt in through +/// [`ClassifierApprovedJson::after_classification`]. Non-public values retain +/// only their classification and redaction reason. +#[derive(Clone, Debug, PartialEq, Deserialize, Serialize)] +#[serde(tag = "state", rename_all = "snake_case", deny_unknown_fields)] +pub enum ClassifierSafeReportedValue { + Public { + value: ClassifierApprovedJson, + }, + Redacted { + classification: FieldSensitivity, + reason: RedactionReason, + }, + Absent, +} + +#[derive(Clone, Debug, PartialEq, Deserialize, Serialize)] +#[serde(transparent)] +pub struct ClassifierApprovedJson(Value); + +impl ClassifierApprovedJson { + /// Marks a value as safe only after the caller has classified and redacted + /// it at the producer boundary. + pub(crate) fn after_classification( + classification: FieldSensitivity, + semantic_approved: bool, + value: Value, + ) -> Option { + classification + .value_is_reportable(semantic_approved) + .then_some(Self(value)) + } + + pub fn as_value(&self) -> &Value { + &self.0 + } +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum RedactionReason { + Policy, + SecretMaterial, + SensitiveMetadata, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct ProjectSemanticImpactReportV1 { + pub schema_version: ProjectSemanticImpactSchemaVersion, + pub baseline: ProjectBaseline, + pub changes: Vec, +} + +impl ProjectSemanticImpactReportV1 { + /// Produces the stable, de-duplicated legacy dimension projection. + #[must_use] + pub fn dimension_only_changes(&self) -> Vec { + let mut dimensions = self + .changes + .iter() + .map(|change| change.dimension) + .collect::>(); + dimensions.sort_unstable(); + dimensions.dedup(); + dimensions + .into_iter() + .map(|dimension| DimensionOnlySemanticChange { dimension }) + .collect() + } +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum SemanticDimension { + Claim, + Integration, + ServicePolicy, + OperatorSecurity, + Disclosure, + Compiler, +} + +impl SemanticDimension { + pub const fn as_str(self) -> &'static str { + match self { + Self::Claim => "claim", + Self::Integration => "integration", + Self::ServicePolicy => "service_policy", + Self::OperatorSecurity => "operator_security", + Self::Disclosure => "disclosure", + Self::Compiler => "compiler", + } + } +} + +impl fmt::Display for SemanticDimension { + fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result { + formatter.write_str(self.as_str()) + } +} + +impl PartialEq<&str> for SemanticDimension { + fn eq(&self, other: &&str) -> bool { + self.as_str() == *other + } +} + +impl PartialEq for &str { + fn eq(&self, other: &SemanticDimension) -> bool { + *self == other.as_str() + } +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum SemanticDirection { + Added, + Removed, + Changed, + Narrowed, + Widened, + DefaultChanged, + Unbaselined, +} + +#[derive(Clone, Debug, Eq, PartialEq)] +pub enum SemanticImpactLocation { + Field { field: ProjectFieldAddress }, + Dimension, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +enum SemanticPrecision { + Field, + Dimension, +} + +#[derive(Clone, Debug, Eq, PartialEq)] +pub struct ProjectSemanticImpact { + pub location: SemanticImpactLocation, + pub dimension: SemanticDimension, + pub direction: SemanticDirection, + pub affected_subjects: Vec, + pub consumers: Vec, + pub review_classes: Vec, + pub product_impacts: Vec, + pub requirements: ImpactRequirements, +} + +impl Serialize for ProjectSemanticImpact { + fn serialize(&self, serializer: S) -> Result + where + S: serde::Serializer, + { + let (precision, field) = match &self.location { + SemanticImpactLocation::Field { field } => (SemanticPrecision::Field, Some(field)), + SemanticImpactLocation::Dimension => (SemanticPrecision::Dimension, None), + }; + ProjectSemanticImpactRef { + precision, + field, + dimension: self.dimension, + direction: self.direction, + affected_subjects: &self.affected_subjects, + consumers: &self.consumers, + review_classes: &self.review_classes, + product_impacts: &self.product_impacts, + requirements: &self.requirements, + } + .serialize(serializer) + } +} + +impl<'de> Deserialize<'de> for ProjectSemanticImpact { + fn deserialize(deserializer: D) -> Result + where + D: Deserializer<'de>, + { + let wire = ProjectSemanticImpactWire::deserialize(deserializer)?; + let location = match (wire.precision, wire.field) { + (SemanticPrecision::Field, Some(field)) => SemanticImpactLocation::Field { field }, + (SemanticPrecision::Dimension, None) => SemanticImpactLocation::Dimension, + (SemanticPrecision::Field, None) => { + return Err(de::Error::custom( + "field precision requires a field address", + )); + } + (SemanticPrecision::Dimension, Some(_)) => { + return Err(de::Error::custom( + "dimension precision must not carry a field address", + )); + } + }; + Ok(Self { + location, + dimension: wire.dimension, + direction: wire.direction, + affected_subjects: wire.affected_subjects, + consumers: wire.consumers, + review_classes: wire.review_classes, + product_impacts: wire.product_impacts, + requirements: wire.requirements, + }) + } +} + +#[derive(Serialize)] +#[serde(deny_unknown_fields)] +struct ProjectSemanticImpactRef<'a> { + precision: SemanticPrecision, + #[serde(skip_serializing_if = "Option::is_none")] + field: Option<&'a ProjectFieldAddress>, + dimension: SemanticDimension, + direction: SemanticDirection, + affected_subjects: &'a [AffectedSubject], + consumers: &'a [ImpactConsumer], + review_classes: &'a [ImpactReviewClass], + product_impacts: &'a [ProductImpact], + requirements: &'a ImpactRequirements, +} + +#[derive(Deserialize)] +#[serde(deny_unknown_fields)] +struct ProjectSemanticImpactWire { + precision: SemanticPrecision, + field: Option, + dimension: SemanticDimension, + direction: SemanticDirection, + affected_subjects: Vec, + consumers: Vec, + review_classes: Vec, + product_impacts: Vec, + requirements: ImpactRequirements, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum AffectedSubjectKind { + Integration, + Fixture, + ServicePolicy, + Consultation, + Claim, + Disclosure, + ProductInput, + GeneratedArtifact, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct AffectedSubject { + pub kind: AffectedSubjectKind, + pub id: String, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum ProjectProduct { + Registryctl, + Relay, + Notary, + Editor, + Docs, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum ProductImpactClass { + Regenerate, + Revalidate, + Reconfigure, + Republish, + None, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct ProductImpact { + pub product: ProjectProduct, + pub impact: ProductImpactClass, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct ImpactRequirements { + pub signing: SigningRequirement, + pub activation: ActivationRequirement, + pub restart: RestartRequirement, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum SigningRequirement { + None, + RelayBundle, + NotaryBundle, + RelayAndNotaryBundles, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum ActivationRequirement { + None, + RepublishArtifacts, + ApplyRelayConfig, + ApplyNotaryConfig, + ApplyRelayAndNotaryConfig, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum RestartRequirement { + None, + RegistryRelay, + RegistryNotary, + RegistryRelayAndNotary, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct ProjectArtifactManifestV1 { + pub schema_version: ProjectArtifactManifestSchemaVersion, + pub format_version: ProjectArtifactManifestFormatVersion, + pub project: String, + pub environment: String, + pub generator: ArtifactGenerator, + pub inputs: Vec, + pub artifacts: Vec, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct ArtifactGenerator { + pub name: ArtifactGeneratorName, + pub version: String, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum ArtifactGeneratorName { + Registryctl, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct ArtifactInputDigest { + pub path: ProjectRelativePath, + pub digest: Sha256Digest, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct GeneratedArtifactRecord { + pub path: ProjectRelativePath, + pub format_version: String, + pub digest: Sha256Digest, + pub classes: Vec, + pub sensitivity: ArtifactSensitivity, + pub publication: ArtifactPublication, + pub edit: ArtifactEditPolicy, + pub version_control: ArtifactVersionControl, + pub review: ArtifactReviewState, + pub lifecycle: ArtifactLifecycle, + pub actions: Vec, + pub consumers: Vec, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum ArtifactClass { + RuntimeConfig, + ConsultationContract, + SourcePlan, + ClaimConfiguration, + DeploymentInput, + ReviewRecord, + Documentation, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum ArtifactSensitivity { + Public, + Internal, + TopologySensitive, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum ArtifactPublication { + Public, + OperatorOnly, + NeverPublish, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum ArtifactEditPolicy { + GeneratedDoNotEdit, + GeneratedReviewBeforeEdit, + HandMaintained, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum ArtifactVersionControl { + Commit, + Ignore, + ProjectDecision, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum ArtifactReviewState { + GeneratedCandidate, + NeedsReview, + Reviewed, + ReadyCandidate, + Released, + Deprecated, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum ArtifactLifecycle { + UnsignedNonDeployable, + SignedCandidate, + VerifiedDeployable, + ReviewEvidence, + PublicationOutput, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum ArtifactAction { + Regenerate, + Compare, + Validate, + Sign, + Verify, + Discard, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum ArtifactConsumer { + RegistryRelay, + RegistryNotary, + BundleSigner, + DeploymentTooling, + ProjectDocumentation, + Operator, +} + +#[derive(Clone, Debug, Eq, Ord, PartialEq, PartialOrd, Serialize)] +#[serde(transparent)] +pub struct ProjectRelativePath(String); + +impl ProjectRelativePath { + pub fn new(path: impl Into) -> Result { + let path = path.into(); + validate_project_relative_path(&path)?; + Ok(Self(path)) + } + + pub fn as_str(&self) -> &str { + &self.0 + } +} + +impl fmt::Display for ProjectRelativePath { + fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result { + formatter.write_str(self.as_str()) + } +} + +impl AsRef for ProjectRelativePath { + fn as_ref(&self) -> &str { + self.as_str() + } +} + +impl AsRef for ProjectRelativePath { + fn as_ref(&self) -> &std::ffi::OsStr { + self.as_str().as_ref() + } +} + +impl AsRef for ProjectRelativePath { + fn as_ref(&self) -> &std::path::Path { + self.as_str().as_ref() + } +} + +impl PartialEq<&str> for ProjectRelativePath { + fn eq(&self, other: &&str) -> bool { + self.as_str() == *other + } +} + +impl PartialEq for &str { + fn eq(&self, other: &ProjectRelativePath) -> bool { + *self == other.as_str() + } +} + +#[derive(Clone, Debug, Eq, Ord, PartialEq, PartialOrd, Serialize)] +#[serde(transparent)] +pub struct JsonPointer(String); + +impl JsonPointer { + pub fn new(pointer: impl Into) -> Result { + let pointer = pointer.into(); + validate_json_pointer(&pointer)?; + Ok(Self(pointer)) + } + + pub fn as_str(&self) -> &str { + &self.0 + } +} + +impl fmt::Display for JsonPointer { + fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result { + formatter.write_str(self.as_str()) + } +} + +impl<'de> Deserialize<'de> for JsonPointer { + fn deserialize(deserializer: D) -> Result + where + D: Deserializer<'de>, + { + let pointer = String::deserialize(deserializer)?; + Self::new(pointer).map_err(de::Error::custom) + } +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq)] +pub struct JsonPointerError; + +impl fmt::Display for JsonPointerError { + fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result { + formatter.write_str("field path must be an RFC 6901 JSON Pointer") + } +} + +fn validate_json_pointer(pointer: &str) -> Result<(), JsonPointerError> { + if pointer.is_empty() { + return Ok(()); + } + if !pointer.starts_with('/') || pointer.bytes().any(|byte| byte.is_ascii_control()) { + return Err(JsonPointerError); + } + let bytes = pointer.as_bytes(); + let mut index = 0; + while index < bytes.len() { + if bytes[index] == b'~' { + index += 1; + if index == bytes.len() || !matches!(bytes[index], b'0' | b'1') { + return Err(JsonPointerError); + } + } + index += 1; + } + Ok(()) +} + +impl<'de> Deserialize<'de> for ProjectRelativePath { + fn deserialize(deserializer: D) -> Result + where + D: Deserializer<'de>, + { + let path = String::deserialize(deserializer)?; + Self::new(path).map_err(de::Error::custom) + } +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq)] +pub struct ProjectRelativePathError; + +impl fmt::Display for ProjectRelativePathError { + fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result { + formatter.write_str("path must be a normalized, safe project-relative path") + } +} + +fn validate_project_relative_path(path: &str) -> Result<(), ProjectRelativePathError> { + if path.is_empty() + || path.starts_with('/') + || path.starts_with('\\') + || path.contains('\\') + || path.contains('\0') + || path.bytes().any(|byte| byte.is_ascii_control()) + { + return Err(ProjectRelativePathError); + } + if path.split('/').any(|part| { + let mut characters = part.chars(); + let Some(first) = characters.next() else { + return true; + }; + let first_is_valid = if first == '.' { + characters.next().is_some_and(|character| { + character.is_ascii_alphanumeric() || "_-".contains(character) + }) + } else { + first.is_ascii_alphanumeric() || "_-".contains(first) + }; + !first_is_valid + || characters + .any(|character| !character.is_ascii_alphanumeric() && !"._-".contains(character)) + }) { + return Err(ProjectRelativePathError); + } + Ok(()) +} + +#[derive(Clone, Debug, Eq, Ord, PartialEq, PartialOrd, Serialize)] +#[serde(transparent)] +pub struct Sha256Digest(String); + +impl Sha256Digest { + pub fn new(digest: impl Into) -> Result { + let digest = digest.into(); + let Some(hex) = digest.strip_prefix("sha256:") else { + return Err(Sha256DigestError); + }; + if hex.len() != 64 + || !hex + .bytes() + .all(|byte| byte.is_ascii_digit() || matches!(byte, b'a'..=b'f')) + { + return Err(Sha256DigestError); + } + Ok(Self(digest)) + } + + pub fn as_str(&self) -> &str { + &self.0 + } +} + +impl fmt::Display for Sha256Digest { + fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result { + formatter.write_str(self.as_str()) + } +} + +impl<'de> Deserialize<'de> for Sha256Digest { + fn deserialize(deserializer: D) -> Result + where + D: Deserializer<'de>, + { + let digest = String::deserialize(deserializer)?; + Self::new(digest).map_err(de::Error::custom) + } +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq)] +pub struct Sha256DigestError; + +impl fmt::Display for Sha256DigestError { + fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result { + formatter.write_str("digest must be lowercase sha256:<64 hex characters>") + } +} diff --git a/crates/registryctl/src/project_authoring/schema_authority.rs b/crates/registryctl/src/project_authoring/schema_authority.rs new file mode 100644 index 000000000..e4dde1621 --- /dev/null +++ b/crates/registryctl/src/project_authoring/schema_authority.rs @@ -0,0 +1,2213 @@ +// SPDX-License-Identifier: Apache-2.0 + +use std::fmt; +use std::sync::OnceLock; + +use jsonschema::error::ValidationErrorKind; +use jsonschema::output::BasicOutput; + +/// A safe authoring-boundary failure. +/// +/// This type intentionally records only locations and validation classes. It +/// never retains the rejected instance, authored scalar values, or the +/// `jsonschema` error because those can contain country configuration. +#[derive(Debug, Clone, PartialEq, Eq)] +enum AuthoringDocumentError { + Syntax { + line: Option, + column: Option, + }, + Schema { + instance_path: String, + schema_path: String, + keyword: &'static str, + reserved_fixture_body: bool, + unsafe_authored_path: bool, + line: Option, + column: Option, + }, + TypedModel { + kind: ProjectSchemaKind, + }, +} + +impl AuthoringDocumentError { + const fn is_syntax(&self) -> bool { + matches!(self, Self::Syntax { .. }) + } + + const fn keyword(&self) -> Option<&'static str> { + match self { + Self::Schema { keyword, .. } => Some(keyword), + Self::Syntax { .. } | Self::TypedModel { .. } => None, + } + } + + fn instance_path(&self) -> Option<&str> { + match self { + Self::Schema { instance_path, .. } if !instance_path.is_empty() => { + Some(instance_path) + } + Self::Schema { .. } | Self::Syntax { .. } | Self::TypedModel { .. } => None, + } + } + + const fn location(&self) -> (Option, Option) { + match self { + Self::Syntax { line, column } => (*line, *column), + Self::Schema { line, column, .. } => (*line, *column), + Self::TypedModel { .. } => (None, None), + } + } + + fn set_location(&mut self, line: Option, column: Option) { + if let Self::Schema { + line: schema_line, + column: schema_column, + .. + } = self + { + *schema_line = line; + *schema_column = column; + } + } + + const fn is_reserved_fixture_body(&self) -> bool { + matches!( + self, + Self::Schema { + reserved_fixture_body: true, + .. + } + ) + } + + const fn is_unsafe_authored_path(&self) -> bool { + matches!( + self, + Self::Schema { + unsafe_authored_path: true, + .. + } + ) + } +} + +impl fmt::Display for AuthoringDocumentError { + fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result { + match self { + Self::Syntax { line, column } => { + write!(formatter, "invalid authored YAML syntax")?; + if let (Some(line), Some(column)) = (line, column) { + write!(formatter, " at line {line}, column {column}")?; + } + Ok(()) + } + Self::Schema { + unsafe_authored_path: true, + .. + } => { + write!( + formatter, + "authored path must be normalized and cannot traverse" + )?; + write_safe_location(formatter, self) + } + Self::Schema { + schema_path, + keyword: "additionalProperties", + .. + } => { + write!( + formatter, + "authored document contains an unknown field and failed canonical schema \ + validation" + )?; + write_safe_location(formatter, self)?; + write!( + formatter, + ": schema_path={schema_path} keyword=additionalProperties" + ) + } + Self::Schema { + schema_path, + keyword, + .. + } => { + write!( + formatter, + "authored document failed canonical schema validation" + )?; + write_safe_location(formatter, self)?; + write!( + formatter, + ": schema_path={schema_path} keyword={keyword}" + ) + } + Self::TypedModel { kind } => write!( + formatter, + "canonical {} schema accepted a document the typed authoring model rejected", + kind.name() + ), + } + } +} + +impl std::error::Error for AuthoringDocumentError {} + +fn write_safe_location( + formatter: &mut fmt::Formatter<'_>, + error: &AuthoringDocumentError, +) -> fmt::Result { + if let (Some(line), Some(column)) = error.location() { + write!(formatter, " at line {line}, column {column}")?; + } + Ok(()) +} + +static PROJECT_VALIDATOR: OnceLock = OnceLock::new(); +static ENVIRONMENT_VALIDATOR: OnceLock = OnceLock::new(); +static INTEGRATION_VALIDATOR: OnceLock = OnceLock::new(); +static FIXTURE_VALIDATOR: OnceLock = OnceLock::new(); +static ENTITY_VALIDATOR: OnceLock = OnceLock::new(); +static FIXTURE_BODY_VALIDATOR: OnceLock = OnceLock::new(); + +fn validator(kind: ProjectSchemaKind) -> Result<&'static jsonschema::JSONSchema> { + let slot = match kind { + ProjectSchemaKind::Project => &PROJECT_VALIDATOR, + ProjectSchemaKind::Environment => &ENVIRONMENT_VALIDATOR, + ProjectSchemaKind::Integration => &INTEGRATION_VALIDATOR, + ProjectSchemaKind::Fixture => &FIXTURE_VALIDATOR, + ProjectSchemaKind::Entity => &ENTITY_VALIDATOR, + }; + if let Some(validator) = slot.get() { + return Ok(validator); + } + let schema: Value = serde_json::from_str(kind.document()) + .with_context(|| format!("embedded {} authoring schema is invalid JSON", kind.name()))?; + let compiled = jsonschema::JSONSchema::options() + .with_draft(jsonschema::Draft::Draft202012) + .compile(&schema) + .map_err(|_| anyhow!("embedded {} authoring schema is invalid", kind.name()))?; + // A racing thread may initialize the same byte-identical schema first. + let _ = slot.set(compiled); + slot.get() + .ok_or_else(|| anyhow!("embedded {} authoring schema is unavailable", kind.name())) +} + +fn validation_keyword(kind: &ValidationErrorKind) -> &'static str { + match kind { + ValidationErrorKind::AdditionalItems { .. } => "additionalItems", + ValidationErrorKind::AdditionalProperties { .. } => "additionalProperties", + ValidationErrorKind::AnyOf => "anyOf", + ValidationErrorKind::BacktrackLimitExceeded { .. } => "pattern", + ValidationErrorKind::Constant { .. } => "const", + ValidationErrorKind::Contains => "contains", + ValidationErrorKind::ContentEncoding { .. } => "contentEncoding", + ValidationErrorKind::ContentMediaType { .. } => "contentMediaType", + ValidationErrorKind::Custom { .. } => "custom", + ValidationErrorKind::Enum { .. } => "enum", + ValidationErrorKind::ExclusiveMaximum { .. } => "exclusiveMaximum", + ValidationErrorKind::ExclusiveMinimum { .. } => "exclusiveMinimum", + ValidationErrorKind::FalseSchema => "false", + ValidationErrorKind::FileNotFound { .. } + | ValidationErrorKind::InvalidReference { .. } + | ValidationErrorKind::InvalidURL { .. } + | ValidationErrorKind::JSONParse { .. } + | ValidationErrorKind::Resolver { .. } + | ValidationErrorKind::Schema + | ValidationErrorKind::UnknownReferenceScheme { .. } + | ValidationErrorKind::Utf8 { .. } => "schema", + ValidationErrorKind::Format { .. } => "format", + ValidationErrorKind::FromUtf8 { .. } => "contentEncoding", + ValidationErrorKind::MaxItems { .. } => "maxItems", + ValidationErrorKind::Maximum { .. } => "maximum", + ValidationErrorKind::MaxLength { .. } => "maxLength", + ValidationErrorKind::MaxProperties { .. } => "maxProperties", + ValidationErrorKind::MinItems { .. } => "minItems", + ValidationErrorKind::Minimum { .. } => "minimum", + ValidationErrorKind::MinLength { .. } => "minLength", + ValidationErrorKind::MinProperties { .. } => "minProperties", + ValidationErrorKind::MultipleOf { .. } => "multipleOf", + ValidationErrorKind::Not { .. } => "not", + ValidationErrorKind::OneOfMultipleValid | ValidationErrorKind::OneOfNotValid => "oneOf", + ValidationErrorKind::Pattern { .. } => "pattern", + ValidationErrorKind::PropertyNames { .. } => "propertyNames", + ValidationErrorKind::Required { .. } => "required", + ValidationErrorKind::Type { .. } => "type", + ValidationErrorKind::UnevaluatedProperties { .. } => "unevaluatedProperties", + ValidationErrorKind::UniqueItems => "uniqueItems", + } +} + +fn is_reserved_fixture_body_path(kind: ProjectSchemaKind, instance_path: &str) -> bool { + if kind != ProjectSchemaKind::Fixture { + return false; + } + let mut segments = instance_path.split('/').skip(1); + let candidate = matches!( + (segments.next(), segments.next(), segments.next()), + (Some("interactions"), Some(index), Some("expect" | "respond")) + if index.parse::().is_ok() + ); + candidate && matches!(segments.next(), None | Some("body")) +} + +fn fixture_body_validator() -> Result<&'static jsonschema::JSONSchema> { + if let Some(validator) = FIXTURE_BODY_VALIDATOR.get() { + return Ok(validator); + } + let schema: Value = serde_json::from_str(ProjectSchemaKind::Fixture.document()) + .context("embedded fixture authoring schema is invalid JSON")?; + let body_schema = schema + .pointer("/$defs/fixtureBody") + .cloned() + .ok_or_else(|| anyhow!("embedded fixture authoring schema has no fixtureBody definition"))?; + let compiled = jsonschema::JSONSchema::options() + .with_draft(jsonschema::Draft::Draft202012) + .compile(&body_schema) + .map_err(|_| anyhow!("embedded fixtureBody authoring schema is invalid"))?; + let _ = FIXTURE_BODY_VALIDATOR.set(compiled); + FIXTURE_BODY_VALIDATOR + .get() + .ok_or_else(|| anyhow!("embedded fixtureBody authoring schema is unavailable")) +} + +fn fixture_body_uses_reserved_file_key( + kind: ProjectSchemaKind, + instance_path: &str, + document: &Value, +) -> bool { + if kind != ProjectSchemaKind::Fixture { + return false; + } + let selected_body = if is_reserved_fixture_body_path(kind, instance_path) { + let mut segments = instance_path.split('/').skip(1); + let _interactions = segments.next(); + segments + .next() + .and_then(|segment| segment.parse::().ok()) + .zip(segments.next()) + .and_then(|(index, side)| { + document + .get("interactions") + .and_then(|interactions| interactions.get(index)) + .and_then(|interaction| interaction.get(side)) + .and_then(|message| message.get("body")) + }) + } else { + None + }; + let body_is_invalid_reserved_reference = |body: &Value| { + body.as_object() + .is_some_and(|object| object.contains_key("file")) + && fixture_body_validator().is_ok_and(|validator| !validator.is_valid(body)) + }; + if selected_body.is_some_and(body_is_invalid_reserved_reference) { + return true; + } + document + .get("interactions") + .and_then(Value::as_array) + .is_some_and(|interactions| { + interactions.iter().any(|interaction| { + ["expect", "respond"].iter().any(|side| { + interaction + .get(side) + .and_then(|message| message.get("body")) + .is_some_and(body_is_invalid_reserved_reference) + }) + }) + }) +} + +fn is_unsafe_authored_path_constraint( + kind: ProjectSchemaKind, + schema_path: &str, +) -> bool { + let authored_path_definition = match kind { + ProjectSchemaKind::Project | ProjectSchemaKind::Integration => "relativePath", + ProjectSchemaKind::Environment => "absolutePath", + ProjectSchemaKind::Fixture | ProjectSchemaKind::Entity => return false, + }; + let Some((constraint_parent, _keyword)) = schema_path.rsplit_once('/') else { + return false; + }; + if constraint_parent == format!("/$defs/{authored_path_definition}") { + return true; + } + let Ok(schema) = serde_json::from_str::(kind.document()) else { + return false; + }; + schema + .pointer(constraint_parent) + .and_then(|node| node.get("$ref")) + .and_then(Value::as_str) + == Some(format!("#/$defs/{authored_path_definition}").as_str()) +} + +fn schema_validation_error( + kind: ProjectSchemaKind, + document: &Value, + error: jsonschema::ValidationError<'_>, + instance_path: String, +) -> AuthoringDocumentError { + let schema_path = error.schema_path.to_string(); + let unsafe_authored_path = is_unsafe_authored_path_constraint(kind, &schema_path); + let reserved_fixture_body = + fixture_body_uses_reserved_file_key(kind, &instance_path, document); + AuthoringDocumentError::Schema { + instance_path, + schema_path, + keyword: validation_keyword(&error.kind), + reserved_fixture_body, + unsafe_authored_path, + line: None, + column: None, + } +} + +fn most_specific_validation_instance_path( + validator: &jsonschema::JSONSchema, + document: &Value, +) -> Option { + let BasicOutput::Invalid(errors) = validator.apply(document).basic() else { + return None; + }; + errors + .iter() + .map(|error| error.instance_location().to_string()) + .max_by(|left, right| { + left.matches('/') + .count() + .cmp(&right.matches('/').count()) + .then_with(|| left.len().cmp(&right.len())) + .then_with(|| right.as_bytes().cmp(left.as_bytes())) + }) +} + +fn escape_json_pointer_segment(segment: &str) -> String { + segment.replace('~', "~0").replace('/', "~1") +} + +fn project_target_request_mapping_validation_instance_path( + services: &serde_json::Map, + definitions: &Value, +) -> Option { + let mut mapping_schema = definitions.get("targetRequestMapping")?.clone(); + let mapping_schema_object = mapping_schema.as_object_mut()?; + mapping_schema_object.insert( + "$schema".to_string(), + Value::String("https://json-schema.org/draft/2020-12/schema".to_string()), + ); + mapping_schema_object.insert("$defs".to_string(), definitions.clone()); + let validator = jsonschema::JSONSchema::options() + .with_draft(jsonschema::Draft::Draft202012) + .compile(&mapping_schema) + .ok()?; + + for (service_id, service) in services { + let Some(consultations) = service.get("consultations").and_then(Value::as_object) else { + continue; + }; + for (consultation_id, consultation) in consultations { + let Some(inputs) = consultation.get("input").and_then(Value::as_object) else { + continue; + }; + for (input_id, mapping) in inputs { + if !validator.is_valid(mapping) { + return Some(format!( + "/services/{}/consultations/{}/input/{}", + escape_json_pointer_segment(service_id), + escape_json_pointer_segment(consultation_id), + escape_json_pointer_segment(input_id), + )); + } + } + } + } + None +} + +fn project_service_validation_instance_path(document: &Value) -> Option { + let services = document.get("services")?.as_object()?; + let root_schema: Value = serde_json::from_str(ProjectSchemaKind::Project.document()).ok()?; + let definitions = root_schema.get("$defs")?.clone(); + if let Some(pointer) = + project_target_request_mapping_validation_instance_path(services, &definitions) + { + return Some(pointer); + } + for (service_id, service) in services { + let branch = match service.get("kind").and_then(Value::as_str) { + Some("evidence") => "evidenceService", + Some("records_api") => "recordsService", + Some(_) => { + return Some(format!( + "/services/{}/kind", + escape_json_pointer_segment(service_id) + )); + } + None => continue, + }; + let mut branch_schema = definitions.get(branch)?.clone(); + let branch_object = branch_schema.as_object_mut()?; + branch_object.insert( + "$schema".to_string(), + Value::String("https://json-schema.org/draft/2020-12/schema".to_string()), + ); + branch_object.insert("$defs".to_string(), definitions.clone()); + let validator = jsonschema::JSONSchema::options() + .with_draft(jsonschema::Draft::Draft202012) + .compile(&branch_schema) + .ok()?; + if validator.is_valid(service) { + continue; + } + let nested = most_specific_validation_instance_path(&validator, service) + .or_else(|| { + validator + .validate(service) + .err() + .and_then(|mut errors| errors.next()) + .map(|error| error.instance_path.to_string()) + }) + .unwrap_or_default(); + return Some(format!( + "/services/{}{}", + escape_json_pointer_segment(service_id), + nested + )); + } + None +} + +fn parse_authoring_value( + bytes: &[u8], + kind: ProjectSchemaKind, +) -> std::result::Result { + let yaml: serde_norway::Value = serde_norway::from_slice(bytes).map_err(|error| { + let location = error.location(); + AuthoringDocumentError::Syntax { + line: location.as_ref().map(serde_norway::Location::line), + column: location.as_ref().map(serde_norway::Location::column), + } + })?; + let value = + serde_json::to_value(yaml).map_err(|_| AuthoringDocumentError::Syntax { + line: None, + column: None, + })?; + let validator = validator(kind).map_err(|_| AuthoringDocumentError::Schema { + instance_path: String::new(), + schema_path: String::new(), + keyword: "schema", + reserved_fixture_body: false, + unsafe_authored_path: false, + line: None, + column: None, + })?; + if let Err(mut errors) = validator.validate(&value) { + let error = errors.next().expect("schema validation returned an error"); + let collapsed_project_union = kind == ProjectSchemaKind::Project + && matches!(&error.kind, ValidationErrorKind::OneOfNotValid); + let instance_path = if collapsed_project_union { + project_service_validation_instance_path(&value) + } else { + None + } + .unwrap_or_else(|| error.instance_path.to_string()); + return Err(schema_validation_error(kind, &value, error, instance_path)); + } + Ok(value) +} + +trait CurrentAuthoringDocument: DeserializeOwned { + const KIND: ProjectSchemaKind; +} + +impl CurrentAuthoringDocument for RegistryProject { + const KIND: ProjectSchemaKind = ProjectSchemaKind::Project; +} + +impl CurrentAuthoringDocument for EnvironmentDocument { + const KIND: ProjectSchemaKind = ProjectSchemaKind::Environment; +} + +impl CurrentAuthoringDocument for AuthoredIntegrationDocument { + const KIND: ProjectSchemaKind = ProjectSchemaKind::Integration; +} + +impl CurrentAuthoringDocument for AuthoredFixtureDocument { + const KIND: ProjectSchemaKind = ProjectSchemaKind::Fixture; +} + +impl CurrentAuthoringDocument for EntityDefinition { + const KIND: ProjectSchemaKind = ProjectSchemaKind::Entity; +} + +fn parse_current_authoring_document( + bytes: &[u8], +) -> std::result::Result { + let value = match parse_authoring_value(bytes, T::KIND) { + Ok(value) => value, + Err(mut error) => { + if matches!(&error, AuthoringDocumentError::Schema { .. }) { + if let Err(typed_error) = serde_norway::from_slice::(bytes) { + let location = typed_error.location(); + error.set_location( + location.as_ref().map(serde_norway::Location::line), + location.as_ref().map(serde_norway::Location::column), + ); + } + } + return Err(error); + } + }; + serde_json::from_value(value).map_err(|_| AuthoringDocumentError::TypedModel { kind: T::KIND }) +} + +#[cfg(test)] +fn assert_current_authoring_value_reaches_typed_model( + kind: ProjectSchemaKind, + value: Value, +) -> std::result::Result<(), AuthoringDocumentError> { + validator(kind) + .map_err(|_| AuthoringDocumentError::Schema { + instance_path: String::new(), + schema_path: String::new(), + keyword: "schema", + reserved_fixture_body: false, + unsafe_authored_path: false, + line: None, + column: None, + })? + .validate(&value) + .map_err(|mut errors| { + let error = errors.next().expect("schema validation returned an error"); + let instance_path = error.instance_path.to_string(); + schema_validation_error(kind, &value, error, instance_path) + })?; + match kind { + ProjectSchemaKind::Project => { + serde_json::from_value::(value).map(drop) + } + ProjectSchemaKind::Environment => { + serde_json::from_value::(value).map(drop) + } + ProjectSchemaKind::Integration => { + serde_json::from_value::(value).map(drop) + } + ProjectSchemaKind::Fixture => { + serde_json::from_value::(value).map(drop) + } + ProjectSchemaKind::Entity => { + serde_json::from_value::(value).map(drop) + } + } + .map_err(|_| AuthoringDocumentError::TypedModel { kind }) +} + +#[cfg(test)] +mod schema_authority_tests { + use super::*; + + const SUPPORTED_SCHEMA_KEYWORDS: &[&str] = &[ + "$defs", + "$id", + "$ref", + "$schema", + "$comment", + "additionalProperties", + "allOf", + "anyOf", + "const", + "default", + "deprecated", + "description", + "else", + "enum", + "examples", + "exclusiveMaximum", + "exclusiveMinimum", + "format", + "if", + "items", + "maxItems", + "maxLength", + "maxProperties", + "maximum", + "minItems", + "minLength", + "minProperties", + "minimum", + "not", + "oneOf", + "pattern", + "prefixItems", + "properties", + "propertyNames", + "readOnly", + "required", + "then", + "title", + "type", + "uniqueItems", + "writeOnly", + "x-registry-field", + ]; + + fn dto_schema(kind: ProjectSchemaKind) -> Value { + let schema = match kind { + ProjectSchemaKind::Project => schemars::schema_for!(RegistryProject), + ProjectSchemaKind::Environment => schemars::schema_for!(EnvironmentDocument), + ProjectSchemaKind::Integration => { + schemars::schema_for!(AuthoredIntegrationDocument) + } + ProjectSchemaKind::Fixture => schemars::schema_for!(AuthoredFixtureDocument), + ProjectSchemaKind::Entity => schemars::schema_for!(EntityDefinition), + }; + serde_json::to_value(schema).expect("mechanically derived DTO schema serializes") + } + + fn dto_rust_root(kind: ProjectSchemaKind) -> &'static str { + match kind { + ProjectSchemaKind::Project => "RegistryProject", + ProjectSchemaKind::Environment => "EnvironmentDocument", + ProjectSchemaKind::Integration => "AuthoredIntegrationDocument", + ProjectSchemaKind::Fixture => "AuthoredFixtureDocument", + ProjectSchemaKind::Entity => "EntityDefinition", + } + } + + fn generated_dto_shape_contract() -> Vec { + let roots = ProjectSchemaKind::ALL + .into_iter() + .map(|kind| { + json!({ + "kind": kind.name(), + "rust_type": dto_rust_root(kind), + "schema": dto_schema(kind), + }) + }) + .collect::>(); + let contract = json!({ + "contract": "registryctl.dto-shape-contract", + "version": 1, + "generator": { + "name": "schemars", + "version": "1.2.1", + "draft": "https://json-schema.org/draft/2020-12/schema" + }, + "roots": roots + }); + let mut bytes = + serde_json::to_vec_pretty(&contract).expect("DTO shape contract serializes"); + bytes.push(b'\n'); + bytes + } + + const DTO_SHAPE_CONTRACT_PATH: &str = concat!( + env!("CARGO_MANIFEST_DIR"), + "/schemas/project-authoring/dto-shape-contract.v1.json" + ); + + #[test] + #[ignore = "explicit maintainer regeneration; the byte-exact check runs by default"] + fn regenerate_dto_shape_contract_from_five_rust_roots() { + std::fs::write(DTO_SHAPE_CONTRACT_PATH, generated_dto_shape_contract()) + .expect("DTO shape contract writes"); + } + + #[test] + fn committed_dto_shape_contract_is_byte_exact_generated_output() { + assert!( + include_str!("../../../../Cargo.toml") + .lines() + .any(|line| line.trim() == r#"schemars = { version = "=1.2.1" }"#), + "DTO contract generator metadata must match the exact workspace schemars pin" + ); + let committed = include_bytes!( + "../../schemas/project-authoring/dto-shape-contract.v1.json" + ) + .as_slice(); + let generated = generated_dto_shape_contract(); + assert!( + committed == generated, + "run `cargo test -p registryctl --lib \ + project_authoring::schema_authority_tests::\ + regenerate_dto_shape_contract_from_five_rust_roots \ + -- --ignored --exact` and review the complete DTO-shape diff \ + (committed bytes: {}, generated bytes: {})", + committed.len(), + generated.len() + ); + } + + fn audit_schema_node( + node: &Value, + root: &Value, + address: &str, + visited_refs: &mut BTreeSet, + visited_nodes: &mut BTreeSet, + ) -> std::result::Result<(), String> { + if let Value::Bool(_) = node { + visited_nodes.insert(address.to_string()); + return Ok(()); + } + let object = node + .as_object() + .ok_or_else(|| format!("{address}: schema node is neither object nor boolean"))?; + visited_nodes.insert(address.to_string()); + for keyword in object.keys() { + if !SUPPORTED_SCHEMA_KEYWORDS.contains(&keyword.as_str()) { + return Err(format!("{address}: unsupported schema keyword {keyword}")); + } + } + if let Some(reference) = object.get("$ref").and_then(Value::as_str) { + if !reference.starts_with("#/") { + return Err(format!("{address}: only local references are supported")); + } + let narrowing_siblings = object.keys().filter(|keyword| { + !matches!( + keyword.as_str(), + "$ref" + | "$comment" + | "default" + | "deprecated" + | "description" + | "examples" + | "readOnly" + | "title" + | "writeOnly" + | "x-registry-field" + ) + }); + if let Some(keyword) = narrowing_siblings.into_iter().next() { + return Err(format!( + "{address}: $ref sibling {keyword} is not included in the containment proof" + )); + } + let target = root + .pointer(&reference[1..]) + .ok_or_else(|| format!("{address}: unresolved local reference {reference}"))?; + if visited_refs.insert(reference.to_string()) { + audit_schema_node( + target, + root, + &format!("{address}->$ref({reference})"), + visited_refs, + visited_nodes, + )?; + } + } + for container in ["$defs", "properties"] { + if let Some(children) = object.get(container) { + let children = children + .as_object() + .ok_or_else(|| format!("{address}/{container}: expected object"))?; + for (name, child) in children { + audit_schema_node( + child, + root, + &format!("{address}/{container}/{name}"), + visited_refs, + visited_nodes, + )?; + } + } + } + for keyword in [ + "additionalProperties", + "else", + "if", + "items", + "not", + "propertyNames", + "then", + ] { + if let Some(child) = object.get(keyword) { + audit_schema_node( + child, + root, + &format!("{address}/{keyword}"), + visited_refs, + visited_nodes, + )?; + } + } + for keyword in ["allOf", "anyOf", "oneOf", "prefixItems"] { + if let Some(children) = object.get(keyword) { + let children = children + .as_array() + .ok_or_else(|| format!("{address}/{keyword}: expected array"))?; + if keyword != "prefixItems" && children.is_empty() { + return Err(format!("{address}/{keyword}: empty union is unsupported")); + } + for (index, child) in children.iter().enumerate() { + audit_schema_node( + child, + root, + &format!("{address}/{keyword}/{index}"), + visited_refs, + visited_nodes, + )?; + } + } + } + Ok(()) + } + + fn resolve<'a>( + mut node: &'a Value, + root: &'a Value, + ) -> std::result::Result<&'a Value, String> { + let mut seen = BTreeSet::new(); + while let Some(reference) = node.get("$ref").and_then(Value::as_str) { + if !reference.starts_with("#/") || !seen.insert(reference) { + return Err(format!("unsupported or cyclic local reference {reference}")); + } + node = root + .pointer(&reference[1..]) + .ok_or_else(|| format!("unresolved local reference {reference}"))?; + } + Ok(node) + } + + fn alternatives(node: &Value) -> Option<&Vec> { + node.get("oneOf") + .or_else(|| node.get("anyOf")) + .and_then(Value::as_array) + } + + fn has_base_shape(node: &Value) -> bool { + [ + "type", + "const", + "enum", + "properties", + "additionalProperties", + "propertyNames", + "required", + "minProperties", + "maxProperties", + "items", + "prefixItems", + "minItems", + "maxItems", + "uniqueItems", + "minLength", + "maxLength", + "pattern", + "format", + "minimum", + "maximum", + "exclusiveMinimum", + "exclusiveMaximum", + "not", + ] + .iter() + .any(|keyword| node.get(*keyword).is_some()) + } + + fn json_type(value: &Value) -> &'static str { + match value { + Value::Null => "null", + Value::Bool(_) => "boolean", + Value::Number(number) if number.is_i64() || number.is_u64() => "integer", + Value::Number(_) => "number", + Value::String(_) => "string", + Value::Array(_) => "array", + Value::Object(_) => "object", + } + } + + fn type_set(node: &Value) -> BTreeSet<&str> { + if let Some(types) = node.get("type") { + return match types { + Value::String(kind) => BTreeSet::from([kind.as_str()]), + Value::Array(kinds) => kinds.iter().filter_map(Value::as_str).collect(), + _ => BTreeSet::new(), + }; + } + if let Some(value) = node.get("const") { + return BTreeSet::from([json_type(value)]); + } + node.get("enum") + .and_then(Value::as_array) + .map(|values| values.iter().map(json_type).collect()) + .unwrap_or_default() + } + + fn accepted_literals(node: &Value) -> Option> { + if let Some(value) = node.get("const") { + return Some(BTreeSet::from([value.to_string()])); + } + node.get("enum") + .and_then(Value::as_array) + .map(|values| values.iter().map(Value::to_string).collect()) + } + + fn additional_schema(node: &Value) -> Value { + node.get("additionalProperties") + .cloned() + .unwrap_or(Value::Bool(true)) + } + + #[derive(Clone, Copy, Debug)] + enum ExactNumber { + Integer(i128), + Float(f64), + } + + impl ExactNumber { + fn from_value(value: &Value) -> Option { + let number = value.as_number()?; + if let Some(value) = number.as_i64() { + return Some(Self::Integer(i128::from(value))); + } + if let Some(value) = number.as_u64() { + return Some(Self::Integer(i128::from(value))); + } + number.as_f64().map(Self::Float) + } + + fn compare(self, other: Self) -> Option { + match (self, other) { + (Self::Integer(left), Self::Integer(right)) => Some(left.cmp(&right)), + (Self::Float(left), Self::Float(right)) => left.partial_cmp(&right), + // Do not round an integer through f64. A mixed representation is + // uncommon in these derived DTOs and cannot establish containment + // without an exact decimal implementation, so fail closed. + (Self::Integer(_), Self::Float(_)) + | (Self::Float(_), Self::Integer(_)) => None, + } + } + } + + #[derive(Clone, Copy, Debug)] + struct NumericBound { + value: ExactNumber, + exclusive: bool, + } + + fn stronger_lower( + left: NumericBound, + right: NumericBound, + ) -> Option { + match left.value.compare(right.value)? { + std::cmp::Ordering::Greater => Some(left), + std::cmp::Ordering::Less => Some(right), + std::cmp::Ordering::Equal if left.exclusive => Some(left), + std::cmp::Ordering::Equal => Some(right), + } + } + + fn stronger_upper( + left: NumericBound, + right: NumericBound, + ) -> Option { + match left.value.compare(right.value)? { + std::cmp::Ordering::Less => Some(left), + std::cmp::Ordering::Greater => Some(right), + std::cmp::Ordering::Equal if left.exclusive => Some(left), + std::cmp::Ordering::Equal => Some(right), + } + } + + fn format_bounds( + format: Option<&str>, + ) -> (Option, Option) { + let inclusive = |value| { + Some(NumericBound { + value: ExactNumber::Integer(value), + exclusive: false, + }) + }; + match format { + Some("uint8") => (inclusive(0), inclusive(i128::from(u8::MAX))), + Some("uint16") => (inclusive(0), inclusive(i128::from(u16::MAX))), + Some("uint32") => (inclusive(0), inclusive(i128::from(u32::MAX))), + Some("uint64") => (inclusive(0), inclusive(i128::from(u64::MAX))), + Some("int8") => ( + inclusive(i128::from(i8::MIN)), + inclusive(i128::from(i8::MAX)), + ), + Some("int16") => ( + inclusive(i128::from(i16::MIN)), + inclusive(i128::from(i16::MAX)), + ), + Some("int32") => ( + inclusive(i128::from(i32::MIN)), + inclusive(i128::from(i32::MAX)), + ), + Some("int64") => ( + inclusive(i128::from(i64::MIN)), + inclusive(i128::from(i64::MAX)), + ), + _ => (None, None), + } + } + + fn literal_numeric_bounds( + node: &Value, + ) -> (Option, Option) { + let mut lower = None; + let mut upper = None; + for value in node.get("const").into_iter().chain( + node.get("enum") + .and_then(Value::as_array) + .into_iter() + .flatten(), + ) { + let Some(value) = ExactNumber::from_value(value) else { + continue; + }; + let bound = NumericBound { + value, + exclusive: false, + }; + lower = match lower { + Some(current) => stronger_upper(current, bound), + None => Some(bound), + }; + upper = match upper { + Some(current) => stronger_lower(current, bound), + None => Some(bound), + }; + } + (lower, upper) + } + + fn combine_lower( + left: Option, + right: Option, + ) -> Option { + match (left, right) { + (Some(left), Some(right)) => stronger_lower(left, right), + (bound @ Some(_), None) | (None, bound @ Some(_)) => bound, + (None, None) => None, + } + } + + fn combine_upper( + left: Option, + right: Option, + ) -> Option { + match (left, right) { + (Some(left), Some(right)) => stronger_upper(left, right), + (bound @ Some(_), None) | (None, bound @ Some(_)) => bound, + (None, None) => None, + } + } + + fn lower_bound(node: &Value) -> Option { + let inclusive = node + .get("minimum") + .and_then(ExactNumber::from_value) + .map(|value| NumericBound { + value, + exclusive: false, + }); + let exclusive = node + .get("exclusiveMinimum") + .and_then(ExactNumber::from_value) + .map(|value| NumericBound { + value, + exclusive: true, + }); + let format = format_bounds(node.get("format").and_then(Value::as_str)).0; + let literal = literal_numeric_bounds(node).0; + combine_lower(combine_lower(inclusive, exclusive), combine_lower(format, literal)) + } + + fn upper_bound(node: &Value) -> Option { + let inclusive = node + .get("maximum") + .and_then(ExactNumber::from_value) + .map(|value| NumericBound { + value, + exclusive: false, + }); + let exclusive = node + .get("exclusiveMaximum") + .and_then(ExactNumber::from_value) + .map(|value| NumericBound { + value, + exclusive: true, + }); + let format = format_bounds(node.get("format").and_then(Value::as_str)).1; + let literal = literal_numeric_bounds(node).1; + combine_upper(combine_upper(inclusive, exclusive), combine_upper(format, literal)) + } + + fn lower_is_at_least(published: NumericBound, dto: NumericBound) -> bool { + match published.value.compare(dto.value) { + Some(std::cmp::Ordering::Greater) => true, + Some(std::cmp::Ordering::Equal) => { + published.exclusive || !dto.exclusive + } + Some(std::cmp::Ordering::Less) | None => false, + } + } + + fn upper_is_at_most(published: NumericBound, dto: NumericBound) -> bool { + match published.value.compare(dto.value) { + Some(std::cmp::Ordering::Less) => true, + Some(std::cmp::Ordering::Equal) => { + published.exclusive || !dto.exclusive + } + Some(std::cmp::Ordering::Greater) | None => false, + } + } + + fn unsigned_constraint(node: &Value, keyword: &str) -> Option { + node.get(keyword).and_then(Value::as_u64) + } + + fn prove_scalar_constraints( + published: &Value, + dto: &Value, + address: &str, + ) -> std::result::Result<(), String> { + if let Some(dto_lower) = lower_bound(dto) { + let published_lower = lower_bound(published).ok_or_else(|| { + format!("{address}: DTO has a lower numeric bound but the published schema does not") + })?; + if !lower_is_at_least(published_lower, dto_lower) { + return Err(format!( + "{address}: published lower numeric bound is weaker than the DTO" + )); + } + } + if let Some(dto_upper) = upper_bound(dto) { + let published_upper = upper_bound(published).ok_or_else(|| { + format!("{address}: DTO has an upper numeric bound but the published schema does not") + })?; + if !upper_is_at_most(published_upper, dto_upper) { + return Err(format!( + "{address}: published upper numeric bound is weaker than the DTO" + )); + } + } + for (minimum, maximum) in [ + ("minLength", "maxLength"), + ("minItems", "maxItems"), + ("minProperties", "maxProperties"), + ] { + if let Some(dto_minimum) = unsigned_constraint(dto, minimum) { + let published_minimum = + unsigned_constraint(published, minimum).unwrap_or(0); + if published_minimum < dto_minimum { + return Err(format!( + "{address}: published {minimum} {published_minimum} is weaker than DTO {dto_minimum}" + )); + } + } + if let Some(dto_maximum) = unsigned_constraint(dto, maximum) { + let published_maximum = + unsigned_constraint(published, maximum).unwrap_or(u64::MAX); + if published_maximum > dto_maximum { + return Err(format!( + "{address}: published {maximum} {published_maximum} is weaker than DTO {dto_maximum}" + )); + } + } + } + if dto.get("uniqueItems").and_then(Value::as_bool) == Some(true) + && published.get("uniqueItems").and_then(Value::as_bool) != Some(true) + { + return Err(format!( + "{address}: DTO requires uniqueItems but the published schema does not" + )); + } + if let Some(dto_pattern) = dto.get("pattern").and_then(Value::as_str) { + let exact_pattern = + published.get("pattern").and_then(Value::as_str) == Some(dto_pattern); + let literals_match = accepted_literals(published).is_some_and(|literals| { + regex::Regex::new(dto_pattern).is_ok_and(|pattern| { + literals.iter().all(|literal| { + serde_json::from_str::(literal) + .ok() + .and_then(|value| value.as_str().map(str::to_string)) + .is_some_and(|value| pattern.is_match(&value)) + }) + }) + }); + if !exact_pattern && !literals_match { + return Err(format!( + "{address}: DTO pattern is not matched exactly by the published schema" + )); + } + } + if let Some(dto_format) = dto.get("format").and_then(Value::as_str) { + let numeric_format = matches!( + dto_format, + "int8" + | "int16" + | "int32" + | "int64" + | "uint8" + | "uint16" + | "uint32" + | "uint64" + | "float" + | "double" + ); + if !numeric_format + && published.get("format").and_then(Value::as_str) != Some(dto_format) + { + return Err(format!( + "{address}: DTO format {dto_format} is absent or different in the published schema" + )); + } + } + Ok(()) + } + + fn prove_contained( + published: &Value, + dto: &Value, + published_root: &Value, + dto_root: &Value, + address: &str, + active: &mut BTreeSet<(usize, usize)>, + ) -> std::result::Result<(), String> { + let published = resolve(published, published_root)?; + let dto = resolve(dto, dto_root)?; + if published == &Value::Bool(false) || dto == &Value::Bool(true) { + return Ok(()); + } + if published == &Value::Bool(true) { + return (dto == &Value::Bool(true)) + .then_some(()) + .ok_or_else(|| format!("{address}: unconstrained published value exceeds DTO")); + } + if dto == &Value::Bool(false) { + return Err(format!("{address}: non-empty published language exceeds false DTO")); + } + + let identity = (published as *const Value as usize, dto as *const Value as usize); + if !active.insert(identity) { + return Ok(()); + } + let result = prove_contained_inner( + published, + dto, + published_root, + dto_root, + address, + active, + ); + active.remove(&identity); + result + } + + fn schema_without(node: &Value, keywords: &[&str]) -> Value { + let mut node = node.clone(); + if let Some(object) = node.as_object_mut() { + for keyword in keywords { + object.remove(*keyword); + } + } + node + } + + fn array_allows_index(node: &Value, index: usize) -> bool { + effective_max_items(node) + .is_none_or(|maximum| (index as u128) < u128::from(maximum)) + } + + fn effective_max_items(node: &Value) -> Option { + let explicit = unsigned_constraint(node, "maxItems"); + let closed_prefix = + (node.get("items") == Some(&Value::Bool(false))).then(|| { + node.get("prefixItems") + .and_then(Value::as_array) + .map_or(0, |prefix| prefix.len() as u64) + }); + match (explicit, closed_prefix) { + (Some(left), Some(right)) => Some(left.min(right)), + (maximum @ Some(_), None) | (None, maximum @ Some(_)) => maximum, + (None, None) => None, + } + } + + fn prove_array_items( + published: &Value, + dto: &Value, + published_root: &Value, + dto_root: &Value, + address: &str, + active: &mut BTreeSet<(usize, usize)>, + ) -> std::result::Result<(), String> { + let published_prefix = published + .get("prefixItems") + .and_then(Value::as_array) + .map(Vec::as_slice) + .unwrap_or_default(); + let dto_prefix = dto + .get("prefixItems") + .and_then(Value::as_array) + .map(Vec::as_slice) + .unwrap_or_default(); + let unconstrained_published_items = Value::Bool(true); + let unconstrained_dto_items = Value::Bool(true); + let published_items = published + .get("items") + .unwrap_or(&unconstrained_published_items); + let dto_items = dto.get("items").unwrap_or(&unconstrained_dto_items); + if let Some(dto_maximum) = effective_max_items(dto) { + let published_maximum = + effective_max_items(published).unwrap_or(u64::MAX); + if published_maximum > dto_maximum { + return Err(format!( + "{address}: published array can exceed DTO maximum length {dto_maximum}" + )); + } + } + let explicit_positions = published_prefix.len().max(dto_prefix.len()); + for index in 0..explicit_positions { + if !array_allows_index(published, index) { + continue; + } + let published_item = published_prefix.get(index).unwrap_or(published_items); + if published_item == &Value::Bool(false) { + continue; + } + let dto_item = dto_prefix.get(index).unwrap_or(dto_items); + prove_contained( + published_item, + dto_item, + published_root, + dto_root, + &format!("{address}/items/{index}"), + active, + )?; + } + let tail_index = explicit_positions; + if array_allows_index(published, tail_index) + && published_items != &Value::Bool(false) + { + prove_contained( + published_items, + dto_items, + published_root, + dto_root, + &format!("{address}/items/tail"), + active, + )?; + } + Ok(()) + } + + fn prove_discriminated_object_union( + published: &Value, + branches: &[Value], + published_root: &Value, + dto_root: &Value, + address: &str, + active: &mut BTreeSet<(usize, usize)>, + ) -> Option> { + let published_properties = published.get("properties")?.as_object()?; + let first_branch = resolve(branches.first()?, dto_root).ok()?; + let first_properties = first_branch.get("properties")?.as_object()?; + for discriminator in first_properties.keys() { + let Some(published_discriminator) = published_properties.get(discriminator) else { + continue; + }; + let Ok(published_discriminator) = + resolve(published_discriminator, published_root) + else { + continue; + }; + let Some(published_literals) = + accepted_literals(published_discriminator) + else { + continue; + }; + let mut branch_literals = Vec::with_capacity(branches.len()); + let mut every_branch_has_literals = true; + for branch in branches { + let property = resolve(branch, dto_root) + .ok() + .and_then(|branch| branch.get("properties")) + .and_then(Value::as_object) + .and_then(|properties| properties.get(discriminator)) + .and_then(|property| resolve(property, dto_root).ok()) + .and_then(accepted_literals); + let Some(property_literals) = property else { + every_branch_has_literals = false; + break; + }; + branch_literals.push(property_literals); + } + if !every_branch_has_literals { + continue; + } + let accepted_by_union = branch_literals + .iter() + .flatten() + .cloned() + .collect::>(); + if !published_literals.is_subset(&accepted_by_union) { + continue; + } + + for literal in published_literals { + let literal_value: Value = serde_json::from_str(&literal).ok()?; + let mut published_variant = published.clone(); + published_variant["properties"][discriminator.as_str()] = + json!({ "const": literal_value }); + let mut failures = Vec::new(); + let mut matched = false; + for (index, branch) in branches.iter().enumerate() { + match prove_contained( + &published_variant, + branch, + published_root, + dto_root, + &format!( + "{address}->dto-discriminator-{discriminator}-branch-{index}" + ), + active, + ) { + Ok(()) => { + matched = true; + break; + } + Err(error) => failures.push(error), + } + } + if !matched { + return Some(Err(format!( + "{address}: discriminator {discriminator} value fits no DTO arm: {}", + failures.join(" | ") + ))); + } + } + return Some(Ok(())); + } + None + } + + fn prove_contained_inner( + published: &Value, + dto: &Value, + published_root: &Value, + dto_root: &Value, + address: &str, + active: &mut BTreeSet<(usize, usize)>, + ) -> std::result::Result<(), String> { + if let Some(branches) = alternatives(published) { + if !has_base_shape(published) { + for (index, branch) in branches.iter().enumerate() { + prove_contained( + branch, + dto, + published_root, + dto_root, + &format!("{address}->published-branch-{index}"), + active, + )?; + } + return Ok(()); + } + } + if let Some(branches) = alternatives(dto) { + if has_base_shape(dto) { + let dto_base = schema_without(dto, &["anyOf", "oneOf"]); + prove_contained( + published, + &dto_base, + published_root, + dto_root, + &format!("{address}->dto-union-base"), + active, + )?; + } + if let Some(result) = prove_discriminated_object_union( + published, + branches, + published_root, + dto_root, + address, + active, + ) { + return result; + } + let mut failures = Vec::new(); + for (index, branch) in branches.iter().enumerate() { + match prove_contained( + published, + branch, + published_root, + dto_root, + &format!("{address}->dto-branch-{index}"), + active, + ) { + Ok(()) => return Ok(()), + Err(error) => failures.push(error), + } + } + return Err(format!( + "{address}: published language fits no DTO union arm: {}", + failures.join(" | ") + )); + } + if let Some(branches) = dto.get("allOf").and_then(Value::as_array) { + for (index, branch) in branches.iter().enumerate() { + prove_contained( + published, + branch, + published_root, + dto_root, + &format!("{address}->dto-allOf-{index}"), + active, + )?; + } + let dto_base = schema_without(dto, &["allOf"]); + prove_contained( + published, + &dto_base, + published_root, + dto_root, + &format!("{address}->dto-allOf-base"), + active, + )?; + return Ok(()); + } + if ["if", "then", "else"] + .iter() + .any(|keyword| dto.get(*keyword).is_some()) + { + return Err(format!( + "{address}: derived DTO uses an unsupported conditional narrowing keyword" + )); + } + if let Some(dto_not) = dto.get("not") { + let published_not = published.get("not").ok_or_else(|| { + format!("{address}: DTO exclusion has no equivalent published exclusion") + })?; + prove_contained( + dto_not, + published_not, + dto_root, + published_root, + &format!("{address}->reversed-not"), + active, + )?; + } else if published.get("not").is_some() && !has_base_shape(published) { + return Err(format!( + "{address}: a published exclusion alone cannot prove containment in a constrained DTO" + )); + } + if let Some(branches) = published.get("allOf").and_then(Value::as_array) { + if !has_base_shape(published) { + let mut failures = Vec::new(); + for (index, branch) in branches.iter().enumerate() { + match prove_contained( + branch, + dto, + published_root, + dto_root, + &format!("{address}->published-allOf-{index}"), + active, + ) { + Ok(()) => return Ok(()), + Err(error) => failures.push(error), + } + } + return Err(format!( + "{address}: no allOf narrowing arm fits DTO: {}", + failures.join(" | ") + )); + } + } + + let published_types = type_set(published); + let dto_types = type_set(dto); + if !dto_types.is_empty() && published_types.is_empty() { + return Err(format!( + "{address}: unconstrained published type exceeds DTO types {dto_types:?}" + )); + } + if !dto_types.is_empty() + && !published_types.iter().all(|kind| { + dto_types.contains(kind) + || (*kind == "integer" && dto_types.contains("number")) + }) + { + return Err(format!( + "{address}: published types {published_types:?} exceed DTO types {dto_types:?}" + )); + } + match (accepted_literals(published), accepted_literals(dto)) { + (Some(published_values), Some(dto_values)) + if !published_values.is_subset(&dto_values) => + { + return Err(format!( + "{address}: published literals {published_values:?} exceed DTO literals {dto_values:?}" + )); + } + (None, Some(dto_values)) => { + return Err(format!( + "{address}: unconstrained published literals exceed DTO literals {dto_values:?}" + )); + } + _ => {} + } + prove_scalar_constraints(published, dto, address)?; + + if published_types.contains("object") + || published.get("properties").is_some() + || published.get("additionalProperties").is_some() + { + let published_required = published + .get("required") + .and_then(Value::as_array) + .into_iter() + .flatten() + .filter_map(Value::as_str) + .collect::>(); + let dto_required = dto + .get("required") + .and_then(Value::as_array) + .into_iter() + .flatten() + .filter_map(Value::as_str) + .collect::>(); + if !dto_required.is_subset(&published_required) { + return Err(format!( + "{address}: DTO requires fields absent from published requirement {:?}", + dto_required.difference(&published_required).collect::>() + )); + } + if let Some(dto_property_names) = dto.get("propertyNames") { + let unconstrained_property_names = Value::Bool(true); + let published_property_names = published + .get("propertyNames") + .unwrap_or(&unconstrained_property_names); + prove_contained( + published_property_names, + dto_property_names, + published_root, + dto_root, + &format!("{address}/propertyNames"), + active, + )?; + } + let dto_properties = dto + .get("properties") + .and_then(Value::as_object); + let dto_additional = additional_schema(dto); + if let Some(properties) = published.get("properties").and_then(Value::as_object) { + for (name, property) in properties { + let target = dto_properties + .and_then(|properties| properties.get(name)) + .unwrap_or(&dto_additional); + prove_contained( + property, + target, + published_root, + dto_root, + &format!("{address}/properties/{name}"), + active, + )?; + } + } + let published_additional = additional_schema(published); + if published_additional != Value::Bool(false) { + prove_contained( + &published_additional, + &dto_additional, + published_root, + dto_root, + &format!("{address}/additionalProperties"), + active, + )?; + } + } + if published_types.contains("array") + || published.get("items").is_some() + || published.get("prefixItems").is_some() + { + prove_array_items( + published, + dto, + published_root, + dto_root, + address, + active, + )?; + } + Ok(()) + } + + fn maintained_document(kind: ProjectSchemaKind) -> &'static [u8] { + match kind { + ProjectSchemaKind::Project => PROJECT_STARTERS + .get_file("bounded-http/registry-stack.yaml") + .expect("bounded HTTP project is embedded") + .contents(), + ProjectSchemaKind::Environment => PROJECT_STARTERS + .get_file("bounded-http/environments/local.yaml") + .expect("bounded HTTP environment is embedded") + .contents(), + ProjectSchemaKind::Integration => PROJECT_STARTERS + .get_file("bounded-http/integrations/person-record/integration.yaml") + .expect("bounded HTTP integration is embedded") + .contents(), + ProjectSchemaKind::Fixture => PROJECT_STARTERS + .get_file( + "bounded-http/integrations/person-record/fixtures/active.yaml", + ) + .expect("bounded HTTP fixture is embedded") + .contents(), + ProjectSchemaKind::Entity => SNAPSHOT_STARTER + .get_file("entities/people.yaml") + .expect("SnapshotExact entity is embedded") + .contents(), + } + } + + #[test] + fn canonical_schema_language_is_structurally_contained_by_derived_dtos() { + for kind in ProjectSchemaKind::ALL { + let published: Value = serde_json::from_str(kind.document()) + .unwrap_or_else(|error| panic!("{} schema parses: {error}", kind.name())); + let dto = dto_schema(kind); + let mut published_refs = BTreeSet::new(); + let mut published_nodes = BTreeSet::new(); + audit_schema_node( + &published, + &published, + kind.name(), + &mut published_refs, + &mut published_nodes, + ) + .unwrap_or_else(|error| panic!("{} published inventory: {error}", kind.name())); + let mut dto_refs = BTreeSet::new(); + let mut dto_nodes = BTreeSet::new(); + audit_schema_node( + &dto, + &dto, + &format!("{}-dto", kind.name()), + &mut dto_refs, + &mut dto_nodes, + ) + .unwrap_or_else(|error| panic!("{} DTO inventory: {error}", kind.name())); + assert!( + !published_nodes.is_empty() && !dto_nodes.is_empty(), + "{} inventories both finite structural languages", + kind.name() + ); + prove_contained( + &published, + &dto, + &published, + &dto, + kind.name(), + &mut BTreeSet::new(), + ) + .unwrap_or_else(|error| panic!("{} containment failed: {error}", kind.name())); + } + } + + #[test] + fn containment_proof_fails_closed_on_every_soundness_boundary() { + let prove = |published: Value, dto: Value| { + prove_contained( + &published, + &dto, + &published, + &dto, + "negative-control", + &mut BTreeSet::new(), + ) + }; + + prove( + json!({"oneOf": [{"type": "string"}, {"type": "integer", "minimum": 0, "maximum": 10}]}), + json!({"oneOf": [{"type": "integer", "minimum": 0, "maximum": 10}, {"type": "string"}]}), + ) + .expect("different published union arms may fit different DTO arms"); + assert!(prove( + json!({"type": "integer", "minimum": 0, "maximum": 300}), + json!({"type": "integer", "format": "uint8", "minimum": 0, "maximum": 255}), + ) + .is_err()); + assert!(prove( + json!({"type": "array"}), + json!({"type": "array", "items": {"type": "string"}}), + ) + .is_err()); + assert!(prove( + json!({"const": "a"}), + json!({"allOf": [{"type": "string"}, {"const": "b"}]}), + ) + .is_err()); + assert!(prove(json!({"type": "string"}), json!({"enum": ["a", "b"]})).is_err()); + assert!(prove(json!({}), json!({"type": "string"})).is_err()); + assert!(prove( + json!({"type": "string"}), + json!({"type": "string", "not": {"const": "blocked"}}), + ) + .is_err()); + + let tuple = json!({ + "type": "array", + "prefixItems": [{"type": "string"}] + }); + assert!(audit_schema_node( + &tuple, + &tuple, + "tuple", + &mut BTreeSet::new(), + &mut BTreeSet::new(), + ) + .is_ok()); + assert!(prove( + json!({ + "type": "array", + "prefixItems": [{"type": "integer"}], + "items": false, + "minItems": 1, + "maxItems": 1 + }), + json!({ + "type": "array", + "prefixItems": [{"type": "string"}], + "items": false, + "minItems": 1, + "maxItems": 1 + }), + ) + .is_err()); + assert!(prove( + json!({"type": "string", "maxLength": 32}), + json!({"type": "string", "maxLength": 16}), + ) + .is_err()); + assert!(prove( + json!({"type": "array", "maxItems": 4}), + json!({"type": "array", "maxItems": 4, "uniqueItems": true}), + ) + .is_err()); + assert!(prove( + json!({"type": "object", "maxProperties": 8}), + json!({"type": "object", "maxProperties": 4}), + ) + .is_err()); + assert!(prove( + json!({"type": "object"}), + json!({"type": "object", "propertyNames": {"pattern": "^[a-z]+$"}}), + ) + .is_err()); + assert!(prove( + json!({"type": "array", "minItems": 1}), + json!({"type": "array", "minItems": 2}), + ) + .is_err()); + assert!(prove( + json!({"type": "string", "pattern": "^[a-z]+$"}), + json!({"type": "string", "pattern": "^[a-z][a-z0-9]+$"}), + ) + .is_err()); + assert!(prove( + json!({ + "type": "array", + "prefixItems": [{"type": "string"}], + "items": {"type": "string"} + }), + json!({ + "type": "array", + "prefixItems": [{"type": "string"}], + "items": false + }), + ) + .is_err()); + + prove( + json!({"type": "integer", "minimum": 0, "maximum": u64::MAX}), + json!({"type": "integer", "format": "uint64"}), + ) + .expect("u64 maximum is compared without f64 rounding"); + assert!(prove( + json!({"type": "integer", "minimum": 0, "maximum": u64::MAX}), + json!({"type": "integer", "minimum": 0, "maximum": u64::MAX - 1}), + ) + .is_err()); + prove( + json!({"type": "integer", "minimum": i64::MIN, "maximum": i64::MAX}), + json!({"type": "integer", "format": "int64"}), + ) + .expect("i64 endpoints are compared exactly"); + assert!(prove( + json!({"type": "integer", "minimum": i64::MIN, "maximum": i64::MAX}), + json!({"type": "integer", "minimum": i64::MIN + 1, "maximum": i64::MAX}), + ) + .is_err()); + + let narrowed_ref_sibling = json!({ + "$defs": {"text": {"type": "string"}}, + "$ref": "#/$defs/text", + "minLength": 1 + }); + assert!(audit_schema_node( + &narrowed_ref_sibling, + &narrowed_ref_sibling, + "ref-sibling", + &mut BTreeSet::new(), + &mut BTreeSet::new(), + ) + .is_err()); + } + + #[test] + fn default_and_deprecation_policy_is_exact_and_runtime_defaults_are_equivalent() { + let mut defaults = Vec::new(); + let mut deprecated = Vec::new(); + for kind in ProjectSchemaKind::ALL { + let schema: Value = serde_json::from_str(kind.document()).expect("schema parses"); + collect_keyword_addresses(&schema, "", "default", &mut defaults); + collect_keyword_addresses(&schema, "", "deprecated", &mut deprecated); + } + defaults.sort(); + assert_eq!( + defaults, + [ + "/$defs/oid4vci/properties/tx_code/properties/required", + "/properties/issuance/properties/algorithm", + ] + ); + assert!( + deprecated.is_empty(), + "deprecated authoring fields require an explicit reviewed inventory and policy" + ); + + let issuance_omitted: IssuanceBinding = serde_json::from_value(json!({ + "issuer": "https://issuer.invalid", + "signing_key": {"secret": "ISSUER_KEY"}, + "signing_kid": "issuer-key", + "generation": 1 + })) + .expect("omitted issuance algorithm parses"); + let issuance_explicit: IssuanceBinding = serde_json::from_value(json!({ + "issuer": "https://issuer.invalid", + "signing_key": {"secret": "ISSUER_KEY"}, + "signing_kid": "issuer-key", + "algorithm": "EdDSA", + "generation": 1 + })) + .expect("explicit issuance algorithm parses"); + assert_eq!( + serde_json::to_value(issuance_omitted).expect("issuance serializes"), + serde_json::to_value(issuance_explicit).expect("issuance serializes") + ); + + let tx_omitted: Oid4vciTxCodeBinding = + serde_json::from_value(json!({})).expect("omitted tx-code default parses"); + let tx_explicit: Oid4vciTxCodeBinding = serde_json::from_value(json!({"required": true})) + .expect("explicit tx-code default parses"); + assert_eq!( + serde_json::to_value(tx_omitted).expect("tx code serializes"), + serde_json::to_value(tx_explicit).expect("tx code serializes") + ); + } + + fn collect_keyword_addresses( + node: &Value, + address: &str, + keyword: &str, + output: &mut Vec, + ) { + let Some(object) = node.as_object() else { + return; + }; + if object.contains_key(keyword) { + output.push(address.to_string()); + } + for container in ["$defs", "properties"] { + if let Some(children) = object.get(container).and_then(Value::as_object) { + for (name, child) in children { + collect_keyword_addresses( + child, + &format!("{address}/{container}/{name}"), + keyword, + output, + ); + } + } + } + for child_keyword in [ + "additionalProperties", + "else", + "if", + "items", + "not", + "propertyNames", + "then", + ] { + if let Some(child) = object.get(child_keyword) { + collect_keyword_addresses( + child, + &format!("{address}/{child_keyword}"), + keyword, + output, + ); + } + } + for child_keyword in ["allOf", "anyOf", "oneOf"] { + if let Some(children) = object.get(child_keyword).and_then(Value::as_array) { + for (index, child) in children.iter().enumerate() { + collect_keyword_addresses( + child, + &format!("{address}/{child_keyword}/{index}"), + keyword, + output, + ); + } + } + } + } + + #[test] + fn explicit_ingress_kind_validates_noncanonical_integration_filename() { + let mut document: Value = + serde_norway::from_slice(maintained_document(ProjectSchemaKind::Integration)) + .expect("integration fixture parses"); + document["schema_authority_unknown"] = Value::Bool(true); + let bytes = serde_norway::to_string(&document) + .expect("mutated integration serializes") + .into_bytes(); + let error = parse_yaml::( + &bytes, + "integrations/person-record/main.yaml", + ) + .expect_err("canonical integration schema rejects an unknown field"); + let rendered = format!("{error:#}"); + assert!(rendered.contains("unknown field"), "{rendered}"); + assert!(rendered.contains("additionalProperties"), "{rendered}"); + assert!(!rendered.contains("schema_authority_unknown")); + } + + #[test] + fn maintained_documents_pass_schema_before_reaching_each_typed_model() { + for kind in ProjectSchemaKind::ALL { + let value = parse_authoring_value(maintained_document(kind), kind) + .unwrap_or_else(|error| panic!("{} schema accepts its example: {error}", kind.name())); + assert_current_authoring_value_reaches_typed_model(kind, value) + .unwrap_or_else(|error| panic!("{} DTO accepts its example: {error}", kind.name())); + } + } + + #[test] + fn schema_failure_text_drops_dynamic_instance_paths_and_property_names() { + let mut value: Value = + serde_norway::from_slice(maintained_document(ProjectSchemaKind::Project)) + .expect("maintained project parses"); + let services = value["services"] + .as_object_mut() + .expect("maintained services is an object"); + let mut service = services + .remove("person-verification") + .expect("maintained service exists"); + service["kind"] = json!("country-sentinel-invalid-kind"); + services.insert("country-sensitive-service-sentinel".to_string(), service); + value["country-sensitive-field-sentinel"] = json!(true); + + let raw_errors = validator(ProjectSchemaKind::Project) + .expect("project schema compiles") + .validate(&value) + .expect_err("planted project is schema-invalid") + .map(|error| error.to_string()) + .collect::>() + .join("\n"); + assert!( + raw_errors.contains("country-sensitive-service-sentinel") + || raw_errors.contains("country-sensitive-field-sentinel"), + "negative control must plant a sentinel in raw validator output" + ); + + let bytes = serde_norway::to_string(&value) + .expect("planted project serializes") + .into_bytes(); + let error = parse_authoring_value(&bytes, ProjectSchemaKind::Project) + .expect_err("planted project is rejected"); + let rendered = error.to_string(); + assert!(!rendered.contains("country-sensitive-service-sentinel")); + assert!(!rendered.contains("country-sensitive-field-sentinel")); + assert!(!rendered.contains("country-sentinel-invalid-kind")); + assert!(!rendered.contains("instance_path")); + } + + #[test] + fn authored_path_classification_is_static_and_drops_the_received_path() { + let mut project: Value = + serde_norway::from_slice(maintained_document(ProjectSchemaKind::Project)) + .expect("maintained project parses"); + project["integrations"]["person-record"]["file"] = + json!("../country-sensitive-path-sentinel/integration.yaml"); + let bytes = serde_norway::to_string(&project) + .expect("invalid project serializes") + .into_bytes(); + let error = parse_current_authoring_document::(&bytes) + .expect_err("traversing path is rejected by the canonical schema"); + assert!(error.is_unsafe_authored_path(), "{error}"); + let rendered = error.to_string(); + assert!(rendered.contains("cannot traverse")); + assert!(!rendered.contains("country-sensitive-path-sentinel")); + assert!(!rendered.contains("instance_path")); + } + + #[test] + fn only_exact_fixture_interaction_body_paths_receive_reserved_classification() { + for (path, expected) in [ + ("/interactions/0/expect/body", true), + ("/interactions/13/respond/body/file", true), + ("/interactions/country-key/respond/body", false), + ("/interactions/0/respond/country-body", false), + ("/expect/body", false), + ] { + assert_eq!( + is_reserved_fixture_body_path(ProjectSchemaKind::Fixture, path), + expected, + "{path}" + ); + assert!(!is_reserved_fixture_body_path( + ProjectSchemaKind::Project, + path + )); + } + } + + #[test] + fn reserved_fixture_body_classification_requires_the_reserved_file_key() { + let mut fixture: Value = + serde_norway::from_slice(maintained_document(ProjectSchemaKind::Fixture)) + .expect("maintained fixture parses"); + fixture["interactions"][0]["respond"]["body"] = json!({ + "file": "bodies/active.json", + "country-sensitive-extra-field": true + }); + let bytes = serde_norway::to_string(&fixture) + .expect("invalid fixture serializes") + .into_bytes(); + let error = parse_authoring_value(&bytes, ProjectSchemaKind::Fixture) + .expect_err("ambiguous reserved file-reference shape is rejected"); + assert!(error.is_reserved_fixture_body()); + assert!(!error + .to_string() + .contains("country-sensitive-extra-field")); + + fixture["interactions"][0]["respond"]["body"] = json!({ + "file_description": "inline JSON remains an ordinary body" + }); + let bytes = serde_norway::to_string(&fixture) + .expect("inline fixture serializes") + .into_bytes(); + parse_current_authoring_document::(&bytes) + .expect("inline JSON without the reserved file key remains valid"); + } +} diff --git a/crates/registryctl/src/project_authoring/semantic_comparison.rs b/crates/registryctl/src/project_authoring/semantic_comparison.rs new file mode 100644 index 000000000..87ec81e41 --- /dev/null +++ b/crates/registryctl/src/project_authoring/semantic_comparison.rs @@ -0,0 +1,1778 @@ +// SPDX-License-Identifier: Apache-2.0 +//! Value-free, offline semantic comparison for normalized Registry projects. +//! +//! This is intentionally separate from the signed approval-state comparison. +//! Current signed v1/v2 baselines bind coarse digests and cannot prove a +//! field-addressed diff. This module instead loads both local inputs through +//! the typed authoring model, compares effective fields with internally held +//! fingerprints, and emits only closed classifications and wildcard-free +//! published schema addresses. It also compares the compiler's in-memory +//! review and approval projections. It never reads a build directory. + +use std::collections::{BTreeMap, BTreeSet}; +use std::fmt; +use std::path::PathBuf; + +use anyhow::{anyhow, bail, Context, Result}; +use serde::{Deserialize, Serialize}; +use serde_json::Value; +use sha2::{Digest as _, Sha256}; + +use super::*; + +pub const PROJECT_SEMANTIC_COMPARISON_SCHEMA_VERSION_V1: &str = + "registry.project.semantic_comparison.v1"; +const MAX_SEMANTIC_COMPARISON_CHANGES: usize = 1_024; +const MAX_SEMANTIC_COMPARISON_OCCURRENCES: usize = 8_192; + +#[derive(Clone, Debug)] +pub struct ProjectSemanticComparisonOptions { + pub current_project_directory: PathBuf, + pub current_environment: String, + pub baseline_project_directory: PathBuf, + pub baseline_environment: String, +} + +#[derive(Clone, Debug)] +pub struct ProjectEnvironmentSemanticComparisonOptions { + pub project_directory: PathBuf, + pub current_environment: String, + pub baseline_environment: String, +} + +#[derive(Clone, Debug)] +pub struct ProjectStarterSemanticComparisonOptions { + pub project_directory: PathBuf, + pub environment: String, + /// An explicitly selected embedded starter kind. `None` uses, and still + /// verifies, the starter id recorded by the authored project. + pub starter: Option, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +pub enum ProjectSemanticComparisonSchemaVersion { + #[serde(rename = "registry.project.semantic_comparison.v1")] + V1, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum SemanticComparisonKind { + LocalProjectToProject, + SameProjectEnvironmentToEnvironment, + EmbeddedStarterToProject, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum SemanticComparisonEvidenceGrade { + OfflineStatic, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum SemanticComparisonAssurance { + LocalUnverified, + EmbeddedExactRelease, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum SemanticComparisonExternalApproval { + NotEvaluated, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum SemanticComparisonEquivalence { + Equivalent, + Different, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum SemanticComparisonPrecision { + FieldAndGeneratedProjection, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum SemanticComparisonReviewPlanState { + GeneratedNoChanges, + GeneratedPendingReview, +} + +#[derive(Clone, Copy, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum SemanticComparisonEvidenceLimitation { + OfflineInputsOnly, + RuntimeNotObserved, + SignedBundleAuthorityNotEvaluated, + ExternalApprovalNotEvaluated, + FingerprintsNotPublished, +} + +const EVIDENCE_LIMITATIONS: [SemanticComparisonEvidenceLimitation; 5] = [ + SemanticComparisonEvidenceLimitation::OfflineInputsOnly, + SemanticComparisonEvidenceLimitation::RuntimeNotObserved, + SemanticComparisonEvidenceLimitation::SignedBundleAuthorityNotEvaluated, + SemanticComparisonEvidenceLimitation::ExternalApprovalNotEvaluated, + SemanticComparisonEvidenceLimitation::FingerprintsNotPublished, +]; + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum SemanticComparisonRequiredAction { + ReviewSemanticChanges, + RunAffectedFixtures, + RegenerateGeneratedArtifacts, + ResignRelayBundle, + ResignNotaryBundle, + ReactivateRelayConfiguration, + ReactivateNotaryConfiguration, + RestartRegistryRelay, + RestartRegistryNotary, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum SemanticComparisonSchemaFamily { + Project, + Environment, + Integration, + Fixture, + Entity, + GeneratedReview, + GeneratedApproval, +} + +#[derive(Clone, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct SemanticComparisonFieldAddress { + pub schema_family: SemanticComparisonSchemaFamily, + /// RFC 6901 address in the installed published schema, never an authored + /// file path or a concrete project member address. + pub field: JsonPointer, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum SemanticComparisonChangeSource { + Authored, + Defaulted, + Derived, + EnvironmentBound, + Generated, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum SemanticComparisonDimension { + Project, + Integration, + Fixture, + Entity, + ServicePolicy, + Consultation, + Claim, + Disclosure, + OperatorSecurity, + GeneratedReview, + GeneratedApproval, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum SemanticComparisonDirection { + Added, + Removed, + Changed, + Narrowed, + Widened, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum SemanticComparisonConsumer { + RegistryctlAuthoring, + RegistryRelay, + RegistryNotary, + EditorTooling, + DocsGenerator, + BundleSigner, + DeploymentTooling, + Operator, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum SemanticComparisonGeneratedArtifact { + EditorSchemas, + ProjectBuild, + RelayConfig, + NotaryConfig, + FixtureReport, + FieldReference, + ReviewPlan, + ApprovalProjection, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum SemanticComparisonReviewClass { + Contract, + Authoring, + Semantics, + Interoperability, + Privacy, + Security, + Relay, + Notary, + Compatibility, + Documentation, + Testing, + Operations, + Release, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum SemanticComparisonAffectedSubjectKind { + Integration, + Fixture, + Entity, + ServicePolicy, + Consultation, + Claim, + Disclosure, + ProductInput, + GeneratedArtifact, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct SemanticComparisonAffectedSubject { + pub kind: SemanticComparisonAffectedSubjectKind, + pub count: u16, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum SemanticComparisonSigningRequirement { + None, + RelayBundle, + NotaryBundle, + RelayAndNotaryBundles, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum SemanticComparisonActivationRequirement { + None, + ApplyRelayConfig, + ApplyNotaryConfig, + ApplyRelayAndNotaryConfig, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(rename_all = "snake_case")] +pub enum SemanticComparisonRestartRequirement { + None, + RegistryRelay, + RegistryNotary, + RegistryRelayAndNotary, +} + +#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct SemanticComparisonRequirements { + pub signing: SemanticComparisonSigningRequirement, + pub activation: SemanticComparisonActivationRequirement, + pub restart: SemanticComparisonRestartRequirement, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct ProjectSemanticComparisonChange { + pub address: SemanticComparisonFieldAddress, + pub source: SemanticComparisonChangeSource, + pub dimension: SemanticComparisonDimension, + pub direction: SemanticComparisonDirection, + pub sensitivity: knowledge::Sensitivity, + pub semantic_owner: knowledge::SemanticOwner, + pub human_owner: knowledge::HumanOwner, + pub consumers: Vec, + pub generated_artifacts: Vec, + pub review_classes: Vec, + pub affected_subjects: Vec, + pub occurrences: u16, + pub requirements: SemanticComparisonRequirements, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct SemanticComparisonReviewPlan { + pub state: SemanticComparisonReviewPlanState, + pub review_classes: Vec, +} + +#[derive(Clone, Debug, Eq, PartialEq, Deserialize, Serialize)] +#[serde(deny_unknown_fields)] +pub struct ProjectSemanticComparisonReportV1 { + pub schema_version: ProjectSemanticComparisonSchemaVersion, + pub comparison: SemanticComparisonKind, + pub evidence_grade: SemanticComparisonEvidenceGrade, + pub assurance: SemanticComparisonAssurance, + pub external_approval: SemanticComparisonExternalApproval, + pub equivalence: SemanticComparisonEquivalence, + pub comparison_precision: SemanticComparisonPrecision, + pub review_plan: SemanticComparisonReviewPlan, + pub changes: Vec, + pub required_actions: Vec, + pub evidence_limitations: Vec, +} + +impl ProjectSemanticComparisonReportV1 { + pub fn canonical_json_bytes(&self) -> Result> { + let value = serde_json::to_value(self) + .context("semantic comparison report could not be serialized safely")?; + if value.get("schema_version").and_then(Value::as_str) + != Some(PROJECT_SEMANTIC_COMPARISON_SCHEMA_VERSION_V1) + { + bail!("semantic comparison report has an unsupported schema version"); + } + canonical_json_line(&value) + .context("semantic comparison report could not be canonicalized safely") + } + + pub fn human_safe_summary(&self) -> String { + format!( + "semantic comparison: {}; assurance: {}; changes: {}; review plan: {}", + equivalence_label(self.equivalence), + assurance_label(self.assurance), + self.changes.len(), + review_plan_label(self.review_plan.state), + ) + } +} + +impl fmt::Display for ProjectSemanticComparisonReportV1 { + fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result { + formatter.write_str(&self.human_safe_summary()) + } +} + +fn equivalence_label(value: SemanticComparisonEquivalence) -> &'static str { + match value { + SemanticComparisonEquivalence::Equivalent => "equivalent", + SemanticComparisonEquivalence::Different => "different", + } +} + +fn assurance_label(value: SemanticComparisonAssurance) -> &'static str { + match value { + SemanticComparisonAssurance::LocalUnverified => "local_unverified", + SemanticComparisonAssurance::EmbeddedExactRelease => "embedded_exact_release", + } +} + +fn review_plan_label(value: SemanticComparisonReviewPlanState) -> &'static str { + match value { + SemanticComparisonReviewPlanState::GeneratedNoChanges => "generated_no_changes", + SemanticComparisonReviewPlanState::GeneratedPendingReview => "generated_pending_review", + } +} + +/// Compares two explicitly environment-bound local projects. Neither input is +/// promoted to reviewed or signed authority. +pub fn compare_registry_projects_semantically( + options: &ProjectSemanticComparisonOptions, +) -> Result { + let current = load_comparison_input( + &options.current_project_directory, + &options.current_environment, + )?; + let baseline = load_comparison_input( + &options.baseline_project_directory, + &options.baseline_environment, + )?; + compare_loaded_projects( + ¤t, + &baseline, + SemanticComparisonKind::LocalProjectToProject, + SemanticComparisonAssurance::LocalUnverified, + ) +} + +/// Compares two environments of the same locally loaded authored project. +pub fn compare_registry_project_environments_semantically( + options: &ProjectEnvironmentSemanticComparisonOptions, +) -> Result { + let current = load_comparison_input(&options.project_directory, &options.current_environment)?; + let baseline = + load_comparison_input(&options.project_directory, &options.baseline_environment)?; + compare_loaded_projects( + ¤t, + &baseline, + SemanticComparisonKind::SameProjectEnvironmentToEnvironment, + SemanticComparisonAssurance::LocalUnverified, + ) +} + +/// Compares the project with the exact starter embedded in this binary. +/// +/// The current project's recorded starter id, release, and starter-content +/// digest must exactly match the independently validated embedded starter. +/// Missing, unknown, or stale provenance fails closed without echoing it. +pub fn compare_registry_project_to_embedded_starter_semantically( + options: &ProjectStarterSemanticComparisonOptions, +) -> Result { + let current = load_comparison_input(&options.project_directory, &options.environment)?; + let recorded = current + .project + .starter + .as_ref() + .ok_or_else(|| anyhow!("project starter provenance cannot be proved by this binary"))?; + let selected = if let Some(selected) = options.starter { + if recorded.id != selected.id() { + bail!("selected embedded starter does not match project starter provenance"); + } + selected + } else { + project_starter_by_id(&recorded.id) + .ok_or_else(|| anyhow!("project starter provenance cannot be proved by this binary"))? + }; + let embedded = selected + .embedded() + .map_err(|_| anyhow!("project starter provenance cannot be proved by this binary"))?; + let staging = + tempfile::tempdir().context("embedded starter comparison staging could not be created")?; + copy_embedded_dir(embedded, staging.path()) + .map_err(|_| anyhow!("embedded starter comparison could not be prepared safely"))?; + let baseline = load_comparison_input(staging.path(), &options.environment) + .map_err(|_| anyhow!("embedded starter cannot be proved for the requested environment"))?; + let embedded_recorded = + baseline.project.starter.as_ref().ok_or_else(|| { + anyhow!("embedded starter provenance cannot be proved by this binary") + })?; + if embedded_recorded.id != selected.id() + || embedded_recorded.content_digest != baseline.project_content_digest + || recorded.id != embedded_recorded.id + || recorded.release != embedded_recorded.release + || recorded.content_digest != embedded_recorded.content_digest + { + bail!("project starter provenance cannot be proved by this binary"); + } + compare_loaded_projects( + ¤t, + &baseline, + SemanticComparisonKind::EmbeddedStarterToProject, + SemanticComparisonAssurance::EmbeddedExactRelease, + ) +} + +fn project_starter_by_id(id: &str) -> Option { + [ + ProjectStarter::Http, + ProjectStarter::Dhis2Tracker, + ProjectStarter::OpencrvsDci, + ProjectStarter::FhirR4, + ProjectStarter::Snapshot, + ] + .into_iter() + .find(|starter| starter.id() == id) +} + +fn load_comparison_input(root: &Path, environment: &str) -> Result { + load_registry_project(root, Some(environment)) + .map_err(|_| anyhow!("semantic comparison input could not be loaded safely")) +} + +#[derive(Clone, Debug, Eq, Ord, PartialEq, PartialOrd)] +enum SnapshotScope { + Project, + Integration(String), + Fixture(String, String), + Entity(String), + Environment, + Generated, +} + +#[derive(Clone, Debug, Eq, Ord, PartialEq, PartialOrd)] +struct SnapshotKey { + scope: SnapshotScope, + instance_field: String, +} + +#[derive(Clone)] +struct SnapshotField { + address: SemanticComparisonFieldAddress, + source: SemanticComparisonChangeSource, + dimension: SemanticComparisonDimension, + sensitivity: knowledge::Sensitivity, + semantic_owner: knowledge::SemanticOwner, + human_owner: knowledge::HumanOwner, + consumers: Vec, + generated_artifacts: Vec, + review_classes: Vec, + fingerprint: [u8; 32], + comparable: Option, +} + +fn compare_loaded_projects( + current: &LoadedRegistryProject, + baseline: &LoadedRegistryProject, + comparison: SemanticComparisonKind, + assurance: SemanticComparisonAssurance, +) -> Result { + let current_snapshot = semantic_snapshot(current)?; + let baseline_snapshot = semantic_snapshot(baseline)?; + // The normalized compiler projections are the final effective-state + // authority for this local comparison. If both are byte-equivalent, raw + // presence differences such as an explicit value versus its equivalent + // default are not semantic changes. + if generated_projections_equal(¤t_snapshot, &baseline_snapshot) { + return Ok(equivalent_report(comparison, assurance)); + } + let subjects = affected_subject_inventory(current, baseline)?; + let mut changes = Vec::new(); + let keys = current_snapshot + .keys() + .chain(baseline_snapshot.keys()) + .cloned() + .collect::>(); + for key in keys { + let current_field = current_snapshot.get(&key); + let baseline_field = baseline_snapshot.get(&key); + if current_field + .zip(baseline_field) + .is_some_and(|(current, baseline)| current.fingerprint == baseline.fingerprint) + { + continue; + } + let field = current_field + .or(baseline_field) + .ok_or_else(|| anyhow!("semantic comparison encountered an empty field projection"))?; + let direction = match (current_field, baseline_field) { + (Some(_), None) => SemanticComparisonDirection::Added, + (None, Some(_)) => SemanticComparisonDirection::Removed, + (Some(current), Some(baseline)) => comparison_direction(current, baseline), + (None, None) => unreachable!(), + }; + changes.push(ProjectSemanticComparisonChange { + address: field.address.clone(), + source: field.source, + dimension: field.dimension, + direction, + sensitivity: field.sensitivity, + semantic_owner: field.semantic_owner, + human_owner: field.human_owner, + consumers: field.consumers.clone(), + generated_artifacts: field.generated_artifacts.clone(), + review_classes: field.review_classes.clone(), + affected_subjects: subjects.clone(), + occurrences: 1, + requirements: requirements_for_consumers(&field.consumers), + }); + if changes.len() > MAX_SEMANTIC_COMPARISON_CHANGES { + bail!("semantic comparison exceeds the bounded change-report capacity"); + } + } + let changes = aggregate_changes(changes)?; + let review_classes = changes + .iter() + .flat_map(|change| change.review_classes.iter().copied()) + .collect::>() + .into_iter() + .collect::>(); + let required_actions = required_actions(&changes); + let equivalent = changes.is_empty(); + Ok(ProjectSemanticComparisonReportV1 { + schema_version: ProjectSemanticComparisonSchemaVersion::V1, + comparison, + evidence_grade: SemanticComparisonEvidenceGrade::OfflineStatic, + assurance, + external_approval: SemanticComparisonExternalApproval::NotEvaluated, + equivalence: if equivalent { + SemanticComparisonEquivalence::Equivalent + } else { + SemanticComparisonEquivalence::Different + }, + comparison_precision: SemanticComparisonPrecision::FieldAndGeneratedProjection, + review_plan: SemanticComparisonReviewPlan { + state: if equivalent { + SemanticComparisonReviewPlanState::GeneratedNoChanges + } else { + SemanticComparisonReviewPlanState::GeneratedPendingReview + }, + review_classes, + }, + changes, + required_actions, + evidence_limitations: EVIDENCE_LIMITATIONS.to_vec(), + }) +} + +fn generated_projections_equal( + current: &BTreeMap, + baseline: &BTreeMap, +) -> bool { + ["/review_plan", "/approval_projection"] + .into_iter() + .all(|field| { + let key = SnapshotKey { + scope: SnapshotScope::Generated, + instance_field: field.to_owned(), + }; + current + .get(&key) + .zip(baseline.get(&key)) + .is_some_and(|(current, baseline)| current.fingerprint == baseline.fingerprint) + }) +} + +fn equivalent_report( + comparison: SemanticComparisonKind, + assurance: SemanticComparisonAssurance, +) -> ProjectSemanticComparisonReportV1 { + ProjectSemanticComparisonReportV1 { + schema_version: ProjectSemanticComparisonSchemaVersion::V1, + comparison, + evidence_grade: SemanticComparisonEvidenceGrade::OfflineStatic, + assurance, + external_approval: SemanticComparisonExternalApproval::NotEvaluated, + equivalence: SemanticComparisonEquivalence::Equivalent, + comparison_precision: SemanticComparisonPrecision::FieldAndGeneratedProjection, + review_plan: SemanticComparisonReviewPlan { + state: SemanticComparisonReviewPlanState::GeneratedNoChanges, + review_classes: Vec::new(), + }, + changes: Vec::new(), + required_actions: Vec::new(), + evidence_limitations: EVIDENCE_LIMITATIONS.to_vec(), + } +} + +fn aggregate_changes( + changes: Vec, +) -> Result> { + #[derive(Clone, Debug, Eq, Ord, PartialEq, PartialOrd)] + struct AggregateKey { + address: SemanticComparisonFieldAddress, + source: SemanticComparisonChangeSource, + dimension: SemanticComparisonDimension, + direction: SemanticComparisonDirection, + sensitivity: knowledge::Sensitivity, + semantic_owner: knowledge::SemanticOwner, + human_owner: knowledge::HumanOwner, + consumers: Vec, + generated_artifacts: Vec, + review_classes: Vec, + requirements: SemanticComparisonRequirements, + } + + let mut aggregated = BTreeMap::::new(); + for change in changes { + let key = AggregateKey { + address: change.address.clone(), + source: change.source, + dimension: change.dimension, + direction: change.direction, + sensitivity: change.sensitivity, + semantic_owner: change.semantic_owner, + human_owner: change.human_owner, + consumers: change.consumers.clone(), + generated_artifacts: change.generated_artifacts.clone(), + review_classes: change.review_classes.clone(), + requirements: change.requirements, + }; + if let Some(existing) = aggregated.get_mut(&key) { + existing.occurrences = existing + .occurrences + .checked_add(change.occurrences) + .filter(|count| usize::from(*count) <= MAX_SEMANTIC_COMPARISON_OCCURRENCES) + .ok_or_else(|| anyhow!("semantic comparison occurrence bound was exceeded"))?; + } else { + aggregated.insert(key, change); + } + } + if aggregated.len() > MAX_SEMANTIC_COMPARISON_CHANGES { + bail!("semantic comparison exceeds the bounded change-report capacity"); + } + Ok(aggregated.into_values().collect()) +} + +fn semantic_snapshot( + loaded: &LoadedRegistryProject, +) -> Result> { + let environment_name = loaded + .environment_name + .as_deref() + .ok_or_else(|| anyhow!("semantic comparison requires an explicit environment"))?; + let explanation = generated_explanation(loaded, environment_name) + .map_err(|_| anyhow!("semantic comparison projection could not be generated safely"))?; + let documents = typed_documents(loaded)?; + let mut snapshot = BTreeMap::new(); + for field in explanation.fields { + let (scope, instance_field) = snapshot_scope(&field.address); + if comparison_ignores_field(&scope, &instance_field) { + continue; + } + let schema_ref = + field.constraints.schema_refs.first().ok_or_else(|| { + anyhow!("semantic comparison field has no published schema address") + })?; + let schema_family = schema_family(schema_ref.schema); + let actual = documents + .value(&scope) + .and_then(|document| document.pointer(&instance_field)) + .cloned(); + let fallback = serde_json::to_value(&field.reported_value) + .context("semantic comparison safe field projection could not be serialized")?; + let sensitivity = + comparison_sensitivity(schema_family, &instance_field, field.knowledge.sensitivity); + let approved_fallback = if sensitivity.value_is_reportable(true) { + match &field.reported_value { + ClassifierSafeReportedValue::Public { value } => Some(value.as_value().clone()), + ClassifierSafeReportedValue::Redacted { .. } + | ClassifierSafeReportedValue::Absent => None, + } + } else { + None + }; + let normalized = actual + .clone() + .or_else(|| approved_fallback.clone()) + .unwrap_or(fallback); + let fingerprint = fingerprint_json(&normalized)?; + let comparable = sensitivity.value_is_reportable(true).then_some(normalized); + let dimension = + comparison_dimension(schema_family, schema_ref.path.as_str(), &instance_field); + let key = SnapshotKey { + scope, + instance_field, + }; + let projected = SnapshotField { + address: SemanticComparisonFieldAddress { + schema_family, + field: schema_ref.path.clone(), + }, + source: comparison_source(field.source.kind), + dimension, + sensitivity, + semantic_owner: field.knowledge.semantic_owner, + human_owner: field.knowledge.human_owner, + consumers: comparison_consumers(&field.knowledge.consumers), + generated_artifacts: comparison_artifacts(&field.knowledge.generated_artifacts), + review_classes: comparison_reviews(&field.knowledge.review_classes), + fingerprint, + comparable, + }; + snapshot.insert(key, projected); + } + add_script_fingerprints(loaded, &mut snapshot)?; + add_generated_projection_fingerprints(loaded, &mut snapshot)?; + Ok(snapshot) +} + +fn comparison_sensitivity( + schema: SemanticComparisonSchemaFamily, + instance_field: &str, + declared: knowledge::Sensitivity, +) -> knowledge::Sensitivity { + if schema == SemanticComparisonSchemaFamily::Environment + && (instance_field.contains("/credential") + || instance_field.ends_with("/signing_key") + || instance_field.ends_with("/api_key_fingerprint") + || instance_field.ends_with("/private_key") + || instance_field.ends_with("/connection")) + { + knowledge::Sensitivity::SecretReference + } else { + declared + } +} + +struct TypedDocuments { + project: Value, + environment: Value, + integrations: BTreeMap, + fixtures: BTreeMap<(String, String), Value>, + entities: BTreeMap, +} + +impl TypedDocuments { + fn value(&self, scope: &SnapshotScope) -> Option<&Value> { + match scope { + SnapshotScope::Project => Some(&self.project), + SnapshotScope::Environment => Some(&self.environment), + SnapshotScope::Integration(id) => self.integrations.get(id), + SnapshotScope::Fixture(integration, fixture) => { + self.fixtures.get(&(integration.clone(), fixture.clone())) + } + SnapshotScope::Entity(id) => self.entities.get(id), + SnapshotScope::Generated => None, + } + } +} + +fn typed_documents(loaded: &LoadedRegistryProject) -> Result { + let environment = loaded + .environment + .as_ref() + .ok_or_else(|| anyhow!("semantic comparison requires an explicit environment"))?; + let project = serde_json::to_value(&loaded.project) + .context("semantic comparison project normalization failed")?; + let environment = serde_json::to_value(environment) + .context("semantic comparison environment normalization failed")?; + let integrations = loaded + .integrations + .iter() + .map(|(id, integration)| { + serde_json::to_value(&integration.document) + .map(|document| (id.clone(), document)) + .context("semantic comparison integration normalization failed") + }) + .collect::>>()?; + let fixtures = loaded + .integrations + .iter() + .flat_map(|(integration, loaded)| { + loaded.fixtures.iter().map(move |(_, fixture)| { + serde_json::to_value(fixture) + .map(|document| ((integration.clone(), fixture.name.clone()), document)) + .context("semantic comparison fixture normalization failed") + }) + }) + .collect::>>()?; + let entities = loaded + .entities + .iter() + .map(|(id, entity)| { + serde_json::to_value(&entity.document) + .map(|document| (id.clone(), document)) + .context("semantic comparison entity normalization failed") + }) + .collect::>>()?; + Ok(TypedDocuments { + project, + environment, + integrations, + fixtures, + entities, + }) +} + +fn snapshot_scope(address: &ProjectFieldAddress) -> (SnapshotScope, String) { + match address { + ProjectFieldAddress::Project { path } => (SnapshotScope::Project, path.as_str().to_owned()), + ProjectFieldAddress::Integration { integration, path } => ( + SnapshotScope::Integration(integration.clone()), + path.as_str().to_owned(), + ), + ProjectFieldAddress::Entity { entity, path } => ( + SnapshotScope::Entity(entity.clone()), + path.as_str().to_owned(), + ), + ProjectFieldAddress::Environment { path, .. } => { + (SnapshotScope::Environment, path.as_str().to_owned()) + } + ProjectFieldAddress::Fixture { + integration, + fixture, + path, + } => ( + SnapshotScope::Fixture(integration.clone(), fixture.clone()), + path.as_str().to_owned(), + ), + } +} + +fn comparison_ignores_field(scope: &SnapshotScope, instance_field: &str) -> bool { + matches!(scope, SnapshotScope::Project) + && (instance_field == "/starter" + || instance_field.starts_with("/starter/") + || ((instance_field.starts_with("/integrations/") + || instance_field.starts_with("/entities/")) + && instance_field.ends_with("/file"))) +} + +fn schema_family(schema: ProjectAuthoringSchema) -> SemanticComparisonSchemaFamily { + match schema { + ProjectAuthoringSchema::Project => SemanticComparisonSchemaFamily::Project, + ProjectAuthoringSchema::Environment => SemanticComparisonSchemaFamily::Environment, + ProjectAuthoringSchema::Integration => SemanticComparisonSchemaFamily::Integration, + ProjectAuthoringSchema::Fixture => SemanticComparisonSchemaFamily::Fixture, + ProjectAuthoringSchema::Entity => SemanticComparisonSchemaFamily::Entity, + } +} + +fn comparison_source(source: FieldSourceKind) -> SemanticComparisonChangeSource { + match source { + FieldSourceKind::Authored => SemanticComparisonChangeSource::Authored, + FieldSourceKind::Defaulted => SemanticComparisonChangeSource::Defaulted, + FieldSourceKind::Derived | FieldSourceKind::Detected => { + SemanticComparisonChangeSource::Derived + } + FieldSourceKind::EnvironmentBound => SemanticComparisonChangeSource::EnvironmentBound, + FieldSourceKind::Generated => SemanticComparisonChangeSource::Generated, + FieldSourceKind::Runtime | FieldSourceKind::Absent => { + SemanticComparisonChangeSource::Derived + } + } +} + +fn comparison_dimension( + schema: SemanticComparisonSchemaFamily, + schema_field: &str, + instance_field: &str, +) -> SemanticComparisonDimension { + match schema { + SemanticComparisonSchemaFamily::Environment => { + SemanticComparisonDimension::OperatorSecurity + } + SemanticComparisonSchemaFamily::Integration => SemanticComparisonDimension::Integration, + SemanticComparisonSchemaFamily::Fixture => SemanticComparisonDimension::Fixture, + SemanticComparisonSchemaFamily::Entity => SemanticComparisonDimension::Entity, + SemanticComparisonSchemaFamily::GeneratedReview => { + SemanticComparisonDimension::GeneratedReview + } + SemanticComparisonSchemaFamily::GeneratedApproval => { + SemanticComparisonDimension::GeneratedApproval + } + SemanticComparisonSchemaFamily::Project => { + if schema_field.contains("/consultations") || instance_field.contains("/consultations/") + { + SemanticComparisonDimension::Consultation + } else if schema_field.contains("/disclosure") + || (instance_field.contains("/claims/") && instance_field.ends_with("/disclosure")) + { + SemanticComparisonDimension::Disclosure + } else if schema_field.contains("/claims") + || schema_field.contains("/credential_profiles") + || instance_field.contains("/claims/") + || instance_field.contains("/credential_profiles/") + { + SemanticComparisonDimension::Claim + } else if schema_field.contains("/integrations") + || instance_field.starts_with("/integrations/") + { + SemanticComparisonDimension::Integration + } else if schema_field.contains("/entities") || instance_field.starts_with("/entities/") + { + SemanticComparisonDimension::Entity + } else if schema_field.contains("/services") || instance_field.starts_with("/services/") + { + SemanticComparisonDimension::ServicePolicy + } else { + SemanticComparisonDimension::Project + } + } + } +} + +fn comparison_consumers(consumers: &[knowledge::Consumer]) -> Vec { + let mut result = consumers + .iter() + .map(|consumer| match consumer { + knowledge::Consumer::RegistryctlAuthoring => { + SemanticComparisonConsumer::RegistryctlAuthoring + } + knowledge::Consumer::RegistryRelay => SemanticComparisonConsumer::RegistryRelay, + knowledge::Consumer::RegistryNotary => SemanticComparisonConsumer::RegistryNotary, + knowledge::Consumer::EditorTooling => SemanticComparisonConsumer::EditorTooling, + knowledge::Consumer::DocsGenerator => SemanticComparisonConsumer::DocsGenerator, + }) + .collect::>(); + if result.contains(&SemanticComparisonConsumer::RegistryRelay) + || result.contains(&SemanticComparisonConsumer::RegistryNotary) + { + result.extend([ + SemanticComparisonConsumer::BundleSigner, + SemanticComparisonConsumer::DeploymentTooling, + SemanticComparisonConsumer::Operator, + ]); + } + result.into_iter().collect() +} + +fn comparison_artifacts( + artifacts: &[knowledge::GeneratedArtifact], +) -> Vec { + artifacts + .iter() + .map(|artifact| match artifact { + knowledge::GeneratedArtifact::EditorSchemas => { + SemanticComparisonGeneratedArtifact::EditorSchemas + } + knowledge::GeneratedArtifact::ProjectBuild => { + SemanticComparisonGeneratedArtifact::ProjectBuild + } + knowledge::GeneratedArtifact::RelayConfig => { + SemanticComparisonGeneratedArtifact::RelayConfig + } + knowledge::GeneratedArtifact::NotaryConfig => { + SemanticComparisonGeneratedArtifact::NotaryConfig + } + knowledge::GeneratedArtifact::FixtureReport => { + SemanticComparisonGeneratedArtifact::FixtureReport + } + knowledge::GeneratedArtifact::FieldReference => { + SemanticComparisonGeneratedArtifact::FieldReference + } + }) + .collect::>() + .into_iter() + .collect() +} + +fn comparison_reviews(reviews: &[knowledge::ReviewClass]) -> Vec { + let mut result = reviews + .iter() + .map(|review| match review { + knowledge::ReviewClass::Contract => SemanticComparisonReviewClass::Contract, + knowledge::ReviewClass::Security => SemanticComparisonReviewClass::Security, + knowledge::ReviewClass::Privacy => SemanticComparisonReviewClass::Privacy, + knowledge::ReviewClass::Relay => SemanticComparisonReviewClass::Relay, + knowledge::ReviewClass::Notary => SemanticComparisonReviewClass::Notary, + knowledge::ReviewClass::Compatibility => SemanticComparisonReviewClass::Compatibility, + knowledge::ReviewClass::Documentation => SemanticComparisonReviewClass::Documentation, + knowledge::ReviewClass::Testing => SemanticComparisonReviewClass::Testing, + }) + .collect::>(); + result.extend([ + SemanticComparisonReviewClass::Authoring, + SemanticComparisonReviewClass::Semantics, + SemanticComparisonReviewClass::Interoperability, + SemanticComparisonReviewClass::Operations, + SemanticComparisonReviewClass::Release, + ]); + result.into_iter().collect() +} + +fn fingerprint_json(value: &Value) -> Result<[u8; 32]> { + let canonical = + canonicalize_json(value).context("semantic comparison value normalization failed")?; + Ok(Sha256::digest(canonical).into()) +} + +fn add_script_fingerprints( + loaded: &LoadedRegistryProject, + snapshot: &mut BTreeMap, +) -> Result<()> { + for (integration, loaded_integration) in &loaded.integrations { + if loaded_integration.script.is_none() && loaded_integration.script_modules.is_empty() { + continue; + } + let key = snapshot + .keys() + .find(|key| { + matches!(&key.scope, SnapshotScope::Integration(id) if id == integration) + && key.instance_field.contains("script") + }) + .cloned() + .ok_or_else(|| anyhow!("script integration has no published comparison address"))?; + let field = snapshot + .get_mut(&key) + .ok_or_else(|| anyhow!("script comparison projection is absent"))?; + let mut hasher = Sha256::new(); + hasher.update(field.fingerprint); + if let Some((_, bytes)) = &loaded_integration.script { + hasher.update([0]); + hasher.update(bytes); + } + for (_, bytes) in &loaded_integration.script_modules { + hasher.update([1]); + hasher.update(bytes); + } + field.fingerprint = hasher.finalize().into(); + field.comparable = None; + } + Ok(()) +} + +fn add_generated_projection_fingerprints( + loaded: &LoadedRegistryProject, + snapshot: &mut BTreeMap, +) -> Result<()> { + let compiled = compile_project(loaded, None) + .map_err(|_| anyhow!("semantic comparison generated projection failed safely"))?; + let mut review = compiled.review; + remove_projection_identity(&mut review, &["registry", "environment"]); + let mut approval = compiled.approval_state; + // The authored-input digest is intentionally byte-sensitive and therefore + // unsuitable for this semantic comparison. The report digest is derived + // from the already compared review projection. All semantic and generated + // closure fingerprints remain internal comparison inputs. + remove_projection_identity( + &mut approval, + &[ + "registry", + "environment", + "authored_input_digest", + "report_digest", + "baseline", + ], + ); + for (schema_family, dimension, field_name, value) in [ + ( + SemanticComparisonSchemaFamily::GeneratedReview, + SemanticComparisonDimension::GeneratedReview, + "/review_plan", + &review, + ), + ( + SemanticComparisonSchemaFamily::GeneratedApproval, + SemanticComparisonDimension::GeneratedApproval, + "/approval_projection", + &approval, + ), + ] { + let address = SemanticComparisonFieldAddress { + schema_family, + field: JsonPointer::new(field_name) + .map_err(|_| anyhow!("generated comparison address is invalid"))?, + }; + snapshot.insert( + SnapshotKey { + scope: SnapshotScope::Generated, + instance_field: field_name.to_owned(), + }, + SnapshotField { + address, + source: SemanticComparisonChangeSource::Generated, + dimension, + sensitivity: knowledge::Sensitivity::Internal, + semantic_owner: knowledge::SemanticOwner::AuthoringContract, + human_owner: knowledge::HumanOwner::RegistryMaintainers, + consumers: vec![ + SemanticComparisonConsumer::RegistryctlAuthoring, + SemanticComparisonConsumer::BundleSigner, + SemanticComparisonConsumer::DeploymentTooling, + SemanticComparisonConsumer::Operator, + ], + generated_artifacts: vec![ + SemanticComparisonGeneratedArtifact::ReviewPlan, + SemanticComparisonGeneratedArtifact::ApprovalProjection, + ], + review_classes: vec![ + SemanticComparisonReviewClass::Contract, + SemanticComparisonReviewClass::Authoring, + SemanticComparisonReviewClass::Semantics, + SemanticComparisonReviewClass::Security, + SemanticComparisonReviewClass::Compatibility, + SemanticComparisonReviewClass::Operations, + SemanticComparisonReviewClass::Release, + ], + fingerprint: fingerprint_json(value)?, + comparable: None, + }, + ); + } + Ok(()) +} + +fn remove_projection_identity(value: &mut Value, fields: &[&str]) { + if let Some(object) = value.as_object_mut() { + for field in fields { + object.remove(*field); + } + } +} + +fn comparison_direction( + current: &SnapshotField, + baseline: &SnapshotField, +) -> SemanticComparisonDirection { + let Some(current_value) = current.comparable.as_ref() else { + return SemanticComparisonDirection::Changed; + }; + let Some(baseline_value) = baseline.comparable.as_ref() else { + return SemanticComparisonDirection::Changed; + }; + direction_for_values( + current.address.field.as_str(), + current_value, + baseline_value, + ) +} + +fn direction_for_values( + schema_field: &str, + current: &Value, + baseline: &Value, +) -> SemanticComparisonDirection { + let current_number = current.as_f64(); + let baseline_number = baseline.as_f64(); + if let (Some(current), Some(baseline)) = (current_number, baseline_number) { + if lower_bound_field(schema_field) { + return if current > baseline { + SemanticComparisonDirection::Narrowed + } else { + SemanticComparisonDirection::Widened + }; + } + if upper_bound_field(schema_field) { + return if current < baseline { + SemanticComparisonDirection::Narrowed + } else { + SemanticComparisonDirection::Widened + }; + } + } + if required_field(schema_field) { + if let (Some(current), Some(baseline)) = (current.as_bool(), baseline.as_bool()) { + return match (current, baseline) { + (true, false) => SemanticComparisonDirection::Narrowed, + (false, true) => SemanticComparisonDirection::Widened, + _ => SemanticComparisonDirection::Changed, + }; + } + } + if disclosure_field(schema_field) { + if let (Some(current), Some(baseline)) = (current.as_str(), baseline.as_str()) { + let rank = |value| match value { + "redacted" => Some(0), + "predicate" => Some(1), + "value" => Some(2), + _ => None, + }; + if let (Some(current), Some(baseline)) = (rank(current), rank(baseline)) { + return if current < baseline { + SemanticComparisonDirection::Narrowed + } else { + SemanticComparisonDirection::Widened + }; + } + } + } + SemanticComparisonDirection::Changed +} + +fn lower_bound_field(field: &str) -> bool { + [ + "/properties/minLength", + "/properties/minimum", + "/properties/min_group_size", + ] + .iter() + .any(|suffix| field.ends_with(suffix)) +} + +fn upper_bound_field(field: &str) -> bool { + [ + "/properties/maxLength", + "/properties/maximum", + "/properties/max_bytes", + "/properties/max_items", + "/properties/max_records", + "/properties/max_limit", + "/properties/calls", + "/properties/request_bytes", + "/properties/source_bytes", + "/properties/concurrency", + "/properties/per_minute", + "/properties/burst", + "/properties/worker_memory_bytes", + "/properties/retain_generations", + ] + .iter() + .any(|suffix| field.ends_with(suffix)) +} + +fn required_field(field: &str) -> bool { + field.ends_with("/properties/required") +} + +fn disclosure_field(field: &str) -> bool { + field.ends_with("/properties/disclosure") +} + +fn requirements_for_consumers( + consumers: &[SemanticComparisonConsumer], +) -> SemanticComparisonRequirements { + let relay = consumers.contains(&SemanticComparisonConsumer::RegistryRelay); + let notary = consumers.contains(&SemanticComparisonConsumer::RegistryNotary); + match (relay, notary) { + (true, true) => SemanticComparisonRequirements { + signing: SemanticComparisonSigningRequirement::RelayAndNotaryBundles, + activation: SemanticComparisonActivationRequirement::ApplyRelayAndNotaryConfig, + restart: SemanticComparisonRestartRequirement::RegistryRelayAndNotary, + }, + (true, false) => SemanticComparisonRequirements { + signing: SemanticComparisonSigningRequirement::RelayBundle, + activation: SemanticComparisonActivationRequirement::ApplyRelayConfig, + restart: SemanticComparisonRestartRequirement::RegistryRelay, + }, + (false, true) => SemanticComparisonRequirements { + signing: SemanticComparisonSigningRequirement::NotaryBundle, + activation: SemanticComparisonActivationRequirement::ApplyNotaryConfig, + restart: SemanticComparisonRestartRequirement::RegistryNotary, + }, + (false, false) => SemanticComparisonRequirements { + signing: SemanticComparisonSigningRequirement::None, + activation: SemanticComparisonActivationRequirement::None, + restart: SemanticComparisonRestartRequirement::None, + }, + } +} + +fn required_actions( + changes: &[ProjectSemanticComparisonChange], +) -> Vec { + let mut actions = BTreeSet::new(); + if !changes.is_empty() { + actions.extend([ + SemanticComparisonRequiredAction::ReviewSemanticChanges, + SemanticComparisonRequiredAction::RunAffectedFixtures, + SemanticComparisonRequiredAction::RegenerateGeneratedArtifacts, + ]); + } + for change in changes { + match change.requirements.signing { + SemanticComparisonSigningRequirement::RelayBundle => { + actions.insert(SemanticComparisonRequiredAction::ResignRelayBundle); + } + SemanticComparisonSigningRequirement::NotaryBundle => { + actions.insert(SemanticComparisonRequiredAction::ResignNotaryBundle); + } + SemanticComparisonSigningRequirement::RelayAndNotaryBundles => { + actions.extend([ + SemanticComparisonRequiredAction::ResignRelayBundle, + SemanticComparisonRequiredAction::ResignNotaryBundle, + ]); + } + SemanticComparisonSigningRequirement::None => {} + } + match change.requirements.activation { + SemanticComparisonActivationRequirement::ApplyRelayConfig => { + actions.insert(SemanticComparisonRequiredAction::ReactivateRelayConfiguration); + } + SemanticComparisonActivationRequirement::ApplyNotaryConfig => { + actions.insert(SemanticComparisonRequiredAction::ReactivateNotaryConfiguration); + } + SemanticComparisonActivationRequirement::ApplyRelayAndNotaryConfig => { + actions.extend([ + SemanticComparisonRequiredAction::ReactivateRelayConfiguration, + SemanticComparisonRequiredAction::ReactivateNotaryConfiguration, + ]); + } + SemanticComparisonActivationRequirement::None => {} + } + match change.requirements.restart { + SemanticComparisonRestartRequirement::RegistryRelay => { + actions.insert(SemanticComparisonRequiredAction::RestartRegistryRelay); + } + SemanticComparisonRestartRequirement::RegistryNotary => { + actions.insert(SemanticComparisonRequiredAction::RestartRegistryNotary); + } + SemanticComparisonRestartRequirement::RegistryRelayAndNotary => { + actions.extend([ + SemanticComparisonRequiredAction::RestartRegistryRelay, + SemanticComparisonRequiredAction::RestartRegistryNotary, + ]); + } + SemanticComparisonRestartRequirement::None => {} + } + } + actions.into_iter().collect() +} + +fn affected_subject_inventory( + current: &LoadedRegistryProject, + baseline: &LoadedRegistryProject, +) -> Result> { + let mut counts = BTreeMap::new(); + counts.insert( + SemanticComparisonAffectedSubjectKind::Integration, + union_count( + current.integrations.keys().cloned(), + baseline.integrations.keys().cloned(), + )?, + ); + counts.insert( + SemanticComparisonAffectedSubjectKind::Fixture, + union_count( + fixture_subjects(current).into_iter(), + fixture_subjects(baseline).into_iter(), + )?, + ); + counts.insert( + SemanticComparisonAffectedSubjectKind::Entity, + union_count( + current.entities.keys().cloned(), + baseline.entities.keys().cloned(), + )?, + ); + counts.insert( + SemanticComparisonAffectedSubjectKind::ServicePolicy, + union_count( + current.project.services.keys().cloned(), + baseline.project.services.keys().cloned(), + )?, + ); + counts.insert( + SemanticComparisonAffectedSubjectKind::Consultation, + union_count( + consultation_subjects(current).into_iter(), + consultation_subjects(baseline).into_iter(), + )?, + ); + let claims = union_count( + claim_subjects(current).into_iter(), + claim_subjects(baseline).into_iter(), + )?; + counts.insert(SemanticComparisonAffectedSubjectKind::Claim, claims); + counts.insert(SemanticComparisonAffectedSubjectKind::Disclosure, claims); + counts.insert(SemanticComparisonAffectedSubjectKind::ProductInput, 2); + counts.insert(SemanticComparisonAffectedSubjectKind::GeneratedArtifact, 8); + Ok(counts + .into_iter() + .filter_map(|(kind, count)| { + (count > 0).then_some(SemanticComparisonAffectedSubject { kind, count }) + }) + .collect()) +} + +fn fixture_subjects(loaded: &LoadedRegistryProject) -> BTreeSet<(String, String)> { + loaded + .integrations + .iter() + .flat_map(|(integration, loaded)| { + loaded + .fixtures + .iter() + .map(move |(_, fixture)| (integration.clone(), fixture.name.clone())) + }) + .collect() +} + +fn consultation_subjects(loaded: &LoadedRegistryProject) -> BTreeSet<(String, String)> { + loaded + .project + .services + .iter() + .flat_map(|(service, declaration)| { + declaration + .consultations + .keys() + .map(move |consultation| (service.clone(), consultation.clone())) + }) + .collect() +} + +fn claim_subjects(loaded: &LoadedRegistryProject) -> BTreeSet<(String, String)> { + loaded + .project + .services + .iter() + .flat_map(|(service, declaration)| { + declaration + .claims + .keys() + .map(move |claim| (service.clone(), claim.clone())) + }) + .collect() +} + +fn union_count( + current: impl Iterator, + baseline: impl Iterator, +) -> Result +where + T: Ord, +{ + let count = current.chain(baseline).collect::>().len(); + if count > MAX_SEMANTIC_COMPARISON_OCCURRENCES { + bail!("semantic comparison affected-subject bound was exceeded"); + } + u16::try_from(count) + .map_err(|_| anyhow!("semantic comparison affected-subject bound was exceeded")) +} + +#[cfg(test)] +mod tests { + use super::*; + use std::fs; + + fn initialized_http_project(parent: &Path, name: &str) -> PathBuf { + let project = parent.join(name); + init_registry_project(&ProjectInitOptions { + starter: ProjectStarter::Http, + directory: project.clone(), + }) + .expect("HTTP project initializes"); + project + } + + fn rewrite_yaml(path: &Path, update: impl FnOnce(&mut Value)) { + let bytes = fs::read(path).expect("YAML reads"); + let mut document: Value = serde_norway::from_slice(&bytes).expect("YAML parses"); + update(&mut document); + fs::write( + path, + serde_norway::to_string(&document).expect("YAML serializes"), + ) + .expect("YAML writes"); + } + + fn assert_schema_valid(report: &ProjectSemanticComparisonReportV1) { + let schema: Value = serde_json::from_str(include_str!( + "../../schemas/project-reports/registry.project.semantic_comparison.v1.schema.json" + )) + .expect("schema parses"); + let validator = jsonschema::JSONSchema::options() + .with_draft(jsonschema::Draft::Draft202012) + .compile(&schema) + .expect("schema compiles"); + let report = serde_json::to_value(report).expect("report serializes"); + if let Err(errors) = validator.validate(&report) { + panic!( + "produced report validates: {:?}", + errors.map(|error| error.to_string()).collect::>() + ); + }; + } + + #[test] + fn direction_reverses_for_proven_upper_and_lower_bounds() { + let upper = "/$defs/limits/properties/max_bytes"; + assert_eq!( + direction_for_values(upper, &Value::from(8), &Value::from(16)), + SemanticComparisonDirection::Narrowed + ); + assert_eq!( + direction_for_values(upper, &Value::from(16), &Value::from(8)), + SemanticComparisonDirection::Widened + ); + let lower = "/$defs/schema/properties/minimum"; + assert_eq!( + direction_for_values(lower, &Value::from(8), &Value::from(4)), + SemanticComparisonDirection::Narrowed + ); + assert_eq!( + direction_for_values(lower, &Value::from(4), &Value::from(8)), + SemanticComparisonDirection::Widened + ); + } + + #[test] + fn report_roundtrip_is_strict_and_human_summary_is_value_free() { + let report = ProjectSemanticComparisonReportV1 { + schema_version: ProjectSemanticComparisonSchemaVersion::V1, + comparison: SemanticComparisonKind::LocalProjectToProject, + evidence_grade: SemanticComparisonEvidenceGrade::OfflineStatic, + assurance: SemanticComparisonAssurance::LocalUnverified, + external_approval: SemanticComparisonExternalApproval::NotEvaluated, + equivalence: SemanticComparisonEquivalence::Equivalent, + comparison_precision: SemanticComparisonPrecision::FieldAndGeneratedProjection, + review_plan: SemanticComparisonReviewPlan { + state: SemanticComparisonReviewPlanState::GeneratedNoChanges, + review_classes: Vec::new(), + }, + changes: Vec::new(), + required_actions: Vec::new(), + evidence_limitations: EVIDENCE_LIMITATIONS.to_vec(), + }; + let value = serde_json::to_value(&report).expect("report serializes"); + let decoded: ProjectSemanticComparisonReportV1 = + serde_json::from_value(value.clone()).expect("report decodes"); + assert_eq!(decoded, report); + let mut unknown = value; + unknown["future"] = Value::Bool(true); + assert!( + serde_json::from_value::(unknown).is_err(), + "unknown fields fail closed" + ); + assert_eq!( + report.human_safe_summary(), + "semantic comparison: equivalent; assurance: local_unverified; changes: 0; review plan: generated_no_changes" + ); + } + + #[test] + fn strict_schema_validates_the_canonical_fixture_and_rejects_unknown_fields() { + let schema: Value = serde_json::from_str(include_str!( + "../../schemas/project-reports/registry.project.semantic_comparison.v1.schema.json" + )) + .expect("schema parses"); + let fixture: Value = serde_json::from_str(include_str!( + "../../tests/fixtures/project-reports/registry.project.semantic_comparison.v1.json" + )) + .expect("fixture parses"); + let validator = jsonschema::JSONSchema::options() + .with_draft(jsonschema::Draft::Draft202012) + .compile(&schema) + .expect("schema compiles"); + if let Err(errors) = validator.validate(&fixture) { + panic!( + "fixture validates: {:?}", + errors.map(|error| error.to_string()).collect::>() + ); + } + let decoded: ProjectSemanticComparisonReportV1 = + serde_json::from_value(fixture.clone()).expect("fixture decodes"); + assert_eq!( + serde_json::to_value(decoded).expect("fixture re-encodes"), + fixture + ); + let mut unknown = fixture; + unknown["changes"][0]["address"]["future"] = Value::Bool(true); + assert!(validator.validate(&unknown).is_err()); + assert!( + serde_json::from_value::(unknown).is_err(), + "typed ingress rejects nested unknown fields" + ); + } + + #[test] + fn formatting_defaults_and_exact_starter_modes_use_effective_state() { + let temporary = tempfile::tempdir().expect("temporary directory"); + let baseline = initialized_http_project(temporary.path(), "baseline"); + let current = initialized_http_project(temporary.path(), "current"); + let compare = || { + compare_registry_projects_semantically(&ProjectSemanticComparisonOptions { + current_project_directory: current.clone(), + current_environment: "local".to_owned(), + baseline_project_directory: baseline.clone(), + baseline_environment: "local".to_owned(), + }) + .expect("projects compare") + }; + + let project_path = current.join(PROJECT_FILE); + let original = fs::read_to_string(&project_path).expect("project reads"); + fs::write(&project_path, format!("# formatting only\n\n{original}\n")) + .expect("project writes"); + assert_eq!( + compare().equivalence, + SemanticComparisonEquivalence::Equivalent + ); + + rewrite_yaml(¤t.join("environments/local.yaml"), |document| { + document["issuance"]["algorithm"] = Value::String("EdDSA".to_owned()); + }); + assert_eq!( + compare().equivalence, + SemanticComparisonEquivalence::Equivalent + ); + + let starter = compare_registry_project_to_embedded_starter_semantically( + &ProjectStarterSemanticComparisonOptions { + project_directory: baseline, + environment: "local".to_owned(), + starter: None, + }, + ) + .expect("exact embedded starter compares"); + assert_eq!( + starter.assurance, + SemanticComparisonAssurance::EmbeddedExactRelease + ); + assert_eq!( + starter.equivalence, + SemanticComparisonEquivalence::Equivalent + ); + } + + #[test] + fn sensitive_environment_change_is_detected_but_never_reported() { + const SENTINEL: &str = "SEMANTIC_COMPARISON_SECRET_SENTINEL"; + + let temporary = tempfile::tempdir().expect("temporary directory"); + let project = initialized_http_project(temporary.path(), "project"); + let candidate = project.join("environments/candidate.yaml"); + fs::copy(project.join("environments/local.yaml"), &candidate).expect("environment copies"); + rewrite_yaml(&candidate, |document| { + document["integrations"]["person-record"]["source"]["credential"]["token"]["secret"] = + Value::String(SENTINEL.to_owned()); + }); + let report = compare_registry_project_environments_semantically( + &ProjectEnvironmentSemanticComparisonOptions { + project_directory: project, + current_environment: "candidate".to_owned(), + baseline_environment: "local".to_owned(), + }, + ) + .expect("environments compare"); + assert_eq!(report.equivalence, SemanticComparisonEquivalence::Different); + assert!(report.changes.iter().any(|change| { + change.dimension == SemanticComparisonDimension::OperatorSecurity + && change.sensitivity == knowledge::Sensitivity::SecretReference + })); + let json = String::from_utf8(report.canonical_json_bytes().expect("report serializes")) + .expect("JSON is UTF-8"); + assert!(!json.contains(SENTINEL)); + assert!(!report.human_safe_summary().contains(SENTINEL)); + assert!(!format!("{report:?}").contains(SENTINEL)); + assert_schema_valid(&report); + } + + #[test] + fn starter_adaptation_compares_and_stale_provenance_fails_value_free() { + const STALE_SENTINEL: &str = "SEMANTIC_COMPARISON_STALE_SENTINEL"; + + let temporary = tempfile::tempdir().expect("temporary directory"); + let project = initialized_http_project(temporary.path(), "project"); + let options = ProjectStarterSemanticComparisonOptions { + project_directory: project.clone(), + environment: "local".to_owned(), + starter: None, + }; + rewrite_yaml(&project.join(PROJECT_FILE), |document| { + document["services"]["person-verification"]["purpose"] = + Value::String("adapted-purpose".to_owned()); + }); + assert_eq!( + compare_registry_project_to_embedded_starter_semantically(&options) + .expect("adapted starter compares") + .equivalence, + SemanticComparisonEquivalence::Different + ); + rewrite_yaml(&project.join(PROJECT_FILE), |document| { + document["starter"]["release"] = Value::String(STALE_SENTINEL.to_owned()); + }); + let error = compare_registry_project_to_embedded_starter_semantically(&options) + .expect_err("stale provenance fails closed"); + let error = format!("{error:#}"); + assert_eq!( + error, + "project starter provenance cannot be proved by this binary" + ); + assert!(!error.contains(STALE_SENTINEL)); + } + + #[test] + fn fixture_changes_feed_the_generated_pending_review_plan() { + let temporary = tempfile::tempdir().expect("temporary directory"); + let baseline = initialized_http_project(temporary.path(), "baseline"); + let current = initialized_http_project(temporary.path(), "current"); + rewrite_yaml( + ¤t.join("integrations/person-record/fixtures/active.yaml"), + |document| { + document["interactions"][0]["respond"]["body"]["active"] = Value::Bool(false); + document["expect"]["outputs"]["active"] = Value::Bool(false); + document["expect"]["claims"]["person-active"] = Value::Bool(false); + }, + ); + let report = compare_registry_projects_semantically(&ProjectSemanticComparisonOptions { + current_project_directory: current, + current_environment: "local".to_owned(), + baseline_project_directory: baseline, + baseline_environment: "local".to_owned(), + }) + .expect("fixture-bearing projects compare"); + assert_eq!( + report.review_plan.state, + SemanticComparisonReviewPlanState::GeneratedPendingReview + ); + assert!(report + .changes + .iter() + .any(|change| change.dimension == SemanticComparisonDimension::Fixture)); + assert!(report.changes.iter().any(|change| { + change.address.schema_family == SemanticComparisonSchemaFamily::GeneratedApproval + })); + assert_schema_valid(&report); + } +} diff --git a/crates/registryctl/src/project_authoring/tests.rs b/crates/registryctl/src/project_authoring/tests.rs index fe36aec7c..ab2435a9d 100644 --- a/crates/registryctl/src/project_authoring/tests.rs +++ b/crates/registryctl/src/project_authoring/tests.rs @@ -378,31 +378,6 @@ outputs: .contains("between one and sixteen entries")); } - fn run_code_owned_project_conformance(project: &Path) -> Result> { - let loaded = load_registry_project(project, None)?; - run_code_owned_loaded_project_conformance(&loaded) - } - - fn run_code_owned_loaded_project_conformance( - loaded: &LoadedRegistryProject, - ) -> Result> { - let offline_environment = offline_fixture_environment(loaded)?; - let compiled = - compile_project_for_environment(loaded, "offline-fixture", &offline_environment, None)?; - let relay_config = compiled - .relay_private - .get(Path::new("config/relay.yaml")) - .ok_or_else(|| anyhow!("generated Relay config is absent"))?; - // This structural compiler bypass is selected only by this cfg(test) - // harness. No authored field, CLI flag, environment variable, startup - // path, or runtime API can request it. - compile_generated_relay_fixture(relay_config, &compiled.relay_private).map(drop)?; - validate_generated_notary(&compiled)?; - let reports = execute_all_fixtures(loaded, &compiled, None, None, false)?; - require_passing_fixtures(&reports)?; - Ok(reports) - } - fn project_golden(name: &str) -> PathBuf { Path::new(env!("CARGO_MANIFEST_DIR")) .join("tests/fixtures/project-authoring") @@ -764,75 +739,6 @@ outputs: } } - #[test] - fn code_owned_rhai_conformance_matches_http_and_is_deterministic() { - let bounded = run_code_owned_project_conformance(&project_golden("dhis2-tracker")) - .expect("bounded DHIS2 conformance passes"); - let rhai_project = project_golden("dhis2-script"); - let rhai = run_code_owned_project_conformance(&rhai_project) - .expect("Rhai DHIS2 conformance passes"); - let repeated = run_code_owned_project_conformance(&rhai_project) - .expect("repeated Rhai DHIS2 conformance passes"); - let mut unknown_product = - load_registry_project(&rhai_project, None).expect("Rhai golden loads"); - unknown_product - .integrations - .get_mut("health-record") - .expect("Rhai integration exists") - .document - .source - .product = Some("previously-unknown-source-system".to_string()); - let unknown_product_report = run_code_owned_loaded_project_conformance(&unknown_product) - .expect("unknown product uses the same Rhai authoring contract"); - assert_eq!( - serde_json::to_value(&unknown_product_report) - .expect("unknown-product report serializes"), - serde_json::to_value(&rhai).expect("Rhai report serializes"), - "source.product may alter provenance but not Rhai fixture behavior" - ); - assert_eq!( - serde_json::to_value(&rhai).expect("first Rhai report serializes"), - serde_json::to_value(&repeated).expect("repeated Rhai report serializes"), - "fresh one-shot workers must produce deterministic fixture reports" - ); - - let rhai_by_name = rhai - .iter() - .map(|fixture| (fixture.fixture.as_str(), fixture)) - .collect::>(); - for expected in &bounded { - let actual = rhai_by_name - .get(expected.fixture.as_str()) - .unwrap_or_else(|| panic!("Rhai omitted fixture {}", expected.fixture)); - assert_eq!( - actual.inputs, expected.inputs, - "{} inputs", - expected.fixture - ); - assert_eq!(actual.calls, expected.calls, "{} calls", expected.fixture); - assert_eq!( - actual.outputs, expected.outputs, - "{} outputs", - expected.fixture - ); - assert_eq!( - actual.claims, expected.claims, - "{} claims", - expected.fixture - ); - assert_eq!( - actual.outcome, expected.outcome, - "{} outcome", - expected.fixture - ); - assert_eq!( - actual.passed, expected.passed, - "{} result", - expected.fixture - ); - } - } - #[test] fn generated_relay_rejects_independent_raw_and_typed_binding_tampering() { let project = Path::new(env!("CARGO_MANIFEST_DIR")) @@ -1735,6 +1641,13 @@ outputs: let request = validate_live_request( &loaded, &json!({ + "target": { + "type": "Person", + "identifiers": [{ + "scheme": "openspp_individual_id", + "value": "IND-AB12CD34", + }], + }, "purpose": "social-programme-verification", "claims": ["social-registry-record-exists"], "disclosure": "predicate", @@ -1798,6 +1711,13 @@ outputs: let request = validate_live_request( &loaded, &json!({ + "target": { + "type": "Person", + "identifiers": [{ + "scheme": "openspp_individual_id", + "value": "IND-AB12CD34", + }], + }, "purpose": "social-programme-verification", "claims": ["social-registry-record-exists"], "disclosure": "predicate", @@ -2293,6 +2213,13 @@ outputs: ("redacted", vec!["household-reference"]), ] { let request = json!({ + "target": { + "type": "Person", + "identifiers": [{ + "scheme": "openspp_individual_id", + "value": "IND-AB12CD34", + }], + }, "purpose": "social-programme-verification", "claims": claims, "disclosure": disclosure, @@ -2306,6 +2233,13 @@ outputs: } let mixed = json!({ + "target": { + "type": "Person", + "identifiers": [{ + "scheme": "openspp_individual_id", + "value": "IND-AB12CD34", + }], + }, "purpose": "social-programme-verification", "claims": [ "social-registry-record-exists", @@ -2327,6 +2261,13 @@ outputs: .expect("OpenSPP golden project loads"); let request = |version| { json!({ + "target": { + "type": "Person", + "identifiers": [{ + "scheme": "openspp_individual_id", + "value": "IND-AB12CD34", + }], + }, "purpose": "social-programme-verification", "claims": [{ "id": "social-registry-record-exists", @@ -2405,6 +2346,13 @@ outputs: let request = validate_live_request( &loaded, &json!({ + "target": { + "type": "Person", + "identifiers": [{ + "scheme": "household_reference", + "value": "HH-AB12CD34", + }], + }, "purpose": "household-support-screening", "claims": ["household-category", "source-household-approval-decision"], "disclosure": "redacted", @@ -2566,6 +2514,15 @@ outputs: validate_signed_review_record(&review).expect("current review record is valid"); validate_signed_approval_state(&approval_state).expect("current approval state is valid"); + let mut legacy_state = approval_state.clone(); + legacy_state["schema"] = json!(APPROVAL_STATE_SCHEMA_V1); + legacy_state + .as_object_mut() + .expect("legacy approval state is an object") + .remove("promotion_projection"); + validate_signed_approval_state(&legacy_state) + .expect("legacy signed state remains parseable for fail-closed migration reporting"); + let mut leaked_digest = review.clone(); leaked_digest .as_object_mut() @@ -2598,6 +2555,31 @@ outputs: .to_string() .contains("missing or unknown fields")); + let mut inconsistent_products = approval_state.clone(); + inconsistent_products["promotion_projection"]["products"] = json!(["relay"]); + assert!(validate_signed_approval_state(&inconsistent_products) + .expect_err("projection products must match signed generated closures") + .to_string() + .contains("product inventory disagrees")); + + let mut missing_projection = approval_state.clone(); + missing_projection + .as_object_mut() + .expect("approval state is an object") + .remove("promotion_projection"); + assert!(validate_signed_approval_state(&missing_projection) + .expect_err("approval state without promotion projection must fail") + .to_string() + .contains("missing or unknown fields")); + + let mut malformed_projection = approval_state.clone(); + malformed_projection["promotion_projection"]["fields"][0]["address"]["path"] = + json!("/not/a/closed/promotion/address"); + assert!(validate_signed_approval_state(&malformed_projection) + .expect_err("approval state promotion projection must remain closed") + .to_string() + .contains("promotion_projection is invalid")); + let mut malformed_state = approval_state.clone(); malformed_state["report_digest"] = Value::String("sha256:not-a-digest".to_string()); assert!(validate_signed_approval_state(&malformed_state) diff --git a/crates/registryctl/src/templates/notary_addon/integrations/person-demographics/fixtures/match.yaml b/crates/registryctl/src/templates/notary_addon/integrations/person-demographics/fixtures/match.yaml index 1a75a9e8c..11efc1afa 100644 --- a/crates/registryctl/src/templates/notary_addon/integrations/person-demographics/fixtures/match.yaml +++ b/crates/registryctl/src/templates/notary_addon/integrations/person-demographics/fixtures/match.yaml @@ -7,4 +7,4 @@ interactions: expect: outcome: match outputs: { registration_status: active } - claims: { person-registration-accepted: true } + claims: { active-registration-exists: true } diff --git a/crates/registryctl/src/templates/notary_addon/integrations/person-demographics/fixtures/no-match.yaml b/crates/registryctl/src/templates/notary_addon/integrations/person-demographics/fixtures/no-match.yaml index 389a6752e..c3c6fef11 100644 --- a/crates/registryctl/src/templates/notary_addon/integrations/person-demographics/fixtures/no-match.yaml +++ b/crates/registryctl/src/templates/notary_addon/integrations/person-demographics/fixtures/no-match.yaml @@ -7,4 +7,4 @@ interactions: expect: outcome: no_match outputs: {} - claims: { person-registration-accepted: false } + claims: { active-registration-exists: false } diff --git a/crates/registryctl/src/templates/notary_addon/integrations/person-demographics/fixtures/pending.yaml b/crates/registryctl/src/templates/notary_addon/integrations/person-demographics/fixtures/pending.yaml index c9ef3f839..4b50d9c5c 100644 --- a/crates/registryctl/src/templates/notary_addon/integrations/person-demographics/fixtures/pending.yaml +++ b/crates/registryctl/src/templates/notary_addon/integrations/person-demographics/fixtures/pending.yaml @@ -7,4 +7,4 @@ interactions: expect: outcome: match outputs: { registration_status: pending } - claims: { person-registration-accepted: false } + claims: { active-registration-exists: false } diff --git a/crates/registryctl/src/templates/notary_addon/registry-stack.yaml b/crates/registryctl/src/templates/notary_addon/registry-stack.yaml index b1fd80d14..8034c4822 100644 --- a/crates/registryctl/src/templates/notary_addon/registry-stack.yaml +++ b/crates/registryctl/src/templates/notary_addon/registry-stack.yaml @@ -20,6 +20,6 @@ services: family_name: request.target.attributes.family_name date_of_birth: request.target.attributes.date_of_birth claims: - person-registration-accepted: + active-registration-exists: cel: enrollment.matched && enrollment.registration_status == "active" disclosure: predicate diff --git a/crates/registryctl/tests/fixtures/project-authoring-journeys.yaml b/crates/registryctl/tests/fixtures/project-authoring-journeys.yaml index 1c8f5cae3..b2b0bea70 100644 --- a/crates/registryctl/tests/fixtures/project-authoring-journeys.yaml +++ b/crates/registryctl/tests/fixtures/project-authoring-journeys.yaml @@ -9,7 +9,7 @@ workspaces: starter: http project_dir: registry-project focused_fixture_file: active.yaml - steps: [init, editor, trace, watch, test, check, build] + steps: [init, editor, trace, watch, test, check, compare, build] environment: local check_explain: true @@ -45,7 +45,7 @@ workspaces: starter: dhis2-tracker project_dir: dhis2-project focused_fixture_file: match.yaml - steps: [init, editor, trace, watch, test, check, build] + steps: [init, editor, trace, watch, test, check, compare, build] environment: local check_explain: true @@ -58,7 +58,7 @@ workspaces: starter: fhir-r4 project_dir: fhir-project focused_fixture_file: match.yaml - steps: [init, editor, trace, watch, test, check, build] + steps: [init, editor, trace, watch, test, check, compare, build] environment: local check_explain: true @@ -83,7 +83,7 @@ workspaces: starter: opencrvs-dci project_dir: opencrvs-project focused_fixture_file: match.yaml - steps: [init, editor, trace, watch, test, check, build] + steps: [init, editor, trace, watch, test, check, compare, build] environment: local check_explain: true @@ -143,7 +143,7 @@ workspaces: starter: snapshot project_dir: snapshot-project focused_fixture_file: match.yaml - steps: [init, editor, trace, watch, test, check, build] + steps: [init, editor, trace, watch, test, check, compare, build] environment: local check_explain: true diff --git a/crates/registryctl/tests/fixtures/project-authoring/custom-system/integrations/eligibility/fixtures/source-approved.yaml b/crates/registryctl/tests/fixtures/project-authoring/custom-system/integrations/eligibility/fixtures/source-approved.yaml index 64343f01d..4b55b1614 100644 --- a/crates/registryctl/tests/fixtures/project-authoring/custom-system/integrations/eligibility/fixtures/source-approved.yaml +++ b/crates/registryctl/tests/fixtures/project-authoring/custom-system/integrations/eligibility/fixtures/source-approved.yaml @@ -1,5 +1,13 @@ name: source-approved-household classification: synthetic +request: + target: + type: Person + identifiers: [{ scheme: household_reference, value: HH-AB12CD34 }] + claims: [household-record-exists] + disclosure: predicate + format: application/vnd.registry-notary.claim-result+json + purpose: household-support-screening input: { household_reference: HH-AB12CD34 } interactions: - expect: diff --git a/crates/registryctl/tests/fixtures/project-authoring/dhis2-script/integrations/health-record/fixtures/match.yaml b/crates/registryctl/tests/fixtures/project-authoring/dhis2-script/integrations/health-record/fixtures/match.yaml index fe6107235..527479d79 100644 --- a/crates/registryctl/tests/fixtures/project-authoring/dhis2-script/integrations/health-record/fixtures/match.yaml +++ b/crates/registryctl/tests/fixtures/project-authoring/dhis2-script/integrations/health-record/fixtures/match.yaml @@ -1,5 +1,15 @@ name: complete-child-health-evidence classification: synthetic +request: + target: + type: Person + identifiers: [{ scheme: dhis2_tracked_entity, value: A0000000001 }] + attributes: { include_inactive: true } + variables: { as_of_date: 2026-01-01 } + claims: [child-program-active] + disclosure: predicate + format: application/vnd.registry-notary.claim-result+json + purpose: programme-enrollment-verification input: { tracked_entity: A0000000001, include_inactive: true } variables: { as_of_date: 2026-01-01 } interactions: diff --git a/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/integrations/health-record/fixtures/match.yaml b/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/integrations/health-record/fixtures/match.yaml index fe6107235..527479d79 100644 --- a/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/integrations/health-record/fixtures/match.yaml +++ b/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/integrations/health-record/fixtures/match.yaml @@ -1,5 +1,15 @@ name: complete-child-health-evidence classification: synthetic +request: + target: + type: Person + identifiers: [{ scheme: dhis2_tracked_entity, value: A0000000001 }] + attributes: { include_inactive: true } + variables: { as_of_date: 2026-01-01 } + claims: [child-program-active] + disclosure: predicate + format: application/vnd.registry-notary.claim-result+json + purpose: programme-enrollment-verification input: { tracked_entity: A0000000001, include_inactive: true } variables: { as_of_date: 2026-01-01 } interactions: diff --git a/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/registry-stack.yaml b/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/registry-stack.yaml index d80ba3fb0..4193b6649 100644 --- a/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/registry-stack.yaml +++ b/crates/registryctl/tests/fixtures/project-authoring/dhis2-tracker/registry-stack.yaml @@ -2,7 +2,7 @@ version: 1 starter: id: dhis2-tracker release: 0.13.0 - content_digest: sha256:4263404b5f519be9f729838525898ec2fef97cb24b9c89d3d5461fae59fb5f5e + content_digest: sha256:7901a738c1a3fe216be4e6f5dcef17e5a1b30d65dc739a31bc9c8621f964dd8c registry: { id: fictional-health-registry } integrations: health-record: { file: integrations/health-record/integration.yaml } diff --git a/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/fixtures/match.yaml b/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/fixtures/match.yaml index 4a4217aeb..c342baad6 100644 --- a/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/fixtures/match.yaml +++ b/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/fixtures/match.yaml @@ -1,5 +1,16 @@ name: coverage-active classification: synthetic +request: + target: + type: Person + identifiers: + - { scheme: birthdate, value: 2018-05-12 } + - { scheme: family, value: Example } + - { scheme: given, value: Ada } + claims: [coverage-active] + disclosure: predicate + format: application/vnd.registry-notary.claim-result+json + purpose: coverage-verification input: { birthdate: 2018-05-12, family: Example, given: Ada } interactions: - expect: diff --git a/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/registry-stack.yaml b/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/registry-stack.yaml index 5252d6149..0cfefd7d7 100644 --- a/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/registry-stack.yaml +++ b/crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/registry-stack.yaml @@ -2,7 +2,7 @@ version: 1 starter: id: fhir-r4 release: 0.13.0 - content_digest: sha256:25e9a824afb227f8a829aa2b5bacc3ee120a4063f02a57151c9ee89e43d7a433 + content_digest: sha256:b99bff37a59c34d90ee6d212b61fd5f50e0ec6995310f574c5020535ebbd4f8d registry: { id: fictional-fhir-registry } integrations: coverage: { file: integrations/coverage/integration.yaml } diff --git a/crates/registryctl/tests/fixtures/project-authoring/opencrvs-country-variant/integrations/birth-record/fixtures/match.yaml b/crates/registryctl/tests/fixtures/project-authoring/opencrvs-country-variant/integrations/birth-record/fixtures/match.yaml index 9b11184b5..2f1aafe26 100644 --- a/crates/registryctl/tests/fixtures/project-authoring/opencrvs-country-variant/integrations/birth-record/fixtures/match.yaml +++ b/crates/registryctl/tests/fixtures/project-authoring/opencrvs-country-variant/integrations/birth-record/fixtures/match.yaml @@ -1,5 +1,14 @@ name: provincial-birth-match classification: synthetic +request: + target: + type: Person + identifiers: [{ scheme: birth_registration_number, value: BR-ZZ-0000001 }] + variables: { as_of_date: 2026-01-01 } + claims: [birth-record-exists] + disclosure: predicate + format: application/vnd.registry-notary.claim-result+json + purpose: provincial-birth-attribute-verification input: { registration_number: BR-ZZ-0000001 } variables: { as_of_date: 2026-01-01 } interactions: diff --git a/crates/registryctl/tests/fixtures/project-authoring/opencrvs/integrations/birth-record/fixtures/match.yaml b/crates/registryctl/tests/fixtures/project-authoring/opencrvs/integrations/birth-record/fixtures/match.yaml index a0f5bf2c3..147bd5b64 100644 --- a/crates/registryctl/tests/fixtures/project-authoring/opencrvs/integrations/birth-record/fixtures/match.yaml +++ b/crates/registryctl/tests/fixtures/project-authoring/opencrvs/integrations/birth-record/fixtures/match.yaml @@ -1,5 +1,14 @@ name: birth-record-match classification: synthetic +request: + target: + type: Person + identifiers: [{ scheme: UIN, value: "0000000001" }] + variables: { as_of_date: 2026-01-01 } + claims: [birth-record-exists] + disclosure: predicate + format: application/vnd.registry-notary.claim-result+json + purpose: birth-record-verification input: { uin: "0000000001" } variables: { as_of_date: 2026-01-01 } interactions: diff --git a/crates/registryctl/tests/fixtures/project-authoring/opencrvs/registry-stack.yaml b/crates/registryctl/tests/fixtures/project-authoring/opencrvs/registry-stack.yaml index 931169f3c..9947705a4 100644 --- a/crates/registryctl/tests/fixtures/project-authoring/opencrvs/registry-stack.yaml +++ b/crates/registryctl/tests/fixtures/project-authoring/opencrvs/registry-stack.yaml @@ -2,7 +2,7 @@ version: 1 starter: id: opencrvs-dci release: 0.13.0 - content_digest: sha256:ab9a02c25061f8d54e0d8e19b82ad54aa48877d25961894a7c8ca9e7a54e0af4 + content_digest: sha256:da86a8af6281e7a3552b009783ce83fe4574daf7d37b47568e232db0767cd842 registry: { id: fictional-civil-registry } integrations: birth-record: { file: integrations/birth-record/integration.yaml } diff --git a/crates/registryctl/tests/fixtures/project-authoring/openspp-exact/integrations/individual/fixtures/match.yaml b/crates/registryctl/tests/fixtures/project-authoring/openspp-exact/integrations/individual/fixtures/match.yaml index 8484adfc6..c215fc1fa 100644 --- a/crates/registryctl/tests/fixtures/project-authoring/openspp-exact/integrations/individual/fixtures/match.yaml +++ b/crates/registryctl/tests/fixtures/project-authoring/openspp-exact/integrations/individual/fixtures/match.yaml @@ -1,5 +1,13 @@ name: social-registry-match classification: synthetic +request: + target: + type: Person + identifiers: [{ scheme: openspp_individual_id, value: IND-AB12CD34 }] + claims: [social-registry-record-exists] + disclosure: predicate + format: application/vnd.registry-notary.claim-result+json + purpose: social-programme-verification input: { individual_id: IND-AB12CD34 } interactions: - expect: diff --git a/crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/integrations/person-snapshot/fixtures/match.yaml b/crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/integrations/person-snapshot/fixtures/match.yaml index bbe7cc7d4..3d21e9777 100644 --- a/crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/integrations/person-snapshot/fixtures/match.yaml +++ b/crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/integrations/person-snapshot/fixtures/match.yaml @@ -1,5 +1,13 @@ name: snapshot-match classification: synthetic +request: + target: + type: Person + identifiers: [{ scheme: population_person_id, value: PER-00000001 }] + claims: [population-record-exists] + disclosure: predicate + format: application/vnd.registry-notary.claim-result+json + purpose: benefits-eligibility input: { person_id: PER-00000001 } interactions: - expect: { method: GET, path: /snapshot } diff --git a/crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/registry-stack.yaml b/crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/registry-stack.yaml index 786248030..eabde24f9 100644 --- a/crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/registry-stack.yaml +++ b/crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/registry-stack.yaml @@ -2,7 +2,7 @@ version: 1 starter: id: snapshot release: 0.13.0 - content_digest: sha256:c156c494b7f5f909012a14110ceefd4ae2b11159050b277475498aa70044ca1e + content_digest: sha256:8fb0772e01333fd084974550f76829e829bc43f6e6941ac50d2e92522baadede registry: { id: fictional-population-registry } integrations: person-snapshot: { file: integrations/person-snapshot/integration.yaml } diff --git a/crates/registryctl/tests/fixtures/project-authoring/snapshot-with-records/integrations/person-snapshot/fixtures/match.yaml b/crates/registryctl/tests/fixtures/project-authoring/snapshot-with-records/integrations/person-snapshot/fixtures/match.yaml index bbe7cc7d4..3d21e9777 100644 --- a/crates/registryctl/tests/fixtures/project-authoring/snapshot-with-records/integrations/person-snapshot/fixtures/match.yaml +++ b/crates/registryctl/tests/fixtures/project-authoring/snapshot-with-records/integrations/person-snapshot/fixtures/match.yaml @@ -1,5 +1,13 @@ name: snapshot-match classification: synthetic +request: + target: + type: Person + identifiers: [{ scheme: population_person_id, value: PER-00000001 }] + claims: [population-record-exists] + disclosure: predicate + format: application/vnd.registry-notary.claim-result+json + purpose: benefits-eligibility input: { person_id: PER-00000001 } interactions: - expect: { method: GET, path: /snapshot } diff --git a/crates/registryctl/tests/fixtures/project-documentation/configuration-reference.miniature.v1.json b/crates/registryctl/tests/fixtures/project-documentation/configuration-reference.miniature.v1.json new file mode 100644 index 000000000..f3a651dad --- /dev/null +++ b/crates/registryctl/tests/fixtures/project-documentation/configuration-reference.miniature.v1.json @@ -0,0 +1,274 @@ +{ + "coverage": { + "by_path_kind": { + "property": 2, + "root": 1 + }, + "by_schema": { + "project": 3 + }, + "by_sensitivity": { + "internal": 2, + "structural": 1 + }, + "path_count": 3, + "reference_count": 0, + "schema_count": 1, + "by_intent_source": { + "schema_description": 3 + }, + "by_intent_profile": {} + }, + "fields": [ + { + "address": { + "path_kind": "root", + "pointer": "", + "schema": "project" + }, + "availability": "published", + "constraints": [ + { + "keyword": "required", + "value": [ + "version" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "consumers": [ + "registryctl_authoring", + "docs_generator" + ], + "default": { + "behavior": "not_applicable" + }, + "diagnostic": "registryctl.authoring.project.invalid", + "empty_behavior": "not_applicable", + "environment_behavior": "environment_independent", + "example": { + "contains_country_values": false, + "guidance": "Use only the committed synthetic miniature values supplied by this contract test.", + "schema_examples_available": false + }, + "field_type": { + "composed": false, + "schema_types": [ + "object" + ] + }, + "generated_artifacts": [ + "editor_schemas", + "field_reference" + ], + "human_owner": "registry_maintainers", + "history_status": "not_verified", + "introduced_in": null, + "migration": "rebuild_project", + "migration_note": "Revalidate the miniature document after changing this test-only authored contract.", + "null_behavior": "not_applicable", + "products": [ + "registryctl", + "docs" + ], + "purpose": "Defines the complete miniature documentation-reference contract used by the generator test.", + "purpose_source": "schema_description", + "requiredness": "not_applicable", + "review_classes": [ + "contract", + "documentation" + ], + "scope": "A miniature authored project contract used only to prove deterministic documentation generation.", + "semantic_owner": "authoring_contract", + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "sensitivity": "structural", + "stability": "experimental", + "state": "authored", + "validation_stages": [ + "json_schema", + "rust_deserialization" + ], + "version_history": [] + }, + { + "address": { + "path_kind": "property", + "pointer": "/properties/mode", + "schema": "project" + }, + "availability": "published", + "constraints": [ + { + "keyword": "enum", + "value": [ + "safe", + "strict" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "consumers": [ + "registryctl_authoring", + "docs_generator" + ], + "default": { + "behavior": "schema_default", + "schema_value": "safe" + }, + "diagnostic": "registryctl.authoring.project.invalid", + "empty_behavior": "allowed", + "environment_behavior": "environment_independent", + "example": { + "contains_country_values": false, + "guidance": "Use only the committed synthetic miniature values supplied by this contract test.", + "schema_examples_available": false + }, + "field_type": { + "composed": false, + "schema_types": [ + "string" + ] + }, + "generated_artifacts": [ + "editor_schemas", + "field_reference" + ], + "human_owner": "registry_maintainers", + "history_status": "not_verified", + "introduced_in": null, + "migration": "rebuild_project", + "migration_note": "Revalidate the miniature document after changing this test-only authored contract.", + "null_behavior": "rejected", + "products": [ + "registryctl", + "docs" + ], + "purpose": "Selects the optional safe mode and documents its committed schema default.", + "purpose_source": "schema_description", + "requiredness": "optional", + "review_classes": [ + "contract", + "documentation" + ], + "scope": "A miniature authored project contract used only to prove deterministic documentation generation.", + "semantic_owner": "authoring_contract", + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "sensitivity": "internal", + "stability": "experimental", + "state": "authored", + "validation_stages": [ + "json_schema", + "rust_deserialization" + ], + "version_history": [] + }, + { + "address": { + "path_kind": "property", + "pointer": "/properties/version", + "schema": "project" + }, + "availability": "published", + "constraints": [ + { + "keyword": "const", + "value": "1" + }, + { + "keyword": "type", + "value": "string" + } + ], + "consumers": [ + "registryctl_authoring", + "docs_generator" + ], + "default": { + "behavior": "no_schema_default" + }, + "diagnostic": "registryctl.authoring.project.invalid", + "empty_behavior": "allowed", + "environment_behavior": "environment_independent", + "example": { + "contains_country_values": false, + "guidance": "Use only the committed synthetic miniature values supplied by this contract test.", + "schema_examples_available": true + }, + "field_type": { + "composed": false, + "schema_types": [ + "string" + ] + }, + "generated_artifacts": [ + "editor_schemas", + "field_reference" + ], + "human_owner": "registry_maintainers", + "history_status": "not_verified", + "introduced_in": null, + "migration": "rebuild_project", + "migration_note": "Revalidate the miniature document after changing this test-only authored contract.", + "null_behavior": "rejected", + "products": [ + "registryctl", + "docs" + ], + "purpose": "Selects the authored miniature contract version used by this deterministic test.", + "purpose_source": "schema_description", + "requiredness": "required", + "review_classes": [ + "contract", + "documentation" + ], + "scope": "A miniature authored project contract used only to prove deterministic documentation generation.", + "semantic_owner": "authoring_contract", + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "sensitivity": "internal", + "stability": "experimental", + "state": "authored", + "validation_stages": [ + "json_schema", + "rust_deserialization" + ], + "version_history": [] + } + ], + "format_version": "1.0", + "reference_baseline": { + "generator_lifecycle": "unreleased", + "published_release": null, + "field_history_status": "not_verified", + "history_verification_method": null, + "compared_releases": [] + }, + "schema_id": "https://id.registrystack.org/schemas/registryctl/project-documentation/registry.project.configuration_reference.v1.schema.json", + "source_contract": { + "field_knowledge": "schemas/project-authoring/parity-coverage.json#field_knowledge", + "human_intent": "schemas/project-authoring/documentation-intent.json", + "reads_country_workspaces": false, + "reads_runtime_configuration": false, + "schema_sources": [ + "project.schema.json" + ], + "schemas": [ + "project" + ], + "runtime_intent": [] + } +} diff --git a/crates/registryctl/tests/fixtures/project-migration/old-40ec7a-attribute-release/README.md b/crates/registryctl/tests/fixtures/project-migration/old-40ec7a-attribute-release/README.md new file mode 100644 index 000000000..bb34113e9 --- /dev/null +++ b/crates/registryctl/tests/fixtures/project-migration/old-40ec7a-attribute-release/README.md @@ -0,0 +1,6 @@ +# Frozen pre-#488 attribute-release project + +The authored YAML in this directory is copied from the NIA attribute-release +fixture at Registry Stack commit +`40ec7aaf37dc8e41599d304bcbd6a6f1213752bb`. Keep it unchanged so migration +tests exercise the historical same-v1 input. diff --git a/crates/registryctl/tests/fixtures/project-migration/old-40ec7a-attribute-release/entities/population.yaml b/crates/registryctl/tests/fixtures/project-migration/old-40ec7a-attribute-release/entities/population.yaml new file mode 100644 index 000000000..09df8295a --- /dev/null +++ b/crates/registryctl/tests/fixtures/project-migration/old-40ec7a-attribute-release/entities/population.yaml @@ -0,0 +1,22 @@ +version: 1 +id: population +revision: 1 +primary_key: uin +schema: + type: object + additionalProperties: false + required: [uin, legacy_nid, given_name, family_name, sex, birth_date, identity_status, alive] + properties: + uin: { type: string, maxLength: 16, pattern: "^[0-9]{10}$" } + legacy_nid: { type: [string, "null"], maxLength: 32 } + given_name: { type: string, maxLength: 128 } + family_name: { type: string, maxLength: 128 } + sex: { type: string, maxLength: 32 } + birth_date: { type: string, format: date, maxLength: 10 } + identity_status: { type: string, maxLength: 32 } + alive: { type: boolean } +materialization: + max_records: 10000000 + max_bytes: 512MiB + refresh: manual + retain_generations: 2 diff --git a/crates/registryctl/tests/fixtures/project-migration/old-40ec7a-attribute-release/environments/local.yaml b/crates/registryctl/tests/fixtures/project-migration/old-40ec7a-attribute-release/environments/local.yaml new file mode 100644 index 000000000..8a5c5ca20 --- /dev/null +++ b/crates/registryctl/tests/fixtures/project-migration/old-40ec7a-attribute-release/environments/local.yaml @@ -0,0 +1,28 @@ +version: 1 +entities: + population: + provider: + type: postgres + connection: { secret: SOLMARA_NIA_DATABASE_URL } + schema: public + table: population_person + columns: + uin: uin + legacy_nid: legacy_nid + given_name: given_name + family_name: family_name + sex: sex + birth_date: birth_date + identity_status: identity_status + alive: alive + source_revision: solmara-nia-population-v1 + generation: 2026-07-15 +relay: + origin: https://nia-relay.solmara.invalid + issuer: https://workload-issuer.solmara.invalid + jwks_url: https://workload-issuer.solmara.invalid/.well-known/jwks.json + audience: registry-relay + allowed_clients: [solmara-esignet] +deployment: + profile: local + relay: { service: nia-population-relay } diff --git a/crates/registryctl/tests/fixtures/project-migration/old-40ec7a-attribute-release/registry-stack.yaml b/crates/registryctl/tests/fixtures/project-migration/old-40ec7a-attribute-release/registry-stack.yaml new file mode 100644 index 000000000..debe2053a --- /dev/null +++ b/crates/registryctl/tests/fixtures/project-migration/old-40ec7a-attribute-release/registry-stack.yaml @@ -0,0 +1,77 @@ +version: 1 +registry: { id: solmara-nia-population } +entities: + population: { file: entities/population.yaml } +services: + nia-population-records: + kind: records_api + entity: population + title: NIA population records + description: Governed population attributes used by NIA-owned services. + owner: National Identity Agency + sensitivity: personal + access_rights: restricted + update_frequency: continuous + api: + scopes: + metadata: population:metadata + rows: population:rows + evidence_verification: population:evidence_verification + purposes: + - https://id.registrystack.org/solmara/purpose/esignet-identity-verification + projection: + - uin + - legacy_nid + - given_name + - family_name + - sex + - birth_date + - identity_status + - alive + pagination: { default_limit: 25, max_limit: 100 } + filters: + uin: [eq] + legacy_nid: [eq] + attribute_release_profiles: + solmara-nia-userinfo: + version: v1 + title: SolmaraID UserInfo + description: Minimal identity attributes for the Solmara eSignet authenticator. + purpose: https://id.registrystack.org/solmara/purpose/esignet-identity-verification + release_scope: population:identity_release + subject: + input: individual_id + source_field: legacy_nid + id_type: national_id + release_conditions: + expression: + cel: "source.identity_status == 'active' && source.alive == true" + claims: + individual_id: + source_field: uin + required: true + sensitivity: direct_identifier + name: + expression: + cel: "source.given_name + ' ' + source.family_name" + required: true + sensitivity: direct_identifier + given_name: + source_field: given_name + required: true + sensitivity: direct_identifier + family_name: + source_field: family_name + required: true + sensitivity: direct_identifier + birthdate: + source_field: birth_date + required: true + sensitivity: personal + gender: + source_field: sex + required: false + sensitivity: personal + response: + max_age_seconds: 300 + standards: { ogc_features: false, sp_dci: false } diff --git a/crates/registryctl/tests/fixtures/project-reports/registry.project.artifact_manifest.v1.json b/crates/registryctl/tests/fixtures/project-reports/registry.project.artifact_manifest.v1.json new file mode 100644 index 000000000..dccc91f5a --- /dev/null +++ b/crates/registryctl/tests/fixtures/project-reports/registry.project.artifact_manifest.v1.json @@ -0,0 +1,81 @@ +{ + "schema_version": "registry.project.artifact_manifest.v1", + "format_version": "registry.project.artifact_manifest.format.v1", + "project": "fictional-citizen-registry", + "environment": "local", + "generator": { + "name": "registryctl", + "version": "0.13.0" + }, + "inputs": [ + { + "path": "registry-stack.yaml", + "digest": "sha256:1111111111111111111111111111111111111111111111111111111111111111" + }, + { + "path": "environments/local.yaml", + "digest": "sha256:2222222222222222222222222222222222222222222222222222222222222222" + }, + { + "path": "integrations/person-record/integration.yaml", + "digest": "sha256:3333333333333333333333333333333333333333333333333333333333333333" + } + ], + "artifacts": [ + { + "path": ".registry-stack/build/local/relay/source-plans/person-record.json", + "format_version": "registry.relay.source_plan.v1", + "digest": "sha256:4444444444444444444444444444444444444444444444444444444444444444", + "classes": [ + "source_plan", + "deployment_input" + ], + "sensitivity": "internal", + "publication": "operator_only", + "edit": "generated_do_not_edit", + "version_control": "ignore", + "review": "generated_candidate", + "lifecycle": "unsigned_non_deployable", + "actions": [ + "compare", + "validate", + "sign", + "verify" + ], + "consumers": [ + "registry_relay", + "bundle_signer", + "deployment_tooling" + ] + }, + { + "path": ".registry-stack/build/local/relay/config/relay.yaml", + "format_version": "registry.relay.config.v1", + "digest": "sha256:5555555555555555555555555555555555555555555555555555555555555555", + "classes": [ + "runtime_config", + "deployment_input" + ], + "sensitivity": "topology_sensitive", + "publication": "never_publish", + "edit": "generated_do_not_edit", + "version_control": "ignore", + "review": "generated_candidate", + "lifecycle": "unsigned_non_deployable", + "actions": [ + "regenerate", + "compare", + "validate", + "sign", + "verify", + "discard" + ], + "consumers": [ + "registry_relay", + "bundle_signer", + "deployment_tooling", + "operator" + ] + } + ] +} diff --git a/crates/registryctl/tests/fixtures/project-reports/registry.project.capability_inventory.v1.json b/crates/registryctl/tests/fixtures/project-reports/registry.project.capability_inventory.v1.json new file mode 100644 index 000000000..c37d58bfa --- /dev/null +++ b/crates/registryctl/tests/fixtures/project-reports/registry.project.capability_inventory.v1.json @@ -0,0 +1,185 @@ +{ + "schema_version": "registry.project.capability_inventory.v1", + "evidence_grade": "offline_static", + "runtime_activation": "not_evaluated", + "capabilities": [ + { + "capability": "source_http", + "kind": "source", + "owner": "registryctl", + "maturity": "release_gated", + "supported_versions": ["project_authoring_v1", "relay_integration_pack_v1"], + "installed_release": "compiled", + "installed_evidence": "embedded_compiler", + "project_declaration": "declared", + "environment_enablement": "enabled", + "used_by": {"services": 1, "consultations": 1, "claims": 0, "total": 2}, + "disposition": "used" + }, + { + "capability": "source_script", + "kind": "source", + "owner": "registryctl", + "maturity": "release_gated", + "supported_versions": ["project_authoring_v1", "relay_integration_pack_v1"], + "installed_release": "compiled", + "installed_evidence": "embedded_compiler", + "project_declaration": "declared", + "environment_enablement": "enabled", + "used_by": {"services": 0, "consultations": 1, "claims": 1, "total": 2}, + "disposition": "used" + }, + { + "capability": "source_snapshot", + "kind": "source", + "owner": "registryctl", + "maturity": "release_gated", + "supported_versions": ["project_authoring_v1", "relay_integration_pack_v1"], + "installed_release": "compiled", + "installed_evidence": "embedded_compiler", + "project_declaration": "declared", + "environment_enablement": "not_enabled", + "used_by": {"services": 0, "consultations": 0, "claims": 0, "total": 0}, + "disposition": "declared_inactive" + }, + { + "capability": "rhai_runtime", + "kind": "runtime", + "owner": "registry_relay", + "maturity": "release_gated", + "supported_versions": ["rhai_language_v1"], + "installed_release": "compiled", + "installed_evidence": "linked_crate", + "project_declaration": "not_applicable", + "environment_enablement": "not_applicable", + "used_by": {"services": 0, "consultations": 1, "claims": 1, "total": 2}, + "disposition": "used" + }, + { + "capability": "rhai_abi", + "kind": "abi", + "owner": "registry_relay", + "maturity": "release_gated", + "supported_versions": ["rhai_xw_v1"], + "installed_release": "compiled", + "installed_evidence": "linked_crate", + "project_declaration": "not_applicable", + "environment_enablement": "not_applicable", + "used_by": {"services": 0, "consultations": 1, "claims": 1, "total": 2}, + "disposition": "used" + }, + { + "capability": "registry_relay_product", + "kind": "product", + "owner": "registry_relay", + "maturity": "release_gated", + "supported_versions": ["registry_relay_config_v1"], + "installed_release": "compiled", + "installed_evidence": "linked_crate", + "project_declaration": "declared", + "environment_enablement": "enabled", + "used_by": {"services": 1, "consultations": 2, "claims": 0, "total": 3}, + "disposition": "used" + }, + { + "capability": "registry_notary_product", + "kind": "product", + "owner": "registry_notary", + "maturity": "release_gated", + "supported_versions": ["registry_notary_config_v1"], + "installed_release": "compiled", + "installed_evidence": "linked_crate", + "project_declaration": "declared", + "environment_enablement": "enabled", + "used_by": {"services": 0, "consultations": 0, "claims": 1, "total": 1}, + "disposition": "used" + }, + { + "capability": "registry_relay_validator", + "kind": "product_validator", + "owner": "registry_relay", + "maturity": "release_gated", + "supported_versions": ["registry_relay_config_v1"], + "installed_release": "compiled", + "installed_evidence": "linked_product_validator", + "project_declaration": "not_applicable", + "environment_enablement": "not_applicable", + "used_by": {"services": 0, "consultations": 0, "claims": 0, "total": 0}, + "disposition": "installed_unused" + }, + { + "capability": "registry_notary_validator", + "kind": "product_validator", + "owner": "registry_notary", + "maturity": "release_gated", + "supported_versions": ["registry_notary_config_v1"], + "installed_release": "compiled", + "installed_evidence": "linked_product_validator", + "project_declaration": "not_applicable", + "environment_enablement": "not_applicable", + "used_by": {"services": 0, "consultations": 0, "claims": 0, "total": 0}, + "disposition": "installed_unused" + }, + { + "capability": "project_authoring_schemas", + "kind": "schema", + "owner": "registryctl", + "maturity": "release_gated", + "supported_versions": ["project_authoring_v1"], + "installed_release": "compiled", + "installed_evidence": "embedded_schema", + "project_declaration": "not_applicable", + "environment_enablement": "not_applicable", + "used_by": {"services": 0, "consultations": 0, "claims": 0, "total": 0}, + "disposition": "installed_unused" + }, + { + "capability": "registry_relay_config_schema", + "kind": "schema", + "owner": "registry_relay", + "maturity": "release_gated", + "supported_versions": ["registry_relay_config_v1"], + "installed_release": "compiled", + "installed_evidence": "embedded_schema", + "project_declaration": "not_applicable", + "environment_enablement": "not_applicable", + "used_by": {"services": 0, "consultations": 0, "claims": 0, "total": 0}, + "disposition": "installed_unused" + }, + { + "capability": "registry_notary_config_schema", + "kind": "schema", + "owner": "registry_notary", + "maturity": "release_gated", + "supported_versions": ["registry_notary_config_v1"], + "installed_release": "compiled", + "installed_evidence": "embedded_schema", + "project_declaration": "not_applicable", + "environment_enablement": "not_applicable", + "used_by": {"services": 0, "consultations": 0, "claims": 0, "total": 0}, + "disposition": "installed_unused" + } + ], + "support": [ + {"component": "http_source_worker", "kind": "worker", "owner": "registry_relay", "state": "available", "evidence": "linked_crate", "required_by": ["source_http"]}, + {"component": "rhai_script_worker", "kind": "worker", "owner": "registry_relay", "state": "available", "evidence": "linked_crate", "required_by": ["source_script", "rhai_runtime"]}, + {"component": "snapshot_materialization_worker", "kind": "worker", "owner": "registry_relay", "state": "missing", "evidence": "explicitly_missing", "required_by": ["source_snapshot"]}, + {"component": "rhai_xw_protocol_helper", "kind": "protocol_helper", "owner": "registry_relay", "state": "available", "evidence": "linked_crate", "required_by": ["source_script", "rhai_abi"]}, + {"component": "registry_relay_product", "kind": "product", "owner": "registry_relay", "state": "available", "evidence": "linked_crate", "required_by": ["source_http", "source_script", "source_snapshot", "registry_relay_product"]}, + {"component": "registry_notary_product", "kind": "product", "owner": "registry_notary", "state": "available", "evidence": "linked_crate", "required_by": ["registry_notary_product"]}, + {"component": "registry_relay_validator", "kind": "product_validator", "owner": "registry_relay", "state": "available", "evidence": "linked_product_validator", "required_by": ["registry_relay_product"]}, + {"component": "registry_notary_validator", "kind": "product_validator", "owner": "registry_notary", "state": "available", "evidence": "linked_product_validator", "required_by": ["registry_notary_product"]}, + {"component": "project_authoring_schema", "kind": "schema", "owner": "registryctl", "state": "available", "evidence": "embedded_schema", "required_by": ["source_http", "source_script", "source_snapshot"]}, + {"component": "registry_relay_config_schema", "kind": "schema", "owner": "registry_relay", "state": "available", "evidence": "embedded_schema", "required_by": ["registry_relay_product"]}, + {"component": "registry_notary_config_schema", "kind": "schema", "owner": "registry_notary", "state": "available", "evidence": "embedded_schema", "required_by": ["registry_notary_product"]}, + {"component": "registryctl_distribution", "kind": "distribution", "owner": "release_engineering", "state": "available", "evidence": "release_metadata", "required_by": ["source_http", "source_script", "source_snapshot", "project_authoring_schemas"]}, + {"component": "registry_relay_image", "kind": "image", "owner": "release_engineering", "state": "not_evaluated", "evidence": "no_evidence", "required_by": ["registry_relay_product"]}, + {"component": "registry_notary_image", "kind": "image", "owner": "release_engineering", "state": "not_evaluated", "evidence": "no_evidence", "required_by": ["registry_notary_product"]} + ], + "missing_support": [ + {"component": "snapshot_materialization_worker", "kind": "worker", "state": "missing", "required_by": ["source_snapshot"]} + ], + "inactive_or_unused": [ + {"capability": "source_snapshot", "reason": "declared_not_enabled"} + ] +} diff --git a/crates/registryctl/tests/fixtures/project-reports/registry.project.explanation.v1.json b/crates/registryctl/tests/fixtures/project-reports/registry.project.explanation.v1.json new file mode 100644 index 000000000..86269c50a --- /dev/null +++ b/crates/registryctl/tests/fixtures/project-reports/registry.project.explanation.v1.json @@ -0,0 +1,146 @@ +{ + "schema_version": "registry.project.explanation.v1", + "project": "fictional-citizen-registry", + "environment": "local", + "fields": [ + { + "address": { + "document": "integration", + "integration": "person-record", + "path": "/http/request/timeout" + }, + "source": { + "kind": "defaulted", + "semantic_rule_id": "registryctl.integration.http.timeout.default" + }, + "state": { + "presence": "defaulted", + "effect": "effective" + }, + "default": { + "source": "semantic_rule", + "applied": true, + "reported_value": { + "state": "public", + "value": "5s" + } + }, + "constraints": { + "schema_refs": [ + { + "schema": "integration", + "path": "/$defs/http_request/properties/timeout" + } + ], + "semantic_rule_ids": [ + "registryctl.integration.http.timeout.bounded" + ] + }, + "knowledge": { + "path_kind": "property", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "sensitivity": "public", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "introduced_in": "0.13.0", + "availability": "published", + "stability": "stable", + "migration": "rebuild_project", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only" + ] + }, + "reported_value": { + "state": "public", + "value": "5s" + } + }, + { + "address": { + "document": "environment", + "environment": "local", + "path": "/integrations/person-record/source/credential" + }, + "source": { + "kind": "authored", + "address": { + "document": "environment", + "environment": "local", + "path": "/integrations/person-record/source/credential" + } + }, + "state": { + "presence": "environment_bound", + "effect": "effective" + }, + "constraints": { + "schema_refs": [ + { + "schema": "environment", + "path": "/$defs/source_binding/properties/credential" + } + ], + "semantic_rule_ids": [ + "registryctl.environment.credential.compatible" + ] + }, + "knowledge": { + "path_kind": "property", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "sensitivity": "secret_reference", + "products": [ + "registryctl", + "relay" + ], + "introduced_in": "0.13.0", + "availability": "published", + "stability": "stable", + "migration": "coordinate_deployment", + "consumers": [ + "registryctl_authoring", + "registry_relay" + ], + "generated_artifacts": [ + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "security", + "relay" + ], + "semantic_rules": [ + "secret_never_reportable", + "sensitive_operational_metadata" + ] + }, + "reported_value": { + "state": "redacted", + "classification": "secret_reference", + "reason": "sensitive_metadata" + } + } + ] +} diff --git a/crates/registryctl/tests/fixtures/project-reports/registry.project.fixture_coverage.no-target.v1.json b/crates/registryctl/tests/fixtures/project-reports/registry.project.fixture_coverage.no-target.v1.json new file mode 100644 index 000000000..728da2c70 --- /dev/null +++ b/crates/registryctl/tests/fixtures/project-reports/registry.project.fixture_coverage.no-target.v1.json @@ -0,0 +1,23 @@ +{ + "schema_version": "registry.project.fixture_coverage.v1", + "project": "fictional-records-registry", + "environment": null, + "evidence_scope": "offline_synthetic", + "compatibility_claim": "none", + "live_compatibility": "not_evaluated", + "governed_request_evidence": "per_consultation_authored_request_witness_evaluation", + "targets": [], + "summary": { + "target_set_state": "no_targets", + "target_count": 0, + "fixture_bearing_target_count": 0, + "fixtureless_target_count": 0, + "requirements": { + "covered": 0, + "missing": 0, + "not_applicable": 0, + "not_evaluated": 0, + "total": 0 + } + } +} diff --git a/crates/registryctl/tests/fixtures/project-reports/registry.project.fixture_coverage.v1.json b/crates/registryctl/tests/fixtures/project-reports/registry.project.fixture_coverage.v1.json new file mode 100644 index 000000000..16bf73949 --- /dev/null +++ b/crates/registryctl/tests/fixtures/project-reports/registry.project.fixture_coverage.v1.json @@ -0,0 +1,1344 @@ +{ + "schema_version": "registry.project.fixture_coverage.v1", + "project": "fictional-citizen-registry", + "environment": null, + "evidence_scope": "offline_synthetic", + "compatibility_claim": "none", + "live_compatibility": "not_evaluated", + "governed_request_evidence": "per_consultation_authored_request_witness_evaluation", + "targets": [ + { + "identity": { + "integration": "person-record", + "capability": "declarative_http" + }, + "contract": { + "source_operation_count": 1, + "reviewed_not_applicable": [ + "subject_mismatch" + ], + "registry_backed_consultations": [ + { + "service_id": "person-verification", + "consultation_id": "person_record" + } + ] + }, + "fixture_set_state": "fixture_bearing", + "compiled_contract": { + "kind": "compiled_contract", + "id": "target/person-record/compiled-contract/v1", + "digest": "sha256:f1b7c3c4a2ece745e634cfdc0c4507f7058fd7650fba342b8f8463e12dd8aea8" + }, + "fixture_inventory": [ + { + "evidence": { + "kind": "authored_fixture", + "id": "target/person-record/fixture/active-person", + "digest": "sha256:4f0b0afa2cd1ac597e2d55a6bef4accee4549e7b74520fd23df10dde2fc02fc3" + }, + "fixture_id": "active-person", + "fixture_digest": "sha256:4f0b0afa2cd1ac597e2d55a6bef4accee4549e7b74520fd23df10dde2fc02fc3", + "expectation": { + "kind": "outcome", + "outcome": "match" + }, + "semantic_null": false, + "interaction_count": 1, + "input_ids": [ + "person_id" + ], + "output_ids": [ + "active" + ], + "claim_ids": [ + "person-active", + "person-record-exists" + ], + "exercised_status_mappings": [], + "classification": "synthetic", + "pass_state": "passed", + "request_to_consultation_binding": { + "state": "passed", + "consultations": [ + { + "service_id": "person-verification", + "consultation_id": "person_record" + } + ], + "actual_relay_consultations": 1, + "safe_error_code": null + } + }, + { + "evidence": { + "kind": "authored_fixture", + "id": "target/person-record/fixture/ambiguous-person", + "digest": "sha256:6a375aa916a0b6b8dba04702b50cd7b1ec600063073c64881a9b62c31f16f232" + }, + "fixture_id": "ambiguous-person", + "fixture_digest": "sha256:6a375aa916a0b6b8dba04702b50cd7b1ec600063073c64881a9b62c31f16f232", + "expectation": { + "kind": "outcome", + "outcome": "ambiguous" + }, + "semantic_null": false, + "interaction_count": 1, + "input_ids": [ + "person_id" + ], + "output_ids": [], + "claim_ids": [], + "exercised_status_mappings": [ + { + "outcome": "ambiguous", + "statuses": [ + 409 + ] + } + ], + "classification": "synthetic", + "pass_state": "passed", + "request_to_consultation_binding": { + "state": "not_authored", + "consultations": [], + "actual_relay_consultations": null, + "safe_error_code": null + } + }, + { + "evidence": { + "kind": "authored_fixture", + "id": "target/person-record/fixture/no-person", + "digest": "sha256:f7968b31cee08af79d6160e1a3bb99fdc4962fcfc7ccd13b92fe35f0d87367a5" + }, + "fixture_id": "no-person", + "fixture_digest": "sha256:f7968b31cee08af79d6160e1a3bb99fdc4962fcfc7ccd13b92fe35f0d87367a5", + "expectation": { + "kind": "outcome", + "outcome": "no_match" + }, + "semantic_null": true, + "interaction_count": 1, + "input_ids": [ + "person_id" + ], + "output_ids": [], + "claim_ids": [ + "person-active", + "person-record-exists" + ], + "exercised_status_mappings": [ + { + "outcome": "no_match", + "statuses": [ + 404 + ] + } + ], + "classification": "synthetic", + "pass_state": "passed", + "request_to_consultation_binding": { + "state": "not_authored", + "consultations": [], + "actual_relay_consultations": null, + "safe_error_code": null + } + } + ], + "generated_cases": [ + { + "evidence": { + "kind": "generated_case", + "id": "target/person-record/fixture/active-person/generated/request_authority/v1", + "digest": "sha256:691232c9fff919e9dd9f361be7b141a07cd9fc56a0864d40a9c5decf6719ed85" + }, + "recipe": { + "id": "request_authority", + "version": "v1" + }, + "source_fixture": { + "fixture_id": "active-person", + "fixture_digest": "sha256:4f0b0afa2cd1ac597e2d55a6bef4accee4549e7b74520fd23df10dde2fc02fc3" + }, + "applicability": { + "state": "applicable" + }, + "mutation_target_class": "request_path_authority", + "expected_safe_code": "fixture.request_mismatch", + "actual_safe_code": "fixture.request_mismatch", + "pass_state": "passed", + "source_access_assertion": null + }, + { + "evidence": { + "kind": "generated_case", + "id": "target/person-record/fixture/active-person/generated/request_order/v1", + "digest": "sha256:1b714bff4811578892f09bd3fe3fe79c634b2fed0c470984f25d373d679cce8c" + }, + "recipe": { + "id": "request_order", + "version": "v1" + }, + "source_fixture": { + "fixture_id": "active-person", + "fixture_digest": "sha256:4f0b0afa2cd1ac597e2d55a6bef4accee4549e7b74520fd23df10dde2fc02fc3" + }, + "applicability": { + "state": "not_applicable", + "reason": "single_source_interaction", + "invariant": "order_mutation_requires_multiple_source_interactions" + }, + "mutation_target_class": "request_interaction_order", + "expected_safe_code": "fixture.request_mismatch", + "actual_safe_code": null, + "pass_state": "not_executed", + "source_access_assertion": null + }, + { + "evidence": { + "kind": "generated_case", + "id": "target/person-record/fixture/active-person/generated/status_rejection/v1", + "digest": "sha256:365e50a447ad14ef0ad14689f569acc4f8c935e03fa85a6fe18f07f64666c451" + }, + "recipe": { + "id": "status_rejection", + "version": "v1" + }, + "source_fixture": { + "fixture_id": "active-person", + "fixture_digest": "sha256:4f0b0afa2cd1ac597e2d55a6bef4accee4549e7b74520fd23df10dde2fc02fc3" + }, + "applicability": { + "state": "applicable" + }, + "mutation_target_class": "source_status", + "expected_safe_code": "source.status_rejected", + "actual_safe_code": "source.status_rejected", + "pass_state": "passed", + "source_access_assertion": null + }, + { + "evidence": { + "kind": "generated_case", + "id": "target/person-record/fixture/active-person/generated/malformed_decode/v1", + "digest": "sha256:00a9b0010878b27345c9ce26b7d2089c21312749ccedfaa98849d97ced748765" + }, + "recipe": { + "id": "malformed_decode", + "version": "v1" + }, + "source_fixture": { + "fixture_id": "active-person", + "fixture_digest": "sha256:4f0b0afa2cd1ac597e2d55a6bef4accee4549e7b74520fd23df10dde2fc02fc3" + }, + "applicability": { + "state": "applicable" + }, + "mutation_target_class": "response_body_decoding", + "expected_safe_code": "source.response_malformed", + "actual_safe_code": "source.response_malformed", + "pass_state": "passed", + "source_access_assertion": null + }, + { + "evidence": { + "kind": "generated_case", + "id": "target/person-record/fixture/active-person/generated/byte_ceiling/v1", + "digest": "sha256:1111c0c5d0542692d8c3efe821e719ee1235654102af5a399ee1da2b4167691e" + }, + "recipe": { + "id": "byte_ceiling", + "version": "v1" + }, + "source_fixture": { + "fixture_id": "active-person", + "fixture_digest": "sha256:4f0b0afa2cd1ac597e2d55a6bef4accee4549e7b74520fd23df10dde2fc02fc3" + }, + "applicability": { + "state": "applicable" + }, + "mutation_target_class": "declared_response_byte_count", + "expected_safe_code": "source.response_too_large", + "actual_safe_code": "source.response_too_large", + "pass_state": "passed", + "source_access_assertion": null + }, + { + "evidence": { + "kind": "generated_case", + "id": "target/person-record/fixture/active-person/generated/timeout/v1", + "digest": "sha256:b491ba87e856a5f652fdef4077861a1cc2c95cca45029856eb72e28a6b0c06e1" + }, + "recipe": { + "id": "timeout", + "version": "v1" + }, + "source_fixture": { + "fixture_id": "active-person", + "fixture_digest": "sha256:4f0b0afa2cd1ac597e2d55a6bef4accee4549e7b74520fd23df10dde2fc02fc3" + }, + "applicability": { + "state": "applicable" + }, + "mutation_target_class": "source_deadline", + "expected_safe_code": "source.deadline_exceeded", + "actual_safe_code": "source.deadline_exceeded", + "pass_state": "passed", + "source_access_assertion": null + }, + { + "evidence": { + "kind": "generated_case", + "id": "target/person-record/fixture/active-person/generated/protocol_verification/v1", + "digest": "sha256:891f622340293bffcd8ef3b6f46e45657b194b5b3be228f37054f57655f38b0c" + }, + "recipe": { + "id": "protocol_verification", + "version": "v1" + }, + "source_fixture": { + "fixture_id": "active-person", + "fixture_digest": "sha256:4f0b0afa2cd1ac597e2d55a6bef4accee4549e7b74520fd23df10dde2fc02fc3" + }, + "applicability": { + "state": "not_applicable", + "reason": "no_generated_request_matcher", + "invariant": "protocol_mutation_requires_generated_request_matcher" + }, + "mutation_target_class": "protocol_response_envelope", + "expected_safe_code": "source.response_malformed", + "actual_safe_code": null, + "pass_state": "not_executed", + "source_access_assertion": null + }, + { + "evidence": { + "kind": "generated_case", + "id": "target/person-record/fixture/active-person/generated/authorization_before_source/v1", + "digest": "sha256:2d5485575a39c37edec432a39f1d2ba08be39c45cc38e55c1dd1e4a75dccb74a" + }, + "recipe": { + "id": "authorization_before_source", + "version": "v1" + }, + "source_fixture": { + "fixture_id": "active-person", + "fixture_digest": "sha256:4f0b0afa2cd1ac597e2d55a6bef4accee4549e7b74520fd23df10dde2fc02fc3" + }, + "applicability": { + "state": "applicable" + }, + "mutation_target_class": "authorization_gate", + "expected_safe_code": "authorization.denied", + "actual_safe_code": "authorization.denied", + "pass_state": "passed", + "source_access_assertion": { + "expected_source_calls": "zero", + "actual_source_calls": 0, + "passed": true + } + }, + { + "evidence": { + "kind": "generated_case", + "id": "target/person-record/fixture/active-person/generated/output_minimization/v1", + "digest": "sha256:dc7c3bbc4489276a37f90f03591ce9cd3e568ad11d2244e1fcb2b3381463c8f0" + }, + "recipe": { + "id": "output_minimization", + "version": "v1" + }, + "source_fixture": { + "fixture_id": "active-person", + "fixture_digest": "sha256:4f0b0afa2cd1ac597e2d55a6bef4accee4549e7b74520fd23df10dde2fc02fc3" + }, + "applicability": { + "state": "applicable" + }, + "mutation_target_class": "unselected_response_member", + "expected_safe_code": null, + "actual_safe_code": null, + "pass_state": "passed", + "source_access_assertion": null + }, + { + "evidence": { + "kind": "generated_case", + "id": "target/person-record/fixture/ambiguous-person/generated/request_authority/v1", + "digest": "sha256:37104336a5fc0b48e66157167df95bd3be54a5c83ecb7a2fce1c4a62223974a7" + }, + "recipe": { + "id": "request_authority", + "version": "v1" + }, + "source_fixture": { + "fixture_id": "ambiguous-person", + "fixture_digest": "sha256:6a375aa916a0b6b8dba04702b50cd7b1ec600063073c64881a9b62c31f16f232" + }, + "applicability": { + "state": "applicable" + }, + "mutation_target_class": "request_path_authority", + "expected_safe_code": "fixture.request_mismatch", + "actual_safe_code": "fixture.request_mismatch", + "pass_state": "passed", + "source_access_assertion": null + }, + { + "evidence": { + "kind": "generated_case", + "id": "target/person-record/fixture/ambiguous-person/generated/request_order/v1", + "digest": "sha256:db7f52d696a31e99b6fb7770b67af97658e13d433e8be67a4e17a7a803b8ae00" + }, + "recipe": { + "id": "request_order", + "version": "v1" + }, + "source_fixture": { + "fixture_id": "ambiguous-person", + "fixture_digest": "sha256:6a375aa916a0b6b8dba04702b50cd7b1ec600063073c64881a9b62c31f16f232" + }, + "applicability": { + "state": "not_applicable", + "reason": "single_source_interaction", + "invariant": "order_mutation_requires_multiple_source_interactions" + }, + "mutation_target_class": "request_interaction_order", + "expected_safe_code": "fixture.request_mismatch", + "actual_safe_code": null, + "pass_state": "not_executed", + "source_access_assertion": null + }, + { + "evidence": { + "kind": "generated_case", + "id": "target/person-record/fixture/ambiguous-person/generated/status_rejection/v1", + "digest": "sha256:17c91679f0bcafb1d73a632361167111fe3adc821d7362b5f73d57cc8e646aec" + }, + "recipe": { + "id": "status_rejection", + "version": "v1" + }, + "source_fixture": { + "fixture_id": "ambiguous-person", + "fixture_digest": "sha256:6a375aa916a0b6b8dba04702b50cd7b1ec600063073c64881a9b62c31f16f232" + }, + "applicability": { + "state": "applicable" + }, + "mutation_target_class": "source_status", + "expected_safe_code": "source.status_rejected", + "actual_safe_code": "source.status_rejected", + "pass_state": "passed", + "source_access_assertion": null + }, + { + "evidence": { + "kind": "generated_case", + "id": "target/person-record/fixture/ambiguous-person/generated/malformed_decode/v1", + "digest": "sha256:16358fa165c4d86fb69c57c9fbb1d47db083b933ac7c449a47ac03a2b3a722a1" + }, + "recipe": { + "id": "malformed_decode", + "version": "v1" + }, + "source_fixture": { + "fixture_id": "ambiguous-person", + "fixture_digest": "sha256:6a375aa916a0b6b8dba04702b50cd7b1ec600063073c64881a9b62c31f16f232" + }, + "applicability": { + "state": "applicable" + }, + "mutation_target_class": "response_body_decoding", + "expected_safe_code": "source.response_malformed", + "actual_safe_code": "source.response_malformed", + "pass_state": "passed", + "source_access_assertion": null + }, + { + "evidence": { + "kind": "generated_case", + "id": "target/person-record/fixture/ambiguous-person/generated/byte_ceiling/v1", + "digest": "sha256:cdfe77bfe9fa27c36bc01f6e9635a1dd593990153c8010657f87fbf8760a36f2" + }, + "recipe": { + "id": "byte_ceiling", + "version": "v1" + }, + "source_fixture": { + "fixture_id": "ambiguous-person", + "fixture_digest": "sha256:6a375aa916a0b6b8dba04702b50cd7b1ec600063073c64881a9b62c31f16f232" + }, + "applicability": { + "state": "applicable" + }, + "mutation_target_class": "declared_response_byte_count", + "expected_safe_code": "source.response_too_large", + "actual_safe_code": "source.response_too_large", + "pass_state": "passed", + "source_access_assertion": null + }, + { + "evidence": { + "kind": "generated_case", + "id": "target/person-record/fixture/ambiguous-person/generated/timeout/v1", + "digest": "sha256:aa73c4fe1667260942dd69968f60973cd0a19dbdde38b991fafb89ef288fbc01" + }, + "recipe": { + "id": "timeout", + "version": "v1" + }, + "source_fixture": { + "fixture_id": "ambiguous-person", + "fixture_digest": "sha256:6a375aa916a0b6b8dba04702b50cd7b1ec600063073c64881a9b62c31f16f232" + }, + "applicability": { + "state": "applicable" + }, + "mutation_target_class": "source_deadline", + "expected_safe_code": "source.deadline_exceeded", + "actual_safe_code": "source.deadline_exceeded", + "pass_state": "passed", + "source_access_assertion": null + }, + { + "evidence": { + "kind": "generated_case", + "id": "target/person-record/fixture/ambiguous-person/generated/protocol_verification/v1", + "digest": "sha256:5a891e5db4eaa349bc1f03f1548fa6759078b953629eea15e2821350d26cf945" + }, + "recipe": { + "id": "protocol_verification", + "version": "v1" + }, + "source_fixture": { + "fixture_id": "ambiguous-person", + "fixture_digest": "sha256:6a375aa916a0b6b8dba04702b50cd7b1ec600063073c64881a9b62c31f16f232" + }, + "applicability": { + "state": "not_applicable", + "reason": "no_generated_request_matcher", + "invariant": "protocol_mutation_requires_generated_request_matcher" + }, + "mutation_target_class": "protocol_response_envelope", + "expected_safe_code": "source.response_malformed", + "actual_safe_code": null, + "pass_state": "not_executed", + "source_access_assertion": null + }, + { + "evidence": { + "kind": "generated_case", + "id": "target/person-record/fixture/ambiguous-person/generated/authorization_before_source/v1", + "digest": "sha256:9c96a3b1b8bb205e135572dee4d2f82d689482ef642eb83f498d8e14c115ad4f" + }, + "recipe": { + "id": "authorization_before_source", + "version": "v1" + }, + "source_fixture": { + "fixture_id": "ambiguous-person", + "fixture_digest": "sha256:6a375aa916a0b6b8dba04702b50cd7b1ec600063073c64881a9b62c31f16f232" + }, + "applicability": { + "state": "applicable" + }, + "mutation_target_class": "authorization_gate", + "expected_safe_code": "authorization.denied", + "actual_safe_code": "authorization.denied", + "pass_state": "passed", + "source_access_assertion": { + "expected_source_calls": "zero", + "actual_source_calls": 0, + "passed": true + } + }, + { + "evidence": { + "kind": "generated_case", + "id": "target/person-record/fixture/ambiguous-person/generated/output_minimization/v1", + "digest": "sha256:2b5e0499735227031d349d9c8ba7b2ccf070228e2ecbdfc97f1632b2352eb7c2" + }, + "recipe": { + "id": "output_minimization", + "version": "v1" + }, + "source_fixture": { + "fixture_id": "ambiguous-person", + "fixture_digest": "sha256:6a375aa916a0b6b8dba04702b50cd7b1ec600063073c64881a9b62c31f16f232" + }, + "applicability": { + "state": "applicable" + }, + "mutation_target_class": "unselected_response_member", + "expected_safe_code": null, + "actual_safe_code": null, + "pass_state": "passed", + "source_access_assertion": null + }, + { + "evidence": { + "kind": "generated_case", + "id": "target/person-record/fixture/no-person/generated/request_authority/v1", + "digest": "sha256:e7ae1794d2cca59818de6b3baf66439dca503d79b6f3196e887956f552ee4881" + }, + "recipe": { + "id": "request_authority", + "version": "v1" + }, + "source_fixture": { + "fixture_id": "no-person", + "fixture_digest": "sha256:f7968b31cee08af79d6160e1a3bb99fdc4962fcfc7ccd13b92fe35f0d87367a5" + }, + "applicability": { + "state": "applicable" + }, + "mutation_target_class": "request_path_authority", + "expected_safe_code": "fixture.request_mismatch", + "actual_safe_code": "fixture.request_mismatch", + "pass_state": "passed", + "source_access_assertion": null + }, + { + "evidence": { + "kind": "generated_case", + "id": "target/person-record/fixture/no-person/generated/request_order/v1", + "digest": "sha256:547b5db1d96930b17a4d855f9c699cddac23120d9c44c86b9ea9d829f91fd315" + }, + "recipe": { + "id": "request_order", + "version": "v1" + }, + "source_fixture": { + "fixture_id": "no-person", + "fixture_digest": "sha256:f7968b31cee08af79d6160e1a3bb99fdc4962fcfc7ccd13b92fe35f0d87367a5" + }, + "applicability": { + "state": "not_applicable", + "reason": "single_source_interaction", + "invariant": "order_mutation_requires_multiple_source_interactions" + }, + "mutation_target_class": "request_interaction_order", + "expected_safe_code": "fixture.request_mismatch", + "actual_safe_code": null, + "pass_state": "not_executed", + "source_access_assertion": null + }, + { + "evidence": { + "kind": "generated_case", + "id": "target/person-record/fixture/no-person/generated/status_rejection/v1", + "digest": "sha256:8bd1e632702cdf10d2841bce8527e2593858cdc0e46611a86f2199737e9829ae" + }, + "recipe": { + "id": "status_rejection", + "version": "v1" + }, + "source_fixture": { + "fixture_id": "no-person", + "fixture_digest": "sha256:f7968b31cee08af79d6160e1a3bb99fdc4962fcfc7ccd13b92fe35f0d87367a5" + }, + "applicability": { + "state": "applicable" + }, + "mutation_target_class": "source_status", + "expected_safe_code": "source.status_rejected", + "actual_safe_code": "source.status_rejected", + "pass_state": "passed", + "source_access_assertion": null + }, + { + "evidence": { + "kind": "generated_case", + "id": "target/person-record/fixture/no-person/generated/malformed_decode/v1", + "digest": "sha256:560c723752d29a94f56203a1593bad292684cc7bde7420185da4191c0a400c26" + }, + "recipe": { + "id": "malformed_decode", + "version": "v1" + }, + "source_fixture": { + "fixture_id": "no-person", + "fixture_digest": "sha256:f7968b31cee08af79d6160e1a3bb99fdc4962fcfc7ccd13b92fe35f0d87367a5" + }, + "applicability": { + "state": "applicable" + }, + "mutation_target_class": "response_body_decoding", + "expected_safe_code": "source.response_malformed", + "actual_safe_code": "source.response_malformed", + "pass_state": "passed", + "source_access_assertion": null + }, + { + "evidence": { + "kind": "generated_case", + "id": "target/person-record/fixture/no-person/generated/byte_ceiling/v1", + "digest": "sha256:9413c3591793f33e81592d852cea1e4e5b52407457d642f95b6b8d9366ac7510" + }, + "recipe": { + "id": "byte_ceiling", + "version": "v1" + }, + "source_fixture": { + "fixture_id": "no-person", + "fixture_digest": "sha256:f7968b31cee08af79d6160e1a3bb99fdc4962fcfc7ccd13b92fe35f0d87367a5" + }, + "applicability": { + "state": "applicable" + }, + "mutation_target_class": "declared_response_byte_count", + "expected_safe_code": "source.response_too_large", + "actual_safe_code": "source.response_too_large", + "pass_state": "passed", + "source_access_assertion": null + }, + { + "evidence": { + "kind": "generated_case", + "id": "target/person-record/fixture/no-person/generated/timeout/v1", + "digest": "sha256:43b0454a34a0c5cdce6d6003d609004047ecfa7308fce2fcdfcb2b1a98fa8516" + }, + "recipe": { + "id": "timeout", + "version": "v1" + }, + "source_fixture": { + "fixture_id": "no-person", + "fixture_digest": "sha256:f7968b31cee08af79d6160e1a3bb99fdc4962fcfc7ccd13b92fe35f0d87367a5" + }, + "applicability": { + "state": "applicable" + }, + "mutation_target_class": "source_deadline", + "expected_safe_code": "source.deadline_exceeded", + "actual_safe_code": "source.deadline_exceeded", + "pass_state": "passed", + "source_access_assertion": null + }, + { + "evidence": { + "kind": "generated_case", + "id": "target/person-record/fixture/no-person/generated/protocol_verification/v1", + "digest": "sha256:023a5c16d404902ae161f2d76688c74841afc120790831ccb6f6ec2e9c6f0a13" + }, + "recipe": { + "id": "protocol_verification", + "version": "v1" + }, + "source_fixture": { + "fixture_id": "no-person", + "fixture_digest": "sha256:f7968b31cee08af79d6160e1a3bb99fdc4962fcfc7ccd13b92fe35f0d87367a5" + }, + "applicability": { + "state": "not_applicable", + "reason": "no_generated_request_matcher", + "invariant": "protocol_mutation_requires_generated_request_matcher" + }, + "mutation_target_class": "protocol_response_envelope", + "expected_safe_code": "source.response_malformed", + "actual_safe_code": null, + "pass_state": "not_executed", + "source_access_assertion": null + }, + { + "evidence": { + "kind": "generated_case", + "id": "target/person-record/fixture/no-person/generated/authorization_before_source/v1", + "digest": "sha256:32f15ede7285f1271d842c7d9a1cd1e9e5906fb0c5a16d1173a49849b117737e" + }, + "recipe": { + "id": "authorization_before_source", + "version": "v1" + }, + "source_fixture": { + "fixture_id": "no-person", + "fixture_digest": "sha256:f7968b31cee08af79d6160e1a3bb99fdc4962fcfc7ccd13b92fe35f0d87367a5" + }, + "applicability": { + "state": "applicable" + }, + "mutation_target_class": "authorization_gate", + "expected_safe_code": "authorization.denied", + "actual_safe_code": "authorization.denied", + "pass_state": "passed", + "source_access_assertion": { + "expected_source_calls": "zero", + "actual_source_calls": 0, + "passed": true + } + }, + { + "evidence": { + "kind": "generated_case", + "id": "target/person-record/fixture/no-person/generated/output_minimization/v1", + "digest": "sha256:ba70efd09852298f5635cf140ecc7ea8ea077b54c83620a57d486ab2f0b2a19f" + }, + "recipe": { + "id": "output_minimization", + "version": "v1" + }, + "source_fixture": { + "fixture_id": "no-person", + "fixture_digest": "sha256:f7968b31cee08af79d6160e1a3bb99fdc4962fcfc7ccd13b92fe35f0d87367a5" + }, + "applicability": { + "state": "applicable" + }, + "mutation_target_class": "unselected_response_member", + "expected_safe_code": null, + "actual_safe_code": null, + "pass_state": "passed", + "source_access_assertion": null + } + ], + "platform_cases": [], + "declared": { + "input_ids": [ + "person_id" + ], + "output_ids": [ + "active" + ], + "claim_ids": [ + "person-active", + "person-record-exists" + ], + "disclosure_modes": [ + "predicate", + "value" + ], + "status_mappings": [ + { + "outcome": "ambiguous", + "statuses": [ + 409 + ] + }, + { + "outcome": "no_match", + "statuses": [ + 404 + ] + } + ], + "protocol_helpers": [], + "limits": [ + "aggregate_source_bytes", + "call_count", + "deadline", + "output_bytes", + "request_bytes", + "response_bytes" + ], + "script_branch_ids": [] + }, + "exercised": { + "input_ids": [ + "person_id" + ], + "output_ids": [ + "active" + ], + "claim_ids": [ + "person-active", + "person-record-exists" + ], + "disclosure_modes": [], + "status_mappings": [ + { + "outcome": "ambiguous", + "statuses": [ + 409 + ] + }, + { + "outcome": "no_match", + "statuses": [ + 404 + ] + } + ], + "protocol_helpers": [], + "limits": [ + "deadline", + "response_bytes" + ], + "script_branch_ids": [] + }, + "comparison": null, + "requirements": [ + { + "state": "covered", + "requirement": "semantic_match", + "evidence": [ + { + "kind": "authored_fixture", + "id": "target/person-record/fixture/active-person", + "digest": "sha256:4f0b0afa2cd1ac597e2d55a6bef4accee4549e7b74520fd23df10dde2fc02fc3" + } + ] + }, + { + "state": "covered", + "requirement": "semantic_no_match", + "evidence": [ + { + "kind": "authored_fixture", + "id": "target/person-record/fixture/no-person", + "digest": "sha256:f7968b31cee08af79d6160e1a3bb99fdc4962fcfc7ccd13b92fe35f0d87367a5" + } + ] + }, + { + "state": "covered", + "requirement": "semantic_ambiguity", + "evidence": [ + { + "kind": "authored_fixture", + "id": "target/person-record/fixture/ambiguous-person", + "digest": "sha256:6a375aa916a0b6b8dba04702b50cd7b1ec600063073c64881a9b62c31f16f232" + } + ] + }, + { + "state": "not_applicable", + "requirement": "subject_mismatch", + "reason": "reviewed_subject_mismatch_not_applicable", + "evidence": [ + { + "kind": "compiled_contract", + "id": "target/person-record/compiled-contract/v1", + "digest": "sha256:f1b7c3c4a2ece745e634cfdc0c4507f7058fd7650fba342b8f8463e12dd8aea8" + } + ] + }, + { + "state": "covered", + "requirement": "semantic_null", + "evidence": [ + { + "kind": "authored_fixture", + "id": "target/person-record/fixture/no-person", + "digest": "sha256:f7968b31cee08af79d6160e1a3bb99fdc4962fcfc7ccd13b92fe35f0d87367a5" + } + ] + }, + { + "state": "missing", + "requirement": "authorization_denial", + "reason": "required_evidence_missing", + "evidence": [] + }, + { + "state": "missing", + "requirement": "source_failure", + "reason": "required_evidence_missing", + "evidence": [] + }, + { + "state": "covered", + "requirement": "request_rendering", + "evidence": [ + { + "kind": "generated_case", + "id": "target/person-record/fixture/active-person/generated/request_authority/v1", + "digest": "sha256:691232c9fff919e9dd9f361be7b141a07cd9fc56a0864d40a9c5decf6719ed85" + }, + { + "kind": "generated_case", + "id": "target/person-record/fixture/ambiguous-person/generated/request_authority/v1", + "digest": "sha256:37104336a5fc0b48e66157167df95bd3be54a5c83ecb7a2fce1c4a62223974a7" + }, + { + "kind": "generated_case", + "id": "target/person-record/fixture/no-person/generated/request_authority/v1", + "digest": "sha256:e7ae1794d2cca59818de6b3baf66439dca503d79b6f3196e887956f552ee4881" + } + ] + }, + { + "state": "covered", + "requirement": "request_to_consultation_binding", + "evidence": [ + { + "kind": "authored_fixture", + "id": "target/person-record/fixture/active-person", + "digest": "sha256:4f0b0afa2cd1ac597e2d55a6bef4accee4549e7b74520fd23df10dde2fc02fc3" + } + ] + }, + { + "state": "covered", + "requirement": "expected_source_interactions", + "evidence": [ + { + "kind": "authored_fixture", + "id": "target/person-record/fixture/active-person", + "digest": "sha256:4f0b0afa2cd1ac597e2d55a6bef4accee4549e7b74520fd23df10dde2fc02fc3" + }, + { + "kind": "authored_fixture", + "id": "target/person-record/fixture/ambiguous-person", + "digest": "sha256:6a375aa916a0b6b8dba04702b50cd7b1ec600063073c64881a9b62c31f16f232" + }, + { + "kind": "authored_fixture", + "id": "target/person-record/fixture/no-person", + "digest": "sha256:f7968b31cee08af79d6160e1a3bb99fdc4962fcfc7ccd13b92fe35f0d87367a5" + } + ] + }, + { + "state": "not_applicable", + "requirement": "source_interaction_order", + "reason": "single_compiled_source_operation", + "evidence": [ + { + "kind": "compiled_contract", + "id": "target/person-record/compiled-contract/v1", + "digest": "sha256:f1b7c3c4a2ece745e634cfdc0c4507f7058fd7650fba342b8f8463e12dd8aea8" + } + ] + }, + { + "state": "covered", + "requirement": "output_fields", + "evidence": [ + { + "kind": "authored_fixture", + "id": "target/person-record/fixture/active-person", + "digest": "sha256:4f0b0afa2cd1ac597e2d55a6bef4accee4549e7b74520fd23df10dde2fc02fc3" + } + ] + }, + { + "state": "covered", + "requirement": "claims", + "evidence": [ + { + "kind": "authored_fixture", + "id": "target/person-record/fixture/active-person", + "digest": "sha256:4f0b0afa2cd1ac597e2d55a6bef4accee4549e7b74520fd23df10dde2fc02fc3" + }, + { + "kind": "authored_fixture", + "id": "target/person-record/fixture/no-person", + "digest": "sha256:f7968b31cee08af79d6160e1a3bb99fdc4962fcfc7ccd13b92fe35f0d87367a5" + } + ] + }, + { + "state": "covered", + "requirement": "declared_disclosure_modes", + "evidence": [ + { + "kind": "compiled_contract", + "id": "target/person-record/compiled-contract/v1", + "digest": "sha256:f1b7c3c4a2ece745e634cfdc0c4507f7058fd7650fba342b8f8463e12dd8aea8" + } + ] + }, + { + "state": "missing", + "requirement": "exercised_disclosure_modes", + "reason": "runtime_dimension_not_observed", + "evidence": [] + }, + { + "state": "not_applicable", + "requirement": "script_branches", + "reason": "no_script_capability", + "evidence": [ + { + "kind": "compiled_contract", + "id": "target/person-record/compiled-contract/v1", + "digest": "sha256:f1b7c3c4a2ece745e634cfdc0c4507f7058fd7650fba342b8f8463e12dd8aea8" + } + ] + }, + { + "state": "not_applicable", + "requirement": "pagination_and_continuation", + "reason": "no_continuation_protocol_declared", + "evidence": [ + { + "kind": "compiled_contract", + "id": "target/person-record/compiled-contract/v1", + "digest": "sha256:f1b7c3c4a2ece745e634cfdc0c4507f7058fd7650fba342b8f8463e12dd8aea8" + } + ] + }, + { + "state": "covered", + "requirement": "status_mappings", + "evidence": [ + { + "kind": "authored_fixture", + "id": "target/person-record/fixture/ambiguous-person", + "digest": "sha256:6a375aa916a0b6b8dba04702b50cd7b1ec600063073c64881a9b62c31f16f232" + }, + { + "kind": "authored_fixture", + "id": "target/person-record/fixture/no-person", + "digest": "sha256:f7968b31cee08af79d6160e1a3bb99fdc4962fcfc7ccd13b92fe35f0d87367a5" + } + ] + }, + { + "state": "not_applicable", + "requirement": "protocol_helpers", + "reason": "no_protocol_helpers_declared", + "evidence": [ + { + "kind": "compiled_contract", + "id": "target/person-record/compiled-contract/v1", + "digest": "sha256:f1b7c3c4a2ece745e634cfdc0c4507f7058fd7650fba342b8f8463e12dd8aea8" + } + ] + }, + { + "state": "not_applicable", + "requirement": "protocol_verification", + "reason": "no_verification_protocol_declared", + "evidence": [ + { + "kind": "compiled_contract", + "id": "target/person-record/compiled-contract/v1", + "digest": "sha256:f1b7c3c4a2ece745e634cfdc0c4507f7058fd7650fba342b8f8463e12dd8aea8" + } + ] + }, + { + "state": "covered", + "requirement": "authorization_before_source", + "evidence": [ + { + "kind": "generated_case", + "id": "target/person-record/fixture/active-person/generated/authorization_before_source/v1", + "digest": "sha256:2d5485575a39c37edec432a39f1d2ba08be39c45cc38e55c1dd1e4a75dccb74a" + }, + { + "kind": "generated_case", + "id": "target/person-record/fixture/ambiguous-person/generated/authorization_before_source/v1", + "digest": "sha256:9c96a3b1b8bb205e135572dee4d2f82d689482ef642eb83f498d8e14c115ad4f" + }, + { + "kind": "generated_case", + "id": "target/person-record/fixture/no-person/generated/authorization_before_source/v1", + "digest": "sha256:32f15ede7285f1271d842c7d9a1cd1e9e5906fb0c5a16d1173a49849b117737e" + } + ] + }, + { + "state": "covered", + "requirement": "malformed_decoding", + "evidence": [ + { + "kind": "generated_case", + "id": "target/person-record/fixture/active-person/generated/malformed_decode/v1", + "digest": "sha256:00a9b0010878b27345c9ce26b7d2089c21312749ccedfaa98849d97ced748765" + }, + { + "kind": "generated_case", + "id": "target/person-record/fixture/ambiguous-person/generated/malformed_decode/v1", + "digest": "sha256:16358fa165c4d86fb69c57c9fbb1d47db083b933ac7c449a47ac03a2b3a722a1" + }, + { + "kind": "generated_case", + "id": "target/person-record/fixture/no-person/generated/malformed_decode/v1", + "digest": "sha256:560c723752d29a94f56203a1593bad292684cc7bde7420185da4191c0a400c26" + } + ] + }, + { + "state": "covered", + "requirement": "structural_limits", + "evidence": [ + { + "kind": "compiled_contract", + "id": "target/person-record/compiled-contract/v1", + "digest": "sha256:f1b7c3c4a2ece745e634cfdc0c4507f7058fd7650fba342b8f8463e12dd8aea8" + } + ] + }, + { + "state": "missing", + "requirement": "request_bytes", + "reason": "numeric_boundary_not_exercised", + "evidence": [ + { + "kind": "compiled_contract", + "id": "target/person-record/compiled-contract/v1", + "digest": "sha256:f1b7c3c4a2ece745e634cfdc0c4507f7058fd7650fba342b8f8463e12dd8aea8" + } + ] + }, + { + "state": "covered", + "requirement": "response_bytes", + "evidence": [ + { + "kind": "generated_case", + "id": "target/person-record/fixture/active-person/generated/byte_ceiling/v1", + "digest": "sha256:1111c0c5d0542692d8c3efe821e719ee1235654102af5a399ee1da2b4167691e" + }, + { + "kind": "generated_case", + "id": "target/person-record/fixture/ambiguous-person/generated/byte_ceiling/v1", + "digest": "sha256:cdfe77bfe9fa27c36bc01f6e9635a1dd593990153c8010657f87fbf8760a36f2" + }, + { + "kind": "generated_case", + "id": "target/person-record/fixture/no-person/generated/byte_ceiling/v1", + "digest": "sha256:9413c3591793f33e81592d852cea1e4e5b52407457d642f95b6b8d9366ac7510" + } + ] + }, + { + "state": "missing", + "requirement": "aggregate_source_bytes", + "reason": "numeric_boundary_not_exercised", + "evidence": [ + { + "kind": "compiled_contract", + "id": "target/person-record/compiled-contract/v1", + "digest": "sha256:f1b7c3c4a2ece745e634cfdc0c4507f7058fd7650fba342b8f8463e12dd8aea8" + } + ] + }, + { + "state": "missing", + "requirement": "output_bytes", + "reason": "numeric_boundary_not_exercised", + "evidence": [ + { + "kind": "compiled_contract", + "id": "target/person-record/compiled-contract/v1", + "digest": "sha256:f1b7c3c4a2ece745e634cfdc0c4507f7058fd7650fba342b8f8463e12dd8aea8" + } + ] + }, + { + "state": "not_applicable", + "requirement": "call_limits", + "reason": "no_dynamic_source_calls_capability", + "evidence": [ + { + "kind": "compiled_contract", + "id": "target/person-record/compiled-contract/v1", + "digest": "sha256:f1b7c3c4a2ece745e634cfdc0c4507f7058fd7650fba342b8f8463e12dd8aea8" + } + ] + }, + { + "state": "covered", + "requirement": "timeout_classification", + "evidence": [ + { + "kind": "generated_case", + "id": "target/person-record/fixture/active-person/generated/timeout/v1", + "digest": "sha256:b491ba87e856a5f652fdef4077861a1cc2c95cca45029856eb72e28a6b0c06e1" + }, + { + "kind": "generated_case", + "id": "target/person-record/fixture/ambiguous-person/generated/timeout/v1", + "digest": "sha256:aa73c4fe1667260942dd69968f60973cd0a19dbdde38b991fafb89ef288fbc01" + }, + { + "kind": "generated_case", + "id": "target/person-record/fixture/no-person/generated/timeout/v1", + "digest": "sha256:43b0454a34a0c5cdce6d6003d609004047ecfa7308fce2fcdfcb2b1a98fa8516" + } + ] + }, + { + "state": "missing", + "requirement": "numeric_deadline_enforcement", + "reason": "numeric_boundary_not_exercised", + "evidence": [ + { + "kind": "generated_case", + "id": "target/person-record/fixture/active-person/generated/timeout/v1", + "digest": "sha256:b491ba87e856a5f652fdef4077861a1cc2c95cca45029856eb72e28a6b0c06e1" + }, + { + "kind": "generated_case", + "id": "target/person-record/fixture/ambiguous-person/generated/timeout/v1", + "digest": "sha256:aa73c4fe1667260942dd69968f60973cd0a19dbdde38b991fafb89ef288fbc01" + }, + { + "kind": "generated_case", + "id": "target/person-record/fixture/no-person/generated/timeout/v1", + "digest": "sha256:43b0454a34a0c5cdce6d6003d609004047ecfa7308fce2fcdfcb2b1a98fa8516" + }, + { + "kind": "compiled_contract", + "id": "target/person-record/compiled-contract/v1", + "digest": "sha256:f1b7c3c4a2ece745e634cfdc0c4507f7058fd7650fba342b8f8463e12dd8aea8" + } + ] + }, + { + "state": "covered", + "requirement": "output_minimization", + "evidence": [ + { + "kind": "generated_case", + "id": "target/person-record/fixture/active-person/generated/output_minimization/v1", + "digest": "sha256:dc7c3bbc4489276a37f90f03591ce9cd3e568ad11d2244e1fcb2b3381463c8f0" + }, + { + "kind": "generated_case", + "id": "target/person-record/fixture/ambiguous-person/generated/output_minimization/v1", + "digest": "sha256:2b5e0499735227031d349d9c8ba7b2ccf070228e2ecbdfc97f1632b2352eb7c2" + }, + { + "kind": "generated_case", + "id": "target/person-record/fixture/no-person/generated/output_minimization/v1", + "digest": "sha256:ba70efd09852298f5635cf140ecc7ea8ea077b54c83620a57d486ab2f0b2a19f" + } + ] + }, + { + "state": "not_evaluated", + "requirement": "changed_input_affected_fixtures", + "reason": "comparison_input_absent", + "evidence": [] + }, + { + "state": "not_evaluated", + "requirement": "changed_output_affected_fixtures", + "reason": "comparison_input_absent", + "evidence": [] + }, + { + "state": "not_evaluated", + "requirement": "changed_claim_affected_fixtures", + "reason": "comparison_input_absent", + "evidence": [] + }, + { + "state": "not_evaluated", + "requirement": "changed_source_contract_affected_fixtures", + "reason": "comparison_input_absent", + "evidence": [] + } + ] + } + ], + "summary": { + "target_set_state": "targets_present", + "target_count": 1, + "fixture_bearing_target_count": 1, + "fixtureless_target_count": 0, + "requirements": { + "covered": 17, + "missing": 7, + "not_applicable": 7, + "not_evaluated": 4, + "total": 35 + } + } +} diff --git a/crates/registryctl/tests/fixtures/project-reports/registry.project.migration.v1.json b/crates/registryctl/tests/fixtures/project-reports/registry.project.migration.v1.json new file mode 100644 index 000000000..678dd07d5 --- /dev/null +++ b/crates/registryctl/tests/fixtures/project-reports/registry.project.migration.v1.json @@ -0,0 +1,186 @@ +{ + "schema_version": "registry.project.migration.v1", + "evidence_grade": "offline_static", + "migration_execution": "not_performed", + "disposition": "ready_for_explicit_write", + "version_support": { + "source": "supported", + "target": "supported" + }, + "version_transitions": [ + { + "contract": "project", + "source_version": 1, + "target_version": 1, + "direction": "same" + }, + { + "contract": "integration", + "source_version": 1, + "target_version": 1, + "direction": "same" + }, + { + "contract": "entity", + "source_version": 1, + "target_version": 1, + "direction": "same" + }, + { + "contract": "fixture", + "source_version": 1, + "target_version": 1, + "direction": "same" + }, + { + "contract": "environment", + "source_version": 1, + "target_version": 1, + "direction": "same" + } + ], + "compatibility": "compatible_normalization_only", + "compatible_normalizations": [ + { + "address": { + "document": "project", + "path": "/registry" + }, + "operation": "normalize_field", + "semantic_effect": "preserved", + "safety": "safe", + "replacement": { + "disposition": "not_applicable", + "address": null + }, + "owner": "registryctl", + "classification": "structural" + }, + { + "address": { + "document": "environment", + "path": "/deployment" + }, + "operation": "normalize_field", + "semantic_effect": "preserved", + "safety": "safe", + "replacement": { + "disposition": "not_applicable", + "address": null + }, + "owner": "operator", + "classification": "structural" + } + ], + "semantic_changes": [], + "affected": { + "fixtures": { + "state": "affected", + "count": 1 + }, + "services": { + "state": "affected", + "count": 1 + }, + "consultations": { + "state": "not_affected", + "count": 0 + }, + "claims": { + "state": "not_affected", + "count": 0 + }, + "environments": { + "state": "affected", + "count": 1 + }, + "generated_artifacts": [ + "relay_config", + "project_explanation", + "generated_configuration_reference" + ] + }, + "reviews": [ + { + "class": "authoring", + "status": "approved" + }, + { + "class": "compatibility", + "status": "approved" + }, + { + "class": "migration", + "status": "approved" + }, + { + "class": "fixtures", + "status": "approved" + }, + { + "class": "relay", + "status": "approved" + }, + { + "class": "security", + "status": "approved" + }, + { + "class": "operations", + "status": "approved" + }, + { + "class": "documentation", + "status": "approved" + }, + { + "class": "release", + "status": "approved" + } + ], + "output": { + "mode": "reviewable_patch", + "write_authority": "explicit_candidate_write_granted", + "candidate_artifact": "reviewable_patch", + "candidate_eligibility": "eligible_to_emit", + "authored_file_policy": "never_overwrite_authored_files", + "application_policy": "explicit_operator_apply_required", + "candidate_emission": "not_emitted" + }, + "rerun_gates": [ + { + "gate": "schema", + "status": "passed" + }, + { + "gate": "fixture", + "status": "passed" + }, + { + "gate": "check", + "status": "passed" + }, + { + "gate": "build", + "status": "passed" + }, + { + "gate": "generated_reference", + "status": "passed" + } + ], + "diagnostics": [], + "unresolved_decisions": [], + "blocking_reasons": [], + "evidence_limitations": [ + "offline_static_only", + "migration_not_performed", + "candidate_does_not_apply_migration", + "authored_files_never_overwritten", + "secret_material_not_inspected", + "raw_authored_values_omitted", + "runtime_not_evaluated", + "deployment_not_performed", + "country_approval_not_inferred" + ] +} diff --git a/crates/registryctl/tests/fixtures/project-reports/registry.project.promotion.v1.json b/crates/registryctl/tests/fixtures/project-reports/registry.project.promotion.v1.json new file mode 100644 index 000000000..1c2713d4a --- /dev/null +++ b/crates/registryctl/tests/fixtures/project-reports/registry.project.promotion.v1.json @@ -0,0 +1,188 @@ +{ + "schema_version": "registry.project.promotion.v1", + "evidence_grade": "offline_static", + "deployment": "not_performed", + "runtime_activation": "not_evaluated", + "disposition": "ready_after_required_actions", + "reviewed_revision": "different_reviewed_semantic_revision", + "changes": [ + { + "address": { + "document": "project", + "path": "/purposes/*" + }, + "kind": "purpose", + "classification": "internal", + "ownership": "reviewed_project_owned", + "boundary": "reviewed_project_revision_difference", + "effect": "changed_within_reviewed_authority" + }, + { + "address": { + "document": "project", + "path": "/service_policy" + }, + "kind": "service_policy", + "classification": "internal", + "ownership": "reviewed_project_owned", + "boundary": "reviewed_project_revision_difference", + "effect": "narrowed" + }, + { + "address": { + "document": "project", + "path": "/notary/claims/*" + }, + "kind": "claim", + "classification": "internal", + "ownership": "reviewed_project_owned", + "boundary": "reviewed_project_revision_difference", + "effect": "changed_within_reviewed_authority" + }, + { + "address": { + "document": "project", + "path": "/notary/disclosures/*" + }, + "kind": "disclosure", + "classification": "internal", + "ownership": "reviewed_project_owned", + "boundary": "reviewed_project_revision_difference", + "effect": "narrowed" + }, + { + "address": { + "document": "project", + "path": "/integrations/*/limits" + }, + "kind": "integration_ceiling", + "classification": "structural", + "ownership": "reviewed_project_owned", + "boundary": "reviewed_project_revision_difference", + "effect": "narrowed" + }, + { + "address": { + "document": "environment", + "path": "/integrations/*/origin" + }, + "kind": "origin", + "classification": "sensitive", + "ownership": "environment_owned", + "boundary": "allowed_environment_owned", + "effect": "changed_within_reviewed_authority" + }, + { + "address": { + "document": "environment", + "path": "/integrations/*/credentials" + }, + "kind": "credential_binding", + "classification": "secret_reference", + "ownership": "environment_owned", + "boundary": "allowed_environment_owned", + "effect": "changed_within_reviewed_authority" + }, + { + "address": { + "document": "environment", + "path": "/integrations/*/trust" + }, + "kind": "trust", + "classification": "sensitive", + "ownership": "environment_owned", + "boundary": "allowed_environment_owned", + "effect": "changed_within_reviewed_authority" + }, + { + "address": { + "document": "environment", + "path": "/notary/callers/*" + }, + "kind": "caller", + "classification": "sensitive", + "ownership": "environment_owned", + "boundary": "allowed_environment_owned", + "effect": "narrowed" + }, + { + "address": { + "document": "environment", + "path": "/operations" + }, + "kind": "operational", + "classification": "internal", + "ownership": "environment_owned", + "boundary": "allowed_environment_owned", + "effect": "changed_within_reviewed_authority" + }, + { + "address": { + "document": "environment", + "path": "/products/*" + }, + "kind": "product_enablement", + "classification": "structural", + "ownership": "environment_owned", + "boundary": "allowed_environment_owned", + "effect": "changed_within_reviewed_authority" + }, + { + "address": { + "document": "environment", + "path": "/integrations/*/capabilities/*" + }, + "kind": "capability_enablement", + "classification": "structural", + "ownership": "environment_owned", + "boundary": "allowed_environment_owned", + "effect": "changed_within_reviewed_authority" + } + ], + "reviewed_ceiling": "narrowed", + "trust": "resolved", + "compatibility": [ + { + "component": "product", + "state": "compatible" + }, + { + "component": "capability", + "state": "compatible" + }, + { + "component": "schema", + "state": "compatible" + }, + { + "component": "abi", + "state": "compatible" + } + ], + "required_actions": { + "review_classes": [ + "authoring", + "contract", + "semantics", + "interoperability", + "privacy", + "security", + "compatibility", + "operations", + "release" + ], + "re_sign": "relay_and_notary", + "reactivate": "relay_and_notary", + "restart": "relay_and_notary" + }, + "blocking_reasons": [], + "evidence_limitations": [ + "offline_static_only", + "runtime_activation_not_evaluated", + "deployment_not_performed", + "live_endpoint_reachability_not_evaluated", + "secret_material_not_inspected", + "raw_authored_values_omitted", + "separate_relay_and_notary_bundle_lifecycle" + ] +} diff --git a/crates/registryctl/tests/fixtures/project-reports/registry.project.semantic_comparison.v1.json b/crates/registryctl/tests/fixtures/project-reports/registry.project.semantic_comparison.v1.json new file mode 100644 index 000000000..1e5e71324 --- /dev/null +++ b/crates/registryctl/tests/fixtures/project-reports/registry.project.semantic_comparison.v1.json @@ -0,0 +1,138 @@ +{ + "schema_version": "registry.project.semantic_comparison.v1", + "comparison": "local_project_to_project", + "evidence_grade": "offline_static", + "assurance": "local_unverified", + "external_approval": "not_evaluated", + "equivalence": "different", + "comparison_precision": "field_and_generated_projection", + "review_plan": { + "state": "generated_pending_review", + "review_classes": [ + "contract", + "authoring", + "semantics", + "interoperability", + "privacy", + "security", + "relay", + "notary", + "compatibility", + "documentation", + "testing", + "operations", + "release" + ] + }, + "changes": [ + { + "address": { + "schema_family": "project", + "field": "/$defs/service/properties/purpose" + }, + "source": "authored", + "dimension": "service_policy", + "direction": "changed", + "sensitivity": "internal", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator", + "bundle_signer", + "deployment_tooling", + "operator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference", + "review_plan", + "approval_projection" + ], + "review_classes": [ + "contract", + "authoring", + "semantics", + "interoperability", + "privacy", + "security", + "relay", + "notary", + "compatibility", + "documentation", + "testing", + "operations", + "release" + ], + "affected_subjects": [ + { + "kind": "integration", + "count": 1 + }, + { + "kind": "fixture", + "count": 4 + }, + { + "kind": "entity", + "count": 1 + }, + { + "kind": "service_policy", + "count": 1 + }, + { + "kind": "consultation", + "count": 1 + }, + { + "kind": "claim", + "count": 2 + }, + { + "kind": "disclosure", + "count": 2 + }, + { + "kind": "product_input", + "count": 2 + }, + { + "kind": "generated_artifact", + "count": 8 + } + ], + "occurrences": 1, + "requirements": { + "signing": "relay_and_notary_bundles", + "activation": "apply_relay_and_notary_config", + "restart": "registry_relay_and_notary" + } + } + ], + "required_actions": [ + "review_semantic_changes", + "run_affected_fixtures", + "regenerate_generated_artifacts", + "resign_relay_bundle", + "resign_notary_bundle", + "reactivate_relay_configuration", + "reactivate_notary_configuration", + "restart_registry_relay", + "restart_registry_notary" + ], + "evidence_limitations": [ + "offline_inputs_only", + "runtime_not_observed", + "signed_bundle_authority_not_evaluated", + "external_approval_not_evaluated", + "fingerprints_not_published" + ] +} diff --git a/crates/registryctl/tests/fixtures/project-reports/registry.project.semantic_impact.v1.json b/crates/registryctl/tests/fixtures/project-reports/registry.project.semantic_impact.v1.json new file mode 100644 index 000000000..ed7a536a8 --- /dev/null +++ b/crates/registryctl/tests/fixtures/project-reports/registry.project.semantic_impact.v1.json @@ -0,0 +1,51 @@ +{ + "schema_version": "registry.project.semantic_impact.v1", + "baseline": "initial_without_baseline", + "changes": [ + { + "precision": "dimension", + "dimension": "integration", + "direction": "unbaselined", + "affected_subjects": [ + { + "kind": "integration", + "id": "person-record" + }, + { + "kind": "fixture", + "id": "person-record.active-person" + }, + { + "kind": "product_input", + "id": "registry-relay.config" + } + ], + "consumers": [ + "registryctl_authoring", + "registry_relay", + "bundle_signer", + "deployment_tooling" + ], + "review_classes": [ + "semantics", + "interoperability", + "operations" + ], + "product_impacts": [ + { + "product": "relay", + "impact": "regenerate" + }, + { + "product": "docs", + "impact": "republish" + } + ], + "requirements": { + "signing": "relay_bundle", + "activation": "apply_relay_config", + "restart": "registry_relay" + } + } + ] +} diff --git a/crates/registryctl/tests/fixtures/project-reports/registryctl.authoring_error_reference.v1.json b/crates/registryctl/tests/fixtures/project-reports/registryctl.authoring_error_reference.v1.json new file mode 100644 index 000000000..bc216f055 --- /dev/null +++ b/crates/registryctl/tests/fixtures/project-reports/registryctl.authoring_error_reference.v1.json @@ -0,0 +1,311 @@ +{ + "schema_version": "registryctl.authoring_error_reference.v1", + "entries": [ + { + "family": "authoring_validation", + "code": "registryctl.authoring.diagnostics.truncated", + "owner": "registryctl", + "product": "registryctl", + "phase": "aggregation", + "safe_meaning": "At most 64 diagnostics are returned in deterministic order.", + "rule": "diagnostic_limit", + "safe_remediation": "Fix the reported diagnostics and run the check again.", + "field_address_pattern": null, + "evidence_scope": "offline authored project files selected for registryctl check", + "secret_sensitive_value_policy": "no_received_value", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.diagnostics.truncated", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "family": "authoring_validation", + "code": "registryctl.authoring.entity.invalid", + "owner": "registryctl", + "product": "registryctl", + "phase": "semantic_validation", + "safe_meaning": "A declared entity id and shape must match the project contract.", + "rule": "entity_contract", + "safe_remediation": "Correct the entity declaration with the entity schema and its project alias.", + "field_address_pattern": "#", + "evidence_scope": "offline authored project files selected for registryctl check", + "secret_sensitive_value_policy": "no_received_value", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.entity.invalid", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "family": "authoring_validation", + "code": "registryctl.authoring.environment.invalid", + "owner": "registryctl", + "product": "registryctl", + "phase": "semantic_validation", + "safe_meaning": "Environment bindings must match declared products, integrations, identities, origins, and bounded generations.", + "rule": "environment_binding", + "safe_remediation": "Align the selected environment with the declared project contract.", + "field_address_pattern": "environments/.yaml#", + "evidence_scope": "offline authored project files selected for registryctl check", + "secret_sensitive_value_policy": "no_received_value", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.environment.invalid", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "family": "authoring_validation", + "code": "registryctl.authoring.file.too_large", + "owner": "registryctl", + "product": "registryctl", + "phase": "safe_input", + "safe_meaning": "Authored files must remain below their documented fixed byte bound.", + "rule": "authored_file_size", + "safe_remediation": "Reduce the file below its documented maximum size.", + "field_address_pattern": "#", + "evidence_scope": "offline authored project files selected for registryctl check", + "secret_sensitive_value_policy": "no_received_value", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.file.too_large", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "family": "authoring_validation", + "code": "registryctl.authoring.file.unreadable", + "owner": "registryctl", + "product": "registryctl", + "phase": "safe_input", + "safe_meaning": "A regular file inside the project root must be readable.", + "rule": "authored_file_readability", + "safe_remediation": "Restore a readable regular project-relative file.", + "field_address_pattern": "#", + "evidence_scope": "offline authored project files selected for registryctl check", + "secret_sensitive_value_policy": "no_received_value", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.file.unreadable", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "family": "authoring_validation", + "code": "registryctl.authoring.fixture.invalid", + "owner": "registryctl", + "product": "registryctl", + "phase": "semantic_validation", + "safe_meaning": "Fixtures must be deterministic, bounded, and satisfy the integration contract without live values.", + "rule": "fixture_contract", + "safe_remediation": "Correct the fixture declaration and its closed interaction contract.", + "field_address_pattern": "integrations//fixtures/.yaml#", + "evidence_scope": "offline authored project files selected for registryctl check", + "secret_sensitive_value_policy": "no_received_value", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.fixture.invalid", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "family": "authoring_validation", + "code": "registryctl.authoring.fixture.reserved_body_field", + "owner": "registryctl", + "product": "registryctl", + "phase": "syntax", + "safe_meaning": "A fixture body object may use `file` only as the closed body-file reference shape.", + "rule": "fixture_body_file_reference", + "safe_remediation": "Use the documented body-file reference shape or an inline JSON body.", + "field_address_pattern": "integrations//fixtures/.yaml#", + "evidence_scope": "offline authored project files selected for registryctl check", + "secret_sensitive_value_policy": "received_type_only", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.fixture.reserved_body_field", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "family": "authoring_validation", + "code": "registryctl.authoring.integration.invalid", + "owner": "registryctl", + "product": "registryctl", + "phase": "semantic_validation", + "safe_meaning": "An integration alias, capability, and declared contract must be internally consistent.", + "rule": "integration_contract", + "safe_remediation": "Correct the integration declaration with the integration schema.", + "field_address_pattern": "integrations//integration.yaml#", + "evidence_scope": "offline authored project files selected for registryctl check", + "secret_sensitive_value_policy": "no_received_value", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.integration.invalid", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "family": "authoring_validation", + "code": "registryctl.authoring.path.unsafe", + "owner": "registryctl", + "product": "registryctl", + "phase": "safe_input", + "safe_meaning": "Paths must be normalized project-relative paths to regular non-symlink entries.", + "rule": "project_relative_path", + "safe_remediation": "Use a normalized project-relative regular file path.", + "field_address_pattern": "#", + "evidence_scope": "offline authored project files selected for registryctl check", + "secret_sensitive_value_policy": "no_received_value", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.path.unsafe", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "family": "authoring_validation", + "code": "registryctl.authoring.project.invalid", + "owner": "registryctl", + "product": "registryctl", + "phase": "semantic_validation", + "safe_meaning": "Project services, entities, integrations, and references must form a closed valid graph.", + "rule": "project_contract", + "safe_remediation": "Align the project declaration and referenced contracts.", + "field_address_pattern": "registry-stack.yaml#", + "evidence_scope": "offline authored project files selected for registryctl check", + "secret_sensitive_value_policy": "no_received_value", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.project.invalid", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "family": "authoring_validation", + "code": "registryctl.authoring.project.scope_collision", + "owner": "registryctl", + "product": "registryctl", + "phase": "semantic_validation", + "safe_meaning": "Effective authorization scopes must be distinct across records API and attribute-release access.", + "rule": "authorization_scope_uniqueness", + "safe_remediation": "Assign distinct scopes to each authorization purpose.", + "field_address_pattern": "registry-stack.yaml#", + "evidence_scope": "offline authored project files selected for registryctl check", + "secret_sensitive_value_policy": "no_received_value", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.project.scope_collision", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "family": "authoring_validation", + "code": "registryctl.authoring.script.closed_contract_violation", + "owner": "registryctl", + "product": "registryctl", + "phase": "script_validation", + "safe_meaning": "Scripts must use the released bounded Script contract and module rules.", + "rule": "released_script_contract", + "safe_remediation": "Use only the released bounded Script contract.", + "field_address_pattern": "#", + "evidence_scope": "offline authored project files selected for registryctl check", + "secret_sensitive_value_policy": "no_received_value", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.script.closed_contract_violation", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "family": "authoring_validation", + "code": "registryctl.authoring.script.invalid_signature", + "owner": "registryctl", + "product": "registryctl", + "phase": "script_validation", + "safe_meaning": "The Script entrypoint must be exactly `consult(context)`.", + "rule": "script_entrypoint_signature", + "safe_remediation": "Define the exact released entrypoint signature.", + "field_address_pattern": "#", + "evidence_scope": "offline authored project files selected for registryctl check", + "secret_sensitive_value_policy": "no_received_value", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.script.invalid_signature", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "family": "authoring_validation", + "code": "registryctl.authoring.script.syntax_error", + "owner": "registryctl", + "product": "registryctl", + "phase": "script_validation", + "safe_meaning": "The Script source must parse under the released runtime.", + "rule": "script_syntax", + "safe_remediation": "Correct the Script syntax at the reported location.", + "field_address_pattern": "#", + "evidence_scope": "offline authored project files selected for registryctl check", + "secret_sensitive_value_policy": "no_received_value", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.script.syntax_error", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "family": "authoring_validation", + "code": "registryctl.authoring.script.unknown_function", + "owner": "registryctl", + "product": "registryctl", + "phase": "script_validation", + "safe_meaning": "The Script must define the released `consult(context)` entrypoint.", + "rule": "script_entrypoint", + "safe_remediation": "Define consult(context) as the Script entrypoint.", + "field_address_pattern": "#", + "evidence_scope": "offline authored project files selected for registryctl check", + "secret_sensitive_value_policy": "no_received_value", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.script.unknown_function", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "family": "authoring_validation", + "code": "registryctl.authoring.yaml.invalid_syntax", + "owner": "registryctl", + "product": "registryctl", + "phase": "syntax", + "safe_meaning": "YAML must parse as the selected closed authoring document shape.", + "rule": "closed_yaml_document", + "safe_remediation": "Correct the YAML with the matching authoring schema.", + "field_address_pattern": "#", + "evidence_scope": "offline authored project files selected for registryctl check", + "secret_sensitive_value_policy": "received_type_only", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.yaml.invalid_syntax", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "family": "authoring_validation", + "code": "registryctl.authoring.yaml.unknown_field", + "owner": "registryctl", + "product": "registryctl", + "phase": "syntax", + "safe_meaning": "Only documented fields in the closed authoring schema are accepted.", + "rule": "closed_yaml_unknown_field", + "safe_remediation": "Remove the unsupported field or replace it with its documented field.", + "field_address_pattern": "#", + "evidence_scope": "offline authored project files selected for registryctl check", + "secret_sensitive_value_policy": "received_type_only", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.yaml.unknown_field", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + } + ] +} diff --git a/crates/registryctl/tests/fixtures/project-reports/registryctl.fixture_error_reference.v1.json b/crates/registryctl/tests/fixtures/project-reports/registryctl.fixture_error_reference.v1.json new file mode 100644 index 000000000..8b1349174 --- /dev/null +++ b/crates/registryctl/tests/fixtures/project-reports/registryctl.fixture_error_reference.v1.json @@ -0,0 +1,293 @@ +{ + "schema_version": "registryctl.fixture_error_reference.v1", + "entries": [ + { + "family": "fixture_execution", + "code": "authorization.denied", + "owner": "registryctl", + "product": "registryctl_relay_offline_harness", + "phase": "offline_execution", + "safe_meaning": "Authorization denied fixture execution before source access.", + "rule": "authorization_before_source", + "safe_remediation": "Align the fixture identity and authorization expectation with the compiled policy.", + "field_address_pattern": null, + "evidence_scope": "offline synthetic fixture execution", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--authorization.denied", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "family": "fixture_execution", + "code": "failure.subject_mismatch", + "owner": "registryctl", + "product": "registryctl_relay_offline_harness", + "phase": "offline_execution", + "safe_meaning": "The source observation did not preserve the requested subject binding.", + "rule": "subject_binding", + "safe_remediation": "Correct the synthetic subject evidence or the reviewed subject comparison.", + "field_address_pattern": null, + "evidence_scope": "offline synthetic fixture execution", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--failure.subject_mismatch", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "family": "fixture_execution", + "code": "fixture.execution_contract_invalid", + "owner": "registryctl", + "product": "registryctl_relay_offline_harness", + "phase": "offline_execution", + "safe_meaning": "Fixture execution violated the compiled offline plan contract.", + "rule": "compiled_execution_contract", + "safe_remediation": "Align the fixture with the exact compiled integration plan.", + "field_address_pattern": null, + "evidence_scope": "offline synthetic fixture execution", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--fixture.execution_contract_invalid", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "family": "fixture_execution", + "code": "fixture.profile_not_found", + "owner": "registryctl", + "product": "registryctl_relay_offline_harness", + "phase": "offline_execution", + "safe_meaning": "The fixture profile pin did not select one exact compiled plan.", + "rule": "profile_pin", + "safe_remediation": "Select one compiled integration profile.", + "field_address_pattern": null, + "evidence_scope": "offline synthetic fixture execution", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--fixture.profile_not_found", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "family": "fixture_execution", + "code": "fixture.request_mismatch", + "owner": "registryctl", + "product": "registryctl_relay_offline_harness", + "phase": "offline_execution", + "safe_meaning": "The rendered request or call order did not match the fixture expectation.", + "rule": "request_authority_and_order", + "safe_remediation": "Align the fixture request expectation with the compiled plan.", + "field_address_pattern": null, + "evidence_scope": "offline synthetic fixture execution", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--fixture.request_mismatch", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "family": "fixture_execution", + "code": "fixture.source_operation_unknown", + "owner": "registryctl", + "product": "registryctl_relay_offline_harness", + "phase": "offline_execution", + "safe_meaning": "The fixture named a source operation outside the compiled plan.", + "rule": "source_operation_closure", + "safe_remediation": "Use only source operations declared by the compiled plan.", + "field_address_pattern": null, + "evidence_scope": "offline synthetic fixture execution", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--fixture.source_operation_unknown", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "family": "fixture_execution", + "code": "input.pattern_mismatch", + "owner": "registryctl", + "product": "registryctl_relay_offline_harness", + "phase": "offline_execution", + "safe_meaning": "A synthetic fixture input did not satisfy its compiled contract.", + "rule": "compiled_input_contract", + "safe_remediation": "Correct the synthetic input shape.", + "field_address_pattern": null, + "evidence_scope": "offline synthetic fixture execution", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--input.pattern_mismatch", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "family": "fixture_execution", + "code": "redacted_unclassified_error", + "owner": "registryctl", + "product": "registryctl_relay_offline_harness", + "phase": "offline_execution", + "safe_meaning": "An error outside the reviewed safe allow-list was redacted.", + "rule": "safe_error_allow_list", + "safe_remediation": "Use classified fixture evidence or inspect private local logs without publishing values.", + "field_address_pattern": null, + "evidence_scope": "offline synthetic fixture execution", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--redacted_unclassified_error", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "family": "fixture_execution", + "code": "source.call_budget_exceeded", + "owner": "registryctl", + "product": "registryctl_relay_offline_harness", + "phase": "offline_execution", + "safe_meaning": "Fixture execution exceeded the compiled source-call budget.", + "rule": "source_call_budget", + "safe_remediation": "Reduce source calls or revise the reviewed bounded plan.", + "field_address_pattern": null, + "evidence_scope": "offline synthetic fixture execution", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--source.call_budget_exceeded", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "family": "fixture_execution", + "code": "source.cardinality_violation", + "owner": "registryctl", + "product": "registryctl_relay_offline_harness", + "phase": "offline_execution", + "safe_meaning": "The synthetic source response violated the compiled cardinality contract.", + "rule": "source_cardinality", + "safe_remediation": "Correct the synthetic response cardinality.", + "field_address_pattern": null, + "evidence_scope": "offline synthetic fixture execution", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--source.cardinality_violation", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "family": "fixture_execution", + "code": "source.deadline_exceeded", + "owner": "registryctl", + "product": "registryctl_relay_offline_harness", + "phase": "offline_execution", + "safe_meaning": "The synthetic source interaction exceeded its deadline.", + "rule": "source_deadline", + "safe_remediation": "Align the timeout fixture with the compiled deadline behavior.", + "field_address_pattern": null, + "evidence_scope": "offline synthetic fixture execution", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--source.deadline_exceeded", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "family": "fixture_execution", + "code": "source.response_malformed", + "owner": "registryctl", + "product": "registryctl_relay_offline_harness", + "phase": "offline_execution", + "safe_meaning": "The synthetic source response violated its closed response contract.", + "rule": "source_response_contract", + "safe_remediation": "Correct the synthetic response shape.", + "field_address_pattern": null, + "evidence_scope": "offline synthetic fixture execution", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--source.response_malformed", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "family": "fixture_execution", + "code": "source.response_too_large", + "owner": "registryctl", + "product": "registryctl_relay_offline_harness", + "phase": "offline_execution", + "safe_meaning": "The synthetic source response exceeded its compiled byte bound.", + "rule": "source_response_byte_bound", + "safe_remediation": "Reduce the synthetic response below the compiled bound.", + "field_address_pattern": null, + "evidence_scope": "offline synthetic fixture execution", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--source.response_too_large", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "family": "fixture_execution", + "code": "source.status_rejected", + "owner": "registryctl", + "product": "registryctl_relay_offline_harness", + "phase": "offline_execution", + "safe_meaning": "The synthetic source returned a status outside the accepted mapping.", + "rule": "source_status_mapping", + "safe_remediation": "Use a reviewed status mapping or correct the fixture status.", + "field_address_pattern": null, + "evidence_scope": "offline synthetic fixture execution", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--source.status_rejected", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "family": "fixture_execution", + "code": "source.unavailable", + "owner": "registryctl", + "product": "registryctl_relay_offline_harness", + "phase": "offline_execution", + "safe_meaning": "The synthetic source was unavailable.", + "rule": "source_availability", + "safe_remediation": "Correct the offline source observation for the intended availability case.", + "field_address_pattern": null, + "evidence_scope": "offline synthetic fixture execution", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--source.unavailable", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "family": "fixture_execution", + "code": "source_unavailable", + "owner": "registryctl", + "product": "registryctl_relay_offline_harness", + "phase": "offline_execution", + "safe_meaning": "The synthetic source was unavailable under the retained legacy code.", + "rule": "legacy_source_availability", + "safe_remediation": "Prefer source.unavailable for new fixtures while retaining compatible evidence.", + "field_address_pattern": null, + "evidence_scope": "offline synthetic fixture execution", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--source_unavailable", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + } + ] +} diff --git a/crates/registryctl/tests/fixtures/project-reports/registryctl.operator_error_reference.v1.json b/crates/registryctl/tests/fixtures/project-reports/registryctl.operator_error_reference.v1.json new file mode 100644 index 000000000..2dfd91627 --- /dev/null +++ b/crates/registryctl/tests/fixtures/project-reports/registryctl.operator_error_reference.v1.json @@ -0,0 +1,1068 @@ +{ + "schema_version": "registryctl.operator_error_reference.v1", + "entries": [ + { + "family": "bundle_verification", + "code": "rejected_binding", + "owner": "registry_platform_ops", + "product": "registry_platform_ops", + "phase": "bundle_verification", + "safe_meaning": "The bundle binding does not match the intended runtime target.", + "rule": "registry.platform.bundle_verification.binding_matches_target", + "safe_remediation": "Use a bundle issued for the intended runtime binding.", + "field_address_pattern": null, + "evidence_scope": "signed bundle and configured runtime binding", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_platform_ops--rejected-binding", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose received or configured binding values." + }, + { + "family": "bundle_verification", + "code": "rejected_rollback", + "owner": "registry_platform_ops", + "product": "registry_platform_ops", + "phase": "bundle_activation", + "safe_meaning": "The bundle or override does not satisfy local anti-rollback requirements.", + "rule": "registry.platform.bundle_verification.rollback_constraints_satisfied", + "safe_remediation": "Use a monotonic bundle or an authorized break-glass selection.", + "field_address_pattern": null, + "evidence_scope": "local anti-rollback state and bundle or override metadata", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_platform_ops--rejected-rollback", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose stored sequences, content digests, paths, or approval values." + }, + { + "family": "bundle_verification", + "code": "rejected_signature", + "owner": "registry_platform_ops", + "product": "registry_platform_ops", + "phase": "bundle_verification", + "safe_meaning": "Bundle authenticity or declared content integrity verification failed.", + "rule": "registry.platform.bundle_verification.signature_and_integrity_accepted", + "safe_remediation": "Rebuild and sign the complete bundle with an accepted trust configuration.", + "field_address_pattern": null, + "evidence_scope": "bundle trust metadata, signature envelope, file closure, and content digests", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_platform_ops--rejected-signature", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose signer identifiers, file names, or content digests." + }, + { + "family": "bundle_verification", + "code": "rejected_validation", + "owner": "registry_platform_ops", + "product": "registry_platform_ops", + "phase": "bundle_verification", + "safe_meaning": "The bundle or acceptance metadata is missing, unreadable, malformed, or unsupported.", + "rule": "registry.platform.bundle_verification.input_is_valid", + "safe_remediation": "Regenerate the bundle and acceptance metadata using supported formats.", + "field_address_pattern": null, + "evidence_scope": "bundle encoding, manifest, acceptance metadata, and required local inputs", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_platform_ops--rejected-validation", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose parser messages, local paths, or supplied values." + }, + { + "family": "notary_activation", + "code": "notary.configuration.invalid", + "owner": "registry_notary", + "product": "registry_notary", + "phase": "configuration_activation", + "safe_meaning": "Registry Notary runtime configuration is invalid", + "rule": "Runtime activation requires valid product configuration, supported features, and resolvable secret and provider bindings", + "safe_remediation": "run registry-notary doctor, correct the reviewed configuration or binding, and retry activation", + "field_address_pattern": null, + "evidence_scope": "Notary configuration, provider bindings, and compiled feature support", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--configuration-invalid", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + }, + { + "family": "notary_activation", + "code": "notary.deployment.gate_failed", + "owner": "registry_notary", + "product": "registry_notary", + "phase": "deployment_activation", + "safe_meaning": "Registry Notary deployment gates refused startup", + "rule": "Every startup-failing deployment gate must pass before activation", + "safe_remediation": "run registry-notary doctor for the selected deployment profile and resolve its startup-failing findings", + "field_address_pattern": null, + "evidence_scope": "selected deployment profile and startup-failing gate results", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--deployment-gate-failed", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + }, + { + "family": "notary_activation", + "code": "notary.relay.activation_failed", + "owner": "registry_notary", + "product": "registry_notary", + "phase": "relay_activation", + "safe_meaning": "Relay consultation activation failed", + "rule": "Registry-backed claims require the reviewed Relay consultation client to activate before Notary serves", + "safe_remediation": "check the Notary configuration and startup environment", + "field_address_pattern": null, + "evidence_scope": "Notary Relay consultation client activation lifecycle", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--relay-activation-failed", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + }, + { + "family": "notary_activation", + "code": "notary.relay.configuration_invalid", + "owner": "registry_notary", + "product": "registry_notary", + "phase": "relay_activation", + "safe_meaning": "Relay consultation configuration is invalid", + "rule": "The Relay destination, activation plan, and activation lifecycle must form one valid reviewed configuration", + "safe_remediation": "check the evidence.relay connection and Registry-backed consultation configuration", + "field_address_pattern": null, + "evidence_scope": "Relay destination, activation plan, and consultation configuration", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--relay-configuration-invalid", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + }, + { + "family": "notary_activation", + "code": "notary.relay.credential_unavailable", + "owner": "registry_notary", + "product": "registry_notary", + "phase": "relay_activation", + "safe_meaning": "Relay workload credential is unavailable", + "rule": "A current non-empty workload credential must be available before a live Relay consultation", + "safe_remediation": "mount a current readable workload JWT at evidence.relay.token_file", + "field_address_pattern": null, + "evidence_scope": "configured Relay workload credential availability", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--relay-credential-unavailable", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + }, + { + "family": "notary_activation", + "code": "notary.relay.credentials_rejected", + "owner": "registry_notary", + "product": "registry_notary", + "phase": "relay_activation", + "safe_meaning": "Relay rejected the configured workload credential", + "rule": "Relay must accept the configured Notary workload binding, scope, and validity window", + "safe_remediation": "rotate the workload JWT and verify that Relay recognizes its workload binding, required scope, and validity window", + "field_address_pattern": null, + "evidence_scope": "Relay workload binding, scope, and validity acceptance", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--relay-credentials-rejected", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + }, + { + "family": "notary_activation", + "code": "notary.relay.profile_mismatch", + "owner": "registry_notary", + "product": "registry_notary", + "phase": "relay_activation", + "safe_meaning": "Relay consultation profile does not match the configured contract pin", + "rule": "The active Relay profile must match the reviewed Notary consultation contract pin", + "safe_remediation": "reconcile the Notary profile id and contract hash with the reviewed Relay consultation contract", + "field_address_pattern": null, + "evidence_scope": "reviewed Notary profile pin and active Relay consultation contract", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--relay-profile-mismatch", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + }, + { + "family": "notary_activation", + "code": "notary.relay.profile_not_found", + "owner": "registry_notary", + "product": "registry_notary", + "phase": "relay_activation", + "safe_meaning": "Relay consultation profile was not found", + "rule": "Every Registry-backed Notary consultation must resolve to an active Relay profile", + "safe_remediation": "deploy the configured Relay profile id, then retry the live check", + "field_address_pattern": null, + "evidence_scope": "configured consultation profile resolution in Relay", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--relay-profile-not-found", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + }, + { + "family": "notary_activation", + "code": "notary.relay.unavailable", + "owner": "registry_notary", + "product": "registry_notary", + "phase": "relay_activation", + "safe_meaning": "Relay consultation service is unavailable", + "rule": "The reviewed Relay destination must be reachable through the configured transport policy", + "safe_remediation": "check Relay reachability, TLS, destination policy, and service health", + "field_address_pattern": null, + "evidence_scope": "reviewed Relay destination, transport policy, and service availability", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--relay-unavailable", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + }, + { + "family": "notary_activation", + "code": "notary.runtime.activation_failed", + "owner": "registry_notary", + "product": "registry_notary", + "phase": "runtime_activation", + "safe_meaning": "Registry Notary runtime activation failed", + "rule": "Audit, state, sensitive-state, and other runtime dependencies must activate successfully before listeners serve", + "safe_remediation": "restore the governed runtime dependency or integrity condition, then retry activation", + "field_address_pattern": null, + "evidence_scope": "governed audit, state, sensitive-state, and runtime dependencies", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--runtime-activation-failed", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + }, + { + "family": "notary_activation", + "code": "notary.runtime.activation_required", + "owner": "registry_notary", + "product": "registry_notary", + "phase": "runtime_activation", + "safe_meaning": "Registry Notary runtime activation is required before serving", + "rule": "Routers may be built only after the governed audit and state activation lifecycle completes", + "safe_remediation": "run the compiled Registry Notary runtime activation step before building or serving routers", + "field_address_pattern": null, + "evidence_scope": "router assembly and governed audit and state activation lifecycle", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--runtime-activation-required", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + }, + { + "family": "notary_activation", + "code": "notary.state.postgresql.database_read_only", + "owner": "registry_notary", + "product": "registry_notary", + "phase": "runtime_activation", + "safe_meaning": "Registry Notary PostgreSQL state database is read-only or recovering", + "rule": "Serving requires a writable PostgreSQL primary for correctness-state transactions", + "safe_remediation": "restore a writable PostgreSQL primary, run registry-notary state doctor, and retry activation", + "field_address_pattern": null, + "evidence_scope": "PostgreSQL writeability and recovery posture", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--postgresql-database-read-only", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + }, + { + "family": "notary_activation", + "code": "notary.state.postgresql.database_unavailable", + "owner": "registry_notary", + "product": "registry_notary", + "phase": "runtime_activation", + "safe_meaning": "Registry Notary PostgreSQL state database is unavailable", + "rule": "Serving requires a reachable PostgreSQL service with an accepted TLS trust chain", + "safe_remediation": "check PostgreSQL reachability, TLS trust, and service health, then run registry-notary state doctor", + "field_address_pattern": null, + "evidence_scope": "PostgreSQL transport, TLS trust, and service availability", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--postgresql-database-unavailable", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + }, + { + "family": "notary_activation", + "code": "notary.state.postgresql.database_unsupported", + "owner": "registry_notary", + "product": "registry_notary", + "phase": "runtime_activation", + "safe_meaning": "Registry Notary PostgreSQL server major is unsupported", + "rule": "Serving requires a PostgreSQL major covered by the Registry Notary compatibility contract", + "safe_remediation": "move the state database to a supported PostgreSQL major, run registry-notary state doctor, and retry activation", + "field_address_pattern": null, + "evidence_scope": "PostgreSQL server-major compatibility", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--postgresql-database-unsupported", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + }, + { + "family": "notary_activation", + "code": "notary.state.postgresql.durability_unsafe", + "owner": "registry_notary", + "product": "registry_notary", + "phase": "runtime_activation", + "safe_meaning": "Registry Notary PostgreSQL durability settings are unsafe", + "rule": "Serving requires the documented PostgreSQL durability settings for correctness state", + "safe_remediation": "restore the required PostgreSQL durability settings, run registry-notary state doctor, and retry activation", + "field_address_pattern": null, + "evidence_scope": "PostgreSQL durability posture", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--postgresql-durability-unsafe", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + }, + { + "family": "notary_activation", + "code": "notary.state.postgresql.role_incompatible", + "owner": "registry_notary", + "product": "registry_notary", + "phase": "runtime_activation", + "safe_meaning": "Registry Notary PostgreSQL runtime role contract is incompatible", + "rule": "Serving requires the documented restricted runtime role and its attested schema binding", + "safe_remediation": "restore the documented runtime grants and role binding, run registry-notary state doctor, and retry activation", + "field_address_pattern": null, + "evidence_scope": "PostgreSQL runtime-role attributes, grants, and schema binding", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--postgresql-role-incompatible", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + }, + { + "family": "notary_activation", + "code": "notary.state.postgresql.schema_incompatible", + "owner": "registry_notary", + "product": "registry_notary", + "phase": "runtime_activation", + "safe_meaning": "Registry Notary PostgreSQL state schema contract is incompatible", + "rule": "Serving requires the exact product-owned schema, catalog, fingerprint, and privilege contract", + "safe_remediation": "restore or install the matching Registry Notary state schema, run registry-notary state doctor, and retry activation", + "field_address_pattern": null, + "evidence_scope": "PostgreSQL state schema, catalog, fingerprint, and privilege contract", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--postgresql-schema-incompatible", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + }, + { + "family": "operator_preflight", + "code": "registryctl.preflight.product_validator_not_checked", + "owner": "registryctl", + "product": "registryctl", + "phase": "product_capability", + "safe_meaning": "A required linked product validator was not checked locally.", + "rule": "registryctl.preflight.product_validator_locally_available", + "safe_remediation": "Enable the linked product validator.", + "field_address_pattern": null, + "evidence_scope": "offline local operator preflight", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registryctl--registryctl.preflight.product_validator_not_checked", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Preflight does not contact live sources or prove remote availability." + }, + { + "family": "operator_preflight", + "code": "registryctl.preflight.report_capacity_exceeded", + "owner": "registryctl", + "product": "registryctl", + "phase": "report_boundary", + "safe_meaning": "The preflight report reached its deterministic safety cap.", + "rule": "registryctl.preflight.report_capacity", + "safe_remediation": "Reduce declared preflight inputs.", + "field_address_pattern": null, + "evidence_scope": "offline local operator preflight", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registryctl--registryctl.preflight.report_capacity_exceeded", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Preflight does not contact live sources or prove remote availability." + }, + { + "family": "operator_preflight", + "code": "registryctl.preflight.runtime_file_empty", + "owner": "registryctl", + "product": "registryctl", + "phase": "runtime_file_posture", + "safe_meaning": "A declared runtime file is empty.", + "rule": "registryctl.preflight.runtime_file_bounded_regular", + "safe_remediation": "Replace the runtime file.", + "field_address_pattern": "", + "evidence_scope": "offline local operator preflight", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registryctl--registryctl.preflight.runtime_file_empty", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Preflight does not contact live sources or prove remote availability." + }, + { + "family": "operator_preflight", + "code": "registryctl.preflight.runtime_file_missing", + "owner": "registryctl", + "product": "registryctl", + "phase": "runtime_file_posture", + "safe_meaning": "A declared runtime file is missing.", + "rule": "registryctl.preflight.runtime_file_bounded_regular", + "safe_remediation": "Replace the runtime file.", + "field_address_pattern": "", + "evidence_scope": "offline local operator preflight", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registryctl--registryctl.preflight.runtime_file_missing", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Preflight does not contact live sources or prove remote availability." + }, + { + "family": "operator_preflight", + "code": "registryctl.preflight.runtime_file_not_checked", + "owner": "registryctl", + "product": "registryctl", + "phase": "runtime_file_posture", + "safe_meaning": "Runtime file posture could not be checked with the required local invariant.", + "rule": "registryctl.preflight.runtime_file_posture_supported", + "safe_remediation": "Run preflight on a supported Unix platform.", + "field_address_pattern": "", + "evidence_scope": "offline local operator preflight", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registryctl--registryctl.preflight.runtime_file_not_checked", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Preflight does not contact live sources or prove remote availability." + }, + { + "family": "operator_preflight", + "code": "registryctl.preflight.runtime_file_not_regular", + "owner": "registryctl", + "product": "registryctl", + "phase": "runtime_file_posture", + "safe_meaning": "A declared runtime file is not an acceptable bounded regular file.", + "rule": "registryctl.preflight.runtime_file_bounded_regular", + "safe_remediation": "Replace the runtime file.", + "field_address_pattern": "", + "evidence_scope": "offline local operator preflight", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registryctl--registryctl.preflight.runtime_file_not_regular", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Preflight does not contact live sources or prove remote availability." + }, + { + "family": "operator_preflight", + "code": "registryctl.preflight.runtime_file_unsafe_mode", + "owner": "registryctl", + "product": "registryctl", + "phase": "runtime_file_posture", + "safe_meaning": "A declared runtime file has unsafe local access permissions.", + "rule": "registryctl.preflight.runtime_file_safe_mode", + "safe_remediation": "Tighten runtime file permissions.", + "field_address_pattern": "", + "evidence_scope": "offline local operator preflight", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registryctl--registryctl.preflight.runtime_file_unsafe_mode", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Preflight does not contact live sources or prove remote availability." + }, + { + "family": "operator_preflight", + "code": "registryctl.preflight.runtime_file_unsafe_owner", + "owner": "registryctl", + "product": "registryctl", + "phase": "runtime_file_posture", + "safe_meaning": "A declared runtime file has an unsafe owner.", + "rule": "registryctl.preflight.runtime_file_safe_owner", + "safe_remediation": "Set the runtime file owner.", + "field_address_pattern": "", + "evidence_scope": "offline local operator preflight", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registryctl--registryctl.preflight.runtime_file_unsafe_owner", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Preflight does not contact live sources or prove remote availability." + }, + { + "family": "operator_preflight", + "code": "registryctl.preflight.secret_empty", + "owner": "registryctl", + "product": "registryctl", + "phase": "secret_availability", + "safe_meaning": "A required secret reference contains only whitespace.", + "rule": "registryctl.preflight.secret_reference_available", + "safe_remediation": "Provide a non-empty secret to the process environment.", + "field_address_pattern": "", + "evidence_scope": "offline local operator preflight", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registryctl--registryctl.preflight.secret_empty", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Preflight does not contact live sources or prove remote availability." + }, + { + "family": "operator_preflight", + "code": "registryctl.preflight.secret_missing", + "owner": "registryctl", + "product": "registryctl", + "phase": "secret_availability", + "safe_meaning": "A required secret reference is unavailable to this process.", + "rule": "registryctl.preflight.secret_reference_available", + "safe_remediation": "Provide the secret to the process environment.", + "field_address_pattern": "", + "evidence_scope": "offline local operator preflight", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registryctl--registryctl.preflight.secret_missing", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Preflight does not contact live sources or prove remote availability." + }, + { + "family": "operator_preflight", + "code": "registryctl.preflight.static_validation_not_checked", + "owner": "registryctl", + "product": "registryctl", + "phase": "static_validation", + "safe_meaning": "Required authoritative static validation was not completed.", + "rule": "registryctl.preflight.authoritative_static_validation", + "safe_remediation": "Complete authoritative static validation.", + "field_address_pattern": "", + "evidence_scope": "offline local operator preflight", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registryctl--registryctl.preflight.static_validation_not_checked", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Preflight does not contact live sources or prove remote availability." + }, + { + "family": "relay_activation", + "code": "relay.consultation.activation.artifact_registry_invalid", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "consultation_activation", + "safe_meaning": "Relay could not compile the verified consultation artifact registry.", + "rule": "The verified artifact closure must compile into one closed registry without conflicting public profiles.", + "safe_remediation": "Rebuild and verify the exact consultation artifact closure before restarting Relay.", + "field_address_pattern": null, + "evidence_scope": "verified consultation artifact closure and compiled public profiles", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--artifact-registry-invalid", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose paths, URLs, parser excerpts, hashes, credentials, identifiers, or authored values." + }, + { + "family": "relay_activation", + "code": "relay.consultation.activation.configuration_missing", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "consultation_activation", + "safe_meaning": "Relay consultation activation requires configuration that is not present.", + "rule": "The closed consultation configuration must exist before Relay compiles serving authority.", + "safe_remediation": "Provide a validated Relay consultation configuration and restart Relay.", + "field_address_pattern": null, + "evidence_scope": "Relay consultation configuration and serving authority", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--configuration-missing", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose paths, URLs, parser excerpts, hashes, credentials, identifiers, or authored values." + }, + { + "family": "relay_activation", + "code": "relay.consultation.activation.protected_metadata_invalid", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "consultation_activation", + "safe_meaning": "Relay could not construct bounded protected consultation metadata.", + "rule": "Protected metadata must contain one strict bounded public contract and its reviewed binding.", + "safe_remediation": "Regenerate and verify the consultation artifact closure, then restart Relay.", + "field_address_pattern": null, + "evidence_scope": "protected consultation metadata, public contract, and reviewed binding", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--protected-metadata-invalid", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose paths, URLs, parser excerpts, hashes, credentials, identifiers, or authored values." + }, + { + "family": "relay_activation", + "code": "relay.consultation.activation.pseudonym_material_unavailable", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "consultation_activation", + "safe_meaning": "Relay could not activate the pseudonym material required for consultation audit evidence.", + "rule": "The configured pseudonym material must be valid and bind to the current write authority.", + "safe_remediation": "Restore the reviewed pseudonym material and write authority, then restart Relay.", + "field_address_pattern": null, + "evidence_scope": "consultation pseudonym material and current write authority", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--pseudonym-material-unavailable", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose paths, URLs, parser excerpts, hashes, credentials, identifiers, or authored values." + }, + { + "family": "relay_activation", + "code": "relay.consultation.activation.quota_limits_invalid", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "consultation_activation", + "safe_meaning": "Relay could not activate the bounded consultation quota contract.", + "rule": "Public and effective quota limits must remain representable, positive, and non-widening.", + "safe_remediation": "Correct the reviewed quota limits and rebuild the consultation artifacts.", + "field_address_pattern": null, + "evidence_scope": "public and effective consultation quota limits", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--quota-limits-invalid", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose paths, URLs, parser excerpts, hashes, credentials, identifiers, or authored values." + }, + { + "family": "relay_activation", + "code": "relay.consultation.activation.source_credentials_unavailable", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "consultation_activation", + "safe_meaning": "Relay could not activate the source-credential capability required by the consultation registry.", + "rule": "Every compiled source plan must have exactly the credential capability it declares.", + "safe_remediation": "Restore the reviewed source-credential references and restart Relay.", + "field_address_pattern": null, + "evidence_scope": "compiled consultation source plans and credential capabilities", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--source-credentials-unavailable", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose paths, URLs, parser excerpts, hashes, credentials, identifiers, or authored values." + }, + { + "family": "relay_activation", + "code": "relay.consultation.activation.state_plane_unavailable", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "consultation_activation", + "safe_meaning": "Relay could not activate the consultation state plane and its current authority.", + "rule": "The state plane, durable audit boundary, quota state, and current write authority must activate together.", + "safe_remediation": "Restore the reviewed Relay state-plane dependencies and restart Relay.", + "field_address_pattern": null, + "evidence_scope": "consultation state plane, audit boundary, quota state, and write authority", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--state-plane-unavailable", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose paths, URLs, parser excerpts, hashes, credentials, identifiers, or authored values." + }, + { + "family": "relay_activation", + "code": "relay.consultation.activation.unsupported_plan", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "consultation_activation", + "safe_meaning": "A compiled consultation plan requires a capability this Relay runtime cannot activate.", + "rule": "Every plan, worker, transport, snapshot binding, and dispatch budget must use a compiled supported capability.", + "safe_remediation": "Use a Relay release that supports the reviewed plan or rebuild the plan with supported capabilities.", + "field_address_pattern": null, + "evidence_scope": "compiled consultation plan and Relay runtime capabilities", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--unsupported-plan", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose paths, URLs, parser excerpts, hashes, credentials, identifiers, or authored values." + }, + { + "family": "relay_activation", + "code": "relay.consultation.activation.workload_binding_invalid", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "consultation_activation", + "safe_meaning": "The configured consultation workload binding is incompatible with Relay authentication.", + "rule": "Issuer, audience, client binding, principal, and selector must satisfy the closed Relay workload contract.", + "safe_remediation": "Align the reviewed consultation workload binding with Relay authentication and restart Relay.", + "field_address_pattern": null, + "evidence_scope": "consultation workload binding and Relay authentication contract", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--workload-binding-invalid", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose paths, URLs, parser excerpts, hashes, credentials, identifiers, or authored values." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.admin_listener_address_in_use", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "listener_binding", + "safe_meaning": "Relay could not open the administration listener because its binding is already in use.", + "rule": "registry.relay.startup.admin_listener_binding_is_unused", + "safe_remediation": "Resolve the listener conflict for server.admin_bind in its owning deployment input; if generated, update the authored project and regenerate the Relay input, then retry.", + "field_address_pattern": null, + "evidence_scope": "configured Relay administration listener and closed bind-failure category", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--admin-listener-address-in-use", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category names server.admin_bind and address-in-use status but does not disclose its address, port, or operating-system error." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.admin_listener_permission_denied", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "listener_binding", + "safe_meaning": "Relay lacks permission to open the configured administration listener.", + "rule": "registry.relay.startup.admin_listener_binding_is_permitted", + "safe_remediation": "Choose a permitted server.admin_bind and correct the service account or network policy in its owning deployment input; regenerate generated Relay input, then retry.", + "field_address_pattern": null, + "evidence_scope": "configured Relay administration listener and closed bind-failure category", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--admin-listener-permission-denied", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category names server.admin_bind and permission-denied status but does not disclose its address, port, account identity, or operating-system error." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.admin_listener_unavailable", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "listener_binding", + "safe_meaning": "Relay could not open the configured administration listener.", + "rule": "registry.relay.startup.admin_listener_is_available", + "safe_remediation": "Check interface availability, address-family support, and deployment networking for server.admin_bind in its owning input; regenerate generated Relay input, then retry.", + "field_address_pattern": null, + "evidence_scope": "configured Relay administration listener and closed bind-failure category", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--admin-listener-unavailable", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The fallback category names server.admin_bind but does not disclose its address, port, or operating-system error." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.bundle_binding_rejected", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "bundle_verification", + "safe_meaning": "The governed bundle does not match this Relay runtime target.", + "rule": "registry.relay.startup.bundle_binding_matches_runtime", + "safe_remediation": "Use a governed bundle issued for this Relay runtime target.", + "field_address_pattern": null, + "evidence_scope": "governed bundle and Relay runtime binding", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--bundle-binding-rejected", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose configured or received binding values." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.bundle_rollback_rejected", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "bundle_activation", + "safe_meaning": "The governed bundle or override failed Relay anti-rollback checks.", + "rule": "registry.relay.startup.bundle_antirollback_satisfied", + "safe_remediation": "Use a monotonic governed bundle or an authorized break-glass selection.", + "field_address_pattern": null, + "evidence_scope": "local anti-rollback state and governed bundle or override metadata", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--bundle-rollback-rejected", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose sequences, hashes, paths, operators, or approval values." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.bundle_signature_rejected", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "bundle_verification", + "safe_meaning": "The governed bundle failed authenticity or content-integrity verification.", + "rule": "registry.relay.startup.bundle_authenticity_and_integrity_accepted", + "safe_remediation": "Rebuild and sign the complete bundle with an accepted trust configuration.", + "field_address_pattern": null, + "evidence_scope": "bundle trust metadata, signature envelope, file closure, and content digests", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--bundle-signature-rejected", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose signer identifiers, file names, hashes, or trust-anchor values." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.bundle_validation_rejected", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "bundle_verification", + "safe_meaning": "The governed bundle or local acceptance metadata is invalid.", + "rule": "registry.relay.startup.bundle_inputs_are_valid", + "safe_remediation": "Regenerate the bundle and acceptance metadata using supported formats.", + "field_address_pattern": null, + "evidence_scope": "bundle encoding, manifest, acceptance metadata, and required local inputs", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--bundle-validation-rejected", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose parser excerpts, local paths, hashes, identities, or supplied values." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.config_deprecated_field_rejected", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "config_document_validation", + "safe_meaning": "A Relay configuration document uses a field that the current runtime no longer accepts.", + "rule": "registry.relay.startup.config_uses_current_fields", + "safe_remediation": "Compare the authored input with the current Relay schema and migration guidance, replace deprecated fields, regenerate generated Relay input, then retry.", + "field_address_pattern": null, + "evidence_scope": "Relay configuration field names and the product-owned deprecated-field registry", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--config-deprecated-field-rejected", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose the configured field path, replacement, source path, or supplied values. Run authored-project validation for field-addressed guidance." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.config_document_invalid", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "config_document_validation", + "safe_meaning": "A Relay configuration or metadata document does not match its required syntax or typed schema.", + "rule": "registry.relay.startup.config_document_is_typed", + "safe_remediation": "Compare the authored input with the current Relay schema, run authored-project validation when generated, correct the document, regenerate generated Relay input, then retry.", + "field_address_pattern": null, + "evidence_scope": "Relay configuration and metadata document encoding, syntax, field grammar, and types", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--config-document-invalid", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose parser excerpts, field paths, local paths, or supplied values. It does not claim field-level diagnostics were emitted." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.config_environment_binding_rejected", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "config_environment_expansion", + "safe_meaning": "A required Relay configuration environment binding could not be expanded safely.", + "rule": "registry.relay.startup.config_environment_bindings_expand", + "safe_remediation": "Check the authored environment expressions and required deployment bindings, then run Relay doctor against the same configuration before retrying.", + "field_address_pattern": null, + "evidence_scope": "Relay configuration environment expressions and deployment-provided bindings", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--config-environment-binding-rejected", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose environment names, expansion errors, source paths, or supplied values. It does not claim field-level diagnostics were emitted." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.config_source_unavailable", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "config_loading", + "safe_meaning": "A required Relay configuration or metadata source could not be read.", + "rule": "registry.relay.startup.config_source_is_readable", + "safe_remediation": "Check the --config source and any configured metadata.source.path, restore readable input from its owner, regenerate generated Relay input instead of editing it in place, then retry.", + "field_address_pattern": null, + "evidence_scope": "Relay configuration and metadata sources", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--config-source-unavailable", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose local paths, operating-system errors, or source contents." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.config_validation_rejected", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "config_validation", + "safe_meaning": "The parsed Relay configuration failed product validation.", + "rule": "registry.relay.startup.config_product_invariants_hold", + "safe_remediation": "Run the authored-project validator, correct its field-addressed issues and governed bindings, regenerate the Relay input, then retry.", + "field_address_pattern": null, + "evidence_scope": "parsed Relay configuration and governed runtime bindings", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--config-validation-rejected", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose configured identifiers, URLs, environment names, hashes, or source values." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.consultation_artifacts_rejected", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "consultation_activation", + "safe_meaning": "The governed consultation artifact closure failed startup validation.", + "rule": "registry.relay.startup.consultation_artifact_closure_is_valid", + "safe_remediation": "Rebuild the complete hash-covered consultation artifact closure and retry.", + "field_address_pattern": null, + "evidence_scope": "governed consultation artifact closure and runtime bindings", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--consultation-artifacts-rejected", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose artifact paths, hashes, selectors, identities, or parser excerpts." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.data_listener_address_in_use", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "listener_binding", + "safe_meaning": "Relay could not open the data-plane listener because its binding is already in use.", + "rule": "registry.relay.startup.data_listener_binding_is_unused", + "safe_remediation": "Resolve the listener conflict for server.bind in its owning deployment input; if generated, update the authored project and regenerate the Relay input, then retry.", + "field_address_pattern": null, + "evidence_scope": "configured Relay data-plane listener and closed bind-failure category", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--data-listener-address-in-use", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category names server.bind and address-in-use status but does not disclose its address, port, or operating-system error." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.data_listener_permission_denied", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "listener_binding", + "safe_meaning": "Relay lacks permission to open the configured data-plane listener.", + "rule": "registry.relay.startup.data_listener_binding_is_permitted", + "safe_remediation": "Choose a permitted server.bind and correct the service account or network policy in its owning deployment input; regenerate generated Relay input, then retry.", + "field_address_pattern": null, + "evidence_scope": "configured Relay data-plane listener and closed bind-failure category", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--data-listener-permission-denied", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category names server.bind and permission-denied status but does not disclose its address, port, account identity, or operating-system error." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.data_listener_unavailable", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "listener_binding", + "safe_meaning": "Relay could not open the configured data-plane listener.", + "rule": "registry.relay.startup.data_listener_is_available", + "safe_remediation": "Check interface availability, address-family support, and deployment networking for server.bind in its owning input; regenerate generated Relay input, then retry.", + "field_address_pattern": null, + "evidence_scope": "configured Relay data-plane listener and closed bind-failure category", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--data-listener-unavailable", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The fallback category names server.bind but does not disclose its address, port, or operating-system error." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.doctor_failed", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "operator_diagnostics", + "safe_meaning": "Relay doctor found one or more blocking diagnostics.", + "rule": "registry.relay.startup.doctor_has_no_blocking_diagnostics", + "safe_remediation": "Use the static diagnostic codes and actions in the doctor report.", + "field_address_pattern": null, + "evidence_scope": "offline Relay readiness and deployment diagnostics", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--doctor-failed", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The process failure does not repeat diagnostic source values or report internals." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.runtime_initialization_failed", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "runtime_initialization", + "safe_meaning": "Relay runtime initialization failed.", + "rule": "registry.relay.startup.runtime_initializes", + "safe_remediation": "Review preceding static diagnostic codes, correct the runtime inputs, and retry.", + "field_address_pattern": null, + "evidence_scope": "Relay runtime dependencies and protected startup capabilities", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--runtime-initialization-failed", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose inner errors, paths, URLs, identities, hashes, or supplied values." + } + ], + "omissions": [] +} diff --git a/crates/registryctl/tests/fixtures/project-reports/registryctl.project_authoring_diagnostic_catalog.v1.json b/crates/registryctl/tests/fixtures/project-reports/registryctl.project_authoring_diagnostic_catalog.v1.json new file mode 100644 index 000000000..9d2f23541 --- /dev/null +++ b/crates/registryctl/tests/fixtures/project-reports/registryctl.project_authoring_diagnostic_catalog.v1.json @@ -0,0 +1 @@ +{"schema_version":"registryctl.project_authoring_diagnostic_catalog.v1","diagnostics":[{"code":"registryctl.authoring.diagnostics.truncated","phase":"aggregation","rule":"diagnostic_limit","accepted":"At most 64 diagnostics are returned in deterministic order.","safe_remediation":"Fix the reported diagnostics and run the check again.","safe_summary_policy":"no_received_value","documentation":"/reference/diagnostics/authoring/#registryctl--registryctl.authoring.diagnostics.truncated"},{"code":"registryctl.authoring.entity.invalid","phase":"semantic_validation","rule":"entity_contract","accepted":"A declared entity id and shape must match the project contract.","safe_remediation":"Correct the entity declaration with the entity schema and its project alias.","safe_summary_policy":"no_received_value","documentation":"/reference/diagnostics/authoring/#registryctl--registryctl.authoring.entity.invalid"},{"code":"registryctl.authoring.environment.invalid","phase":"semantic_validation","rule":"environment_binding","accepted":"Environment bindings must match declared products, integrations, identities, origins, and bounded generations.","safe_remediation":"Align the selected environment with the declared project contract.","safe_summary_policy":"no_received_value","documentation":"/reference/diagnostics/authoring/#registryctl--registryctl.authoring.environment.invalid"},{"code":"registryctl.authoring.file.too_large","phase":"safe_input","rule":"authored_file_size","accepted":"Authored files must remain below their documented fixed byte bound.","safe_remediation":"Reduce the file below its documented maximum size.","safe_summary_policy":"no_received_value","documentation":"/reference/diagnostics/authoring/#registryctl--registryctl.authoring.file.too_large"},{"code":"registryctl.authoring.file.unreadable","phase":"safe_input","rule":"authored_file_readability","accepted":"A regular file inside the project root must be readable.","safe_remediation":"Restore a readable regular project-relative file.","safe_summary_policy":"no_received_value","documentation":"/reference/diagnostics/authoring/#registryctl--registryctl.authoring.file.unreadable"},{"code":"registryctl.authoring.fixture.invalid","phase":"semantic_validation","rule":"fixture_contract","accepted":"Fixtures must be deterministic, bounded, and satisfy the integration contract without live values.","safe_remediation":"Correct the fixture declaration and its closed interaction contract.","safe_summary_policy":"no_received_value","documentation":"/reference/diagnostics/authoring/#registryctl--registryctl.authoring.fixture.invalid"},{"code":"registryctl.authoring.fixture.reserved_body_field","phase":"syntax","rule":"fixture_body_file_reference","accepted":"A fixture body object may use `file` only as the closed body-file reference shape.","safe_remediation":"Use the documented body-file reference shape or an inline JSON body.","safe_summary_policy":"received_type_only","documentation":"/reference/diagnostics/authoring/#registryctl--registryctl.authoring.fixture.reserved_body_field"},{"code":"registryctl.authoring.integration.invalid","phase":"semantic_validation","rule":"integration_contract","accepted":"An integration alias, capability, and declared contract must be internally consistent.","safe_remediation":"Correct the integration declaration with the integration schema.","safe_summary_policy":"no_received_value","documentation":"/reference/diagnostics/authoring/#registryctl--registryctl.authoring.integration.invalid"},{"code":"registryctl.authoring.path.unsafe","phase":"safe_input","rule":"project_relative_path","accepted":"Paths must be normalized project-relative paths to regular non-symlink entries.","safe_remediation":"Use a normalized project-relative regular file path.","safe_summary_policy":"no_received_value","documentation":"/reference/diagnostics/authoring/#registryctl--registryctl.authoring.path.unsafe"},{"code":"registryctl.authoring.project.invalid","phase":"semantic_validation","rule":"project_contract","accepted":"Project services, entities, integrations, and references must form a closed valid graph.","safe_remediation":"Align the project declaration and referenced contracts.","safe_summary_policy":"no_received_value","documentation":"/reference/diagnostics/authoring/#registryctl--registryctl.authoring.project.invalid"},{"code":"registryctl.authoring.project.scope_collision","phase":"semantic_validation","rule":"authorization_scope_uniqueness","accepted":"Effective authorization scopes must be distinct across records API and attribute-release access.","safe_remediation":"Assign distinct scopes to each authorization purpose.","safe_summary_policy":"no_received_value","documentation":"/reference/diagnostics/authoring/#registryctl--registryctl.authoring.project.scope_collision"},{"code":"registryctl.authoring.script.closed_contract_violation","phase":"script_validation","rule":"released_script_contract","accepted":"Scripts must use the released bounded Script contract and module rules.","safe_remediation":"Use only the released bounded Script contract.","safe_summary_policy":"no_received_value","documentation":"/reference/diagnostics/authoring/#registryctl--registryctl.authoring.script.closed_contract_violation"},{"code":"registryctl.authoring.script.invalid_signature","phase":"script_validation","rule":"script_entrypoint_signature","accepted":"The Script entrypoint must be exactly `consult(context)`.","safe_remediation":"Define the exact released entrypoint signature.","safe_summary_policy":"no_received_value","documentation":"/reference/diagnostics/authoring/#registryctl--registryctl.authoring.script.invalid_signature"},{"code":"registryctl.authoring.script.syntax_error","phase":"script_validation","rule":"script_syntax","accepted":"The Script source must parse under the released runtime.","safe_remediation":"Correct the Script syntax at the reported location.","safe_summary_policy":"no_received_value","documentation":"/reference/diagnostics/authoring/#registryctl--registryctl.authoring.script.syntax_error"},{"code":"registryctl.authoring.script.unknown_function","phase":"script_validation","rule":"script_entrypoint","accepted":"The Script must define the released `consult(context)` entrypoint.","safe_remediation":"Define consult(context) as the Script entrypoint.","safe_summary_policy":"no_received_value","documentation":"/reference/diagnostics/authoring/#registryctl--registryctl.authoring.script.unknown_function"},{"code":"registryctl.authoring.yaml.invalid_syntax","phase":"syntax","rule":"closed_yaml_document","accepted":"YAML must parse as the selected closed authoring document shape.","safe_remediation":"Correct the YAML with the matching authoring schema.","safe_summary_policy":"received_type_only","documentation":"/reference/diagnostics/authoring/#registryctl--registryctl.authoring.yaml.invalid_syntax"},{"code":"registryctl.authoring.yaml.unknown_field","phase":"syntax","rule":"closed_yaml_unknown_field","accepted":"Only documented fields in the closed authoring schema are accepted.","safe_remediation":"Remove the unsupported field or replace it with its documented field.","safe_summary_policy":"received_type_only","documentation":"/reference/diagnostics/authoring/#registryctl--registryctl.authoring.yaml.unknown_field","replacement":"No deprecated replacement is implied by an unknown field; use only a documented field.","changed_behavior":"Unknown fields are rejected rather than ignored."}]} diff --git a/crates/registryctl/tests/fixtures/project-reports/registryctl.project_command.v1.json b/crates/registryctl/tests/fixtures/project-reports/registryctl.project_command.v1.json new file mode 100644 index 000000000..5d6bcc59a --- /dev/null +++ b/crates/registryctl/tests/fixtures/project-reports/registryctl.project_command.v1.json @@ -0,0 +1,48 @@ +{ + "schema_version": "registryctl.project_command.v1", + "status": "valid", + "project": "fictional-citizen-registry", + "environment": "local", + "fixtures": [ + { + "integration": "person-record", + "fixture": "active-person", + "inputs": [ + "person_id" + ], + "calls": [ + "lookup" + ], + "outputs": [ + "active" + ], + "claims": [ + "is_active" + ], + "outcome": "matched", + "source_access": false, + "passed": true + } + ], + "semantic_changes": [ + { + "dimension": "integration" + } + ], + "baseline": "initial_without_baseline", + "semantic_impact": { + "schema_version": "registry.project.semantic_impact.v1", + "baseline": "initial_without_baseline", + "changes": [] + }, + "artifact_manifest": { + "path": ".registry-stack/build/local/artifact-manifest.json", + "digest": "sha256:6666666666666666666666666666666666666666666666666666666666666666" + }, + "explanation": { + "schema_version": "registry.project.explanation.v1", + "project": "fictional-citizen-registry", + "environment": "local", + "fields": [] + } +} diff --git a/crates/registryctl/tests/fixtures/project-reports/registryctl.project_diagnostics.v1.json b/crates/registryctl/tests/fixtures/project-reports/registryctl.project_diagnostics.v1.json new file mode 100644 index 000000000..384e72b6a --- /dev/null +++ b/crates/registryctl/tests/fixtures/project-reports/registryctl.project_diagnostics.v1.json @@ -0,0 +1,28 @@ +{ + "schema_version": "registryctl.project_diagnostics.v1", + "status": "invalid", + "diagnostics": [ + { + "code": "registryctl.authoring.yaml.unknown_field", + "file": "integrations/eligibility/fixtures/example.yaml", + "field": "interactions.body", + "line": 12, + "column": 5, + "schema_hint": "registryctl authoring schema --kind fixture > fixture.schema.json", + "addresses": [ + { + "file": "integrations/eligibility/fixtures/example.yaml", + "pointer": "/interactions/body" + } + ], + "phase": "syntax", + "rule": "closed_yaml_unknown_field", + "accepted": "Only documented fields in the closed authoring schema are accepted.", + "safe_summary_policy": "received_type_only", + "received_summary": "invalid_type_or_shape", + "documentation": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.yaml.unknown_field", + "cause": "The YAML document contains an unknown field.", + "remediation": "Correct the fixture YAML using the fixture authoring schema." + } + ] +} diff --git a/crates/registryctl/tests/fixtures/project-reports/registryctl.project_preflight.v1.json b/crates/registryctl/tests/fixtures/project-reports/registryctl.project_preflight.v1.json new file mode 100644 index 000000000..1b772ffb6 --- /dev/null +++ b/crates/registryctl/tests/fixtures/project-reports/registryctl.project_preflight.v1.json @@ -0,0 +1,134 @@ +{ + "schema_version": "registryctl.project_preflight.v1", + "status": "ready", + "project": "country-registry", + "environment": "production", + "execution": { + "mode": "offline", + "contact": "none", + "network": "not_attempted", + "live_reachability": "not_attempted", + "fixture_execution": "not_attempted", + "external_processes": "not_attempted", + "build_output": "not_written" + }, + "runtime_boundary": { + "posture_scope": "current_mount_namespace_and_effective_identity", + "permission_invariant": "unix_owner_and_mode_enforced" + }, + "static_checks": [ + { + "capability": "project_model", + "addresses": [ + { + "file": "registry-stack.yaml", + "pointer": "" + } + ], + "state": "static_valid" + }, + { + "capability": "environment_completeness", + "addresses": [ + { + "file": "environments/production.yaml", + "pointer": "" + }, + { + "file": "registry-stack.yaml", + "pointer": "/services" + } + ], + "state": "static_valid" + }, + { + "capability": "origin_relationships", + "addresses": [ + { + "file": "environments/production.yaml", + "pointer": "/integrations/people/source/origin" + }, + { + "file": "integrations/people/integration.yaml", + "pointer": "/http" + } + ], + "state": "static_valid" + }, + { + "capability": "non_widening_bounds", + "addresses": [ + { + "file": "environments/production.yaml", + "pointer": "/integrations/people/source" + }, + { + "file": "integrations/people/integration.yaml", + "pointer": "/bounds" + } + ], + "state": "static_valid" + } + ], + "product_validators": [ + { + "product": "registry_relay", + "capability": "configuration_validation", + "state": "locally_available" + }, + { + "product": "registry_notary", + "capability": "configuration_validation", + "state": "locally_available" + } + ], + "secret_checks": [ + { + "consumers": [ + "source_bearer_token", + "source_oauth_client_secret" + ], + "addresses": [ + { + "file": "environments/production.yaml", + "pointer": "/integrations/benefits/source/credential/client_secret" + }, + { + "file": "environments/production.yaml", + "pointer": "/integrations/people/source/credential/token" + } + ], + "state": "available" + } + ], + "runtime_files": [ + { + "kind": "source_ca", + "addresses": [ + { + "file": "environments/production.yaml", + "pointer": "/integrations/people/source/ca/file" + } + ], + "generation": "declared", + "state": "available" + }, + { + "kind": "notary_to_relay_token", + "addresses": [ + { + "file": "environments/production.yaml", + "pointer": "/notary_relay/token_file" + } + ], + "generation": "not_declared", + "state": "available" + } + ], + "diagnostics": [], + "limits": { + "max_checks": 256, + "max_diagnostics": 256, + "truncated": false + } +} diff --git a/crates/registryctl/tests/project_authoring.rs b/crates/registryctl/tests/project_authoring.rs index 886a8533a..c1d60116d 100644 --- a/crates/registryctl/tests/project_authoring.rs +++ b/crates/registryctl/tests/project_authoring.rs @@ -4,12 +4,18 @@ use std::collections::BTreeSet; use std::path::{Path, PathBuf}; use registryctl::{ - add_config_anchor_key, build_registry_project, check_registry_project, init_config_anchor, - init_registry_project, render_project_authoring_diagnostics, setup_registry_project_editor, - sign_config_bundle, test_registry_project, test_registry_project_selected, - verify_config_bundle_cli, BundleSignOptions, InitSource, ProjectAuthoringDiagnostics, - ProjectBuildOptions, ProjectCheckOptions, ProjectEditorSetupOptions, ProjectInitOptions, - ProjectSchemaKind, ProjectStarter, ProjectTestOptions, ProjectTestSelection, + add_config_anchor_key, build_registry_project_with_baselines_and_context, + build_registry_project_with_context, check_registry_project_with_context, + compare_registry_projects_semantically, init_config_anchor, init_registry_project, + inspect_project_capabilities, preflight_registry_project, render_project_authoring_diagnostics, + setup_registry_project_editor, sign_config_bundle, test_registry_project_selected_with_context, + test_registry_project_with_context, verify_config_bundle_cli, BundleSignOptions, + ClassifierSafeReportedValue, InitSource, ProjectAuthoringDiagnostics, + ProjectBuildBaselineSetOptions, ProjectBuildOptions, ProjectCapabilityOptions, + ProjectCheckOptions, ProjectEditorSetupOptions, ProjectExecutionContext, + ProjectExplanationReportV1, ProjectFieldAddress, ProjectFieldExplanation, ProjectInitOptions, + ProjectPreflightOptions, ProjectSchemaKind, ProjectSemanticComparisonOptions, ProjectStarter, + ProjectTestOptions, ProjectTestSelection, SemanticComparisonEquivalence, }; use serde::Deserialize; use sha2::{Digest as _, Sha256}; @@ -53,6 +59,99 @@ fn golden(name: &str) -> PathBuf { .join(name) } +fn project_execution_context() -> ProjectExecutionContext { + ProjectExecutionContext::new(env!("CARGO_BIN_EXE_registryctl")) + .expect("Cargo provides the real registryctl executable") +} + +fn test_registry_project( + options: &ProjectTestOptions, +) -> anyhow::Result { + test_registry_project_with_context(options, &project_execution_context()) +} + +fn test_registry_project_selected( + options: &ProjectTestOptions, + selection: &ProjectTestSelection, +) -> anyhow::Result { + test_registry_project_selected_with_context(options, selection, &project_execution_context()) +} + +fn check_registry_project( + options: &ProjectCheckOptions, +) -> anyhow::Result { + check_registry_project_with_context(options, &project_execution_context()) +} + +fn build_registry_project( + options: &ProjectBuildOptions, +) -> anyhow::Result { + build_registry_project_with_context(options, &project_execution_context()) +} + +fn project_explanation_field<'a>( + report: &'a ProjectExplanationReportV1, + path: &str, +) -> &'a ProjectFieldExplanation { + report + .fields + .iter() + .find(|field| { + matches!( + &field.address, + ProjectFieldAddress::Project { path: actual } if actual.as_str() == path + ) + }) + .unwrap_or_else(|| panic!("project explanation field {path} exists")) +} + +fn integration_explanation_field<'a>( + report: &'a ProjectExplanationReportV1, + integration: &str, + path: &str, +) -> &'a ProjectFieldExplanation { + report + .fields + .iter() + .find(|field| { + matches!( + &field.address, + ProjectFieldAddress::Integration { + integration: actual_integration, + path: actual_path, + } if actual_integration == integration && actual_path.as_str() == path + ) + }) + .unwrap_or_else(|| panic!("integration explanation field {integration}{path} exists")) +} + +fn environment_explanation_field<'a>( + report: &'a ProjectExplanationReportV1, + environment: &str, + path: &str, +) -> &'a ProjectFieldExplanation { + report + .fields + .iter() + .find(|field| { + matches!( + &field.address, + ProjectFieldAddress::Environment { + environment: actual_environment, + path: actual_path, + } if actual_environment == environment && actual_path.as_str() == path + ) + }) + .unwrap_or_else(|| panic!("environment explanation field {environment}{path} exists")) +} + +fn public_explanation_value(field: &ProjectFieldExplanation) -> &serde_json::Value { + let ClassifierSafeReportedValue::Public { value } = &field.reported_value else { + panic!("expected classifier-approved explanation value"); + }; + value.as_value() +} + fn repository_root() -> PathBuf { Path::new(env!("CARGO_MANIFEST_DIR")).join("../..") } @@ -280,14 +379,14 @@ fn project_check_aggregates_script_host_call_and_environment_diagnostics_safely( let human = render_project_authoring_diagnostics(&report); let json = serde_json::to_string_pretty(&report).expect("diagnostics serialize"); let debug = format!("{report:#?}"); + assert_eq!( + human + .matches("registryctl.authoring.script.unknown_function") + .count(), + 1, + "{human}" + ); for rendered in [&human, &json, &debug] { - assert_eq!( - rendered - .matches("registryctl.authoring.script.unknown_function") - .count(), - 1, - "{rendered}" - ); for forbidden in [ ARGUMENT_MARKER, ENVIRONMENT_MARKER, @@ -353,7 +452,7 @@ fn project_check_keeps_script_probe_stable_across_metadata_and_ignores_non_calls integration["source"]["product"] = serde_norway::Value::String("unrelated-product-metadata".to_string()); integration["source"]["versions"] = - serde_norway::from_str("unverified: [9.9]\n").expect("version metadata"); + serde_norway::from_str("unverified: ['9.9']\n").expect("version metadata"); write_yaml(&integration_path, &integration); assert_eq!(authoring_diagnostics(&project), baseline); } @@ -383,15 +482,16 @@ fn project_check_root_parse_gates_references_but_keeps_selected_environment_synt } #[test] -fn project_check_reports_two_independent_environment_errors_once_each() { +fn project_check_reports_two_schema_valid_environment_errors_once_each() { let temporary = tempfile::tempdir().expect("temporary directory"); let project = copy_project("custom-system", temporary.path()); let environment_path = project.join("environments/local.yaml"); let mut environment = read_yaml(&environment_path); environment["integrations"]["eligibility"]["source"]["origin"] = - serde_norway::Value::String("http://unsafe-origin-marker.invalid".to_string()); - environment["integrations"]["eligibility"]["source"]["credential"]["generation"] = - serde_norway::Value::Number(0.into()); + serde_norway::Value::String("https://user@unsafe-origin-marker.invalid".to_string()); + environment["integrations"]["eligibility"]["source"]["credential"] = + serde_norway::from_str("token: { secret: HOUSEHOLD_TOKEN }\ngeneration: 1\n") + .expect("schema-valid incompatible credential"); write_yaml(&environment_path, &environment); let report = authoring_diagnostics(&project); @@ -787,11 +887,6 @@ fn project_check_collects_all_safe_missing_integration_references_without_cascad && diagnostic.column.is_none() })); let json = serde_json::to_string(&report).expect("missing references serialize"); - assert_eq!( - json.matches("registryctl.authoring.file.unreadable") - .count(), - 2 - ); assert!(!json.contains("project.invalid")); assert!(!json.contains("environment.invalid")); assert!(!json.contains(&temporary.path().display().to_string())); @@ -891,8 +986,9 @@ fn project_check_unsafe_inputs_are_terminal_and_value_free() { #[test] fn project_authoring_catalog_classifies_every_golden_and_only_five_starters() { const GOLDEN_SOURCE_PREFIX: &str = "crates/registryctl/tests/fixtures/project-authoring/"; - const SUPPORTED_STEPS: [&str; 7] = - ["init", "editor", "trace", "watch", "test", "check", "build"]; + const SUPPORTED_STEPS: [&str; 8] = [ + "init", "editor", "trace", "watch", "test", "check", "compare", "build", + ]; let catalog = project_authoring_journey_catalog(); assert_eq!(catalog.version, 1); @@ -1035,6 +1131,11 @@ fn project_authoring_catalog_classifies_every_golden_and_only_five_starters() { "{} non-starter cannot initialize", journey.id ); + assert!( + !journey.steps.contains(&"compare".to_string()), + "{} non-starter has no embedded-starter baseline", + journey.id + ); } if let Some(name) = journey.source.strip_prefix(GOLDEN_SOURCE_PREFIX) { catalog_goldens.insert(name); @@ -1150,6 +1251,27 @@ fn every_cataloged_supported_project_authoring_command_is_automated() { .unwrap_or_else(|error| panic!("{} editor setup failed: {error:#}", journey.id)); assert_eq!(report.status, "configured", "{} editor", journey.id); } + + let comparison = + compare_registry_projects_semantically(&ProjectSemanticComparisonOptions { + current_project_directory: project.clone(), + current_environment: journey.environment.clone(), + baseline_project_directory: catalog_workspace(&journey), + baseline_environment: journey.environment.clone(), + }) + .unwrap_or_else(|error| panic!("{} semantic comparison failed: {error:#}", journey.id)); + assert_eq!( + comparison.equivalence, + SemanticComparisonEquivalence::Equivalent, + "{} semantic comparison", + journey.id + ); + assert!( + comparison.changes.is_empty(), + "{} semantic comparison changes", + journey.id + ); + if journey.steps.contains(&"trace".to_string()) { let (integration, fixture) = catalog_focused_selection(&journey); let report = test_registry_project_selected( @@ -1203,14 +1325,14 @@ fn every_cataloged_supported_project_authoring_command_is_automated() { assert!(check.explanation.is_some(), "{} explanation", journey.id); let build = build_registry_project(&ProjectBuildOptions { - project_directory: project, + project_directory: project.clone(), environment: journey.environment.clone(), against: None, anchor: None, }) .unwrap_or_else(|error| panic!("{} build failed: {error:#}", journey.id)); assert_eq!(build.status, "built", "{} build", journey.id); - let output = PathBuf::from(build.output.expect("catalog build output")); + let output = resolve_build_output(&project, build.output.expect("catalog build output")); let relay = output.join("private/relay"); let notary = output.join("private/notary"); match journey.topology.as_str() { @@ -1538,12 +1660,23 @@ fn exact_sources_report_reviewable_ambiguity_not_applicable_evidence() { anchor: None, }) .unwrap_or_else(|error| panic!("{project} check failed: {error:#}")); - let ambiguity = &report.explanation.as_ref().expect("explanation")["integrations"] - [integration]["not_applicable"]["ambiguity"]; - assert_eq!(ambiguity["request_fixture"], fixture, "{project}"); - assert!(ambiguity["rationale"] - .as_str() - .is_some_and(|rationale| rationale.len() >= 24)); + let explanation = report.explanation.as_ref().expect("explanation"); + for path in [ + "/not_applicable/ambiguity/request_fixture", + "/not_applicable/ambiguity/rationale", + ] { + assert!( + matches!( + integration_explanation_field(explanation, integration, path).reported_value, + ClassifierSafeReportedValue::Redacted { .. } + ), + "{project} must retain the reviewable field address without reporting its value" + ); + } + assert!( + !fixture.is_empty(), + "{project} keeps the request fixture in authored input" + ); assert!(!report .fixtures .iter() @@ -1577,12 +1710,23 @@ fn response_contracts_without_comparable_identifiers_report_subject_mismatch_evi anchor: None, }) .unwrap_or_else(|error| panic!("{project} check failed: {error:#}")); - let reason = &report.explanation.as_ref().expect("explanation")["integrations"] - [integration]["not_applicable"]["subject_mismatch"]; - assert_eq!(reason["request_fixture"], fixture, "{project}"); - assert!(reason["rationale"] - .as_str() - .is_some_and(|rationale| rationale.len() >= 24)); + let explanation = report.explanation.as_ref().expect("explanation"); + for path in [ + "/not_applicable/subject_mismatch/request_fixture", + "/not_applicable/subject_mismatch/rationale", + ] { + assert!( + matches!( + integration_explanation_field(explanation, integration, path).reported_value, + ClassifierSafeReportedValue::Redacted { .. } + ), + "{project} must retain the reviewable field address without reporting its value" + ); + } + assert!( + !fixture.is_empty(), + "{project} keeps the request fixture in authored input" + ); assert!(!report.fixtures.iter().any(|fixture| { fixture.expected_error.as_deref() == Some("failure.subject_mismatch") })); @@ -1879,7 +2023,7 @@ fn local_rhai_modules_are_a_static_hash_covered_closure() { anchor: None, }; let first = build_registry_project(&options).expect("project with local module builds"); - let first_output = PathBuf::from(first.output.expect("first build output")); + let first_output = resolve_build_output(&project, first.output.expect("first build output")); let compiled_path = first_output.join("private/relay/config/artifacts/rhai/health-record.rhai"); let compiled = std::fs::read_to_string(&compiled_path).expect("compiled closure reads"); assert!(compiled.contains("registry-local-module:lib/normalize.rhai")); @@ -1890,7 +2034,7 @@ fn local_rhai_modules_are_a_static_hash_covered_closure() { std::fs::write(&module, "fn normalize_status(value) { value == () }\n") .expect("local module changes"); let second = build_registry_project(&options).expect("changed local module builds"); - let second_output = PathBuf::from(second.output.expect("second build output")); + let second_output = resolve_build_output(&project, second.output.expect("second build output")); assert_ne!( closure_digest(&first_closure), closure_digest(&directory_closure(&second_output)), @@ -1918,7 +2062,7 @@ fn public_rhai_commands_accept_the_released_contract_for_an_unknown_product() { replace_in_file( &project.join("integrations/health-record/integration.yaml"), "versions: { unverified: [2.41.9] }", - "versions: { unverified: [7.3] }", + "versions: { unverified: ['7.3'] }", ); let metadata_free = copy_project("dhis2-script", &absent_root); @@ -1952,14 +2096,17 @@ fn public_rhai_commands_accept_the_released_contract_for_an_unknown_product() { assert_eq!(check_report.status, "valid"); let build_report = build_registry_project(&ProjectBuildOptions { - project_directory, + project_directory: project_directory.clone(), environment: "local".to_string(), against: None, anchor: None, }) .expect("product-neutral Rhai project builds"); assert_eq!(build_report.status, "built"); - let output = PathBuf::from(build_report.output.expect("build output")); + let output = resolve_build_output( + &project_directory, + build_report.output.expect("build output"), + ); let pack: serde_json::Value = serde_json::from_slice( &std::fs::read( output.join("private/relay/config/artifacts/integration-packs/health-record.json"), @@ -2196,6 +2343,10 @@ fn typed_target_attribute_executes_through_the_offline_notary_journey() { for entry in std::fs::read_dir(&fixture_directory).expect("starter fixtures") { let path = entry.expect("fixture entry").path(); let fixture = std::fs::read_to_string(&path).expect("fixture file"); + let fixture = fixture.replace( + " identifiers: [{ scheme: registry_person_id, value: AB-123456 }]", + " attributes: { person_sequence: 1 }", + ); std::fs::write(&path, fixture.replace("AB-123456", "1")).expect("typed fixture writes"); } @@ -2610,7 +2761,7 @@ fn editor_setup_rejects_symlinked_output_ancestors_without_writes() { } #[test] -fn check_explain_reports_starter_divergence_and_runtime_abi() { +fn check_explain_reports_adapted_identity_and_effective_http_contract() { let temporary = tempfile::tempdir().expect("temporary directory"); let project = temporary.path().join("registry-project"); init_registry_project(&ProjectInitOptions { @@ -2636,22 +2787,29 @@ fn check_explain_reports_starter_divergence_and_runtime_abi() { }) .expect("adapted starter remains valid"); let explanation = checked.explanation.expect("explanation"); - assert_eq!(explanation["starter"]["id"], "http"); - assert_eq!(explanation["starter"]["state"], "diverged"); - assert_ne!( - explanation["starter"]["expected_content_digest"], - explanation["starter"]["current_content_digest"] - ); + assert_eq!(explanation.project, "adapted-citizen-registry"); assert_eq!( - explanation["platform"]["defaults_release"], - env!("CARGO_PKG_VERSION") - ); - assert_eq!(explanation["platform"]["script_runtime"], "rhai_v1"); - assert_eq!(explanation["platform"]["script_abi"], "xw.v1"); + public_explanation_value(integration_explanation_field( + &explanation, + "person-record", + "/capability/type", + )), + &serde_json::json!("http") + ); + let request_bytes = + integration_explanation_field(&explanation, "person-record", "/limits/request_bytes"); + assert!(request_bytes + .default + .as_ref() + .is_some_and(|default| default.applied)); + assert!(matches!( + project_explanation_field(&explanation, "/registry/id").reported_value, + ClassifierSafeReportedValue::Redacted { .. } + )); } #[test] -fn check_explain_reports_environment_starter_divergence() { +fn check_explain_reports_environment_binding_without_origin_value() { let temporary = tempfile::tempdir().expect("temporary directory"); let project = temporary.path().join("registry-project"); init_registry_project(&ProjectInitOptions { @@ -2680,15 +2838,169 @@ fn check_explain_reports_environment_starter_divergence() { }) .expect("adapted environment remains valid"); let explanation = checked.explanation.expect("explanation"); - assert_eq!(explanation["starter"]["id"], "http"); - assert_eq!(explanation["starter"]["state"], "diverged"); - assert_ne!( - explanation["starter"]["expected_content_digest"], - explanation["starter"]["current_content_digest"] + assert_eq!(explanation.environment, "local"); + assert!(matches!( + environment_explanation_field( + &explanation, + "local", + "/integrations/person-record/source/origin", + ) + .reported_value, + ClassifierSafeReportedValue::Redacted { .. } + )); + let serialized = serde_json::to_string(&explanation).expect("explanation serializes"); + assert!(!serialized.contains("adapted-citizen-registry.invalid")); +} + +#[test] +fn offline_preflight_reports_missing_local_requirements_without_leaking_references() { + let temporary = tempfile::tempdir().expect("temporary directory"); + let project = temporary.path().join("registry-project"); + init_registry_project(&ProjectInitOptions { + starter: ProjectStarter::Http, + directory: project.clone(), + }) + .expect("starter initializes"); + + let report = preflight_registry_project(&ProjectPreflightOptions { + project_directory: project, + environment: "local".to_owned(), + }) + .expect("offline preflight produces a bounded report"); + assert_eq!(report.status, registryctl::PreflightStatus::NotReady); + assert_eq!(report.static_checks.len(), 4); + assert_eq!(report.product_validators.len(), 2); + assert!(!report.secret_checks.is_empty()); + assert!(!report.runtime_files.is_empty()); + assert_eq!( + report.execution, + registryctl::PreflightExecutionBoundary::default() + ); + + let serialized = serde_json::to_string(&report).expect("preflight report serializes"); + for forbidden in [ + "FICTIONAL_REGISTRY_TOKEN", + "REGISTRY_NOTARY_ISSUER_JWK", + "EVIDENCE_CLIENT_TOKEN_HASH", + "/run/secrets/relay-workload-token", + "citizen-registry.invalid", + "fictional-registry-notary", + ] { + assert!( + !serialized.contains(forbidden), + "preflight report must not contain {forbidden}" + ); + } +} + +#[test] +fn capability_inventory_separates_static_support_from_runtime_and_image_evidence() { + let temporary = tempfile::tempdir().expect("temporary directory"); + let project = temporary.path().join("registry-project"); + init_registry_project(&ProjectInitOptions { + starter: ProjectStarter::Http, + directory: project.clone(), + }) + .expect("starter initializes"); + + let report = inspect_project_capabilities(&ProjectCapabilityOptions { + project_directory: project, + environment: "local".to_owned(), + }) + .expect("capability inventory builds from validated local facts"); + let http = report + .capabilities + .iter() + .find(|record| record.capability == registryctl::CapabilityId::SourceHttp) + .expect("HTTP capability is inventoried"); + assert_eq!( + http.project_declaration, + registryctl::ProjectDeclarationState::Declared + ); + assert_eq!( + http.environment_enablement, + registryctl::EnvironmentEnablementState::Enabled + ); + assert_eq!(http.disposition, registryctl::CapabilityDisposition::Used); + let script = report + .capabilities + .iter() + .find(|record| record.capability == registryctl::CapabilityId::SourceScript) + .expect("script capability is inventoried"); + assert_eq!( + script.installed_evidence, + registryctl::InstalledCapabilityEvidence::EmbeddedCompiler + ); + assert_eq!( + report.runtime_activation, + registryctl::RuntimeActivationEvaluation::NotEvaluated + ); + for image in [ + registryctl::SupportComponent::RegistryRelayImage, + registryctl::SupportComponent::RegistryNotaryImage, + ] { + let support = report + .support + .iter() + .find(|entry| entry.component == image) + .expect("image support is represented"); + assert_eq!(support.state, registryctl::SupportState::NotEvaluated); + assert_eq!(support.evidence, registryctl::SupportEvidence::NoEvidence); + } + + let report_value = serde_json::to_value(&report).expect("capability report serializes"); + let schema = serde_json::from_str(include_str!( + "../schemas/project-reports/registry.project.capability_inventory.v1.schema.json" + )) + .expect("capability schema parses"); + let validator = jsonschema::JSONSchema::options() + .with_draft(jsonschema::Draft::Draft202012) + .compile(&schema) + .expect("capability schema compiles"); + if let Err(errors) = validator.validate(&report_value) { + let details = errors.map(|error| error.to_string()).collect::>(); + panic!("real command report should validate: {details:?}"); + } + let decoded: registryctl::ProjectCapabilityInventoryReportV1 = + serde_json::from_value(report_value).expect("real command report passes strict ingress"); + assert_eq!(decoded, report); +} + +#[test] +fn capability_inventory_attributes_only_registry_backed_claims_to_the_source() { + let temporary = tempfile::tempdir().expect("temporary directory"); + let project = copy_project("custom-system", temporary.path()); + let project_path = project.join("registry-stack.yaml"); + let mut document = read_yaml(&project_path); + document["services"]["household-eligibility"]["claims"]["applicant-declaration"] = + serde_norway::from_str("cel: 'true'\nvalue: { type: boolean }\ndisclosure: predicate\n") + .expect("source-free claim"); + write_yaml(&project_path, &document); + + let report = inspect_project_capabilities(&ProjectCapabilityOptions { + project_directory: project, + environment: "local".to_owned(), + }) + .expect("mixed registry-backed and source-free evidence inventories"); + let http = report + .capabilities + .iter() + .find(|record| record.capability == registryctl::CapabilityId::SourceHttp) + .expect("HTTP capability is inventoried"); + assert_eq!(http.used_by.services, 1); + assert_eq!(http.used_by.consultations, 1); + assert_eq!( + http.used_by.claims, 3, + "the source-free claim must not inherit the service's HTTP consultation" ); + let notary = report + .capabilities + .iter() + .find(|record| record.capability == registryctl::CapabilityId::RegistryNotaryProduct) + .expect("Notary product capability is inventoried"); assert_eq!( - explanation["environment_binding"]["integrations"]["person-record"]["source_origin"], - "https://adapted-citizen-registry.invalid" + notary.used_by.claims, 4, + "Notary still owns evaluation of every claim" ); } @@ -2950,6 +3262,105 @@ fn source_product_is_metadata_not_runtime_dispatch() { assert_eq!(report.status, "passed"); } +#[test] +fn code_owned_rhai_conformance_uses_the_injected_worker_and_is_deterministic() { + let options = |project_directory| ProjectTestOptions { + project_directory, + environment: None, + live: false, + }; + let bounded = test_registry_project(&options(golden("dhis2-tracker"))) + .expect("bounded DHIS2 conformance passes") + .fixtures; + let rhai_project = golden("dhis2-script"); + let rhai = test_registry_project(&options(rhai_project.clone())) + .expect("Rhai DHIS2 conformance passes") + .fixtures; + let repeated = test_registry_project(&options(rhai_project.clone())) + .expect("repeated Rhai DHIS2 conformance passes") + .fixtures; + + let temporary = tempfile::tempdir().expect("temporary directory"); + let unknown_product = copy_project("dhis2-script", temporary.path()); + replace_in_file( + &unknown_product.join("integrations/health-record/integration.yaml"), + "product: dhis2", + "product: previously-unknown-source-system", + ); + let unknown_product_report = test_registry_project(&options(unknown_product)) + .expect("unknown product uses the same Rhai authoring contract") + .fixtures; + assert_eq!( + serde_json::to_value(&unknown_product_report).expect("unknown-product report serializes"), + serde_json::to_value(&rhai).expect("Rhai report serializes"), + "source.product may alter provenance but not Rhai fixture behavior" + ); + assert_eq!( + serde_json::to_value(&rhai).expect("first Rhai report serializes"), + serde_json::to_value(&repeated).expect("repeated Rhai report serializes"), + "fresh one-shot workers must produce deterministic fixture reports" + ); + + let rhai_by_name = rhai + .iter() + .map(|fixture| (fixture.fixture.as_str(), fixture)) + .collect::>(); + for expected in &bounded { + let actual = rhai_by_name + .get(expected.fixture.as_str()) + .unwrap_or_else(|| panic!("Rhai omitted fixture {}", expected.fixture)); + assert_eq!( + actual.inputs, expected.inputs, + "{} inputs", + expected.fixture + ); + assert_eq!(actual.calls, expected.calls, "{} calls", expected.fixture); + assert_eq!( + actual.outputs, expected.outputs, + "{} outputs", + expected.fixture + ); + assert_eq!( + actual.claims, expected.claims, + "{} claims", + expected.fixture + ); + assert_eq!( + actual.outcome, expected.outcome, + "{} outcome", + expected.fixture + ); + assert_eq!( + actual.passed, expected.passed, + "{} result", + expected.fixture + ); + } + + let traced = test_registry_project_selected( + &options(rhai_project), + &ProjectTestSelection { + integration: Some("health-record".to_string()), + fixture: Some("complete-child-health-evidence".to_string()), + trace: true, + }, + ) + .expect("focused Rhai trace passes"); + let calls = &traced.fixtures[0].calls; + assert_eq!( + calls, + &["call=1 operation=script-source-call method=GET path=/api/tracker/trackedEntities/* query=[fields,includeDeleted] headers=[] body=none"] + ); + for sensitive in ["A0000000001", "Nia", "REF-0001"] { + assert!(!calls[0].contains(sensitive)); + } + let serialized = serde_json::to_string(&traced).expect("trace report serializes"); + assert!( + !serialized.contains(env!("CARGO_BIN_EXE_registryctl")), + "the injected worker path must not enter project reports" + ); +} + #[test] fn project_integrations_share_one_logical_source_without_conflating_protocol_helpers() { let shared_root = tempfile::tempdir().expect("shared-source temporary directory"); @@ -3032,7 +3443,9 @@ fn pre_freeze_fact_authoring_keys_are_rejected_without_aliases() { live: false, }) .expect_err("integration facts alias must be rejected"); - assert!(format!("{error:#}").contains("facts")); + let rendered = format!("{error:#}"); + assert!(rendered.contains("canonical schema validation")); + assert!(!rendered.contains("facts")); let claim_root = tempfile::tempdir().expect("claim-key temporary directory"); let claim = copy_project("custom-system", claim_root.path()); @@ -3047,7 +3460,9 @@ fn pre_freeze_fact_authoring_keys_are_rejected_without_aliases() { live: false, }) .expect_err("claim fact alias must be rejected"); - assert!(format!("{error:#}").contains("fact")); + let rendered = format!("{error:#}"); + assert!(rendered.contains("canonical schema validation")); + assert!(!rendered.contains("fact:")); let fixture_root = tempfile::tempdir().expect("fixture-key temporary directory"); let fixture = copy_project("custom-system", fixture_root.path()); @@ -3059,7 +3474,9 @@ fn pre_freeze_fact_authoring_keys_are_rejected_without_aliases() { live: false, }) .expect_err("fixture facts alias must be rejected"); - assert!(format!("{error:#}").contains("facts")); + let rendered = format!("{error:#}"); + assert!(rendered.contains("canonical schema validation")); + assert!(!rendered.contains("facts")); } #[test] @@ -3124,7 +3541,12 @@ fn authored_unknown_fields_and_traversal_fail_closed() { live: false, }) .expect_err("implementation conformance mode must not be authored"); - assert!(format!("{error:#}").contains("worker_probe")); + let diagnostic = format!("{error:#}"); + assert!(diagnostic.contains("unknown field"), "{diagnostic}"); + assert!( + !diagnostic.contains("worker_probe"), + "unknown country-authored field names remain value-free" + ); let traversal = temporary.path().join("traversal"); init_registry_project(&ProjectInitOptions { @@ -3353,12 +3775,11 @@ fn project_authoring_schemas_keep_editor_annotations_and_valid_examples() { ); } - let (descriptions, defaults, examples) = schema_annotation_counts(&schema); + let (descriptions, _defaults, examples) = schema_annotation_counts(&schema); assert!( descriptions > properties.len() + definitions.len(), "{schema_name} description coverage regressed" ); - assert!(defaults >= 1, "{schema_name} needs at least one default"); assert!(examples >= 1, "{schema_name} needs at least one example"); let compiled = jsonschema::JSONSchema::options() @@ -3466,36 +3887,485 @@ fn project_schema_keeps_attribute_release_source_metadata_private() { } #[test] -fn project_check_field_addresses_records_scope_collisions() { - for (metadata_scope, expected_field, expected_cause) in [ - ( - "population:aggregate", - "services.api.scopes", - "Effective records API authorization scopes collide.", - ), - ( - "population:identity_release", - "services.api.attribute_release_profiles.release_scope", - "An attribute release scope collides with a records API authorization scope.", - ), - ] { - let temporary = tempfile::tempdir().expect("temporary directory"); - let project = copy_project("nia-attribute-release", temporary.path()); - let project_file = project.join("registry-stack.yaml"); - let mut document = read_yaml(&project_file); - document["services"]["nia-population-records"]["api"]["scopes"]["metadata"] = - serde_norway::Value::String(metadata_scope.to_string()); - write_yaml(&project_file, &document); +fn project_check_field_addresses_records_scope_collisions() { + for (metadata_scope, expected_field, expected_cause) in [ + ( + "population:aggregate", + "services.api.scopes", + "Effective records API authorization scopes collide.", + ), + ( + "population:identity_release", + "services.api.attribute_release_profiles.release_scope", + "An attribute release scope collides with a records API authorization scope.", + ), + ] { + let temporary = tempfile::tempdir().expect("temporary directory"); + let project = copy_project("nia-attribute-release", temporary.path()); + let project_file = project.join("registry-stack.yaml"); + let mut document = read_yaml(&project_file); + document["services"]["nia-population-records"]["api"]["scopes"]["metadata"] = + serde_norway::Value::String(metadata_scope.to_string()); + write_yaml(&project_file, &document); + + let report = authoring_diagnostics(&project); + let diagnostic = report + .diagnostics + .iter() + .find(|diagnostic| diagnostic.code == "registryctl.authoring.project.scope_collision") + .expect("scope collision diagnostic"); + assert_eq!(diagnostic.field, Some(expected_field)); + assert_eq!(diagnostic.cause, expected_cause); + } +} + +#[test] +fn project_check_preserves_both_exact_sides_of_cross_file_failures() { + let assert_addresses = |project: &Path, code: &str, expected: &[(&str, &str)]| { + let report = authoring_diagnostics(project); + let diagnostic = report + .diagnostics + .iter() + .find(|diagnostic| diagnostic.code == code) + .unwrap_or_else(|| panic!("missing {code}: {report:#?}")); + let addresses = diagnostic + .addresses + .iter() + .map(|address| (address.file.as_str(), address.pointer.as_str())) + .collect::>(); + assert_eq!(addresses, expected.iter().copied().collect(), "{report:#?}"); + let serialized = serde_json::to_string(&report).expect("diagnostics serialize"); + assert!(!serialized.contains(&project.display().to_string())); + }; + + let service_root = tempfile::tempdir().expect("service temporary directory"); + let service_project = copy_project("custom-system", service_root.path()); + let service_path = service_project.join("registry-stack.yaml"); + let mut service = read_yaml(&service_path); + let input = service["services"]["household-eligibility"]["consultations"]["household"]["input"] + .as_mapping_mut() + .expect("consultation input"); + let value = input + .remove(serde_norway::Value::String( + "household_reference".to_string(), + )) + .expect("selector exists"); + input.insert( + serde_norway::Value::String("unrelated_selector".to_string()), + value, + ); + write_yaml(&service_path, &service); + assert_addresses( + &service_project, + "registryctl.authoring.project.invalid", + &[ + ("integrations/eligibility/integration.yaml", "/input"), + ( + "registry-stack.yaml", + "/services/household-eligibility/consultations/household/input", + ), + ], + ); + + let entity_root = tempfile::tempdir().expect("entity temporary directory"); + let entity_project = copy_project("snapshot-with-records", entity_root.path()); + let entity_project_path = entity_project.join("registry-stack.yaml"); + let mut entity_project_document = read_yaml(&entity_project_path); + entity_project_document["services"]["people-records"]["api"]["projection"] + .as_sequence_mut() + .expect("records projection") + .push(serde_norway::Value::String("unknown_field".to_string())); + write_yaml(&entity_project_path, &entity_project_document); + assert_addresses( + &entity_project, + "registryctl.authoring.project.invalid", + &[ + ("entities/people.yaml", "/schema"), + ("registry-stack.yaml", "/services/people-records/api"), + ], + ); + + let fixture_root = tempfile::tempdir().expect("fixture temporary directory"); + let fixture_project = copy_project("custom-system", fixture_root.path()); + let fixture_path = + fixture_project.join("integrations/eligibility/fixtures/source-approved.yaml"); + let mut fixture = read_yaml(&fixture_path); + fixture["input"] + .as_mapping_mut() + .expect("fixture input") + .clear(); + fixture["input"]["unrelated_input"] = + serde_norway::Value::String("schema-valid-mismatch".to_string()); + write_yaml(&fixture_path, &fixture); + assert_addresses( + &fixture_project, + "registryctl.authoring.fixture.invalid", + &[ + ( + "integrations/eligibility/fixtures/source-approved.yaml", + "/input", + ), + ("integrations/eligibility/integration.yaml", "/input"), + ], + ); + + let not_applicable_root = tempfile::tempdir().expect("not-applicable temporary directory"); + let not_applicable_project = copy_project("custom-system", not_applicable_root.path()); + let not_applicable_fixture = + not_applicable_project.join("integrations/eligibility/fixtures/source-approved.yaml"); + let mut fixture = read_yaml(¬_applicable_fixture); + fixture["expect"]["error"] = serde_norway::Value::String("source.timeout".to_string()); + write_yaml(¬_applicable_fixture, &fixture); + assert_addresses( + ¬_applicable_project, + "registryctl.authoring.fixture.invalid", + &[ + ( + "integrations/eligibility/fixtures/source-approved.yaml", + "/expect/error", + ), + ( + "integrations/eligibility/integration.yaml", + "/not_applicable/subject_mismatch/request_fixture", + ), + ], + ); + + let environment_root = tempfile::tempdir().expect("environment temporary directory"); + let environment_project = copy_project("custom-system", environment_root.path()); + let environment_path = environment_project.join("environments/local.yaml"); + let mut environment = read_yaml(&environment_path); + environment["integrations"] + .as_mapping_mut() + .expect("environment integrations") + .clear(); + write_yaml(&environment_path, &environment); + assert_addresses( + &environment_project, + "registryctl.authoring.environment.invalid", + &[ + ("environments/local.yaml", "/integrations"), + ("integrations/eligibility/integration.yaml", "/capability"), + ], + ); +} + +#[test] +fn project_check_points_to_representative_semantic_reference_and_value_failures() { + let assert_exact_pointer = + |project: &Path, cause: &str, expected_file: &str, expected_pointer: &str| { + let report = authoring_diagnostics(project); + let diagnostic = report + .diagnostics + .iter() + .find(|diagnostic| diagnostic.cause == cause) + .unwrap_or_else(|| panic!("missing {cause}: {report:#?}")); + assert!( + diagnostic.addresses.iter().any(|address| { + address.file == expected_file && address.pointer == expected_pointer + }), + "missing {expected_file}#{expected_pointer}: {diagnostic:#?}" + ); + assert!( + diagnostic + .addresses + .iter() + .all(|address| !address.pointer.is_empty()), + "a precise semantic diagnostic degraded to a document-root address: {diagnostic:#?}" + ); + }; + + let integration_root = tempfile::tempdir().expect("integration temporary directory"); + let integration_project = copy_project("custom-system", integration_root.path()); + let project_path = integration_project.join("registry-stack.yaml"); + let mut project = read_yaml(&project_path); + project["services"]["household-eligibility"]["consultations"]["household"]["integration"] = + serde_norway::Value::String("missing-integration".to_string()); + write_yaml(&project_path, &project); + assert_exact_pointer( + &integration_project, + "A service consultation references an unknown integration.", + "registry-stack.yaml", + "/services/household-eligibility/consultations/household/integration", + ); + + let credential_root = tempfile::tempdir().expect("credential temporary directory"); + let credential_project = copy_project("custom-system", credential_root.path()); + let project_path = credential_project.join("registry-stack.yaml"); + let mut project = read_yaml(&project_path); + project["services"]["household-eligibility"]["credential_profiles"]["household-eligibility"] + ["claims"][0] = serde_norway::Value::String("missing-claim".to_string()); + write_yaml(&project_path, &project); + assert_exact_pointer( + &credential_project, + "A credential profile references an unknown claim.", + "registry-stack.yaml", + "/services/household-eligibility/credential_profiles/household-eligibility/claims/0", + ); + + let cel_root = tempfile::tempdir().expect("CEL temporary directory"); + let cel_project = copy_project("custom-system", cel_root.path()); + let project_path = cel_project.join("registry-stack.yaml"); + let mut project = read_yaml(&project_path); + project["services"]["household-eligibility"]["claims"]["household-record-exists"]["cel"] = + serde_norway::Value::String("missing_consultation.matched".to_string()); + write_yaml(&project_path, &project); + assert_exact_pointer( + &cel_project, + "A claim evaluation does not resolve to a declared consultation.", + "registry-stack.yaml", + "/services/household-eligibility/claims/household-record-exists/cel", + ); + + let validity_root = tempfile::tempdir().expect("validity temporary directory"); + let validity_project = copy_project("custom-system", validity_root.path()); + let project_path = validity_project.join("registry-stack.yaml"); + let mut project = read_yaml(&project_path); + project["services"]["household-eligibility"]["credential_profiles"]["household-eligibility"] + ["validity"] = serde_norway::Value::String("ten-minutes".to_string()); + write_yaml(&project_path, &project); + assert_exact_pointer( + &validity_project, + "The YAML document does not satisfy its canonical authoring schema.", + "registry-stack.yaml", + "/services/household-eligibility/credential_profiles/household-eligibility/validity", + ); + + let disclosure_root = tempfile::tempdir().expect("disclosure temporary directory"); + let disclosure_project = copy_project("custom-system", disclosure_root.path()); + let project_path = disclosure_project.join("registry-stack.yaml"); + let mut project = read_yaml(&project_path); + project["services"]["household-eligibility"]["claims"]["household-record-exists"] + ["disclosure"] = serde_norway::Value::String("unsupported-mode".to_string()); + write_yaml(&project_path, &project); + assert_exact_pointer( + &disclosure_project, + "The YAML document does not satisfy its canonical authoring schema.", + "registry-stack.yaml", + "/services/household-eligibility/claims/household-record-exists/disclosure", + ); +} + +#[test] +fn project_check_moves_unknown_direct_outputs_into_exact_typed_diagnostics() { + let temporary = tempfile::tempdir().expect("temporary directory"); + let project = copy_project("custom-system", temporary.path()); + let project_path = project.join("registry-stack.yaml"); + let mut authored = read_yaml(&project_path); + authored["services"]["household-eligibility"]["claims"]["household-category"]["output"] = + serde_norway::Value::String("household.unknown-output".to_string()); + write_yaml(&project_path, &authored); + + let report = authoring_diagnostics(&project); + let diagnostic = report + .diagnostics + .iter() + .find(|diagnostic| { + diagnostic.cause == "A direct claim references an unknown integration output." + }) + .unwrap_or_else(|| panic!("missing direct-output diagnostic: {report:#?}")); + assert_eq!( + diagnostic + .addresses + .iter() + .map(|address| (address.file.as_str(), address.pointer.as_str())) + .collect::>(), + BTreeSet::from([ + ("integrations/eligibility/integration.yaml", "/outputs"), + ( + "registry-stack.yaml", + "/services/household-eligibility/claims/household-category/output", + ), + ]) + ); +} + +#[test] +fn project_check_rejects_unresolvable_request_paths_and_string_source_type_mismatches() { + let path_root = tempfile::tempdir().expect("path temporary directory"); + let path_project = copy_project("custom-system", path_root.path()); + let project_path = path_project.join("registry-stack.yaml"); + let mut project = read_yaml(&project_path); + project["services"]["household-eligibility"]["consultations"]["household"]["input"] + ["household_reference"] = serde_norway::Value::String("request.ghost_field".to_string()); + write_yaml(&project_path, &project); + let report = authoring_diagnostics(&path_project); + assert!( + report.diagnostics.iter().any(|diagnostic| { + diagnostic.addresses.iter().any(|address| { + address.pointer + == "/services/household-eligibility/consultations/household/input/household_reference" + }) + }), + "{report:#?}" + ); + + let type_root = tempfile::tempdir().expect("type temporary directory"); + let type_project = copy_project("custom-system", type_root.path()); + let integration_path = type_project.join("integrations/eligibility/integration.yaml"); + let mut integration = read_yaml(&integration_path); + integration["input"]["household_reference"]["type"] = + serde_norway::Value::String("boolean".to_string()); + integration["input"]["household_reference"] + .as_mapping_mut() + .expect("input schema is a map") + .remove(serde_norway::Value::String("maxLength".to_string())); + integration["input"]["household_reference"] + .as_mapping_mut() + .expect("input schema is a map") + .remove(serde_norway::Value::String("pattern".to_string())); + write_yaml(&integration_path, &integration); + for fixture in std::fs::read_dir(type_project.join("integrations/eligibility/fixtures")) + .expect("fixture directory reads") + { + let path = fixture.expect("fixture entry").path(); + if path.extension().and_then(|extension| extension.to_str()) != Some("yaml") { + continue; + } + let mut fixture = read_yaml(&path); + fixture["input"]["household_reference"] = serde_norway::Value::Bool(true); + write_yaml(&path, &fixture); + } + + let report = authoring_diagnostics(&type_project); + let diagnostic = report + .diagnostics + .iter() + .find(|diagnostic| { + diagnostic.cause + == "A governed request string source is incompatible with its integration input." + }) + .unwrap_or_else(|| panic!("missing source-type diagnostic: {report:#?}")); + assert_eq!( + diagnostic + .addresses + .iter() + .map(|address| (address.file.as_str(), address.pointer.as_str())) + .collect::>(), + BTreeSet::from([ + ( + "integrations/eligibility/integration.yaml", + "/input/household_reference/type", + ), + ( + "registry-stack.yaml", + "/services/household-eligibility/consultations/household/input/household_reference", + ), + ]) + ); +} + +#[test] +fn project_check_keeps_same_legacy_cross_file_failures_distinct_by_address() { + let temporary = tempfile::tempdir().expect("temporary directory"); + let project = copy_project("snapshot-with-records", temporary.path()); + let project_path = project.join("registry-stack.yaml"); + let mut document = read_yaml(&project_path); + for service_id in ["benefits-eligibility", "emergency-assistance"] { + let input = document["services"][service_id]["consultations"]["person"]["input"] + .as_mapping_mut() + .expect("consultation input"); + let target = input + .remove(serde_norway::Value::String("person_id".to_string())) + .expect("person selector exists"); + input.insert( + serde_norway::Value::String("unknown_input".to_string()), + target, + ); + } + write_yaml(&project_path, &document); + + let report = authoring_diagnostics(&project); + assert_eq!(report, authoring_diagnostics(&project)); + let diagnostics = report + .diagnostics + .iter() + .filter(|diagnostic| { + diagnostic.code == "registryctl.authoring.project.invalid" + && diagnostic.field == Some("services.consultations") + }) + .collect::>(); + assert_eq!(diagnostics.len(), 2, "{report:#?}"); + let project_pointers = diagnostics + .iter() + .map(|diagnostic| { + assert_eq!( + diagnostic + .addresses + .iter() + .map(|address| (address.file.as_str(), address.pointer.as_str())) + .collect::>() + .len(), + diagnostic.addresses.len(), + "one diagnostic must not duplicate exact addresses" + ); + diagnostic + .addresses + .iter() + .find(|address| address.file == "registry-stack.yaml") + .expect("project-side address") + .pointer + .as_str() + }) + .collect::>(); + assert_eq!( + project_pointers, + vec![ + "/services/benefits-eligibility/consultations/person/input", + "/services/emergency-assistance/consultations/person/input", + ] + ); +} + +#[test] +fn project_check_addresses_an_unknown_snapshot_entity_without_fabricating_a_file() { + let temporary = tempfile::tempdir().expect("temporary directory"); + let project = copy_project("snapshot-with-records", temporary.path()); + let integration_path = project.join("integrations/person-snapshot/integration.yaml"); + let mut integration = read_yaml(&integration_path); + integration["capability"]["snapshot"]["entity"] = + serde_norway::Value::String("missing-entity".to_string()); + write_yaml(&integration_path, &integration); - let report = authoring_diagnostics(&project); - let diagnostic = report + let report = authoring_diagnostics(&project); + let matching = report + .diagnostics + .iter() + .filter(|diagnostic| { + diagnostic.code == "registryctl.authoring.project.invalid" + && diagnostic.field == Some("capability.snapshot.entity") + }) + .collect::>(); + assert_eq!(matching.len(), 1, "{report:#?}"); + assert_eq!( + matching[0] + .addresses + .iter() + .map(|address| (address.file.as_str(), address.pointer.as_str())) + .collect::>(), + vec![ + ( + "integrations/person-snapshot/integration.yaml", + "/capability/snapshot/entity", + ), + ("registry-stack.yaml", "/entities"), + ] + ); + assert!( + report .diagnostics .iter() - .find(|diagnostic| diagnostic.code == "registryctl.authoring.project.scope_collision") - .expect("scope collision diagnostic"); - assert_eq!(diagnostic.field, Some(expected_field)); - assert_eq!(diagnostic.cause, expected_cause); - } + .all(|diagnostic| diagnostic.file != "entities/missing-entity.yaml"), + "diagnostics must not fabricate a target entity file" + ); + assert!( + report.diagnostics.iter().all(|diagnostic| { + !(diagnostic.file == "registry-stack.yaml" + && diagnostic.field == Some("services") + && diagnostic.cause == "A project entity reference is inconsistent.") + }), + "the exact unknown-entity diagnostic must not degrade to the generic fallback" + ); } #[test] @@ -3957,13 +4827,13 @@ fn integration_input_bounds_match_the_production_compiler_limit() { "maxLength: 64", ); let report = build_registry_project(&ProjectBuildOptions { - project_directory: accepted, + project_directory: accepted.clone(), environment: "local".to_string(), against: None, anchor: None, }) .expect("256-byte input builds through the production Relay compiler closure"); - let output = PathBuf::from(report.output.expect("build output")); + let output = resolve_build_output(&accepted, report.output.expect("build output")); let pack: serde_json::Value = serde_json::from_slice( &std::fs::read( output.join("private/relay/config/artifacts/integration-packs/eligibility.json"), @@ -4002,13 +4872,13 @@ fn integration_input_names_match_the_wire_grammar() { let boundary_name = format!("a{}", "0".repeat(63)); rename_custom_input(&accepted, &boundary_name); let report = build_registry_project(&ProjectBuildOptions { - project_directory: accepted, + project_directory: accepted.clone(), environment: "local".to_string(), against: None, anchor: None, }) .expect("64-byte input name builds through the production Relay compiler closure"); - let output = PathBuf::from(report.output.expect("build output")); + let output = resolve_build_output(&accepted, report.output.expect("build output")); let pack: serde_json::Value = serde_json::from_slice( &std::fs::read( output.join("private/relay/config/artifacts/integration-packs/eligibility.json"), @@ -4041,10 +4911,8 @@ fn integration_input_names_match_the_wire_grammar() { }) .expect_err("invalid input name must be rejected before source access"); let error = format!("{error:#}"); - assert!( - error.contains(&format!("input.{invalid_name}.name")), - "{error}" - ); + assert!(error.contains("canonical schema validation"), "{error}"); + assert!(!error.contains(&invalid_name), "{error}"); } } @@ -4107,17 +4975,21 @@ fn exact_selector_authored_member_order_is_canonical() { reverse_yaml_mapping(&fixture.expect("fixture entry").path(), &["input"]); } - let build = |project_directory| { - build_registry_project(&ProjectBuildOptions { - project_directory, + let build = |project_directory: &Path| { + let report = build_registry_project(&ProjectBuildOptions { + project_directory: project_directory.to_path_buf(), environment: "local".to_string(), against: None, anchor: None, }) - .expect("ordered selector project builds") + .expect("ordered selector project builds"); + resolve_build_output( + project_directory, + report.output.expect("ordered selector build output"), + ) }; - let first = PathBuf::from(build(first).output.expect("first output")); - let second = PathBuf::from(build(second).output.expect("second output")); + let first = build(&first); + let second = build(&second); for relative in [ "private/relay/config/artifacts/integration-packs/eligibility.json", "private/relay/config/artifacts/consultation-contracts/household-eligibility-household.json", @@ -4162,7 +5034,7 @@ fn api_key_interfaces_keep_values_environment_only_and_use_the_stable_auth_type( anchor: None, }) .unwrap_or_else(|error| panic!("{credential_type} failed: {error:#}")); - let output = PathBuf::from(report.output.expect("build output")); + let output = resolve_build_output(&project, report.output.expect("build output")); let closure = directory_closure(&output); let joined = closure .iter() @@ -4228,7 +5100,7 @@ fn api_key_interfaces_keep_values_environment_only_and_use_the_stable_auth_type( anchor: None, }) .expect_err("environment auth-type compatibility alias must fail"); - assert_authoring_diagnostic(&error, "registryctl.authoring.yaml.unknown_field"); + assert_authoring_diagnostic(&error, "registryctl.authoring.environment.invalid"); } #[test] @@ -4346,17 +5218,21 @@ fn opencrvs_composite_dci_uses_unified_exact_predicates_canonically() { &["source", "protocol", "signed_dci", "selectors"], ); - let build = |project_directory| { - build_registry_project(&ProjectBuildOptions { - project_directory, + let build = |project_directory: &Path| { + let report = build_registry_project(&ProjectBuildOptions { + project_directory: project_directory.to_path_buf(), environment: "local".to_string(), against: None, anchor: None, }) - .expect("composite DCI project builds") + .expect("composite DCI project builds"); + resolve_build_output( + project_directory, + report.output.expect("composite DCI build output"), + ) }; - let first = PathBuf::from(build(first).output.expect("first output")); - let second = PathBuf::from(build(second).output.expect("second output")); + let first = build(&first); + let second = build(&second); let relative = "private/relay/config/artifacts/integration-packs/birth-record.json"; let first_pack = std::fs::read(first.join(relative)).expect("first DCI pack"); let second_pack = std::fs::read(second.join(relative)).expect("second DCI pack"); @@ -4415,45 +5291,67 @@ fn check_and_build_produce_deterministic_product_inputs() { ]) ); let explanation = check.explanation.expect("explanation is present"); - assert!(explanation - .pointer("/integrations/eligibility/generated_pack") - .is_none()); - assert!(explanation - .pointer("/services/household-eligibility/profiles/0/policy_hash") - .is_none()); - assert!(explanation - .pointer("/services/household-eligibility/profiles/0/version") - .is_none()); - assert!(explanation - .pointer("/services/household-eligibility/profiles/0/contract_hash") - .and_then(serde_json::Value::as_str) - .is_some()); - assert!(explanation - .pointer("/environment_binding/callers") - .is_some()); - assert!(explanation - .pointer("/services/household-eligibility/consultations") - .is_some()); - assert!(explanation - .pointer("/services/household-eligibility/claims/source-household-approval-decision/cel",) - .and_then(serde_json::Value::as_str) - .is_some()); - assert!(explanation - .pointer("/services/household-eligibility/credential_profiles") - .is_some()); - assert_eq!( - explanation["integrations"]["eligibility"]["capability"], - "http" + assert_eq!( + public_explanation_value(integration_explanation_field( + &explanation, + "eligibility", + "/capability/type", + )), + &serde_json::json!("http") + ); + assert_eq!( + public_explanation_value(project_explanation_field( + &explanation, + "/services/household-eligibility/consultation_count", + )), + &serde_json::json!(1) + ); + assert!(matches!( + project_explanation_field( + &explanation, + "/services/household-eligibility/claims/source-household-approval-decision/cel", + ) + .reported_value, + ClassifierSafeReportedValue::Redacted { .. } + )); + assert!(matches!( + environment_explanation_field( + &explanation, + "local", + "/integrations/eligibility/source/origin", + ) + .reported_value, + ClassifierSafeReportedValue::Redacted { .. } + )); + let serialized_explanation = + serde_json::to_string(&explanation).expect("typed explanation serializes"); + for forbidden in [ + "household-authority.invalid", + "HOUSEHOLD_USERNAME", + "HOUSEHOLD_PASSWORD", + "household.matched &&", + "BENEFITS_CLIENT_TOKEN_HASH", + ] { + assert!( + !serialized_explanation.contains(forbidden), + "explanation must not report {forbidden}" + ); + } + assert!( + !serialized_explanation.contains("generated_pack") + && !serialized_explanation.contains("policy_hash") + && !serialized_explanation.contains("contract_hash"), + "explanation reports authored/effective intent, not generated configuration" ); let options = ProjectBuildOptions { - project_directory: project, + project_directory: project.clone(), environment: "local".to_string(), against: None, anchor: None, }; let first = build_registry_project(&options).expect("first build"); - let output = PathBuf::from(first.output.expect("build output")); + let output = resolve_build_output(&project, first.output.expect("build output")); let notary_config = std::fs::read_to_string(output.join("private/notary/config/notary.yaml")) .expect("generated Notary config"); let notary_document: serde_norway::Value = @@ -4487,8 +5385,173 @@ fn check_and_build_produce_deterministic_product_inputs() { assert_eq!(first_closure, directory_closure(&output)); assert_eq!( closure_digest(&first_closure), - "1aed5bc2896097978d635b49cb487718d4daa524776d7fe189d7927296f1b419", - "project inputs must match the cross-machine golden digest" + "44b7218cd4d0b4739e74b756dfbaa26cdfb837ef14985ec9b1248823f99ded9b", + "project output, including its deterministic manifest, must match the cross-machine golden digest" + ); +} + +#[test] +fn build_artifact_manifest_is_complete_relative_private_and_deterministic() { + let temporary = tempfile::tempdir().expect("temporary directory"); + let project = copy_project("custom-system", temporary.path()); + let options = ProjectBuildOptions { + project_directory: project.clone(), + environment: "local".to_string(), + against: None, + anchor: None, + }; + + let first = build_registry_project(&options).expect("first manifest build"); + let first_report = serde_json::to_value(&first).expect("first build report serializes"); + let output_relative = first_report["output"] + .as_str() + .expect("build output is reported"); + assert_eq!(output_relative, ".registry-stack/build/local"); + assert!(!Path::new(output_relative).is_absolute()); + let manifest_reference = first_report["artifact_manifest"] + .as_object() + .expect("build report references its artifact manifest"); + let manifest_relative = manifest_reference["path"] + .as_str() + .expect("manifest reference path"); + assert_eq!( + manifest_relative, + ".registry-stack/build/local/artifact-manifest.json" + ); + assert!(!Path::new(manifest_relative).is_absolute()); + + let output = project.join(output_relative); + let manifest_path = project.join(manifest_relative); + let first_manifest_bytes = std::fs::read(&manifest_path).expect("artifact manifest reads"); + assert_eq!( + manifest_reference["digest"], + test_sha256_uri(&first_manifest_bytes) + ); + assert_eq!(first_manifest_bytes.last(), Some(&b'\n')); + let manifest: serde_json::Value = + serde_json::from_slice(&first_manifest_bytes).expect("artifact manifest parses"); + assert_eq!( + manifest["schema_version"], + "registry.project.artifact_manifest.v1" + ); + assert_eq!( + manifest["format_version"], + "registry.project.artifact_manifest.format.v1" + ); + assert_eq!(manifest["environment"], "local"); + assert_eq!(manifest["generator"]["name"], "registryctl"); + + let inputs = manifest["inputs"] + .as_array() + .expect("manifest authored inputs"); + assert!(!inputs.is_empty()); + let input_paths = inputs + .iter() + .map(|input| input["path"].as_str().expect("input path")) + .collect::>(); + assert!(input_paths.windows(2).all(|pair| pair[0] < pair[1])); + for input in inputs { + let relative = input["path"].as_str().expect("input path"); + assert!(!Path::new(relative).is_absolute()); + assert!(!relative.starts_with(".registry-stack/")); + assert_eq!( + input["digest"], + test_sha256_uri( + &std::fs::read(project.join(relative)).expect("authored manifest input reads") + ) + ); + } + + let artifacts = manifest["artifacts"] + .as_array() + .expect("manifest generated artifacts"); + let artifact_paths = artifacts + .iter() + .map(|artifact| artifact["path"].as_str().expect("artifact path")) + .collect::>(); + assert!(artifact_paths.windows(2).all(|pair| pair[0] < pair[1])); + assert!(!artifact_paths.contains(&manifest_relative)); + for artifact in artifacts { + let relative = artifact["path"].as_str().expect("generated artifact path"); + let payload_relative = relative + .strip_prefix(&format!("{output_relative}/")) + .expect("artifact is under the reported environment output"); + assert_eq!( + artifact["digest"], + test_sha256_uri( + &std::fs::read(output.join(payload_relative)) + .expect("manifest payload artifact reads") + ) + ); + assert!(artifact["format_version"].as_str().is_some()); + assert!(!artifact["classes"] + .as_array() + .expect("artifact classes") + .is_empty()); + assert!(artifact["sensitivity"].as_str().is_some()); + assert!(artifact["publication"].as_str().is_some()); + assert_eq!(artifact["edit"], "generated_do_not_edit"); + assert_eq!(artifact["version_control"], "ignore"); + assert!(artifact["review"].as_str().is_some()); + assert_eq!(artifact["lifecycle"], "unsigned_non_deployable"); + let actions = artifact["actions"].as_array().expect("artifact actions"); + assert!(actions.iter().any(|action| action == "regenerate")); + assert!(actions.iter().any(|action| action == "compare")); + assert!(actions.iter().any(|action| action == "validate")); + assert!(actions.iter().any(|action| action == "discard")); + let consumers = artifact["consumers"] + .as_array() + .expect("artifact consumers"); + assert!(!consumers.is_empty()); + if payload_relative.starts_with("private/relay/") { + assert!(!consumers + .iter() + .any(|consumer| consumer == "registry_notary")); + } + if payload_relative.starts_with("private/notary/") { + assert!(!consumers + .iter() + .any(|consumer| consumer == "registry_relay")); + } + if matches!( + payload_relative, + "private/relay/config/relay.yaml" | "private/notary/config/notary.yaml" + ) { + assert_eq!(artifact["sensitivity"], "topology_sensitive"); + assert_eq!(artifact["publication"], "never_publish"); + assert!(consumers + .iter() + .any(|consumer| consumer == "deployment_tooling")); + } + } + + let filesystem_payloads = directory_closure(&output) + .into_iter() + .filter_map(|(path, _)| { + (path != Path::new("artifact-manifest.json")).then(|| { + format!( + "{output_relative}/{}", + path.to_str().expect("generated path is Unicode") + ) + }) + }) + .collect::>(); + assert_eq!(artifact_paths, filesystem_payloads); + + let report_json = serde_json::to_vec(&first).expect("build report serializes"); + let project_absolute = project.to_string_lossy(); + assert!(!String::from_utf8_lossy(&first_manifest_bytes).contains(project_absolute.as_ref())); + assert!(!String::from_utf8_lossy(&report_json).contains(project_absolute.as_ref())); + assert!(!String::from_utf8_lossy(&first_manifest_bytes).contains(".tmp-")); + + let second = build_registry_project(&options).expect("second manifest build"); + let second_report = serde_json::to_value(&second).expect("second build report serializes"); + let second_manifest_bytes = + std::fs::read(&manifest_path).expect("second artifact manifest reads"); + assert_eq!(first_manifest_bytes, second_manifest_bytes); + assert_eq!( + first_report["artifact_manifest"], + second_report["artifact_manifest"] ); } @@ -4500,13 +5563,13 @@ fn generated_relay_contract_activates_through_notary_exactly_and_rejects_a_stale let temporary = tempfile::tempdir().expect("temporary directory"); let project = copy_project("custom-system", temporary.path()); let build = build_registry_project(&ProjectBuildOptions { - project_directory: project, + project_directory: project.clone(), environment: "local".to_string(), against: None, anchor: None, }) .expect("combined project builds"); - let output = PathBuf::from(build.output.expect("build output")); + let output = resolve_build_output(&project, build.output.expect("build output")); let contract_path = output.join( "private/relay/config/artifacts/consultation-contracts/household-eligibility-household.json", ); @@ -4587,13 +5650,13 @@ fn generated_snapshot_contracts_activate_through_notary_at_the_authoring_bound() write_yaml(&entity_path, &entity); let build = build_registry_project(&ProjectBuildOptions { - project_directory: project, + project_directory: project.clone(), environment: "local".to_string(), against: None, anchor: None, }) .expect("snapshot project builds within the authored materialization bound"); - let output = PathBuf::from(build.output.expect("build output")); + let output = resolve_build_output(&project, build.output.expect("build output")); let contract_bytes = std::fs::read(output.join( "private/relay/config/artifacts/consultation-contracts/benefits-eligibility-person.json", )) @@ -4655,7 +5718,7 @@ fn script_only_change_moves_the_relay_closure_without_forking_the_public_contrac anchor: None, }; let first = build_registry_project(&options).expect("initial Script project builds"); - let first_output = PathBuf::from(first.output.expect("initial build output")); + let first_output = resolve_build_output(&project, first.output.expect("initial build output")); let contract_relative = "private/relay/config/artifacts/consultation-contracts/health-verification-health.json"; let pack_relative = "private/relay/config/artifacts/integration-packs/health-record.json"; @@ -4704,7 +5767,8 @@ fn script_only_change_moves_the_relay_closure_without_forking_the_public_contrac script.push_str("\n// reviewed script-only contract change\n"); std::fs::write(&script_path, script).expect("Script change writes"); let second = build_registry_project(&options).expect("changed Script project builds"); - let second_output = PathBuf::from(second.output.expect("changed build output")); + let second_output = + resolve_build_output(&project, second.output.expect("changed build output")); let second_contract = std::fs::read(second_output.join(contract_relative)).expect("changed contract reads"); let second_pack = @@ -4770,13 +5834,13 @@ fn records_and_snapshot_share_one_generated_materialization() { let temporary = tempfile::tempdir().expect("temporary directory"); let project = copy_project("snapshot-with-records", temporary.path()); let build = build_registry_project(&ProjectBuildOptions { - project_directory: project, + project_directory: project.clone(), environment: "local".to_string(), against: None, anchor: None, }) .expect("records plus evidence golden builds through production validation"); - let output = PathBuf::from(build.output.expect("build output")); + let output = resolve_build_output(&project, build.output.expect("build output")); let relay_root = output.join("private/relay"); let relay: serde_json::Value = serde_norway::from_slice( &std::fs::read(relay_root.join("config/relay.yaml")).expect("Relay config reads"), @@ -4856,13 +5920,13 @@ fn relay_only_and_notary_only_projects_emit_only_selected_products() { let temporary = tempfile::tempdir().expect("temporary directory"); let project = copy_project(project_name, temporary.path()); let build = build_registry_project(&ProjectBuildOptions { - project_directory: project, + project_directory: project.clone(), environment: "local".to_string(), against: None, anchor: None, }) .unwrap_or_else(|error| panic!("{project_name} build failed: {error:#}")); - let output = PathBuf::from(build.output.expect("build output")); + let output = resolve_build_output(&project, build.output.expect("build output")); assert!( output.join("private").join(present).is_dir(), "{project_name}" @@ -4891,13 +5955,13 @@ fn materialization_only_project_emits_private_relay_table_without_public_records let temporary = tempfile::tempdir().expect("temporary directory"); let project = copy_project("relay-only-materialization", temporary.path()); let build = build_registry_project(&ProjectBuildOptions { - project_directory: project, + project_directory: project.clone(), environment: "local".to_string(), against: None, anchor: None, }) .expect("materialization-only Relay project builds"); - let output = PathBuf::from(build.output.expect("build output")); + let output = resolve_build_output(&project, build.output.expect("build output")); assert!(output.join("private/relay").is_dir()); assert!(!output.join("private/notary").exists()); @@ -4927,13 +5991,13 @@ fn relay_oidc_clients_are_separate_from_the_notary_consultation_workload() { let temporary = tempfile::tempdir().expect("temporary directory"); let project = copy_project("custom-system", temporary.path()); let build = build_registry_project(&ProjectBuildOptions { - project_directory: project, + project_directory: project.clone(), environment: "local".to_string(), against: None, anchor: None, }) .expect("combined project builds with separate Relay identities"); - let output = PathBuf::from(build.output.expect("build output")); + let output = resolve_build_output(&project, build.output.expect("build output")); let relay = read_yaml(&output.join("private/relay/config/relay.yaml")); let allowed_clients = relay["auth"]["oidc"]["allowed_clients"] .as_sequence() @@ -4985,13 +6049,13 @@ fn local_loopback_relay_topology_is_explicit_and_nonportable() { write_yaml(&environment_path, &environment); let build = build_registry_project(&ProjectBuildOptions { - project_directory: project, + project_directory: project.clone(), environment: "local".to_string(), against: None, anchor: None, }) .expect("local IP-loopback Relay, issuer, and JWKS build"); - let output = PathBuf::from(build.output.expect("build output")); + let output = resolve_build_output(&project, build.output.expect("build output")); let relay = read_yaml(&output.join("private/relay/config/relay.yaml")); assert_eq!( relay["auth"]["oidc"]["allow_dev_insecure_fetch_urls"].as_bool(), @@ -5085,13 +6149,13 @@ fn hosted_notary_can_use_an_explicit_loopback_relay_connection() { write_yaml(&environment_path, &environment); let build = build_registry_project(&ProjectBuildOptions { - project_directory: project, + project_directory: project.clone(), environment: "local".to_string(), against: None, anchor: None, }) .expect("hosted project builds with a private loopback Notary-to-Relay connection"); - let output = PathBuf::from(build.output.expect("build output")); + let output = resolve_build_output(&project, build.output.expect("build output")); let relay = read_yaml(&output.join("private/relay/config/relay.yaml")); assert_eq!( relay["catalog"]["base_url"].as_str(), @@ -5136,13 +6200,13 @@ fn issuance_accepts_a_full_verification_method_kid() { write_yaml(&environment_path, &environment); let build = build_registry_project(&ProjectBuildOptions { - project_directory: project, + project_directory: project.clone(), environment: "local".to_string(), against: None, anchor: None, }) .expect("a full verification-method kid builds"); - let output = PathBuf::from(build.output.expect("build output")); + let output = resolve_build_output(&project, build.output.expect("build output")); let notary = read_yaml(&output.join("private/notary/config/notary.yaml")); assert_eq!( notary["evidence"]["signing_keys"]["project-issuer"]["kid"].as_str(), @@ -5267,13 +6331,13 @@ fn authored_oid4vci_binding_generates_the_complete_notary_owned_issuer() { ); let build = build_registry_project(&ProjectBuildOptions { - project_directory: project, + project_directory: project.clone(), environment: "local".to_string(), against: None, anchor: None, }) .expect("typed OID4VCI authority project builds through the production validator"); - let output = PathBuf::from(build.output.expect("build output")); + let output = resolve_build_output(&project, build.output.expect("build output")); let notary = read_yaml(&output.join("private/notary/config/notary.yaml")); assert_eq!( @@ -5383,13 +6447,13 @@ fn authored_oid4vci_binding_generates_the_complete_notary_owned_issuer() { let plain_root = tempfile::tempdir().expect("plain temporary directory"); let plain = create_source_free_evaluation_project(plain_root.path()); let build = build_registry_project(&ProjectBuildOptions { - project_directory: plain, + project_directory: plain.clone(), environment: "local".to_string(), against: None, anchor: None, }) .expect("ordinary API-key Notary still builds"); - let output = PathBuf::from(build.output.expect("plain build output")); + let output = resolve_build_output(&plain, build.output.expect("plain build output")); let notary = read_yaml(&output.join("private/notary/config/notary.yaml")); assert!(notary["auth"].get("mode").is_none()); assert_eq!( @@ -5423,13 +6487,13 @@ fn authored_oid4vci_walt_profile_is_explicit_and_keeps_the_bearer_window_bounded ); let build = build_registry_project(&ProjectBuildOptions { - project_directory: project, + project_directory: project.clone(), environment: "local".to_string(), against: None, anchor: None, }) .expect("explicit Walt-compatible binding builds"); - let output = PathBuf::from(build.output.expect("build output")); + let output = resolve_build_output(&project, build.output.expect("build output")); let notary = read_yaml(&output.join("private/notary/config/notary.yaml")); assert_eq!( notary["evidence"]["signing_keys"]["project-issuer"]["alg"].as_str(), @@ -5593,13 +6657,13 @@ credential_profiles: {} write_yaml(&environment_path, &environment); let build = build_registry_project(&ProjectBuildOptions { - project_directory: project, + project_directory: project.clone(), environment: "local".to_string(), against: None, anchor: None, }) .expect("combined records and evaluation project builds without a Relay consultation"); - let output = PathBuf::from(build.output.expect("build output")); + let output = resolve_build_output(&project, build.output.expect("build output")); let relay = read_yaml(&output.join("private/relay/config/relay.yaml")); assert!(relay.get("consultation").is_none()); let notary = read_yaml(&output.join("private/notary/config/notary.yaml")); @@ -5622,13 +6686,13 @@ fn source_free_evaluation_without_credential_profiles_omits_issuance_and_signing .expect("evaluation-only Notary project checks without issuance"); assert_eq!(check.status, "valid"); let build = build_registry_project(&ProjectBuildOptions { - project_directory: project, + project_directory: project.clone(), environment: "local".to_string(), against: None, anchor: None, }) .expect("evaluation-only Notary project builds without issuance"); - let output = PathBuf::from(build.output.expect("build output")); + let output = resolve_build_output(&project, build.output.expect("build output")); let notary = read_yaml(&output.join("private/notary/config/notary.yaml")); assert_eq!(notary["state"]["storage"].as_str(), Some("postgresql")); assert!(notary["evidence"].get("relay").is_none()); @@ -5764,13 +6828,13 @@ response_fields: { residency_confirmed: residency_confirmed } write_yaml(&environment_path, &environment); let build = build_registry_project(&ProjectBuildOptions { - project_directory: project, + project_directory: project.clone(), environment: "local".to_string(), against: None, anchor: None, }) .expect("enabled records standards build through Relay production validation"); - let output = PathBuf::from(build.output.expect("build output")); + let output = resolve_build_output(&project, build.output.expect("build output")); let relay: serde_json::Value = serde_norway::from_slice( &std::fs::read(output.join("private/relay/config/relay.yaml")).expect("Relay config reads"), ) @@ -5857,7 +6921,7 @@ fn records_provider_change_requires_a_new_generation() { anchor: None, }) .expect("initial records build passes"); - let output = PathBuf::from(initial.output.expect("initial output")); + let output = resolve_build_output(&project, initial.output.expect("initial output")); let private_key = temporary.path().join("records-private.jwk"); let public_key = temporary.path().join("records-public.jwk"); let anchor = temporary.path().join("records-anchor.json"); @@ -5950,13 +7014,13 @@ fn every_required_golden_builds_registry_backed_notary_without_transitional_sour assert!(check.explanation.is_some(), "{project_name}"); let build = build_registry_project(&ProjectBuildOptions { - project_directory: project, + project_directory: project.clone(), environment: "local".to_string(), against: None, anchor: None, }) .unwrap_or_else(|error| panic!("{project_name} build failed: {error:#}")); - let output = PathBuf::from(build.output.expect("build output")); + let output = resolve_build_output(&project, build.output.expect("build output")); assert!(output.join("reviewable/review.json").is_file()); assert!(output .join("private/relay/approval/project-state.json") @@ -6050,14 +7114,14 @@ fn generated_product_inputs_sign_and_verify_without_secret_values() { let project = copy_project("custom-system", temporary.path()); std::env::set_var("HOUSEHOLD_PASSWORD", SECRET_SENTINEL); let build = build_registry_project(&ProjectBuildOptions { - project_directory: project, + project_directory: project.clone(), environment: "local".to_string(), against: None, anchor: None, }) .expect("project builds"); std::env::remove_var("HOUSEHOLD_PASSWORD"); - let output = PathBuf::from(build.output.expect("build output")); + let output = resolve_build_output(&project, build.output.expect("build output")); assert!(directory_closure(&output).iter().all(|(_, bytes)| !bytes .windows(SECRET_SENTINEL.len()) .any(|window| window == SECRET_SENTINEL.as_bytes()))); @@ -6105,13 +7169,13 @@ fn generated_project_output_is_owner_only() { let temporary = tempfile::tempdir().expect("temporary directory"); let project = copy_project("custom-system", temporary.path()); let build = build_registry_project(&ProjectBuildOptions { - project_directory: project, + project_directory: project.clone(), environment: "local".to_string(), against: None, anchor: None, }) .expect("project builds"); - let output = PathBuf::from(build.output.expect("build output")); + let output = resolve_build_output(&project, build.output.expect("build output")); assert_owner_only(&output); } @@ -6181,7 +7245,7 @@ fn verified_signed_baseline_classifies_semantic_review_dimensions_independently( anchor: None, }) .expect("initial project build passes"); - let output = PathBuf::from(initial.output.expect("initial build output")); + let output = resolve_build_output(&project, initial.output.expect("initial build output")); let private_key = temporary.path().join("baseline-private.jwk"); let public_key = temporary.path().join("baseline-public.jwk"); let anchor = temporary.path().join("baseline-anchor.json"); @@ -6209,6 +7273,29 @@ fn verified_signed_baseline_classifies_semantic_review_dimensions_independently( out: baseline.clone(), }) .expect("baseline signs"); + let relay_anchor = temporary.path().join("relay-baseline-anchor.json"); + let relay_baseline = temporary.path().join("relay-baseline-bundle"); + init_config_anchor( + &relay_anchor, + "registry-relay".to_string(), + "local".to_string(), + "project-authoring-relay".to_string(), + "project-relay-instance".to_string(), + ) + .expect("Relay baseline anchor initializes"); + add_config_anchor_key(&relay_anchor, &public_key, true).expect("Relay baseline key adds"); + sign_config_bundle(BundleSignOptions { + input: output.join("private/relay"), + key: private_key.display().to_string(), + product: "registry-relay".to_string(), + environment: "local".to_string(), + stream_id: "project-authoring-relay".to_string(), + instance_id: Some("project-relay-instance".to_string()), + sequence: 1, + bundle_id: "project-authoring-relay-baseline".to_string(), + out: relay_baseline.clone(), + }) + .expect("Relay baseline signs"); for relative in ["approval/review.json", "approval/project-state.json"] { let tampered = temporary @@ -6246,14 +7333,26 @@ fn verified_signed_baseline_classifies_semantic_review_dimensions_independently( assert!(initial_state["generated_closure_digests"]["notary"].is_string()); assert!(initial_state["report_digest"].is_string()); - let reviewed_build = build_registry_project(&ProjectBuildOptions { - project_directory: project.clone(), - environment: "local".to_string(), - against: Some(baseline.clone()), - anchor: Some(anchor.clone()), - }) + let reviewed_build = build_registry_project_with_baselines_and_context( + &ProjectBuildOptions { + project_directory: project.clone(), + environment: "local".to_string(), + against: None, + anchor: None, + }, + &ProjectBuildBaselineSetOptions { + relay_against: Some(relay_baseline), + relay_anchor: Some(relay_anchor), + notary_against: Some(baseline.clone()), + notary_anchor: Some(anchor.clone()), + }, + &project_execution_context(), + ) .expect("verified-baseline build passes"); - let reviewed_output = PathBuf::from(reviewed_build.output.expect("reviewed build output")); + let reviewed_output = resolve_build_output( + &project, + reviewed_build.output.expect("reviewed build output"), + ); let reviewed_record: serde_json::Value = serde_json::from_slice( &std::fs::read(reviewed_output.join("reviewable/review.json")) .expect("reviewed record reads"), @@ -6267,10 +7366,14 @@ fn verified_signed_baseline_classifies_semantic_review_dimensions_independently( assert_eq!(reviewed_record["baseline"], "verified_signed_bundle"); assert_public_review_has_only_contract_hashes(&reviewed_record); assert_eq!( - reviewed_state["baseline"]["verified_manifest"]["schema"], + reviewed_state["baseline"]["verified_manifests"]["notary"]["schema"], + "registry.platform.config_bundle.v1" + ); + assert_eq!( + reviewed_state["baseline"]["verified_manifests"]["relay"]["schema"], "registry.platform.config_bundle.v1" ); - let signed_paths = reviewed_state["baseline"]["verified_manifest"]["files"] + let signed_paths = reviewed_state["baseline"]["verified_manifests"]["notary"]["files"] .as_array() .expect("verified manifest files") .iter() @@ -6488,6 +7591,11 @@ fn verified_signed_baseline_classifies_semantic_review_dimensions_independently( "request.target.identifiers.household_reference", "request.target.identifiers.household_case_number", ); + replace_in_file( + &consultation_project.join("integrations/eligibility/fixtures/source-approved.yaml"), + "scheme: household_reference", + "scheme: household_case_number", + ); assert_change_dimensions( consultation_project, &baseline, @@ -6669,6 +7777,19 @@ fn extend_exact_selector(project: &Path, golden_name: &str, size: usize) { serde_norway::Value::String(format!("selector_{component}")), serde_norway::Value::String(value.clone()), ); + if let Some(identifiers) = document + .get_mut("request") + .and_then(|request| request.get_mut("target")) + .and_then(|target| target.get_mut("identifiers")) + .and_then(serde_norway::Value::as_sequence_mut) + { + identifiers.push( + serde_norway::from_str(&format!( + "{{ scheme: selector_{component}, value: {value:?} }}" + )) + .expect("fixture request selector"), + ); + } if golden_name == "custom-system" { if let Some(interactions) = document .get_mut("interactions") @@ -6797,30 +7918,41 @@ fn duplicate_project_integration(project: &Path, source_alias: &str, target_alia .as_str() .expect("consultation name is a string"); let reference = format!("{consultation_name}."); - let (source_claim_name, mut duplicated_claim) = service["claims"] + let duplicated_claims = service["claims"] .as_mapping() - .and_then(|claims| { - claims.iter().find_map(|(name, claim)| { - yaml_contains_string(claim, &reference).then(|| (name.clone(), claim.clone())) - }) + .map(|claims| { + claims + .iter() + .filter_map(|(name, claim)| { + let source_claim = name.as_str()?; + if !yaml_contains_string(claim, &reference) { + return None; + } + let mut duplicated_claim = claim.clone(); + replace_yaml_strings( + &mut duplicated_claim, + &reference, + &format!("{target_alias}."), + ); + Some(( + source_claim.to_string(), + format!("{target_alias}-{source_claim}"), + duplicated_claim, + )) + }) + .collect::>() }) - .expect("source consultation claim"); - replace_yaml_strings( - &mut duplicated_claim, - &reference, - &format!("{target_alias}."), - ); - let claim_name = format!( - "{target_alias}-{}", - source_claim_name.as_str().expect("claim name is a string") - ); - service["claims"] - .as_mapping_mut() - .expect("project claims mapping") - .insert( - serde_norway::Value::String(claim_name.clone()), - duplicated_claim, - ); + .filter(|claims| !claims.is_empty()) + .expect("source consultation claims"); + for (_, target_claim, duplicated_claim) in &duplicated_claims { + service["claims"] + .as_mapping_mut() + .expect("project claims mapping") + .insert( + serde_norway::Value::String(target_claim.clone()), + duplicated_claim.clone(), + ); + } for credential in service["credential_profiles"] .as_mapping_mut() .expect("project credential profiles") @@ -6829,18 +7961,23 @@ fn duplicate_project_integration(project: &Path, source_alias: &str, target_alia credential["claims"] .as_sequence_mut() .expect("credential profile claims") - .push(serde_norway::Value::String(claim_name.clone())); + .extend( + duplicated_claims + .iter() + .map(|(_, target_claim, _)| serde_norway::Value::String(target_claim.clone())), + ); } write_yaml(&project_path, &project_document); + let claim_translations = duplicated_claims + .iter() + .map(|(source, target, _)| (source.clone(), target.clone())) + .collect::>(); rewrite_duplicated_fixture_claims( &project .join("integrations") .join(target_alias) .join("fixtures"), - source_claim_name - .as_str() - .expect("source claim name is a string"), - &claim_name, + &claim_translations, ); let environment_path = project.join("environments/local.yaml"); @@ -6857,25 +7994,43 @@ fn duplicate_project_integration(project: &Path, source_alias: &str, target_alia write_yaml(&environment_path, &environment); } -fn rewrite_duplicated_fixture_claims(fixtures: &Path, source_claim: &str, target_claim: &str) { +fn rewrite_duplicated_fixture_claims(fixtures: &Path, translations: &[(String, String)]) { + let translate = |claim: &str| { + translations + .iter() + .find_map(|(source, target)| (source == claim).then_some(target.as_str())) + }; for entry in std::fs::read_dir(fixtures).expect("duplicated fixtures directory reads") { let path = entry.expect("duplicated fixture entry reads").path(); if path.extension().and_then(std::ffi::OsStr::to_str) != Some("yaml") { continue; } let mut fixture = read_yaml(&path); - let Some(claims) = fixture["expect"]["claims"].as_mapping_mut() else { - continue; - }; - let source_key = serde_norway::Value::String(source_claim.to_string()); - let Some(expected) = claims.get(&source_key).cloned() else { - continue; - }; - claims.clear(); - claims.insert( - serde_norway::Value::String(target_claim.to_string()), - expected, - ); + if let Some(claims) = fixture["expect"]["claims"].as_mapping_mut() { + let rewritten = claims + .iter() + .map(|(claim, expected)| { + let claim = claim.as_str().expect("fixture claim is a string"); + ( + serde_norway::Value::String(translate(claim).unwrap_or(claim).to_string()), + expected.clone(), + ) + }) + .collect::(); + *claims = rewritten; + } + if let Some(request_claims) = fixture + .get_mut("request") + .and_then(|request| request.get_mut("claims")) + .and_then(serde_norway::Value::as_sequence_mut) + { + for claim in request_claims { + let source_claim = claim.as_str().expect("request claim is a string"); + if let Some(target_claim) = translate(source_claim) { + *claim = serde_norway::Value::String(target_claim.to_string()); + } + } + } write_yaml(&path, &fixture); } } @@ -7079,6 +8234,15 @@ place: request.target.identifiers.place "uin: '0000000001'\nfamily: Example\nplace: Fictional District\n", ) .expect("composite DCI fixture inputs"); + if fixture.get("request").is_some() { + fixture["request"]["target"]["identifiers"] = serde_norway::from_str( + r#"- { scheme: uin, value: "0000000001" } +- { scheme: family, value: Example } +- { scheme: place, value: Fictional District } +"#, + ) + .expect("composite DCI request identifiers"); + } let data_interaction = fixture["interactions"] .as_sequence_mut() .and_then(|interactions| { @@ -7254,6 +8418,19 @@ fn copy_tree(source: &Path, destination: &Path) { } } +fn resolve_build_output(project: &Path, reported: String) -> PathBuf { + let relative = Path::new(&reported); + assert!( + !relative.is_absolute(), + "build output must be project-relative: {reported}" + ); + assert!( + reported.starts_with(".registry-stack/build/"), + "build output must remain under the project build root: {reported}" + ); + project.join(relative) +} + fn directory_closure(root: &Path) -> Vec<(PathBuf, Vec)> { let mut files = Vec::new(); walkdir(root, root, &mut files); @@ -7261,6 +8438,10 @@ fn directory_closure(root: &Path) -> Vec<(PathBuf, Vec)> { files } +fn test_sha256_uri(bytes: &[u8]) -> String { + format!("sha256:{}", hex::encode(Sha256::digest(bytes))) +} + fn closure_digest(files: &[(PathBuf, Vec)]) -> String { use std::fmt::Write as _; diff --git a/crates/registryctl/tests/project_authoring_diagnostic_contract.rs b/crates/registryctl/tests/project_authoring_diagnostic_contract.rs new file mode 100644 index 000000000..90d69704f --- /dev/null +++ b/crates/registryctl/tests/project_authoring_diagnostic_contract.rs @@ -0,0 +1,108 @@ +// SPDX-License-Identifier: Apache-2.0 + +use serde_json::{json, Value}; +use std::collections::BTreeSet; + +const DIAGNOSTICS_SCHEMA: &str = + include_str!("../schemas/project-reports/registryctl.project_diagnostics.v1.schema.json"); +const CATALOG_SCHEMA: &str = include_str!( + "../schemas/project-reports/registryctl.project_authoring_diagnostic_catalog.v1.schema.json" +); +const DIAGNOSTICS_FIXTURE: &str = + include_str!("fixtures/project-reports/registryctl.project_diagnostics.v1.json"); +const CATALOG_FIXTURE: &str = include_str!( + "fixtures/project-reports/registryctl.project_authoring_diagnostic_catalog.v1.json" +); + +fn parse(document: &str) -> Value { + serde_json::from_str(document).expect("fixture or schema is JSON") +} + +fn assert_valid(schema: &str, document: &Value) { + let validator = jsonschema::JSONSchema::options() + .with_draft(jsonschema::Draft::Draft202012) + .compile(&parse(schema)) + .expect("strict schema compiles"); + if let Err(errors) = validator.validate(document) { + panic!( + "document must validate: {:?}", + errors.map(|error| error.to_string()).collect::>() + ); + }; +} + +fn assert_invalid(schema: &str, document: &Value) { + let validator = jsonschema::JSONSchema::options() + .with_draft(jsonschema::Draft::Draft202012) + .compile(&parse(schema)) + .expect("strict schema compiles"); + assert!(validator.validate(document).is_err(), "document must fail"); +} + +#[test] +fn canonical_authoring_diagnostic_artifacts_are_strict() { + assert_valid(DIAGNOSTICS_SCHEMA, &parse(DIAGNOSTICS_FIXTURE)); + assert_valid(CATALOG_SCHEMA, &parse(CATALOG_FIXTURE)); +} + +#[test] +fn diagnostics_reject_unknown_fields_and_non_rfc6901_addresses() { + let mut unknown = parse(DIAGNOSTICS_FIXTURE); + unknown["diagnostics"][0]["received_secret"] = json!("must-not-serialize"); + assert_invalid(DIAGNOSTICS_SCHEMA, &unknown); + + let mut pointer = parse(DIAGNOSTICS_FIXTURE); + pointer["diagnostics"][0]["addresses"][0]["pointer"] = json!("not-a-pointer"); + assert_invalid(DIAGNOSTICS_SCHEMA, &pointer); + + let mut absolute = parse(DIAGNOSTICS_FIXTURE); + absolute["diagnostics"][0]["addresses"][0]["file"] = + json!("/tmp/private-project/registry-stack.yaml"); + assert_invalid(DIAGNOSTICS_SCHEMA, &absolute); +} + +#[test] +fn diagnostics_accept_sorted_cross_file_address_pairs() { + let mut relationship = parse(DIAGNOSTICS_FIXTURE); + relationship["diagnostics"][0]["addresses"] = json!([ + { + "file": "integrations/eligibility/integration.yaml", + "pointer": "/input/household_reference" + }, + { + "file": "registry-stack.yaml", + "pointer": "/services/household-eligibility/consultations/household/input/household_reference" + } + ]); + assert_valid(DIAGNOSTICS_SCHEMA, &relationship); +} + +#[test] +fn catalog_rejects_unsafe_summary_policy_and_unknown_definitions() { + let mut unsafe_policy = parse(CATALOG_FIXTURE); + unsafe_policy["diagnostics"][0]["safe_summary_policy"] = json!("received_value"); + assert_invalid(CATALOG_SCHEMA, &unsafe_policy); + + let mut unknown = parse(CATALOG_FIXTURE); + unknown["diagnostics"][0]["received_secret"] = json!("must-not-serialize"); + assert_invalid(CATALOG_SCHEMA, &unknown); +} + +#[test] +fn report_schema_and_catalog_cannot_drift_on_authoring_codes() { + let schema = parse(DIAGNOSTICS_SCHEMA); + let schema_codes = schema["$defs"]["code"]["enum"] + .as_array() + .expect("diagnostics schema defines a code enum") + .iter() + .map(|code| code.as_str().expect("code is a string")) + .collect::>(); + let catalog = parse(CATALOG_FIXTURE); + let catalog_codes = catalog["diagnostics"] + .as_array() + .expect("catalog has definitions") + .iter() + .map(|definition| definition["code"].as_str().expect("code is a string")) + .collect::>(); + assert_eq!(schema_codes, catalog_codes); +} diff --git a/crates/registryctl/tests/project_authoring_schema_parity.rs b/crates/registryctl/tests/project_authoring_schema_parity.rs new file mode 100644 index 000000000..b1523ca4e --- /dev/null +++ b/crates/registryctl/tests/project_authoring_schema_parity.rs @@ -0,0 +1,1542 @@ +// SPDX-License-Identifier: Apache-2.0 + +use std::collections::{BTreeMap, BTreeSet}; +use std::path::{Path, PathBuf}; + +use registryctl::ProjectSchemaKind; +use registryctl::{ + check_registry_project_with_context, ProjectAuthoringDiagnostics, ProjectCheckOptions, + ProjectExecutionContext, +}; +use serde::Deserialize; +use serde_json::Value; + +#[path = "../src/project_authoring/knowledge.rs"] +mod field_knowledge; + +use field_knowledge::{ + index_published_field_knowledge, published_field_knowledge_index, + reachable_published_field_paths, FieldKnowledgeCatalog, FieldPathKind, PublishedSchema, + SchemaKind, SemanticRule, Sensitivity, +}; + +const COVERAGE_FILE: &str = "schemas/project-authoring/parity-coverage.json"; +const SCHEMA_METADATA_KEYWORDS: [&str; 11] = [ + "$comment", + "$id", + "$schema", + "default", + "deprecated", + "description", + "examples", + "readOnly", + "title", + "writeOnly", + "x-registry-field", +]; + +fn check_registry_project( + options: &ProjectCheckOptions, +) -> anyhow::Result { + let context = ProjectExecutionContext::new(env!("CARGO_BIN_EXE_registryctl")) + .expect("Cargo provides the real registryctl executable"); + check_registry_project_with_context(options, &context) +} + +#[derive(Debug, Deserialize)] +#[serde(deny_unknown_fields)] +struct ParityCoverage { + version: u8, + schemas: Vec, + field_knowledge: FieldKnowledgeCatalog, + open_object_exceptions: Vec, + parity_cases: Vec, +} + +#[derive(Debug, Deserialize)] +#[serde(deny_unknown_fields)] +struct SchemaEntry { + kind: String, + file: String, +} + +#[derive(Debug, Deserialize)] +#[serde(deny_unknown_fields)] +struct OpenObjectException { + schema: String, + pointer: String, + kind: OpenObjectKind, + rationale: String, +} + +#[derive(Debug, Clone, Copy, Deserialize, PartialEq, Eq)] +#[serde(rename_all = "snake_case")] +enum OpenObjectKind { + TypedMap, + ExtensionMap, +} + +#[derive(Debug, Deserialize)] +#[serde(deny_unknown_fields)] +struct ParityCase { + id: String, + dimension: String, + schema: String, + source: String, + document: String, + mutation: Mutation, + expected_failing_keywords: Vec, + #[serde(default)] + expected_error_code: Option, + #[serde(default)] + expected_remediation: Option, +} + +#[derive(Debug, Deserialize)] +#[serde(deny_unknown_fields)] +struct Mutation { + operation: MutationOperation, + pointer: String, + #[serde(default)] + value: Option, +} + +#[derive(Debug, Clone, Copy, Deserialize)] +#[serde(rename_all = "snake_case")] +enum MutationOperation { + Set, + Remove, +} + +#[derive(Debug, Deserialize)] +#[serde(deny_unknown_fields)] +struct JourneyCatalog { + version: u8, + workspaces: Vec, +} + +#[derive(Debug, Deserialize)] +struct Journey { + id: String, + source: String, + environment: String, + #[serde(flatten)] + metadata: BTreeMap, +} + +fn crate_root() -> PathBuf { + PathBuf::from(env!("CARGO_MANIFEST_DIR")) +} + +fn repository_root() -> PathBuf { + crate_root().join("../..") +} + +fn schema_root() -> PathBuf { + crate_root().join("schemas/project-authoring") +} + +fn coverage() -> ParityCoverage { + serde_json::from_slice( + &std::fs::read(crate_root().join(COVERAGE_FILE)).expect("parity coverage asset reads"), + ) + .expect("parity coverage asset parses") +} + +fn compile_schema(file: &str) -> (Value, jsonschema::JSONSchema) { + let document: Value = serde_json::from_slice( + &std::fs::read(schema_root().join(file)) + .unwrap_or_else(|error| panic!("{file} reads: {error}")), + ) + .unwrap_or_else(|error| panic!("{file} parses: {error}")); + let compiled = jsonschema::JSONSchema::options() + .with_draft(jsonschema::Draft::Draft202012) + .compile(&document) + .unwrap_or_else(|error| panic!("{file} compiles as draft 2020-12: {error}")); + (document, compiled) +} + +fn field_schema_kind(kind: &str) -> SchemaKind { + match kind { + "project" => SchemaKind::Project, + "environment" => SchemaKind::Environment, + "integration" => SchemaKind::Integration, + "fixture" => SchemaKind::Fixture, + "entity" => SchemaKind::Entity, + other => panic!("unknown published field-knowledge schema: {other}"), + } +} + +fn knowledge_documents(coverage: &ParityCoverage) -> Vec<(SchemaKind, Value)> { + coverage + .schemas + .iter() + .map(|schema| { + ( + field_schema_kind(&schema.kind), + compile_schema(&schema.file).0, + ) + }) + .collect() +} + +fn published_schemas(documents: &[(SchemaKind, Value)]) -> Vec> { + documents + .iter() + .map(|(kind, document)| PublishedSchema { + kind: *kind, + document, + }) + .collect() +} + +fn read_yaml_json(path: &Path) -> Value { + let yaml: serde_norway::Value = serde_norway::from_slice( + &std::fs::read(path).unwrap_or_else(|error| panic!("{} reads: {error}", path.display())), + ) + .unwrap_or_else(|error| panic!("{} parses: {error}", path.display())); + serde_json::to_value(yaml) + .unwrap_or_else(|error| panic!("{} converts to JSON: {error}", path.display())) +} + +fn validate_document(schema: &jsonschema::JSONSchema, path: &Path) { + let document = read_yaml_json(path); + if let Err(errors) = schema.validate(&document) { + let messages = errors.map(|error| error.to_string()).collect::>(); + panic!("schema rejected {}: {messages:?}", path.display()); + }; +} + +fn sorted_yaml_files(directory: &Path) -> Vec { + if !directory.is_dir() { + return Vec::new(); + } + let mut paths = std::fs::read_dir(directory) + .unwrap_or_else(|error| panic!("{} reads: {error}", directory.display())) + .map(|entry| entry.expect("directory entry reads").path()) + .filter(|path| path.extension().and_then(|extension| extension.to_str()) == Some("yaml")) + .collect::>(); + paths.sort(); + paths +} + +fn referenced_files(project: &Value, field: &str) -> BTreeSet { + project + .get(field) + .and_then(Value::as_object) + .into_iter() + .flat_map(|references| references.values()) + .map(|reference| { + PathBuf::from( + reference["file"] + .as_str() + .unwrap_or_else(|| panic!("{field} reference file is a string")), + ) + }) + .collect() +} + +#[test] +fn published_field_knowledge_is_complete_typed_reachable_and_editor_exact() { + let coverage = coverage(); + let documents = knowledge_documents(&coverage); + let schemas = published_schemas(&documents); + let index = index_published_field_knowledge(&coverage.field_knowledge, &schemas) + .expect("all published field knowledge is typed, complete, and internally resolvable"); + + assert_eq!( + index.coverage_by_schema(), + [ + (SchemaKind::Project, 219), + (SchemaKind::Environment, 191), + (SchemaKind::Integration, 138), + (SchemaKind::Fixture, 62), + (SchemaKind::Entity, 35), + ] + .into_iter() + .collect(), + "all five roots, including entity, retain an exact reviewed path count" + ); + assert_eq!( + index.coverage_by_path_kind(), + [ + (FieldPathKind::Root, 5), + (FieldPathKind::Property, 455), + (FieldPathKind::MapKey, 25), + (FieldPathKind::MapValue, 32), + (FieldPathKind::ArrayItem, 32), + (FieldPathKind::Branch, 96), + ] + .into_iter() + .collect(), + "properties, arbitrary map keys/values, array items, and branch-only nodes are explicit" + ); + assert_eq!( + index.coverage_by_sensitivity(), + [ + (Sensitivity::Public, 6), + (Sensitivity::Internal, 410), + (Sensitivity::Sensitive, 64), + (Sensitivity::SecretReference, 14), + (Sensitivity::RedactedFixture, 50), + (Sensitivity::Structural, 101), + ] + .into_iter() + .collect(), + "reportability classifications remain exact and conservative" + ); + assert_eq!( + index.by_path().len(), + 645, + "the field-knowledge gate covers every published schema path" + ); + assert_eq!( + index.references().len(), + 257, + "every published local reference remains resolved in the deterministic reference index" + ); + assert_eq!( + published_field_knowledge_index() + .expect("embedded producer field-knowledge source is valid") + .by_path(), + index.by_path(), + "producer and parity-gate indexes are exact" + ); + + let reachable = schemas + .iter() + .map(reachable_published_field_paths) + .collect::, _>>() + .expect("all local references resolve safely") + .into_iter() + .flatten() + .collect::>(); + assert_eq!( + index.by_path().keys().cloned().collect::>(), + reachable, + "every annotation is reachable and every reachable published leaf or structural path is annotated" + ); + + assert!(index.by_path().values().all(|knowledge| { + knowledge + .semantic_rules + .contains(&SemanticRule::KnowledgeOnly) + && knowledge + .semantic_rules + .contains(&SemanticRule::GeneratedDocsNeverLoadCountryValues) + })); + assert!(index.by_path().values().all(|knowledge| { + !matches!( + knowledge.sensitivity, + Sensitivity::SecretReference + | Sensitivity::SecretValue + | Sensitivity::RedactedFixture + | Sensitivity::Sensitive + ) || !knowledge.sensitivity.value_is_reportable(false) + })); + assert_eq!( + index.coverage_by_sensitivity()[&Sensitivity::SecretReference], + 14, + "secret-reference values and names remain explicitly never-reportable" + ); + assert_eq!( + index.coverage_by_sensitivity()[&Sensitivity::RedactedFixture], + 50, + "fixture request, response, input, body, and expected values remain redacted" + ); + walk_schema( + &documents + .iter() + .find(|(kind, _)| *kind == SchemaKind::Environment) + .expect("environment schema is published") + .1, + "", + &mut |node, pointer| { + if node.get("$ref").and_then(Value::as_str) == Some("#/$defs/secret") { + assert_eq!( + node.get("x-registry-field").and_then(Value::as_str), + Some("secret_reference_property"), + "environment#{pointer} carries a secret-reference name and must never be reportable" + ); + } + }, + ); + for pointer in [ + "/properties/relay/properties/origin", + "/properties/relay/properties/jwks_url", + "/$defs/oid4vci/properties/authorization_server/properties/token_url", + "/$defs/oid4vci/properties/client/properties/id", + "/$defs/privateCidrs/items", + "/$defs/oid4vci/properties/access_token/properties/signing_kid", + "/$defs/credential/oneOf/3/properties/generation", + "/properties/notary_state/properties/postgresql/properties/root_certificate_path", + ] { + assert!( + matches!( + index.by_path()[&field_knowledge::FieldPath { + schema: SchemaKind::Environment, + pointer: pointer.to_string(), + }] + .sensitivity, + Sensitivity::Sensitive + ), + "environment#{pointer} must retain conservative operational sensitivity" + ); + } + + for (entry, kind) in coverage.schemas.iter().zip([ + ProjectSchemaKind::Project, + ProjectSchemaKind::Environment, + ProjectSchemaKind::Integration, + ProjectSchemaKind::Fixture, + ProjectSchemaKind::Entity, + ]) { + assert_eq!(entry.file, kind.filename()); + assert_eq!( + std::fs::read(schema_root().join(&entry.file)).expect("published schema reads"), + kind.document().as_bytes(), + "{} editor-emitted schema must be byte-exact with the field-knowledge source", + entry.kind + ); + } +} + +#[test] +fn field_knowledge_gate_rejects_missing_malformed_unknown_duplicate_and_unresolved_paths() { + let coverage = coverage(); + + let assert_rejected = |documents: &[(SchemaKind, Value)], expected: &str| { + let error = index_published_field_knowledge( + &coverage.field_knowledge, + &published_schemas(documents), + ) + .expect_err("field-knowledge corruption must fail closed"); + assert!( + error.to_string().contains(expected), + "expected {expected:?} in {error}" + ); + }; + + let mut missing = knowledge_documents(&coverage); + missing[0] + .1 + .as_object_mut() + .expect("project schema is an object") + .remove("x-registry-field"); + assert_rejected(&missing, "without x-registry-field"); + + let mut malformed = knowledge_documents(&coverage); + malformed[0].1["x-registry-field"] = serde_json::json!({ "profile": "root" }); + assert_rejected(&malformed, "must be a classification string"); + + let mut unknown = knowledge_documents(&coverage); + unknown[0].1["x-registry-field"] = Value::String("unreviewed".to_string()); + assert_rejected(&unknown, "unknown field classification"); + + let mut unresolved = knowledge_documents(&coverage); + unresolved[0].1["properties"]["starter"]["$ref"] = + Value::String("#/$defs/doesNotExist".to_string()); + assert_rejected(&unresolved, "unresolved local $ref"); + + let documents = knowledge_documents(&coverage); + let mut duplicated = published_schemas(&documents); + duplicated.push(PublishedSchema { + kind: SchemaKind::Project, + document: &documents[0].1, + }); + let error = index_published_field_knowledge(&coverage.field_knowledge, &duplicated) + .expect_err("duplicate schema root is a duplicate field path"); + assert!(error + .to_string() + .contains("duplicate published schema kind")); +} + +#[test] +fn schemas_compile_and_all_catalog_documents_pass_schema_and_runtime() { + let coverage = coverage(); + assert_eq!(coverage.version, 1); + assert_eq!( + coverage + .schemas + .iter() + .map(|entry| (entry.kind.as_str(), entry.file.as_str())) + .collect::>(), + [ + ("project", "project.schema.json"), + ("environment", "environment.schema.json"), + ("integration", "integration.schema.json"), + ("fixture", "fixture.schema.json"), + ("entity", "entity.schema.json"), + ], + "the parity gate must enumerate the exact published five-schema catalog" + ); + let compiled = coverage + .schemas + .iter() + .map(|entry| (entry.kind.as_str(), compile_schema(&entry.file).1)) + .collect::>(); + + let catalog: JourneyCatalog = serde_norway::from_slice( + &std::fs::read(crate_root().join("tests/fixtures/project-authoring-journeys.yaml")) + .expect("journey catalog reads"), + ) + .expect("journey catalog parses"); + assert_eq!(catalog.version, 1); + assert!(!catalog.workspaces.is_empty()); + + for journey in catalog.workspaces { + assert!( + !journey.metadata.is_empty(), + "{} retains its maintained journey metadata", + journey.id + ); + let root = repository_root().join(&journey.source); + let project_path = root.join("registry-stack.yaml"); + validate_document(&compiled["project"], &project_path); + let project = read_yaml_json(&project_path); + + let entity_references = referenced_files(&project, "entities"); + let authored_entities = sorted_yaml_files(&root.join("entities")) + .into_iter() + .map(|path| { + path.strip_prefix(&root) + .expect("entity is below project root") + .to_path_buf() + }) + .collect::>(); + assert_eq!( + entity_references, authored_entities, + "{} must reference every maintained entity document exactly once", + journey.id + ); + for relative in entity_references { + validate_document(&compiled["entity"], &root.join(relative)); + } + + let integration_references = referenced_files(&project, "integrations"); + let authored_integrations = if root.join("integrations").is_dir() { + let mut paths = std::fs::read_dir(root.join("integrations")) + .expect("integrations directory reads") + .map(|entry| { + entry + .expect("integration directory entry reads") + .path() + .join("integration.yaml") + }) + .filter(|path| path.is_file()) + .map(|path| { + path.strip_prefix(&root) + .expect("integration is below project root") + .to_path_buf() + }) + .collect::>(); + paths.sort(); + paths.into_iter().collect() + } else { + BTreeSet::new() + }; + assert_eq!( + integration_references, authored_integrations, + "{} must reference every maintained integration document exactly once", + journey.id + ); + for relative in integration_references { + let integration_path = root.join(&relative); + validate_document(&compiled["integration"], &integration_path); + for fixture in sorted_yaml_files( + integration_path + .parent() + .expect("integration has a parent") + .join("fixtures") + .as_path(), + ) { + validate_document(&compiled["fixture"], &fixture); + } + } + + let environments = sorted_yaml_files(&root.join("environments")); + assert!( + !environments.is_empty(), + "{} has at least one maintained environment", + journey.id + ); + for environment_path in environments { + validate_document(&compiled["environment"], &environment_path); + let environment = environment_path + .file_stem() + .and_then(|name| name.to_str()) + .expect("environment filename is Unicode"); + let report = check_registry_project(&ProjectCheckOptions { + project_directory: root.clone(), + environment: environment.to_string(), + explain: false, + against: None, + anchor: None, + }) + .unwrap_or_else(|error| { + panic!( + "{} failed the production check path for {environment}: {error:#}", + journey.id + ) + }); + assert_eq!(report.status, "valid", "{} production check", journey.id); + } + assert!( + sorted_yaml_files(&root.join("environments")) + .iter() + .any(|path| { + path.file_stem().and_then(|name| name.to_str()) + == Some(journey.environment.as_str()) + }), + "{} catalog environment is maintained", + journey.id + ); + } +} + +fn escape_pointer_segment(segment: &str) -> String { + segment.replace('~', "~0").replace('/', "~1") +} + +fn walk_schema(schema: &Value, pointer: &str, visit: &mut impl FnMut(&Value, &str)) { + visit(schema, pointer); + let Some(object) = schema.as_object() else { + return; + }; + for container in ["$defs", "properties", "dependentSchemas"] { + if let Some(children) = object.get(container).and_then(Value::as_object) { + for (name, child) in children { + walk_schema( + child, + &format!("{pointer}/{container}/{}", escape_pointer_segment(name)), + visit, + ); + } + } + } + for keyword in [ + "additionalProperties", + "contains", + "else", + "if", + "items", + "not", + "propertyNames", + "then", + ] { + if object.get(keyword).is_some_and(Value::is_object) { + walk_schema(&object[keyword], &format!("{pointer}/{keyword}"), visit); + } + } + for keyword in ["allOf", "anyOf", "oneOf", "prefixItems"] { + if let Some(children) = object.get(keyword).and_then(Value::as_array) { + for (index, child) in children.iter().enumerate() { + walk_schema(child, &format!("{pointer}/{keyword}/{index}"), visit); + } + } + } +} + +fn is_object_schema(schema: &Value) -> bool { + match schema.get("type") { + Some(Value::String(kind)) => kind == "object", + Some(Value::Array(kinds)) => kinds.iter().any(|kind| kind.as_str() == Some("object")), + _ => false, + } +} + +#[derive(Debug, Default, Clone, Copy, PartialEq, Eq)] +struct PublishedStructuralInventory { + nodes: usize, + local_refs: usize, + union_nodes: usize, + union_branches: usize, + conditionals: usize, + objects: usize, + closed_objects: usize, + typed_maps: usize, + open_maps: usize, + arrays: usize, + scalar_types: usize, + nullable_nodes: usize, + integer_lower_bounds: usize, + integer_upper_bounds: usize, + string_length_bounds: usize, + string_patterns: usize, + array_size_bounds: usize, + unique_arrays: usize, + object_size_bounds: usize, + property_name_constraints: usize, + enums: usize, + consts: usize, + defaults: usize, + deprecations: usize, +} + +fn published_structural_inventory(schema: &Value) -> PublishedStructuralInventory { + let mut inventory = PublishedStructuralInventory::default(); + walk_schema(schema, "", &mut |node, _| { + inventory.nodes += 1; + let Some(object) = node.as_object() else { + return; + }; + inventory.local_refs += usize::from(object.contains_key("$ref")); + for keyword in ["anyOf", "oneOf"] { + if let Some(branches) = object.get(keyword).and_then(Value::as_array) { + inventory.union_nodes += 1; + inventory.union_branches += branches.len(); + } + } + inventory.conditionals += usize::from(object.contains_key("if")); + inventory.arrays += usize::from(match object.get("type") { + Some(Value::String(kind)) => kind == "array", + Some(Value::Array(kinds)) => kinds.iter().any(|kind| kind.as_str() == Some("array")), + _ => false, + }); + let types = match object.get("type") { + Some(Value::String(kind)) => vec![kind.as_str()], + Some(Value::Array(kinds)) => kinds.iter().filter_map(Value::as_str).collect(), + _ => Vec::new(), + }; + inventory.scalar_types += types + .iter() + .filter(|kind| matches!(**kind, "null" | "boolean" | "integer" | "number" | "string")) + .count(); + inventory.nullable_nodes += usize::from(types.contains(&"null")); + if types.contains(&"integer") { + inventory.integer_lower_bounds += usize::from( + object.contains_key("minimum") || object.contains_key("exclusiveMinimum"), + ); + inventory.integer_upper_bounds += usize::from( + object.contains_key("maximum") || object.contains_key("exclusiveMaximum"), + ); + } + inventory.string_length_bounds += + usize::from(object.contains_key("minLength") || object.contains_key("maxLength")); + inventory.string_patterns += usize::from(object.contains_key("pattern")); + inventory.array_size_bounds += + usize::from(object.contains_key("minItems") || object.contains_key("maxItems")); + inventory.unique_arrays += + usize::from(object.get("uniqueItems") == Some(&Value::Bool(true))); + inventory.object_size_bounds += usize::from( + object.contains_key("minProperties") || object.contains_key("maxProperties"), + ); + inventory.property_name_constraints += usize::from(object.contains_key("propertyNames")); + inventory.enums += usize::from(object.contains_key("enum")); + inventory.consts += usize::from(object.contains_key("const")); + inventory.defaults += usize::from(object.contains_key("default")); + inventory.deprecations += usize::from(object.contains_key("deprecated")); + if is_object_schema(node) { + inventory.objects += 1; + match object.get("additionalProperties") { + Some(Value::Bool(false)) => inventory.closed_objects += 1, + Some(Value::Object(_)) => inventory.typed_maps += 1, + None | Some(Value::Bool(true)) => inventory.open_maps += 1, + other => panic!("unsupported additionalProperties shape: {other:?}"), + } + } + }); + inventory +} + +#[test] +fn exact_published_structural_contract_inventory_is_release_gated() { + let coverage = coverage(); + let actual = coverage + .schemas + .iter() + .map(|entry| { + ( + entry.kind.as_str(), + published_structural_inventory(&compile_schema(&entry.file).0), + ) + }) + .collect::>(); + + assert_eq!( + actual, + [ + ( + "project", + PublishedStructuralInventory { + nodes: 252, + local_refs: 123, + union_nodes: 9, + union_branches: 19, + conditionals: 0, + objects: 51, + closed_objects: 36, + typed_maps: 15, + open_maps: 0, + arrays: 11, + scalar_types: 30, + nullable_nodes: 0, + integer_lower_bounds: 9, + integer_upper_bounds: 9, + string_length_bounds: 10, + string_patterns: 12, + array_size_bounds: 9, + unique_arrays: 8, + object_size_bounds: 17, + property_name_constraints: 14, + enums: 12, + consts: 8, + defaults: 0, + deprecations: 0, + }, + ), + ( + "environment", + PublishedStructuralInventory { + nodes: 215, + local_refs: 82, + union_nodes: 6, + union_branches: 16, + conditionals: 7, + objects: 39, + closed_objects: 35, + typed_maps: 4, + open_maps: 0, + arrays: 4, + scalar_types: 40, + nullable_nodes: 0, + integer_lower_bounds: 16, + integer_upper_bounds: 16, + string_length_bounds: 15, + string_patterns: 13, + array_size_bounds: 4, + unique_arrays: 4, + object_size_bounds: 5, + property_name_constraints: 4, + enums: 2, + consts: 6, + defaults: 2, + deprecations: 0, + }, + ), + ( + "integration", + PublishedStructuralInventory { + nodes: 159, + local_refs: 35, + union_nodes: 8, + union_branches: 19, + conditionals: 0, + objects: 33, + closed_objects: 27, + typed_maps: 6, + open_maps: 0, + arrays: 9, + scalar_types: 46, + nullable_nodes: 0, + integer_lower_bounds: 14, + integer_upper_bounds: 14, + string_length_bounds: 14, + string_patterns: 18, + array_size_bounds: 9, + unique_arrays: 8, + object_size_bounds: 8, + property_name_constraints: 3, + enums: 10, + consts: 14, + defaults: 0, + deprecations: 0, + }, + ), + ( + "fixture", + PublishedStructuralInventory { + nodes: 71, + local_refs: 10, + union_nodes: 4, + union_branches: 8, + conditionals: 0, + objects: 21, + closed_objects: 11, + typed_maps: 7, + open_maps: 3, + arrays: 4, + scalar_types: 36, + nullable_nodes: 4, + integer_lower_bounds: 1, + integer_upper_bounds: 1, + string_length_bounds: 9, + string_patterns: 7, + array_size_bounds: 4, + unique_arrays: 0, + object_size_bounds: 10, + property_name_constraints: 4, + enums: 2, + consts: 1, + defaults: 0, + deprecations: 0, + }, + ), + ( + "entity", + PublishedStructuralInventory { + nodes: 40, + local_refs: 7, + union_nodes: 3, + union_branches: 6, + conditionals: 0, + objects: 5, + closed_objects: 4, + typed_maps: 1, + open_maps: 0, + arrays: 3, + scalar_types: 13, + nullable_nodes: 0, + integer_lower_bounds: 8, + integer_upper_bounds: 8, + string_length_bounds: 1, + string_patterns: 4, + array_size_bounds: 3, + unique_arrays: 3, + object_size_bounds: 1, + property_name_constraints: 1, + enums: 2, + consts: 6, + defaults: 0, + deprecations: 0, + }, + ), + ] + .into_iter() + .collect(), + "every finite schema node, local reference, union/conditional, object/map shape, scalar/null type, numeric/string/array/object constraint, enum/const, default, and deprecation is release-gated" + ); +} + +fn normalized_rust_source(source: &str) -> String { + source.split_whitespace().collect::>().join(" ") +} + +fn validate_production_ingress_inventory( + project_source: &str, + output_source: &str, + diagnostics_source: &str, + schema_authority_source: &str, +) -> Result<(), String> { + let project = normalized_rust_source(project_source); + let output = normalized_rust_source(output_source); + let diagnostics = normalized_rust_source(diagnostics_source); + let schema_authority = normalized_rust_source(schema_authority_source); + let routes = [ + ( + "loader/project", + &project, + "let project: RegistryProject = parse_yaml(&project_bytes, PROJECT_FILE)", + ), + ( + "loader/entity", + &project, + "let document: EntityDefinition = parse_yaml(&bytes, relative)", + ), + ( + "loader/integration", + &project, + "let authored: AuthoredIntegrationDocument = parse_yaml(&bytes, &reference.file.display().to_string())", + ), + ( + "loader/environment", + &project, + "let document: EnvironmentDocument = parse_yaml(&bytes, &relative.display().to_string())", + ), + ( + "loader/fixture", + &output, + "let authored: AuthoredFixtureDocument = parse_yaml(&bytes, relative)", + ), + ( + "diagnostics/project", + &diagnostics, + "diagnostic_parse_yaml(&project_bytes, PROJECT_FILE, \"project\", PROJECT_SCHEMA_HINT)", + ), + ( + "diagnostics/entity", + &diagnostics, + "diagnostic_parse_yaml(&bytes, &file, \"entity\", ENTITY_SCHEMA_HINT)", + ), + ( + "diagnostics/integration", + &diagnostics, + "diagnostic_parse_yaml(&bytes, &file, \"integration\", INTEGRATION_SCHEMA_HINT)", + ), + ( + "diagnostics/environment", + &diagnostics, + "diagnostic_parse_yaml(&bytes, &file, \"environment\", ENVIRONMENT_SCHEMA_HINT)", + ), + ( + "diagnostics/fixture", + &diagnostics, + "diagnostic_parse_yaml(&bytes, &file, \"fixture\", FIXTURE_SCHEMA_HINT)", + ), + ]; + for (route, source, needle) in routes { + let count = source.matches(needle).count(); + if count != 1 { + return Err(format!( + "{route} must occur exactly once in the production ingress inventory; found {count}" + )); + } + } + + let project_production = project_source + .split("#[cfg(test)]") + .next() + .expect("project source has a production prefix"); + if project_production.matches("parse_yaml(").count() != 4 { + return Err("project loader must retain exactly four direct authored routes".to_string()); + } + if output_source.matches("parse_yaml(").count() != 1 + || output_source.matches("fn parse_yaml<").count() != 1 + { + return Err( + "output module must retain exactly one fixture route and one central parse helper" + .to_string(), + ); + } + let diagnostic_production = diagnostics_source + .split("#[cfg(test)]") + .next() + .expect("diagnostics source has a production prefix"); + if diagnostic_production + .matches("diagnostic_parse_yaml(") + .count() + != 5 + || diagnostic_production + .matches("fn diagnostic_parse_yaml<") + .count() + != 1 + { + return Err( + "diagnostics must retain five authored routes and one central diagnostic helper" + .to_string(), + ); + } + for (rust_type, kind) in [ + ("RegistryProject", "Project"), + ("EnvironmentDocument", "Environment"), + ("AuthoredIntegrationDocument", "Integration"), + ("AuthoredFixtureDocument", "Fixture"), + ("EntityDefinition", "Entity"), + ] { + let mapping = format!( + "impl CurrentAuthoringDocument for {rust_type} {{ const KIND: ProjectSchemaKind = ProjectSchemaKind::{kind}; }}" + ); + if schema_authority.matches(&mapping).count() != 1 { + return Err(format!( + "typed schema-authority mapping must occur exactly once: {mapping}" + )); + } + } + if output + .matches("parse_current_authoring_document(bytes)") + .count() + != 1 + || diagnostics + .matches("parse_current_authoring_document(bytes)") + .count() + != 1 + { + return Err( + "both loader and diagnostic ingress helpers must route through canonical schema authority" + .to_string(), + ); + } + Ok(()) +} + +fn collect_project_authoring_rust_sources( + directory: &Path, + sources: &mut Vec<(PathBuf, String)>, +) -> std::io::Result<()> { + let mut entries = std::fs::read_dir(directory)?.collect::, _>>()?; + entries.sort_by_key(std::fs::DirEntry::path); + for entry in entries { + let path = entry.path(); + if path.is_dir() { + collect_project_authoring_rust_sources(&path, sources)?; + } else if path.extension().is_some_and(|extension| extension == "rs") { + sources.push((path.clone(), std::fs::read_to_string(path)?)); + } + } + Ok(()) +} + +fn direct_current_document_deserializers(sources: &[(PathBuf, String)]) -> Vec { + const PARSERS: [&str; 5] = [ + "serde_norway::from_slice", + "serde_norway::from_str", + "serde_json::from_slice", + "serde_json::from_str", + "serde_json::from_value", + ]; + const CURRENT_DOCUMENTS: [&str; 5] = [ + "RegistryProject", + "EnvironmentDocument", + "AuthoredIntegrationDocument", + "AuthoredFixtureDocument", + "EntityDefinition", + ]; + + let mut violations = Vec::new(); + for (path, source) in sources { + if path + .file_name() + .is_some_and(|name| name == "schema_authority.rs") + { + continue; + } + let production = source.split("\n#[cfg(test)]").next().unwrap_or(source); + let normalized = normalized_rust_source(production); + for statement in normalized.split(';') { + let Some(parser) = PARSERS.iter().find(|parser| statement.contains(**parser)) else { + continue; + }; + for document in CURRENT_DOCUMENTS { + if contains_rust_identifier(statement, document) { + violations.push(format!( + "{} directly deserializes {document} with {parser}", + path.display() + )); + } + } + } + } + violations.sort(); + violations.dedup(); + violations +} + +fn contains_rust_identifier(source: &str, identifier: &str) -> bool { + source.match_indices(identifier).any(|(start, matched)| { + let before = source[..start].chars().next_back(); + let after = source[start + matched.len()..].chars().next(); + before.is_none_or(|character| !(character.is_alphanumeric() || character == '_')) + && after.is_none_or(|character| !(character.is_alphanumeric() || character == '_')) + }) +} + +#[test] +fn every_production_current_format_ingress_routes_through_schema_authority() { + let project = include_str!("../src/project_authoring/project.rs"); + let output = include_str!("../src/project_authoring/output.rs"); + let diagnostics = include_str!("../src/project_authoring/diagnostics.rs"); + let schema_authority = include_str!("../src/project_authoring/schema_authority.rs"); + validate_production_ingress_inventory(project, output, diagnostics, schema_authority) + .expect("the production ingress inventory is exact"); + + let missing_route = project.replacen("AuthoredIntegrationDocument", "EntityDefinition", 1); + assert!( + validate_production_ingress_inventory( + &missing_route, + output, + diagnostics, + schema_authority + ) + .expect_err("route-kind drift must fail closed") + .contains("loader/integration"), + "the route inventory has a planted negative control" + ); + + let manifest_dir = Path::new(env!("CARGO_MANIFEST_DIR")); + let mut sources = Vec::new(); + collect_project_authoring_rust_sources( + &manifest_dir.join("src/project_authoring"), + &mut sources, + ) + .expect("project-authoring Rust sources are readable"); + let root_module = manifest_dir.join("src/project_authoring.rs"); + sources.push(( + root_module.clone(), + std::fs::read_to_string(root_module).expect("project-authoring root is readable"), + )); + assert!( + direct_current_document_deserializers(&sources).is_empty(), + "current authoring DTOs must not bypass schema authority: {:#?}", + direct_current_document_deserializers(&sources) + ); + + let planted_bypass = vec![( + PathBuf::from("new_loader.rs"), + "let project: RegistryProject = serde_norway::from_slice(bytes)?;".to_string(), + )]; + assert_eq!( + direct_current_document_deserializers(&planted_bypass), + vec!["new_loader.rs directly deserializes RegistryProject with \ + serde_norway::from_slice" + .to_string()], + "the repository-wide ingress guard has a planted negative control" + ); +} + +#[test] +fn published_schema_vocabulary_and_open_object_exceptions_are_explicit() { + let coverage = coverage(); + let schema_files = coverage + .schemas + .iter() + .map(|schema| (schema.kind.as_str(), schema.file.as_str())) + .collect::>(); + let mut expected = BTreeMap::new(); + for exception in &coverage.open_object_exceptions { + assert!( + schema_files.contains_key(exception.schema.as_str()), + "unknown schema in open-object exception: {}", + exception.schema + ); + assert!( + exception.pointer.starts_with('/'), + "exception pointer must be absolute: {}", + exception.pointer + ); + assert!( + exception.rationale.len() >= 32, + "{} {} needs a concrete rationale", + exception.schema, + exception.pointer + ); + assert!( + expected + .insert( + (exception.schema.as_str(), exception.pointer.as_str()), + exception.kind, + ) + .is_none(), + "duplicate open-object exception: {} {}", + exception.schema, + exception.pointer + ); + } + + let mut actual = BTreeMap::new(); + let metadata_keywords = SCHEMA_METADATA_KEYWORDS + .into_iter() + .collect::>(); + let mut encountered_keywords = BTreeSet::new(); + for schema in &coverage.schemas { + let (document, _) = compile_schema(&schema.file); + walk_schema(&document, "", &mut |node, pointer| { + let Some(object) = node.as_object() else { + return; + }; + encountered_keywords.extend( + object + .keys() + .filter(|keyword| !metadata_keywords.contains(keyword.as_str())) + .cloned(), + ); + if !is_object_schema(node) + || object.get("additionalProperties") == Some(&Value::Bool(false)) + { + return; + } + let kind = match object.get("additionalProperties") { + Some(Value::Object(_)) => OpenObjectKind::TypedMap, + None | Some(Value::Bool(true)) => OpenObjectKind::ExtensionMap, + other => panic!( + "{}{pointer} has unsupported additionalProperties form {other:?}", + schema.kind + ), + }; + assert!( + actual + .insert((schema.kind.as_str(), pointer.to_string()), kind) + .is_none(), + "duplicate schema node {}{pointer}", + schema.kind + ); + }); + } + + let expected_owned = expected + .into_iter() + .map(|((schema, pointer), kind)| ((schema, pointer.to_string()), kind)) + .collect::>(); + assert_eq!( + actual, expected_owned, + "every object schema must be closed or have one exact named map/extension exception" + ); + + assert_eq!( + encountered_keywords, + [ + "$defs", + "$ref", + "additionalProperties", + "allOf", + "anyOf", + "const", + "else", + "enum", + "exclusiveMinimum", + "format", + "if", + "items", + "maxItems", + "maxLength", + "maxProperties", + "maximum", + "minItems", + "minLength", + "minProperties", + "minimum", + "not", + "oneOf", + "pattern", + "prefixItems", + "properties", + "propertyNames", + "required", + "then", + "type", + "uniqueItems", + ] + .into_iter() + .map(str::to_string) + .collect(), + "published schema vocabulary changed; update the inventory and add exact evidence where a rule is exercised" + ); +} + +fn copy_tree(source: &Path, destination: &Path) { + std::fs::create_dir_all(destination) + .unwrap_or_else(|error| panic!("{} creates: {error}", destination.display())); + let mut entries = std::fs::read_dir(source) + .unwrap_or_else(|error| panic!("{} reads: {error}", source.display())) + .map(|entry| entry.expect("source entry reads")) + .collect::>(); + entries.sort_by_key(std::fs::DirEntry::file_name); + for entry in entries { + let source_path = entry.path(); + let destination_path = destination.join(entry.file_name()); + if entry.file_type().expect("source entry type reads").is_dir() { + copy_tree(&source_path, &destination_path); + } else { + std::fs::copy(&source_path, &destination_path).unwrap_or_else(|error| { + panic!( + "{} copies to {}: {error}", + source_path.display(), + destination_path.display() + ) + }); + } + } +} + +fn decode_pointer_segment(segment: &str) -> String { + segment.replace("~1", "/").replace("~0", "~") +} + +fn mutate(document: &mut Value, mutation: &Mutation) { + assert!( + mutation.pointer.starts_with('/'), + "mutation pointer must be absolute: {}", + mutation.pointer + ); + let (parent_pointer, segment) = mutation + .pointer + .rsplit_once('/') + .expect("absolute mutation pointer has a parent"); + let segment = decode_pointer_segment(segment); + let parent = document + .pointer_mut(parent_pointer) + .unwrap_or_else(|| panic!("mutation parent exists: {parent_pointer}")); + match mutation.operation { + MutationOperation::Set => { + let value = mutation + .value + .clone() + .expect("set mutation supplies a value"); + match parent { + Value::Object(object) => { + object.insert(segment, value); + } + Value::Array(array) => { + let index = segment.parse::().expect("array index is numeric"); + *array.get_mut(index).expect("array mutation index exists") = value; + } + _ => panic!("set mutation parent is an object or array"), + } + } + MutationOperation::Remove => { + assert!( + mutation.value.is_none(), + "remove mutation does not supply a value" + ); + match parent { + Value::Object(object) => { + assert!( + object.remove(&segment).is_some(), + "removed field exists: {}", + mutation.pointer + ); + } + Value::Array(array) => { + let index = segment.parse::().expect("array index is numeric"); + assert!(index < array.len(), "removed array index exists"); + array.remove(index); + } + _ => panic!("remove mutation parent is an object or array"), + } + } + } +} + +#[test] +fn representative_mutations_fail_schema_and_runtime() { + let coverage = coverage(); + let schemas = coverage + .schemas + .iter() + .map(|entry| (entry.kind.as_str(), compile_schema(&entry.file).1)) + .collect::>(); + let mut ids = BTreeSet::new(); + let mut dimensions = BTreeMap::<&str, BTreeSet<&str>>::new(); + let mut observed_keyword_evidence = BTreeMap::new(); + + for case in &coverage.parity_cases { + assert!( + ids.insert(case.id.as_str()), + "duplicate case id: {}", + case.id + ); + assert!( + !case.expected_failing_keywords.is_empty(), + "{} must name at least one observed failing schema keyword", + case.id + ); + assert!( + case.expected_failing_keywords + .windows(2) + .all(|keywords| keywords[0] < keywords[1]), + "{} failing schema keywords must be unique and sorted", + case.id + ); + let schema = schemas + .get(case.schema.as_str()) + .unwrap_or_else(|| panic!("{} names a published schema", case.id)); + dimensions + .entry(case.dimension.as_str()) + .or_default() + .insert(case.schema.as_str()); + + let temporary = tempfile::tempdir().expect("temporary directory creates"); + let project = temporary.path().join("project"); + copy_tree(&repository_root().join(&case.source), &project); + let document_path = project.join(&case.document); + let mut document = read_yaml_json(&document_path); + assert!( + schema.is_valid(&document), + "{} starts from a schema-valid maintained document", + case.id + ); + mutate(&mut document, &case.mutation); + let observed_failing_keywords = schema + .validate(&document) + .expect_err("maintained mutation must fail its published schema") + .map(|error| { + error + .schema_path + .to_string() + .rsplit('/') + .next() + .filter(|keyword| !keyword.is_empty()) + .unwrap_or("") + .to_string() + }) + .collect::>(); + observed_keyword_evidence.insert(case.id.as_str(), observed_failing_keywords); + std::fs::write( + &document_path, + serde_norway::to_string(&document).expect("mutated document serializes as YAML"), + ) + .expect("mutated document writes"); + + let error = match check_registry_project(&ProjectCheckOptions { + project_directory: project, + environment: "local".to_string(), + explain: false, + against: None, + anchor: None, + }) { + Ok(_) => panic!( + "{} failed its schema but was accepted by the production loader/check path", + case.id + ), + Err(error) => error, + }; + match (&case.expected_error_code, &case.expected_remediation) { + (Some(expected_code), Some(expected_remediation)) => { + let report = error + .downcast_ref::() + .unwrap_or_else(|| { + panic!("{} returns typed authoring diagnostics: {error:#}", case.id) + }); + assert!( + report.diagnostics.iter().any(|diagnostic| { + diagnostic.code == expected_code + && diagnostic.remediation == expected_remediation + }), + "{} must return the exact safe remediation: {report:#?}", + case.id + ); + } + (None, None) => {} + _ => panic!( + "{} must declare both expected_error_code and expected_remediation", + case.id + ), + } + } + + let all_schemas = ["entity", "environment", "fixture", "integration", "project"] + .into_iter() + .collect::>(); + for dimension in ["unknown_field", "missing_required", "type", "boundary"] { + assert_eq!( + dimensions.get(dimension), + Some(&all_schemas), + "{dimension} must retain a representative mutation for every schema kind" + ); + } + assert_eq!( + dimensions.get("conditional"), + Some( + &["environment", "fixture", "integration", "project"] + .into_iter() + .collect() + ), + "every schema with a maintained conditional union needs a representative mutation" + ); + assert_eq!( + dimensions.keys().copied().collect::>(), + [ + "boundary", + "conditional", + "missing_required", + "type", + "unknown_field" + ] + .into_iter() + .collect(), + "new parity dimensions require an explicit gate assertion" + ); + assert_eq!( + observed_keyword_evidence, + coverage + .parity_cases + .iter() + .map(|case| { + ( + case.id.as_str(), + case.expected_failing_keywords.iter().cloned().collect(), + ) + }) + .collect(), + "each maintained mutation must name the exact schema keywords observed to fail" + ); +} diff --git a/crates/registryctl/tests/project_build_baseline_set.rs b/crates/registryctl/tests/project_build_baseline_set.rs new file mode 100644 index 000000000..7ead819c0 --- /dev/null +++ b/crates/registryctl/tests/project_build_baseline_set.rs @@ -0,0 +1,335 @@ +// SPDX-License-Identifier: Apache-2.0 + +use std::path::{Path, PathBuf}; + +use registryctl::{ + add_config_anchor_key, build_registry_project_with_baselines_and_context, + build_registry_project_with_context, init_config_anchor, init_registry_project, + sign_config_bundle, BundleSignOptions, ProjectBuildBaselineSetOptions, ProjectBuildOptions, + ProjectExecutionContext, ProjectInitOptions, ProjectStarter, +}; + +const TEST_PRIVATE_JWK: &str = r#"{"kty":"OKP","crv":"Ed25519","d":"2oPoxdKuO7Kpd-3JLfNW_4xwpFxItbS-fxe03ZybYEw","x":"1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc","alg":"EdDSA","kid":"registryctl-test-private-key"}"#; +const TEST_PUBLIC_JWK: &str = r#"{"kty":"OKP","crv":"Ed25519","x":"1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc","alg":"EdDSA","kid":"registryctl-test-private-key"}"#; + +#[derive(Clone)] +struct SignedProductBaseline { + bundle: PathBuf, + anchor: PathBuf, +} + +fn context() -> ProjectExecutionContext { + ProjectExecutionContext::new(env!("CARGO_BIN_EXE_registryctl")) + .expect("Cargo provides the exact registryctl executable") +} + +fn initialize_project(root: &Path) -> PathBuf { + let project = root.join("approved-baseline-project"); + init_registry_project(&ProjectInitOptions { + starter: ProjectStarter::Http, + directory: project.clone(), + }) + .expect("combined starter initializes"); + project +} + +fn build_options(project: &Path) -> ProjectBuildOptions { + ProjectBuildOptions { + project_directory: project.to_path_buf(), + environment: "local".to_string(), + against: None, + anchor: None, + } +} + +fn initial_build(project: &Path) -> PathBuf { + let report = build_registry_project_with_context(&build_options(project), &context()) + .expect("initial build without an approved baseline succeeds"); + project.join(report.output.expect("build reports its output")) +} + +fn sign_product_baseline( + output: &Path, + temporary: &Path, + product: &str, + product_directory: &str, + environment: &str, + suffix: &str, +) -> SignedProductBaseline { + let private_key = temporary.join(format!("{suffix}-private.jwk")); + let public_key = temporary.join(format!("{suffix}-public.jwk")); + let anchor = temporary.join(format!("{suffix}-anchor.json")); + let bundle = temporary.join(format!("{suffix}-bundle")); + std::fs::write(&private_key, TEST_PRIVATE_JWK).expect("private test key writes"); + std::fs::write(&public_key, TEST_PUBLIC_JWK).expect("public test key writes"); + init_config_anchor( + &anchor, + product.to_string(), + environment.to_string(), + format!("{suffix}-stream"), + format!("{suffix}-instance"), + ) + .expect("product trust anchor initializes"); + add_config_anchor_key(&anchor, &public_key, true).expect("product signer is trusted"); + sign_config_bundle(BundleSignOptions { + input: output.join("private").join(product_directory), + key: private_key.display().to_string(), + product: product.to_string(), + environment: environment.to_string(), + stream_id: format!("{suffix}-stream"), + instance_id: Some(format!("{suffix}-instance")), + sequence: 1, + bundle_id: format!("{suffix}-bundle"), + out: bundle.clone(), + }) + .expect("product baseline signs"); + SignedProductBaseline { bundle, anchor } +} + +fn sign_common_pair( + output: &Path, + temporary: &Path, + suffix: &str, +) -> ProjectBuildBaselineSetOptions { + let relay = sign_product_baseline( + output, + temporary, + "registry-relay", + "relay", + "local", + &format!("{suffix}-relay"), + ); + let notary = sign_product_baseline( + output, + temporary, + "registry-notary", + "notary", + "local", + &format!("{suffix}-notary"), + ); + ProjectBuildBaselineSetOptions { + relay_against: Some(relay.bundle), + relay_anchor: Some(relay.anchor), + notary_against: Some(notary.bundle), + notary_anchor: Some(notary.anchor), + } +} + +fn copy_tree(source: &Path, destination: &Path) { + std::fs::create_dir_all(destination).expect("destination directory creates"); + for entry in std::fs::read_dir(source).expect("source directory reads") { + let entry = entry.expect("directory entry reads"); + let source_path = entry.path(); + let destination_path = destination.join(entry.file_name()); + if entry.file_type().expect("entry type reads").is_dir() { + copy_tree(&source_path, &destination_path); + } else { + std::fs::copy(&source_path, &destination_path).expect("fixture file copies"); + } + } +} + +fn assert_value_free_rejection( + project: &Path, + baselines: &ProjectBuildBaselineSetOptions, + temporary: &Path, +) { + let error = build_registry_project_with_baselines_and_context( + &build_options(project), + baselines, + &context(), + ) + .expect_err("invalid approved baseline set must fail"); + let message = format!("{error:#}"); + assert!(message.contains("could not establish verified build baselines")); + for forbidden in [ + "approved-baseline-project", + "FICTIONAL_REGISTRY_TOKEN", + temporary.to_str().expect("temporary path is UTF-8"), + ] { + assert!( + !message.contains(forbidden), + "baseline rejection exposed {forbidden:?}: {message}" + ); + } +} + +#[test] +fn initial_and_common_approved_baseline_builds_are_distinct_and_lineage_is_product_labelled() { + let temporary = tempfile::tempdir().expect("temporary directory creates"); + let project = initialize_project(temporary.path()); + let output = initial_build(&project); + let relay_initial = std::fs::read(output.join("private/relay/approval/project-state.json")) + .expect("initial Relay approval state reads"); + let notary_initial = std::fs::read(output.join("private/notary/approval/project-state.json")) + .expect("initial Notary approval state reads"); + assert_eq!(relay_initial, notary_initial); + let initial_state: serde_json::Value = + serde_json::from_slice(&relay_initial).expect("initial approval state parses"); + assert_eq!( + initial_state["schema"], + "registry.project.approval-state.v3" + ); + assert!(initial_state["baseline"].is_null()); + + let baselines = sign_common_pair(&output, temporary.path(), "common"); + let relay_baseline = baselines + .relay_against + .as_deref() + .expect("Relay baseline exists"); + let notary_baseline = baselines + .notary_against + .as_deref() + .expect("Notary baseline exists"); + assert_eq!( + std::fs::read(relay_baseline.join("approval/project-state.json")) + .expect("signed Relay approval state reads"), + std::fs::read(notary_baseline.join("approval/project-state.json")) + .expect("signed Notary approval state reads") + ); + assert_eq!( + std::fs::read(relay_baseline.join("approval/review.json")) + .expect("signed Relay review reads"), + std::fs::read(notary_baseline.join("approval/review.json")) + .expect("signed Notary review reads") + ); + let report = build_registry_project_with_baselines_and_context( + &build_options(&project), + &baselines, + &context(), + ) + .expect("complete common approved baseline builds"); + assert_eq!(report.baseline, "verified_signed_bundle"); + + let next_output = project.join(report.output.expect("reviewed build output is reported")); + let relay_next = std::fs::read(next_output.join("private/relay/approval/project-state.json")) + .expect("next Relay approval state reads"); + let notary_next = std::fs::read(next_output.join("private/notary/approval/project-state.json")) + .expect("next Notary approval state reads"); + assert_eq!(relay_next, notary_next); + let state: serde_json::Value = + serde_json::from_slice(&relay_next).expect("next approval state parses"); + assert_eq!( + state["baseline"]["verified_manifests"]["relay"]["product"], + "registry-relay" + ); + assert_eq!( + state["baseline"]["verified_manifests"]["notary"]["product"], + "registry-notary" + ); + assert_eq!( + state["baseline"]["verified_manifests"]["relay"]["bundle_id"], + "common-relay-bundle" + ); + assert_eq!( + state["baseline"]["verified_manifests"]["notary"]["bundle_id"], + "common-notary-bundle" + ); +} + +#[test] +fn partial_swapped_tampered_and_wrong_environment_sets_fail_before_publication() { + let temporary = tempfile::tempdir().expect("temporary directory creates"); + let project = initialize_project(temporary.path()); + let output = initial_build(&project); + let original_state = std::fs::read(output.join("private/relay/approval/project-state.json")) + .expect("initial approval state reads"); + let baselines = sign_common_pair(&output, temporary.path(), "rejection"); + + let partial = ProjectBuildBaselineSetOptions { + relay_against: baselines.relay_against.clone(), + relay_anchor: baselines.relay_anchor.clone(), + ..ProjectBuildBaselineSetOptions::default() + }; + assert_value_free_rejection(&project, &partial, temporary.path()); + assert_eq!( + std::fs::read(output.join("private/relay/approval/project-state.json")) + .expect("published approval state rereads"), + original_state + ); + + let swapped = ProjectBuildBaselineSetOptions { + relay_against: baselines.notary_against.clone(), + relay_anchor: baselines.notary_anchor.clone(), + notary_against: baselines.relay_against.clone(), + notary_anchor: baselines.relay_anchor.clone(), + }; + assert_value_free_rejection(&project, &swapped, temporary.path()); + + let tampered_bundle = temporary.path().join("tampered-relay-bundle"); + copy_tree( + baselines + .relay_against + .as_deref() + .expect("Relay baseline exists"), + &tampered_bundle, + ); + let tampered_state = tampered_bundle.join("approval/project-state.json"); + let mut bytes = std::fs::read(&tampered_state).expect("signed state reads"); + bytes.push(b' '); + std::fs::write(&tampered_state, bytes).expect("signed state tampers"); + let tampered = ProjectBuildBaselineSetOptions { + relay_against: Some(tampered_bundle), + ..baselines.clone() + }; + assert_value_free_rejection(&project, &tampered, temporary.path()); + + let wrong_environment = sign_product_baseline( + &output, + temporary.path(), + "registry-relay", + "relay", + "other", + "wrong-environment-relay", + ); + let wrong_environment = ProjectBuildBaselineSetOptions { + relay_against: Some(wrong_environment.bundle), + relay_anchor: Some(wrong_environment.anchor), + notary_against: baselines.notary_against, + notary_anchor: baselines.notary_anchor, + }; + assert_value_free_rejection(&project, &wrong_environment, temporary.path()); +} + +#[test] +fn independently_valid_but_divergent_product_approval_states_are_rejected() { + let temporary = tempfile::tempdir().expect("temporary directory creates"); + let project = initialize_project(temporary.path()); + let first_output = initial_build(&project); + let relay = sign_product_baseline( + &first_output, + temporary.path(), + "registry-relay", + "relay", + "local", + "divergent-relay", + ); + + let environment_path = project.join("environments/local.yaml"); + let original_environment = + std::fs::read_to_string(&environment_path).expect("environment reads"); + let changed_environment = original_environment.replace( + "https://citizen-registry.invalid", + "https://reviewed-registry.invalid", + ); + assert_ne!(changed_environment, original_environment); + std::fs::write(&environment_path, changed_environment).expect("environment changes"); + let second_output = initial_build(&project); + let notary = sign_product_baseline( + &second_output, + temporary.path(), + "registry-notary", + "notary", + "local", + "divergent-notary", + ); + std::fs::write(&environment_path, original_environment).expect("environment restores"); + + let divergent = ProjectBuildBaselineSetOptions { + relay_against: Some(relay.bundle), + relay_anchor: Some(relay.anchor), + notary_against: Some(notary.bundle), + notary_anchor: Some(notary.anchor), + }; + assert_value_free_rejection(&project, &divergent, temporary.path()); +} diff --git a/crates/registryctl/tests/project_capability_inventory.rs b/crates/registryctl/tests/project_capability_inventory.rs new file mode 100644 index 000000000..096bff3d7 --- /dev/null +++ b/crates/registryctl/tests/project_capability_inventory.rs @@ -0,0 +1,692 @@ +// SPDX-License-Identifier: Apache-2.0 + +#![allow(dead_code)] + +#[path = "../src/project_authoring/capability_inventory.rs"] +mod capability_inventory; + +use std::collections::BTreeSet; + +use capability_inventory::{ + build_capability_inventory, CapabilityDisposition, CapabilityId, CapabilityInventoryError, + CapabilityInventoryInput, CapabilityUsageCounts, InstalledCapabilityEvidence, + InstalledCapabilityState, ProjectCapabilityInventoryReportV1, RuntimeActivationEvaluation, + SupportComponent, SupportEvidence, SupportKind, SupportState, SupportedCapabilityVersion, + COMPILED_CAPABILITY_RELEASE_FACTS, MAX_CAPABILITY_USAGE_COUNT, +}; +use serde_json::{json, Value}; + +const SCHEMA: &str = + include_str!("../schemas/project-reports/registry.project.capability_inventory.v1.schema.json"); +const FIXTURE: &str = + include_str!("fixtures/project-reports/registry.project.capability_inventory.v1.json"); + +fn parse(input: &str) -> Value { + serde_json::from_str(input).expect("JSON parses") +} + +fn validator() -> jsonschema::JSONSchema { + jsonschema::JSONSchema::options() + .with_draft(jsonschema::Draft::Draft202012) + .compile(&parse(SCHEMA)) + .expect("capability inventory schema compiles") +} + +fn assert_schema_valid(document: &Value) { + if let Err(errors) = validator().validate(document) { + let details = errors.map(|error| error.to_string()).collect::>(); + panic!("document should validate: {details:?}"); + } +} + +fn assert_schema_invalid(document: &Value) { + assert!( + validator().validate(document).is_err(), + "document should not validate" + ); +} + +fn compiled_input() -> CapabilityInventoryInput { + let mut input = CapabilityInventoryInput::new(); + for (capability, state, evidence) in COMPILED_CAPABILITY_RELEASE_FACTS { + input + .record_installed_capability(capability, state, evidence) + .expect("compiled evidence records"); + } + for (component, evidence) in [ + ( + SupportComponent::HttpSourceWorker, + SupportEvidence::LinkedCrate, + ), + ( + SupportComponent::RhaiScriptWorker, + SupportEvidence::LinkedCrate, + ), + ( + SupportComponent::RhaiXwProtocolHelper, + SupportEvidence::LinkedCrate, + ), + ( + SupportComponent::RegistryRelayProduct, + SupportEvidence::LinkedCrate, + ), + ( + SupportComponent::RegistryNotaryProduct, + SupportEvidence::LinkedCrate, + ), + ( + SupportComponent::RegistryRelayValidator, + SupportEvidence::LinkedProductValidator, + ), + ( + SupportComponent::RegistryNotaryValidator, + SupportEvidence::LinkedProductValidator, + ), + ( + SupportComponent::ProjectAuthoringSchema, + SupportEvidence::EmbeddedSchema, + ), + ( + SupportComponent::RegistryRelayConfigSchema, + SupportEvidence::EmbeddedSchema, + ), + ( + SupportComponent::RegistryNotaryConfigSchema, + SupportEvidence::EmbeddedSchema, + ), + ( + SupportComponent::RegistryctlDistribution, + SupportEvidence::ReleaseMetadata, + ), + ] { + input + .record_support(component, SupportState::Available, evidence) + .expect("available support records"); + } + input + .record_support( + SupportComponent::SnapshotMaterializationWorker, + SupportState::Missing, + SupportEvidence::ExplicitlyMissing, + ) + .expect("missing worker records"); + for image in [ + SupportComponent::RegistryRelayImage, + SupportComponent::RegistryNotaryImage, + ] { + input + .record_support( + image, + SupportState::NotEvaluated, + SupportEvidence::NoEvidence, + ) + .expect("image remains not evaluated"); + } + input +} + +fn canonical_input() -> CapabilityInventoryInput { + let mut input = compiled_input(); + for capability in [ + CapabilityId::SourceHttp, + CapabilityId::SourceScript, + CapabilityId::SourceSnapshot, + CapabilityId::RegistryRelayProduct, + CapabilityId::RegistryNotaryProduct, + ] { + input + .record_project_declaration(capability) + .expect("declaration records"); + } + for capability in [ + CapabilityId::SourceHttp, + CapabilityId::SourceScript, + CapabilityId::RegistryRelayProduct, + CapabilityId::RegistryNotaryProduct, + ] { + input + .record_environment_enablement(capability) + .expect("enablement records"); + } + for (capability, usage) in [ + ( + CapabilityId::SourceHttp, + CapabilityUsageCounts { + services: 1, + consultations: 1, + claims: 0, + }, + ), + ( + CapabilityId::SourceScript, + CapabilityUsageCounts { + services: 0, + consultations: 1, + claims: 1, + }, + ), + ( + CapabilityId::RhaiRuntime, + CapabilityUsageCounts { + services: 0, + consultations: 1, + claims: 1, + }, + ), + ( + CapabilityId::RhaiAbi, + CapabilityUsageCounts { + services: 0, + consultations: 1, + claims: 1, + }, + ), + ( + CapabilityId::RegistryRelayProduct, + CapabilityUsageCounts { + services: 1, + consultations: 2, + claims: 0, + }, + ), + ( + CapabilityId::RegistryNotaryProduct, + CapabilityUsageCounts { + services: 0, + consultations: 0, + claims: 1, + }, + ), + ] { + input + .record_usage(capability, usage) + .expect("usage records"); + } + input +} + +#[test] +fn canonical_fixture_validates_and_roundtrips_exactly() { + let document = parse(FIXTURE); + assert_schema_valid(&document); + let decoded: ProjectCapabilityInventoryReportV1 = + serde_json::from_value(document.clone()).expect("canonical fixture decodes"); + assert_eq!( + serde_json::to_value(decoded).expect("canonical fixture re-encodes"), + document + ); +} + +#[test] +fn pure_builder_is_deterministic_and_matches_the_canonical_fixture() { + let first = build_capability_inventory(canonical_input()).expect("inventory builds"); + let second = build_capability_inventory(canonical_input()).expect("inventory rebuilds"); + assert_eq!(first, second); + assert_eq!( + serde_json::to_value(&first).expect("report serializes"), + parse(FIXTURE) + ); + + let capability_order = first + .capabilities + .iter() + .map(|record| record.capability) + .collect::>(); + assert!(capability_order.windows(2).all(|pair| pair[0] < pair[1])); + assert_eq!( + capability_order + .iter() + .copied() + .collect::>() + .len(), + capability_order.len() + ); + let support_order = first + .support + .iter() + .map(|record| record.component) + .collect::>(); + assert!(support_order.windows(2).all(|pair| pair[0] < pair[1])); +} + +#[test] +fn schema_and_typed_ingress_require_every_closed_inventory_row_exactly_once() { + for (collection, duplicate_index) in [("capabilities", 11), ("support", 13)] { + let mut duplicate = parse(FIXTURE); + let first = duplicate[collection][0].clone(); + duplicate[collection][duplicate_index] = first; + assert_schema_invalid(&duplicate); + assert!( + serde_json::from_value::(duplicate).is_err(), + "typed ingress must reject a duplicate {collection} row that omits a closed ID" + ); + + let mut omitted = parse(FIXTURE); + omitted[collection] + .as_array_mut() + .expect("inventory collection is an array") + .pop(); + assert_schema_invalid(&omitted); + assert!( + serde_json::from_value::(omitted).is_err(), + "typed ingress must reject an omitted {collection} row" + ); + } +} + +#[test] +fn installed_declared_enabled_used_missing_and_inactive_states_stay_distinct() { + let report = build_capability_inventory(canonical_input()).expect("inventory builds"); + let state = |capability| { + report + .capabilities + .iter() + .find(|record| record.capability == capability) + .expect("capability is inventoried") + }; + assert_eq!( + state(CapabilityId::SourceHttp).disposition, + CapabilityDisposition::Used + ); + assert_eq!( + state(CapabilityId::SourceSnapshot).disposition, + CapabilityDisposition::DeclaredInactive + ); + assert_eq!( + state(CapabilityId::RegistryRelayValidator).disposition, + CapabilityDisposition::InstalledUnused + ); + assert_eq!(report.missing_support.len(), 1); + assert_eq!( + report.missing_support[0].component, + SupportComponent::SnapshotMaterializationWorker + ); + assert_eq!(report.missing_support[0].kind, SupportKind::Worker); + assert_eq!(report.inactive_or_unused.len(), 1); + assert_eq!( + report.runtime_activation, + RuntimeActivationEvaluation::NotEvaluated + ); + + let mut missing_worker = CapabilityInventoryInput::new(); + missing_worker + .record_installed_capability( + CapabilityId::SourceScript, + InstalledCapabilityState::Compiled, + InstalledCapabilityEvidence::EmbeddedCompiler, + ) + .expect("script compilation records"); + missing_worker + .record_project_declaration(CapabilityId::SourceScript) + .expect("script declaration records"); + missing_worker + .record_environment_enablement(CapabilityId::SourceScript) + .expect("script enablement records"); + missing_worker + .record_usage( + CapabilityId::SourceScript, + CapabilityUsageCounts { + services: 0, + consultations: 1, + claims: 0, + }, + ) + .expect("script usage records"); + missing_worker + .record_support( + SupportComponent::RhaiScriptWorker, + SupportState::Missing, + SupportEvidence::ExplicitlyMissing, + ) + .expect("missing worker records"); + let report = build_capability_inventory(missing_worker).expect("inventory builds"); + assert_eq!( + report.capabilities[1].disposition, + CapabilityDisposition::UsedWithMissingSupport + ); +} + +#[test] +fn builder_fails_closed_on_inconsistent_or_duplicate_evidence() { + let mut enabled_without_declaration = CapabilityInventoryInput::new(); + enabled_without_declaration + .record_environment_enablement(CapabilityId::SourceHttp) + .expect("enablement records"); + assert_eq!( + build_capability_inventory(enabled_without_declaration), + Err(CapabilityInventoryError::EnabledWithoutDeclaration( + CapabilityId::SourceHttp + )) + ); + + let mut used_without_declaration = CapabilityInventoryInput::new(); + used_without_declaration + .record_usage( + CapabilityId::SourceScript, + CapabilityUsageCounts { + services: 0, + consultations: 1, + claims: 0, + }, + ) + .expect("usage records"); + assert_eq!( + build_capability_inventory(used_without_declaration), + Err(CapabilityInventoryError::UsedWithoutDeclaration( + CapabilityId::SourceScript + )) + ); + + let mut duplicate = CapabilityInventoryInput::new(); + duplicate + .record_project_declaration(CapabilityId::SourceSnapshot) + .expect("first declaration records"); + assert_eq!( + duplicate.record_project_declaration(CapabilityId::SourceSnapshot), + Err(CapabilityInventoryError::DuplicateProjectDeclaration( + CapabilityId::SourceSnapshot + )) + ); + + let mut invalid_evidence = CapabilityInventoryInput::new(); + assert_eq!( + invalid_evidence.record_installed_capability( + CapabilityId::SourceHttp, + InstalledCapabilityState::Compiled, + InstalledCapabilityEvidence::NoEvidence, + ), + Err(CapabilityInventoryError::InvalidInstalledEvidence) + ); +} + +#[test] +fn image_and_runtime_activation_claims_cannot_be_inferred_from_static_input() { + let mut input = CapabilityInventoryInput::new(); + assert_eq!( + input.record_support( + SupportComponent::RegistryRelayImage, + SupportState::Available, + SupportEvidence::ReleaseMetadata, + ), + Err(CapabilityInventoryError::ImageAvailabilityCannotBeClaimed) + ); + assert_eq!( + input.record_support( + SupportComponent::RegistryRelayImage, + SupportState::Missing, + SupportEvidence::ExplicitlyMissing, + ), + Err(CapabilityInventoryError::ImageAvailabilityCannotBeClaimed) + ); + + let report = build_capability_inventory(input).expect("empty static inventory builds"); + assert_eq!( + report.runtime_activation, + RuntimeActivationEvaluation::NotEvaluated + ); + for image in report + .support + .iter() + .filter(|assessment| assessment.kind == SupportKind::Image) + { + assert_eq!(image.state, SupportState::NotEvaluated); + assert_eq!(image.evidence, SupportEvidence::NoEvidence); + } +} + +#[test] +fn usage_bound_is_total_and_overflow_safe() { + let mut exact = CapabilityInventoryInput::new(); + exact + .record_usage( + CapabilityId::RegistryRelayProduct, + CapabilityUsageCounts { + services: MAX_CAPABILITY_USAGE_COUNT, + consultations: 0, + claims: 0, + }, + ) + .expect("exact maximum records"); + + let mut total_too_large = CapabilityInventoryInput::new(); + assert_eq!( + total_too_large.record_usage( + CapabilityId::RegistryRelayProduct, + CapabilityUsageCounts { + services: MAX_CAPABILITY_USAGE_COUNT, + consultations: 1, + claims: 0, + }, + ), + Err(CapabilityInventoryError::UsageCountOutOfRange) + ); + + let mut overflow = CapabilityInventoryInput::new(); + assert_eq!( + overflow.record_usage( + CapabilityId::RegistryRelayProduct, + CapabilityUsageCounts { + services: u32::MAX, + consultations: u32::MAX, + claims: u32::MAX, + }, + ), + Err(CapabilityInventoryError::UsageCountOutOfRange) + ); + + let schema = parse(SCHEMA); + assert_eq!( + schema["$defs"]["usage"]["x-registry-aggregateMaximum"], + json!(MAX_CAPABILITY_USAGE_COUNT) + ); + let mut declared_total_too_large = parse(FIXTURE); + declared_total_too_large["capabilities"][0]["used_by"]["total"] = + json!(MAX_CAPABILITY_USAGE_COUNT + 1); + assert_schema_invalid(&declared_total_too_large); + + let mut aggregate_too_large = parse(FIXTURE); + aggregate_too_large["capabilities"][0]["used_by"] = json!({ + "services": 500_000, + "consultations": 500_000, + "claims": 1, + "total": MAX_CAPABILITY_USAGE_COUNT + }); + assert_schema_valid(&aggregate_too_large); + assert!( + serde_json::from_value::(aggregate_too_large).is_err(), + "strict typed ingress must enforce the aggregate ceiling behind the bounded total" + ); + + let mut mismatched_total = parse(FIXTURE); + mismatched_total["capabilities"][0]["used_by"]["total"] = json!(0); + assert_schema_valid(&mismatched_total); + assert!( + serde_json::from_value::(mismatched_total).is_err(), + "strict typed ingress must reject a declared total that does not equal the breakdown" + ); +} + +#[test] +fn relay_product_usage_requires_relay_product_support() { + let mut input = CapabilityInventoryInput::new(); + input + .record_installed_capability( + CapabilityId::RegistryRelayProduct, + InstalledCapabilityState::Compiled, + InstalledCapabilityEvidence::LinkedCrate, + ) + .expect("Relay product compilation records"); + input + .record_project_declaration(CapabilityId::RegistryRelayProduct) + .expect("Relay product declaration records"); + input + .record_environment_enablement(CapabilityId::RegistryRelayProduct) + .expect("Relay product enablement records"); + input + .record_usage( + CapabilityId::RegistryRelayProduct, + CapabilityUsageCounts { + services: 1, + consultations: 0, + claims: 0, + }, + ) + .expect("Relay product usage records"); + input + .record_support( + SupportComponent::RegistryRelayProduct, + SupportState::Missing, + SupportEvidence::ExplicitlyMissing, + ) + .expect("missing Relay product support records"); + + let report = build_capability_inventory(input).expect("inventory builds"); + let relay = report + .capabilities + .iter() + .find(|record| record.capability == CapabilityId::RegistryRelayProduct) + .expect("Relay product capability is inventoried"); + assert_eq!( + relay.disposition, + CapabilityDisposition::UsedWithMissingSupport + ); +} + +#[test] +fn schema_and_dto_reject_country_value_carriers() { + let mut root = parse(FIXTURE); + root["project"] = json!("COUNTRY_PROJECT_SENTINEL"); + assert_schema_invalid(&root); + assert!(serde_json::from_value::(root).is_err()); + + for (pointer, forbidden_field, sentinel) in [ + ( + "/capabilities/0", + "origin", + "https://COUNTRY_ORIGIN_SENTINEL.invalid", + ), + ("/capabilities/1", "path", "/COUNTRY/PATH/SENTINEL"), + ("/support/0", "secret_name", "COUNTRY_SECRET_NAME_SENTINEL"), + ( + "/support/12", + "runtime_observation", + "COUNTRY_RUNTIME_SENTINEL", + ), + ( + "/missing_support/0", + "detail", + "COUNTRY_SUPPORT_VALUE_SENTINEL", + ), + ] { + let mut document = parse(FIXTURE); + document + .pointer_mut(pointer) + .and_then(Value::as_object_mut) + .expect("test object exists") + .insert(forbidden_field.to_owned(), json!(sentinel)); + assert_schema_invalid(&document); + assert!(serde_json::from_value::(document).is_err()); + } +} + +#[test] +fn schema_rejects_image_availability_runtime_activation_and_open_enums() { + let mut runtime = parse(FIXTURE); + runtime["runtime_activation"] = json!("active"); + assert_schema_invalid(&runtime); + + let mut image = parse(FIXTURE); + image["support"][12]["state"] = json!("available"); + image["support"][12]["evidence"] = json!("release_metadata"); + assert_schema_invalid(&image); + + let mut disguised_image = parse(FIXTURE); + disguised_image["support"][12]["kind"] = json!("worker"); + disguised_image["support"][12]["state"] = json!("available"); + disguised_image["support"][12]["evidence"] = json!("release_metadata"); + assert_schema_invalid(&disguised_image); + assert!( + serde_json::from_value::(disguised_image).is_err(), + "closed image component identity must not be bypassed through mutable kind metadata" + ); + + let mut claimed_missing_image = parse(FIXTURE); + claimed_missing_image["support"][12]["state"] = json!("missing"); + claimed_missing_image["support"][12]["evidence"] = json!("explicitly_missing"); + claimed_missing_image["missing_support"] + .as_array_mut() + .expect("missing support is an array") + .push(json!({ + "component": "registry_relay_image", + "kind": "image", + "state": "missing", + "required_by": ["registry_relay_product"] + })); + assert_schema_invalid(&claimed_missing_image); + assert!( + serde_json::from_value::(claimed_missing_image) + .is_err(), + "offline typed ingress must not infer that an image is missing" + ); + + let mut capability = parse(FIXTURE); + capability["capabilities"][0]["capability"] = json!("country_specific_connector"); + assert_schema_invalid(&capability); + + let mut unknown_nested = parse(FIXTURE); + unknown_nested["capabilities"][0]["used_by"]["records"] = json!(1); + assert_schema_invalid(&unknown_nested); + assert!(serde_json::from_value::(unknown_nested).is_err()); + + let mut compiled_without_evidence = parse(FIXTURE); + compiled_without_evidence["capabilities"][0]["installed_evidence"] = json!("no_evidence"); + assert_schema_invalid(&compiled_without_evidence); + + let mut missing_without_evidence = parse(FIXTURE); + missing_without_evidence["support"][2]["evidence"] = json!("no_evidence"); + assert_schema_invalid(&missing_without_evidence); +} + +#[test] +fn typed_ingress_recomputes_derived_support_inactivity_and_dispositions() { + let mut contradictory_support = parse(FIXTURE); + contradictory_support["support"][2]["state"] = json!("available"); + contradictory_support["support"][2]["evidence"] = json!("linked_crate"); + assert_schema_valid(&contradictory_support); + assert!( + serde_json::from_value::(contradictory_support) + .is_err(), + "missing_support must not contradict the canonical support row" + ); + + let mut missing_inactive_row = parse(FIXTURE); + missing_inactive_row["inactive_or_unused"] = json!([]); + assert_schema_valid(&missing_inactive_row); + assert!( + serde_json::from_value::(missing_inactive_row).is_err(), + "inactive_or_unused must be the exact projection of declared unused capabilities" + ); + + let mut false_disposition = parse(FIXTURE); + false_disposition["capabilities"][0]["disposition"] = json!("installed_unused"); + assert_schema_valid(&false_disposition); + assert!( + serde_json::from_value::(false_disposition).is_err(), + "capability disposition must be recomputed from the primary report state" + ); +} + +#[test] +fn reported_rhai_abi_version_is_pinned_to_the_linked_runtime() { + assert_eq!(registry_relay::rhai_worker::xw::XW_ABI_VERSION, "xw.v1"); + let report = build_capability_inventory(canonical_input()).expect("inventory builds"); + let rhai_abi = report + .capabilities + .iter() + .find(|record| record.capability == CapabilityId::RhaiAbi) + .expect("Rhai ABI is inventoried"); + assert_eq!( + rhai_abi.supported_versions, + vec![SupportedCapabilityVersion::RhaiXwV1] + ); +} diff --git a/crates/registryctl/tests/project_check_human_output.rs b/crates/registryctl/tests/project_check_human_output.rs new file mode 100644 index 000000000..bfbc852ef --- /dev/null +++ b/crates/registryctl/tests/project_check_human_output.rs @@ -0,0 +1,523 @@ +// SPDX-License-Identifier: Apache-2.0 + +use std::path::{Path, PathBuf}; +use std::process::{Command, Output}; + +const REGISTRYCTL_BIN: &str = env!("CARGO_BIN_EXE_registryctl"); + +fn registryctl_command() -> Command { + let mut command = Command::new(REGISTRYCTL_BIN); + command.env("REGISTRYCTL_NO_UPDATE_CHECK", "1"); + command +} + +fn run_registryctl(args: &[&str]) -> Output { + registryctl_command() + .args(args) + .output() + .expect("the exact Cargo-injected registryctl binary runs") +} + +fn assert_success(output: &Output, action: &str) { + assert!( + output.status.success(), + "{action} failed with status {:?}\nstdout:\n{}\nstderr:\n{}", + output.status.code(), + String::from_utf8_lossy(&output.stdout), + String::from_utf8_lossy(&output.stderr) + ); + assert!( + output.stderr.is_empty(), + "{action} wrote stderr:\n{}", + String::from_utf8_lossy(&output.stderr) + ); +} + +fn assert_no_worker_path(output: &Output) { + let injected = Path::new(REGISTRYCTL_BIN); + let canonical = std::fs::canonicalize(injected) + .expect("the Cargo-injected registryctl binary has a canonical path"); + for path in [injected.to_path_buf(), canonical] { + let path = path + .to_str() + .expect("the Cargo-injected registryctl binary path is UTF-8"); + for (stream, bytes) in [ + ("stdout", output.stdout.as_slice()), + ("stderr", output.stderr.as_slice()), + ] { + let rendered = String::from_utf8_lossy(bytes); + assert!( + !rendered.contains(path), + "{stream} exposed the fixture-worker path {path}: {rendered}" + ); + } + } +} + +fn assert_strict_project_diagnostics(output: &Output) -> serde_json::Value { + assert!( + !output.status.success(), + "invalid check unexpectedly succeeded: {}", + String::from_utf8_lossy(&output.stdout) + ); + assert!( + output.stderr.is_empty(), + "portable check failure wrote non-JSON stderr: {}", + String::from_utf8_lossy(&output.stderr) + ); + let report: serde_json::Value = + serde_json::from_slice(&output.stdout).expect("check failure emits a JSON document"); + let schema: serde_json::Value = serde_json::from_str(include_str!( + "../schemas/project-reports/registryctl.project_diagnostics.v1.schema.json" + )) + .expect("diagnostics schema parses"); + let validator = jsonschema::JSONSchema::options() + .with_draft(jsonschema::Draft::Draft202012) + .compile(&schema) + .expect("diagnostics schema compiles"); + if let Err(errors) = validator.validate(&report) { + panic!( + "check failure violates the strict diagnostics contract: {:?}", + errors.map(|error| error.to_string()).collect::>() + ); + } + report +} + +fn initialize_http_starter(parent: &Path) -> PathBuf { + let project = parent.join("registry-project"); + let project_arg = project + .to_str() + .expect("temporary project path is valid UTF-8"); + let output = run_registryctl(&["init", "--from", "http", "--project-dir", project_arg]); + assert_success(&output, "HTTP starter initialization"); + assert_no_worker_path(&output); + project +} + +fn check_http_starter(project: &Path, explain: bool) -> Output { + let project_arg = project + .to_str() + .expect("temporary project path is valid UTF-8"); + let mut args = vec![ + "check", + "--project-dir", + project_arg, + "--environment", + "local", + ]; + if explain { + args.push("--explain"); + } + let output = run_registryctl(&args); + assert_success( + &output, + if explain { + "expanded HTTP project check" + } else { + "concise HTTP project check" + }, + ); + assert_no_worker_path(&output); + output +} + +#[test] +fn process_harness_uses_the_exact_cargo_injected_registryctl_binary() { + let empty_path = tempfile::tempdir().expect("empty PATH directory"); + let mut command = registryctl_command(); + assert_eq!(command.get_program(), std::ffi::OsStr::new(REGISTRYCTL_BIN)); + let output = command + .arg("--version") + .env("PATH", empty_path.path()) + .output() + .expect("the exact Cargo-injected registryctl binary runs without PATH lookup"); + + assert_success(&output, "exact-binary identity check"); + assert_no_worker_path(&output); +} + +#[test] +fn process_human_check_is_concise_and_explain_adds_review_detail() { + let temporary = tempfile::tempdir().expect("temporary directory"); + let project = initialize_http_starter(temporary.path()); + + let concise = check_http_starter(&project, false); + let concise = String::from_utf8(concise.stdout).expect("concise output is UTF-8"); + for heading in [ + "Baseline:", + "Semantic changes:", + "Fixtures:", + "Effective authority and limits:", + "Rhai xw.v1 reference:", + ] { + assert!(concise.contains(heading), "missing {heading}: {concise}"); + } + assert!(concise.contains("Fixtures: 25/25 passed (offline synthetic)")); + assert!(concise.contains( + "Fixture request witnesses: 1/1 independently authored offline request-to-consultation bindings passed; 2 fixture(s) remain mapping-derived." + )); + assert!(concise.contains( + "Fixture proof boundary: independently authored fixture requests exercise offline request-to-consultation bindings; mapping-derived fixtures exercise consultation and source behavior only. External/live caller compatibility is not evaluated." + )); + assert!(!concise.contains("Services, claims, and disclosure:")); + assert!(concise.contains("topology: Relay + Notary")); + assert!(concise.contains("calls=1 call (derived)")); + assert!(concise.contains("deadline=15s (defaulted)")); + assert!(!concise.contains("1calls")); + assert!(!concise.contains("\"15s\"duration")); + assert!(!concise.contains("subject mismatch not applicable:")); + assert!(!concise.contains("request fixture:")); + + let expanded = check_http_starter(&project, true); + let expanded = String::from_utf8(expanded.stdout).expect("expanded output is UTF-8"); + for expected in [ + "operation 1: class=data", + "Services, claims, and disclosure:", + "purpose: public-service-person-verification", + "legal basis: public-service-delivery", + "consent: not_required", + "scopes: evidence:person:read", + "claim person-active: class=consultation_output, disclosure=value", + "claim person-record-exists: class=registry_backed_evaluation, disclosure=predicate", + "Redactions:", + ] { + assert!( + expanded.contains(expected), + "missing {expected}: {expanded}" + ); + } + assert!(!expanded.contains("outputs:")); +} + +#[test] +fn process_human_check_does_not_emit_classifier_redaction_sentinels() { + let temporary = tempfile::tempdir().expect("temporary directory"); + let project = initialize_http_starter(temporary.path()); + let rendered = check_http_starter(&project, true); + let rendered = String::from_utf8(rendered.stdout).expect("expanded output is UTF-8"); + + for forbidden in [ + "FICTIONAL_REGISTRY_TOKEN", + "https://citizen-registry.invalid", + "/people/{input.person_id}", + "/people/{person_id}", + "/active", + "person_record.matched", + "active-person", + "/run/secrets/relay-workload-token", + "fictional-registry-notary", + "The selected response projection contains no identifier", + ] { + assert!( + !rendered.contains(forbidden), + "classifier-redacted sentinel leaked: {forbidden}: {rendered}" + ); + } +} + +#[test] +fn explicit_trusted_local_check_shows_authored_metadata_but_not_secrets_or_fixtures() { + const METADATA_SENTINEL: &str = "https://metadata-review-sentinel.invalid"; + const SECRET_SENTINEL: &str = "TRUSTED_LOCAL_SECRET_SENTINEL"; + const ENVIRONMENT_SECRET_VALUE_SENTINEL: &str = + "TRUSTED_LOCAL_ENVIRONMENT_SECRET_VALUE_SENTINEL"; + const FIXTURE_SENTINEL: &str = "TRUSTED_LOCAL_FIXTURE_SENTINEL"; + const PARSER_SENTINEL: &str = "TRUSTED_LOCAL_PARSER_SENTINEL"; + + let temporary = tempfile::tempdir().expect("temporary directory"); + let project = initialize_http_starter(temporary.path()); + let environment_path = project.join("environments/local.yaml"); + let environment = std::fs::read_to_string(&environment_path).expect("environment reads"); + std::fs::write( + &environment_path, + environment + .replace("https://citizen-registry.invalid", METADATA_SENTINEL) + .replace("FICTIONAL_REGISTRY_TOKEN", SECRET_SENTINEL), + ) + .expect("environment sentinel writes"); + let fixture_path = project.join("integrations/person-record/fixtures/active.yaml"); + let fixture = std::fs::read_to_string(&fixture_path).expect("fixture reads"); + std::fs::write( + &fixture_path, + fixture.replace("AB-123456", FIXTURE_SENTINEL), + ) + .expect("fixture sentinel writes"); + let project_path = project.join("registry-stack.yaml"); + let project_document = std::fs::read_to_string(&project_path).expect("project reads"); + std::fs::write( + &project_path, + project_document.replace( + "cel: person_record.matched", + &format!( + "cel: 'person_record.matched && \"{PARSER_SENTINEL}\" == \"{PARSER_SENTINEL}\"'" + ), + ), + ) + .expect("parser sentinel writes"); + + let project_arg = project + .to_str() + .expect("temporary project path is valid UTF-8"); + let rendered = registryctl_command() + .args([ + "check", + "--project-dir", + project_arg, + "--environment", + "local", + "--explain", + "--show-authored-values", + ]) + .env(SECRET_SENTINEL, ENVIRONMENT_SECRET_VALUE_SENTINEL) + .output() + .expect("trusted-local HTTP project check runs"); + assert_success(&rendered, "trusted-local HTTP project check"); + assert_no_worker_path(&rendered); + let rendered = String::from_utf8(rendered.stdout).expect("trusted-local output is UTF-8"); + assert!(rendered.contains( + "WARNING: trusted-local authored values follow. This output includes project-sensitive metadata and must not be shared." + )); + for visible in [ + "fictional-citizen-registry", + "integrations/person-record/integration.yaml", + METADATA_SENTINEL, + "https://relay.internal.invalid", + "registry-relay", + ] { + assert!( + rendered.contains(visible), + "trusted-local output omitted useful authored metadata {visible}: {rendered}" + ); + } + let always_hidden = [ + SECRET_SENTINEL, + ENVIRONMENT_SECRET_VALUE_SENTINEL, + FIXTURE_SENTINEL, + PARSER_SENTINEL, + "REGISTRY_NOTARY_ISSUER_JWK", + "EVIDENCE_CLIENT_TOKEN_HASH", + "/run/secrets/relay-workload-token", + "/people/{input.person_id}", + "person_record.matched", + "= \"/active\"", + ]; + for forbidden in always_hidden { + assert!( + !rendered.contains(forbidden), + "trusted-local output leaked prohibited value {forbidden}: {rendered}" + ); + } + + for (format, extra_args) in [ + ("default human", &["--explain"][..]), + ("portable JSON", &["--explain", "--format", "json"][..]), + ] { + let mut args = vec![ + "check", + "--project-dir", + project_arg, + "--environment", + "local", + ]; + args.extend_from_slice(extra_args); + let output = registryctl_command() + .args(args) + .env(SECRET_SENTINEL, ENVIRONMENT_SECRET_VALUE_SENTINEL) + .output() + .unwrap_or_else(|error| panic!("{format} project check runs: {error}")); + assert_success(&output, format); + assert_no_worker_path(&output); + let output = String::from_utf8(output.stdout) + .unwrap_or_else(|error| panic!("{format} output is UTF-8: {error}")); + for forbidden in [METADATA_SENTINEL].into_iter().chain(always_hidden) { + assert!( + !output.contains(forbidden), + "{format} output leaked redacted value {forbidden}: {output}" + ); + } + } +} + +#[test] +fn authored_values_require_explicit_explanation_and_human_output() { + let temporary = tempfile::tempdir().expect("temporary directory"); + let project = initialize_http_starter(temporary.path()); + let project_arg = project + .to_str() + .expect("temporary project path is valid UTF-8"); + + let missing_explain = run_registryctl(&[ + "check", + "--project-dir", + project_arg, + "--environment", + "local", + "--show-authored-values", + ]); + assert!(!missing_explain.status.success()); + assert!(String::from_utf8_lossy(&missing_explain.stderr).contains("--explain")); + + let json = run_registryctl(&[ + "check", + "--project-dir", + project_arg, + "--environment", + "local", + "--explain", + "--show-authored-values", + "--format", + "json", + ]); + assert!(!json.status.success()); + let diagnostics = assert_strict_project_diagnostics(&json); + assert_eq!(diagnostics["status"], "invalid"); + + let portable = run_registryctl(&[ + "check", + "--project-dir", + project_arg, + "--environment", + "local", + "--format", + "json", + ]); + assert_success(&portable, "portable JSON project check"); + let portable = String::from_utf8(portable.stdout).expect("portable JSON is UTF-8"); + assert!(!portable.contains("trusted-local")); + assert!(!portable.contains("https://citizen-registry.invalid")); + assert!(!portable.contains("FICTIONAL_REGISTRY_TOKEN")); + assert!(!portable.contains("AB-123456")); + let portable: serde_json::Value = + serde_json::from_str(&portable).expect("portable check report is JSON"); + assert_eq!( + portable["fixture_coverage"]["governed_request_evidence"], + "per_consultation_authored_request_witness_evaluation" + ); + assert_eq!( + portable["fixture_coverage"]["live_compatibility"], + "not_evaluated" + ); + let binding_states = portable["fixture_coverage"]["targets"] + .as_array() + .expect("fixture coverage targets are an array") + .iter() + .flat_map(|target| { + target["fixture_inventory"] + .as_array() + .expect("fixture inventory is an array") + }) + .map(|fixture| { + fixture["request_to_consultation_binding"]["state"] + .as_str() + .expect("request binding state is a string") + }) + .collect::>(); + assert_eq!( + binding_states + .iter() + .filter(|state| **state == "passed") + .count(), + 1 + ); + assert_eq!( + binding_states + .iter() + .filter(|state| **state == "not_authored") + .count(), + 2 + ); +} + +#[test] +fn every_portable_check_failure_emits_strict_redacted_diagnostics() { + const OUTPUT_SENTINEL: &str = "country-output-sentinel"; + const BASELINE_SENTINEL: &str = "country-baseline-path-sentinel"; + + let temporary = tempfile::tempdir().expect("temporary directory"); + let project = initialize_http_starter(temporary.path()); + let project_arg = project + .to_str() + .expect("temporary project path is valid UTF-8"); + let project_path = project.join("registry-stack.yaml"); + let authored = std::fs::read_to_string(&project_path).expect("project reads"); + assert!(authored.contains("output: person_record.active")); + std::fs::write( + &project_path, + authored.replace( + "output: person_record.active", + &format!("output: person_record.{OUTPUT_SENTINEL}"), + ), + ) + .expect("unknown output writes"); + + let typed = run_registryctl(&[ + "check", + "--project-dir", + project_arg, + "--environment", + "local", + "--format", + "json", + ]); + let typed = assert_strict_project_diagnostics(&typed); + assert!(typed["diagnostics"].as_array().is_some_and(|diagnostics| { + diagnostics.iter().any(|diagnostic| { + diagnostic["addresses"].as_array().is_some_and(|addresses| { + addresses.iter().any(|address| { + address["pointer"] + == "/services/person-verification/claims/person-active/output" + }) + }) + }) + })); + assert!( + !typed.to_string().contains(OUTPUT_SENTINEL), + "typed diagnostics leaked the rejected output name" + ); + + let baseline = temporary.path().join(BASELINE_SENTINEL); + let fallback = registryctl_command() + .args([ + "check", + "--project-dir", + project_arg, + "--environment", + "local", + "--format", + "json", + "--against", + ]) + .arg(&baseline) + .output() + .expect("registryctl fallback check runs"); + let fallback = assert_strict_project_diagnostics(&fallback); + assert_eq!( + fallback["diagnostics"][0]["cause"], + "The offline project check could not complete safely." + ); + assert!( + !fallback.to_string().contains(BASELINE_SENTINEL), + "fallback diagnostics leaked the local baseline path" + ); +} + +#[test] +fn trusted_local_library_entry_point_requires_explanation() { + let error = match registryctl::check_registry_project_with_trusted_local_authored_values( + ®istryctl::ProjectCheckOptions { + project_directory: PathBuf::from("unused"), + environment: "local".to_owned(), + explain: false, + against: None, + anchor: None, + }, + ) { + Ok(_) => panic!("trusted-local library entry point must require explanation"), + Err(error) => error, + }; + assert_eq!( + error.to_string(), + "trusted-local authored values require an explanation" + ); +} diff --git a/crates/registryctl/tests/project_diagnostic_reference.rs b/crates/registryctl/tests/project_diagnostic_reference.rs new file mode 100644 index 000000000..cfffaf93c --- /dev/null +++ b/crates/registryctl/tests/project_diagnostic_reference.rs @@ -0,0 +1,322 @@ +// SPDX-License-Identifier: Apache-2.0 + +use std::collections::BTreeMap; + +use registry_notary_server::NOTARY_ACTIVATION_CODE_DEFINITIONS; +use registry_platform_ops::BUNDLE_VERIFICATION_CODE_DEFINITIONS; +use registry_relay::consultation::consultation_service_activation_definitions; +use registry_relay::process_startup::PROCESS_STARTUP_CODE_DEFINITIONS; +use registryctl::{ + authoring_error_reference, fixture_error_reference, operator_error_reference, + validate_authoring_error_reference, validate_fixture_error_reference, + validate_operator_error_reference, ErrorReferenceEntry, ErrorReferenceFamily, + ErrorReferenceLifecycle, ErrorReferenceProduct, ErrorReferenceValidationError, + OperatorErrorOmission, OperatorErrorOmissionFamily, OperatorErrorOmissionReason, + AUTHORING_ERROR_REFERENCE_SCHEMA_VERSION_V1, FIXTURE_ERROR_REFERENCE_SCHEMA_VERSION_V1, + OPERATOR_ERROR_REFERENCE_SCHEMA_VERSION_V1, +}; +use serde_json::Value; + +const AUTHORING_SCHEMA: &str = + include_str!("../schemas/project-reports/registryctl.authoring_error_reference.v1.schema.json"); +const FIXTURE_SCHEMA: &str = + include_str!("../schemas/project-reports/registryctl.fixture_error_reference.v1.schema.json"); +const OPERATOR_SCHEMA: &str = + include_str!("../schemas/project-reports/registryctl.operator_error_reference.v1.schema.json"); + +#[test] +fn published_diagnostic_references_are_closed_complete_and_unreleased() { + let authoring = authoring_error_reference(); + let fixture = fixture_error_reference(); + let operator = operator_error_reference(); + + assert_eq!( + authoring.schema_version, + AUTHORING_ERROR_REFERENCE_SCHEMA_VERSION_V1 + ); + assert_eq!( + fixture.schema_version, + FIXTURE_ERROR_REFERENCE_SCHEMA_VERSION_V1 + ); + assert_eq!( + operator.schema_version, + OPERATOR_ERROR_REFERENCE_SCHEMA_VERSION_V1 + ); + validate_authoring_error_reference(&authoring).expect("authoring reference is exact"); + validate_fixture_error_reference(&fixture).expect("fixture reference is exact"); + validate_operator_error_reference(&operator).expect("operator reference is exact"); + + assert_eq!(authoring.entries.len(), 17); + assert_eq!(fixture.entries.len(), 16); + assert_eq!(operator.entries.len(), 59); + assert!( + operator.omissions.is_empty(), + "all operator catalogs now expose complete product-owned metadata" + ); + let family_counts = + operator + .entries + .iter() + .fold(BTreeMap::<&str, usize>::new(), |mut counts, entry| { + *counts.entry(entry.family.as_str()).or_default() += 1; + counts + }); + assert_eq!( + family_counts, + BTreeMap::from([ + ("bundle_verification", 4), + ("notary_activation", 17), + ("operator_preflight", 11), + ("relay_activation", 9), + ("relay_process_startup", 18), + ]) + ); + + for entry in authoring + .entries + .iter() + .chain(&fixture.entries) + .chain(&operator.entries) + { + assert_eq!(entry.lifecycle, ErrorReferenceLifecycle::Unreleased); + assert_eq!(entry.introduced_in, None); + assert!(!entry.phase.is_empty()); + assert!(!entry.safe_meaning.is_empty()); + assert!(!entry.rule.is_empty()); + assert!(!entry.safe_remediation.is_empty()); + assert!(!entry.evidence_scope.is_empty()); + assert!(!entry.evidence_limitation.is_empty()); + assert!(!entry.docs_anchor.contains("/reference/registryctl/")); + } +} + +#[test] +fn operator_projection_is_exact_to_all_product_owned_metadata() { + let operator = operator_error_reference(); + + for definition in BUNDLE_VERIFICATION_CODE_DEFINITIONS { + let entry = entry_for( + &operator.entries, + ErrorReferenceFamily::BundleVerification, + ErrorReferenceProduct::RegistryPlatformOps, + definition.code.as_str(), + ); + assert_eq!(entry.phase, definition.phase); + assert_eq!(entry.safe_meaning, definition.safe_meaning); + assert_eq!(entry.rule, definition.rule); + assert_eq!(entry.safe_remediation, definition.safe_remediation); + assert_eq!(entry.evidence_scope, definition.evidence_scope); + assert_eq!(entry.evidence_limitation, definition.evidence_limitation); + assert_eq!( + entry.docs_anchor, + format!( + "/reference/diagnostics/operator/#registry_platform_ops--{}", + definition.docs_slug + ) + ); + } + for definition in consultation_service_activation_definitions() { + let entry = entry_for( + &operator.entries, + ErrorReferenceFamily::RelayActivation, + ErrorReferenceProduct::RegistryRelay, + definition.code.as_str(), + ); + assert_eq!(entry.phase, definition.phase); + assert_eq!(entry.safe_meaning, definition.meaning); + assert_eq!(entry.rule, definition.rule); + assert_eq!(entry.safe_remediation, definition.remediation); + assert_eq!(entry.evidence_scope, definition.evidence_scope); + assert_eq!(entry.evidence_limitation, definition.evidence_limitation); + assert_eq!( + entry.docs_anchor, + format!( + "/reference/diagnostics/operator/#registry_relay--{}", + definition.docs_slug + ) + ); + } + for definition in PROCESS_STARTUP_CODE_DEFINITIONS { + let entry = entry_for( + &operator.entries, + ErrorReferenceFamily::RelayProcessStartup, + ErrorReferenceProduct::RegistryRelay, + definition.code.as_str(), + ); + assert_eq!(entry.phase, definition.phase); + assert_eq!(entry.safe_meaning, definition.safe_meaning); + assert_eq!(entry.rule, definition.rule); + assert_eq!(entry.safe_remediation, definition.safe_remediation); + assert_eq!(entry.evidence_scope, definition.evidence_scope); + assert_eq!(entry.evidence_limitation, definition.evidence_limitation); + assert_eq!( + entry.docs_anchor, + format!( + "/reference/diagnostics/operator/#registry_relay--{}", + definition.docs_slug + ) + ); + } + for definition in &NOTARY_ACTIVATION_CODE_DEFINITIONS { + let entry = entry_for( + &operator.entries, + ErrorReferenceFamily::NotaryActivation, + ErrorReferenceProduct::RegistryNotary, + definition.code.as_str(), + ); + assert_eq!(entry.phase, definition.phase); + assert_eq!(entry.safe_meaning, definition.meaning); + assert_eq!(entry.rule, definition.rule); + assert_eq!(entry.safe_remediation, definition.remediation); + assert_eq!(entry.evidence_scope, definition.evidence_scope); + assert_eq!(entry.evidence_limitation, definition.evidence_limitation); + assert_eq!( + entry.docs_anchor, + format!( + "/reference/diagnostics/operator/#registry_notary--{}", + definition.docs_slug + ) + ); + } +} + +#[test] +fn strict_validation_rejects_missing_duplicate_reordered_stale_and_drifted_data() { + let mut authoring = authoring_error_reference(); + authoring.entries.pop(); + assert_eq!( + validate_authoring_error_reference(&authoring), + Err(ErrorReferenceValidationError::EntriesDoNotMatchSources) + ); + + let mut fixture = fixture_error_reference(); + fixture.entries[0].safe_meaning.push_str(" changed"); + assert_eq!( + validate_fixture_error_reference(&fixture), + Err(ErrorReferenceValidationError::EntriesDoNotMatchSources) + ); + + let mut operator = operator_error_reference(); + operator.entries.push(operator.entries[0].clone()); + operator + .entries + .sort_by(|left, right| reference_key(left).cmp(&reference_key(right))); + assert_eq!( + validate_operator_error_reference(&operator), + Err(ErrorReferenceValidationError::DuplicateEntry) + ); + + let mut operator = operator_error_reference(); + operator.entries.swap(0, 1); + assert_eq!( + validate_operator_error_reference(&operator), + Err(ErrorReferenceValidationError::UnsortedEntries) + ); + + let mut operator = operator_error_reference(); + operator.entries[0].lifecycle = ErrorReferenceLifecycle::Active; + assert_eq!( + validate_operator_error_reference(&operator), + Err(ErrorReferenceValidationError::LifecycleVersionMismatch) + ); + + let mut operator = operator_error_reference(); + operator.entries[0].docs_anchor.push_str("-drift"); + assert_eq!( + validate_operator_error_reference(&operator), + Err(ErrorReferenceValidationError::DocsAnchorMismatch) + ); + + let mut operator = operator_error_reference(); + operator.omissions.push(OperatorErrorOmission { + family: OperatorErrorOmissionFamily::NotaryActivation, + product: ErrorReferenceProduct::RegistryNotary, + reason: OperatorErrorOmissionReason::NoCompletePublicCodeCatalog, + evidence: "stale omission".to_string(), + required_action: "remove it".to_string(), + }); + assert_eq!( + validate_operator_error_reference(&operator), + Err(ErrorReferenceValidationError::OmissionsDoNotMatchSources) + ); +} + +#[test] +fn strict_json_schemas_accept_only_the_generated_shapes() { + for (schema, document) in [ + ( + AUTHORING_SCHEMA, + serde_json::to_value(authoring_error_reference()).unwrap(), + ), + ( + FIXTURE_SCHEMA, + serde_json::to_value(fixture_error_reference()).unwrap(), + ), + ( + OPERATOR_SCHEMA, + serde_json::to_value(operator_error_reference()).unwrap(), + ), + ] { + let schema: Value = serde_json::from_str(schema).unwrap(); + let validator = jsonschema::JSONSchema::options() + .with_draft(jsonschema::Draft::Draft202012) + .compile(&schema) + .unwrap(); + assert!(validator.is_valid(&document)); + + let mut unknown = document.clone(); + unknown + .as_object_mut() + .unwrap() + .insert("unexpected".to_string(), Value::Bool(true)); + assert!(!validator.is_valid(&unknown)); + } +} + +#[test] +fn operator_schema_accepts_exact_catalog_and_rejects_open_values() { + let schema: Value = serde_json::from_str(OPERATOR_SCHEMA).unwrap(); + let validator = jsonschema::JSONSchema::options() + .with_draft(jsonschema::Draft::Draft202012) + .compile(&schema) + .unwrap(); + let canonical = serde_json::to_value(operator_error_reference()).unwrap(); + assert_eq!(canonical["entries"].as_array().unwrap().len(), 59); + assert!(validator.is_valid(&canonical)); + + let mut open_code = canonical.clone(); + open_code["entries"] + .as_array_mut() + .unwrap() + .iter_mut() + .find(|entry| entry["family"] == "relay_process_startup") + .unwrap()["code"] = Value::String("relay.startup.unregistered_open_value".to_string()); + assert!(!validator.is_valid(&open_code)); + + let mut open_field = canonical; + open_field["entries"][0] + .as_object_mut() + .unwrap() + .insert("runtime_value".to_string(), Value::Bool(true)); + assert!(!validator.is_valid(&open_field)); +} + +fn entry_for<'a>( + entries: &'a [ErrorReferenceEntry], + family: ErrorReferenceFamily, + product: ErrorReferenceProduct, + code: &str, +) -> &'a ErrorReferenceEntry { + entries + .iter() + .find(|entry| entry.family == family && entry.product == product && entry.code == code) + .unwrap_or_else(|| panic!("missing {family:?}/{product:?}/{code}")) +} + +fn reference_key(entry: &ErrorReferenceEntry) -> (&str, &str, &str) { + ( + entry.family.as_str(), + entry.product.as_str(), + entry.code.as_str(), + ) +} diff --git a/crates/registryctl/tests/project_diagnostic_reference_cli.rs b/crates/registryctl/tests/project_diagnostic_reference_cli.rs new file mode 100644 index 000000000..a13f6c7ad --- /dev/null +++ b/crates/registryctl/tests/project_diagnostic_reference_cli.rs @@ -0,0 +1,99 @@ +// SPDX-License-Identifier: Apache-2.0 + +use std::fs; +use std::process::{Command, Output}; + +use tempfile::TempDir; + +const AUTHORING_FIXTURE: &[u8] = + include_bytes!("fixtures/project-reports/registryctl.authoring_error_reference.v1.json"); +const FIXTURE_FIXTURE: &[u8] = + include_bytes!("fixtures/project-reports/registryctl.fixture_error_reference.v1.json"); +const OPERATOR_FIXTURE: &[u8] = + include_bytes!("fixtures/project-reports/registryctl.operator_error_reference.v1.json"); +const SENTINEL: &str = "COUNTRY_SECRET_SENTINEL_DIAGNOSTIC_CLI"; + +#[test] +fn json_catalogs_are_workspace_independent_deterministic_and_byte_exact() { + let directory = hostile_workspace(); + for (catalog, expected) in [ + ("authoring", AUTHORING_FIXTURE), + ("fixture", FIXTURE_FIXTURE), + ("operator", OPERATOR_FIXTURE), + ] { + let first = run(directory.path(), catalog, "json"); + let second = run(directory.path(), catalog, "json"); + assert!( + first.status.success(), + "{catalog} failed: {}", + String::from_utf8_lossy(&first.stderr) + ); + assert!(first.stderr.is_empty()); + assert_eq!(first.stdout, expected); + assert_eq!(second.status, first.status); + assert_eq!(second.stdout, first.stdout); + assert_eq!(second.stderr, first.stderr); + assert!(!String::from_utf8_lossy(&first.stdout).contains(SENTINEL)); + assert!( + !String::from_utf8_lossy(&first.stdout).contains(directory.path().to_str().unwrap()) + ); + } +} + +#[test] +fn human_catalogs_are_deterministic_static_and_value_free() { + let directory = hostile_workspace(); + for catalog in ["authoring", "fixture", "operator"] { + let first = run(directory.path(), catalog, "human"); + let second = run(directory.path(), catalog, "human"); + assert!(first.status.success()); + assert!(first.stderr.is_empty()); + assert_eq!(second.stdout, first.stdout); + assert_eq!(second.stderr, first.stderr); + let stdout = String::from_utf8(first.stdout).unwrap(); + assert!(stdout.contains(&format!("Registry Stack {catalog} diagnostic reference."))); + assert!(stdout.contains("Evidence limitation:")); + assert!(!stdout.contains(SENTINEL)); + assert!(!stdout.contains(directory.path().to_str().unwrap())); + } +} + +#[test] +fn unknown_catalog_is_a_usage_error() { + let directory = hostile_workspace(); + let output = run(directory.path(), "country", "json"); + assert_eq!(output.status.code(), Some(2)); + assert!(output.stdout.is_empty()); + assert!(String::from_utf8_lossy(&output.stderr).contains("invalid value 'country'")); +} + +fn hostile_workspace() -> TempDir { + let directory = tempfile::tempdir().unwrap(); + fs::write( + directory.path().join("registry-stack.yaml"), + format!("country_secret: {SENTINEL}\n"), + ) + .unwrap(); + directory +} + +fn run(directory: &std::path::Path, catalog: &str, format: &str) -> Output { + Command::new(env!("CARGO_BIN_EXE_registryctl")) + .current_dir(directory) + .env_clear() + .env("REGISTRY_CONFIG", SENTINEL) + .env("REGISTRY_RELAY_CONFIG", SENTINEL) + .env("REGISTRY_NOTARY_CONFIG", SENTINEL) + .env("REGISTRYCTL_UPDATE_ENDPOINT", SENTINEL) + .env("COUNTRY_SECRET", SENTINEL) + .args([ + "project", + "diagnostics", + "--catalog", + catalog, + "--format", + format, + ]) + .output() + .unwrap() +} diff --git a/crates/registryctl/tests/project_documentation_reference.rs b/crates/registryctl/tests/project_documentation_reference.rs new file mode 100644 index 000000000..2da07a7a9 --- /dev/null +++ b/crates/registryctl/tests/project_documentation_reference.rs @@ -0,0 +1,958 @@ +// SPDX-License-Identifier: Apache-2.0 +#![allow(dead_code)] + +use std::collections::BTreeMap; +use std::path::PathBuf; + +use serde_json::{json, Value}; + +#[path = "../src/project_authoring/documentation.rs"] +mod documentation; +#[path = "../src/project_authoring/knowledge.rs"] +mod knowledge; + +use documentation::{ + configuration_reference_coverage, generate_configuration_reference, + runtime_configuration_intent_gaps, ConfigurationSchemaKind, ConfigurationState, + DocumentationDomainIntent, DocumentationIntentCatalog, DocumentationIntentPolicy, + DocumentationSchema, EnvironmentBehavior, HumanIntentSource, ProhibitedIntentSource, + RuntimeIntentCatalog, StructuralIntent, StructuralIntentReview, ValidationStage, + CONFIGURATION_REFERENCE_COVERAGE_SCHEMA_ID, CONFIGURATION_REFERENCE_SCHEMA_ID, +}; +use knowledge::{ + Availability, Consumer, FieldClassification, FieldKnowledgeCatalog, FieldKnowledgeDefaults, + FieldPathKind, GeneratedArtifact, HumanOwner, Migration, Product, PublishedSchema, ReviewClass, + SchemaDomain, SchemaKind, SemanticOwner, SemanticRule, Sensitivity, Stability, +}; + +fn crate_root() -> PathBuf { + PathBuf::from(env!("CARGO_MANIFEST_DIR")) +} + +fn read_json(path: impl Into) -> Value { + let path = path.into(); + serde_json::from_slice( + &std::fs::read(&path).unwrap_or_else(|error| panic!("{} reads: {error}", path.display())), + ) + .unwrap_or_else(|error| panic!("{} parses: {error}", path.display())) +} + +fn compile_schema(document: &Value) -> jsonschema::JSONSchema { + jsonschema::JSONSchema::options() + .with_draft(jsonschema::Draft::Draft202012) + .compile(document) + .unwrap_or_else(|error| panic!("documentation schema compiles: {error}")) +} + +fn assert_valid(schema: &jsonschema::JSONSchema, value: &Value, context: &str) { + if let Err(errors) = schema.validate(value) { + panic!( + "{context} failed schema validation: {:?}", + errors.map(|error| error.to_string()).collect::>() + ); + } +} + +fn miniature_catalog() -> FieldKnowledgeCatalog { + FieldKnowledgeCatalog { + version: 1, + defaults: FieldKnowledgeDefaults { + introduced_in: "0.13.0".to_owned(), + availability: Availability::Published, + stability: Stability::Experimental, + semantic_rules: vec![ + SemanticRule::KnowledgeOnly, + SemanticRule::GeneratedDocsNeverLoadCountryValues, + ], + }, + schema_domains: vec![SchemaDomain { + schema: SchemaKind::Project, + semantic_owner: SemanticOwner::AuthoringContract, + human_owner: HumanOwner::RegistryMaintainers, + products: vec![Product::Registryctl, Product::Docs], + migration: Migration::RebuildProject, + consumers: vec![Consumer::RegistryctlAuthoring, Consumer::DocsGenerator], + generated_artifacts: vec![ + GeneratedArtifact::EditorSchemas, + GeneratedArtifact::FieldReference, + ], + review_classes: vec![ReviewClass::Contract, ReviewClass::Documentation], + }], + classifications: vec![ + FieldClassification { + id: "root".to_owned(), + path_kind: FieldPathKind::Root, + sensitivity: Sensitivity::Structural, + review_classes: vec![ReviewClass::Contract], + semantic_rules: vec![SemanticRule::KnowledgeOnly], + }, + FieldClassification { + id: "property".to_owned(), + path_kind: FieldPathKind::Property, + sensitivity: Sensitivity::Internal, + review_classes: vec![ReviewClass::Documentation], + semantic_rules: vec![SemanticRule::KnowledgeOnly], + }, + ], + } +} + +fn miniature_structural_catalog() -> FieldKnowledgeCatalog { + let mut catalog = miniature_catalog(); + catalog.classifications.extend([ + FieldClassification { + id: "map_key".to_owned(), + path_kind: FieldPathKind::MapKey, + sensitivity: Sensitivity::Internal, + review_classes: vec![ReviewClass::Contract, ReviewClass::Documentation], + semantic_rules: vec![SemanticRule::ArbitraryMapKeysNotFixedProperties], + }, + FieldClassification { + id: "map_value".to_owned(), + path_kind: FieldPathKind::MapValue, + sensitivity: Sensitivity::Internal, + review_classes: vec![ReviewClass::Contract, ReviewClass::Documentation], + semantic_rules: vec![SemanticRule::ArbitraryMapKeysNotFixedProperties], + }, + FieldClassification { + id: "array_item".to_owned(), + path_kind: FieldPathKind::ArrayItem, + sensitivity: Sensitivity::Internal, + review_classes: vec![ReviewClass::Contract, ReviewClass::Documentation], + semantic_rules: vec![SemanticRule::ArrayItemsShareElementContract], + }, + FieldClassification { + id: "branch".to_owned(), + path_kind: FieldPathKind::Branch, + sensitivity: Sensitivity::Structural, + review_classes: vec![ReviewClass::Contract, ReviewClass::Compatibility], + semantic_rules: vec![SemanticRule::BranchHasNoAuthoredValue], + }, + ]); + catalog +} + +fn miniature_schema() -> Value { + json!({ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "https://registrystack.example/tests/documentation-miniature.v1.json", + "type": "object", + "description": "Defines the complete miniature documentation-reference contract used by the generator test.", + "x-registry-field": "root", + "additionalProperties": false, + "required": ["version"], + "properties": { + "version": { + "description": "Selects the authored miniature contract version used by this deterministic test.", + "type": "string", + "const": "1", + "examples": ["COUNTRY_VALUE_SENTINEL"], + "x-registry-field": "property" + }, + "mode": { + "description": "Selects the optional safe mode and documents its committed schema default.", + "type": "string", + "enum": ["safe", "strict"], + "default": "safe", + "x-registry-field": "property" + } + } + }) +} + +fn miniature_schema_with_unreviewed_structural_paths() -> Value { + let mut document = miniature_schema(); + document["properties"]["structural_map"] = json!({ + "description": "Defines a miniature typed map whose structural paths require exact review.", + "type": "object", + "propertyNames": { + "type": "string", + "x-registry-field": "map_key" + }, + "additionalProperties": { + "type": "string", + "x-registry-field": "map_value" + }, + "x-registry-field": "property" + }); + document["properties"]["structural_list"] = json!({ + "description": "Defines a miniature ordered list whose item path requires exact review.", + "type": "array", + "items": { + "type": "string", + "x-registry-field": "array_item" + }, + "x-registry-field": "property" + }); + document["properties"]["structural_choice"] = json!({ + "description": "Defines a miniature conditional value whose branch requires exact review.", + "not": { + "const": "blocked", + "x-registry-field": "branch" + }, + "x-registry-field": "property" + }); + document +} + +fn miniature_structural_reviews() -> Vec { + [ + ( + "/properties/structural_map/propertyNames", + FieldPathKind::MapKey, + ), + ( + "/properties/structural_map/additionalProperties", + FieldPathKind::MapValue, + ), + ( + "/properties/structural_list/items", + FieldPathKind::ArrayItem, + ), + ("/properties/structural_choice/not", FieldPathKind::Branch), + ] + .into_iter() + .map(|(pointer, path_kind)| StructuralIntentReview { + schema: SchemaKind::Project, + pointer: pointer.to_owned(), + path_kind, + }) + .collect() +} + +fn miniature_intent() -> DocumentationIntentCatalog { + DocumentationIntentCatalog { + schema: Some( + "https://id.registrystack.org/schemas/registryctl/project-authoring/documentation-intent.v1.schema.json" + .to_owned(), + ), + format_version: "1.0".to_owned(), + policy: DocumentationIntentPolicy { + human_sources: vec![ + HumanIntentSource::SchemaDescription, + HumanIntentSource::ReviewedOverride, + HumanIntentSource::StructuralTaxonomy, + ], + prohibited_sources: vec![ + ProhibitedIntentSource::CountryWorkspace, + ProhibitedIntentSource::CountryValue, + ProhibitedIntentSource::RuntimeConfiguration, + ProhibitedIntentSource::DerivedFieldLabel, + ], + prose_required_for: vec![ + FieldPathKind::Root, + FieldPathKind::Property, + FieldPathKind::MapKey, + FieldPathKind::MapValue, + FieldPathKind::ArrayItem, + FieldPathKind::Branch, + ], + }, + structural_intents: [ + ( + FieldPathKind::MapKey, + StructuralIntent { + purpose: "Documents the authored key contract for a miniature typed map." + .to_owned(), + }, + ), + ( + FieldPathKind::MapValue, + StructuralIntent { + purpose: "Documents the authored value contract for a miniature typed map." + .to_owned(), + }, + ), + ( + FieldPathKind::ArrayItem, + StructuralIntent { + purpose: "Documents the authored item contract for a miniature ordered list." + .to_owned(), + }, + ), + ( + FieldPathKind::Branch, + StructuralIntent { + purpose: + "Documents a miniature validation branch that has no standalone value." + .to_owned(), + }, + ), + ] + .into_iter() + .collect::>(), + structural_reviews: Vec::new(), + domains: vec![DocumentationDomainIntent { + schema: SchemaKind::Project, + scope: "A miniature authored project contract used only to prove deterministic documentation generation." + .to_owned(), + state: ConfigurationState::Authored, + environment_behavior: EnvironmentBehavior::EnvironmentIndependent, + validation_stages: vec![ + ValidationStage::JsonSchema, + ValidationStage::RustDeserialization, + ], + diagnostic: "registryctl.authoring.project.invalid".to_owned(), + migration_note: + "Revalidate the miniature document after changing this test-only authored contract." + .to_owned(), + example_guidance: + "Use only the committed synthetic miniature values supplied by this contract test." + .to_owned(), + }], + overrides: Vec::new(), + } +} + +#[test] +fn human_intent_sidecar_and_documentation_contracts_are_strict_schemas() { + let schema_root = crate_root().join("schemas"); + let intent_schema_document = + read_json(schema_root.join("project-authoring/documentation-intent.schema.json")); + let intent_schema = compile_schema(&intent_schema_document); + let intent = read_json(schema_root.join("project-authoring/documentation-intent.json")); + assert_valid(&intent_schema, &intent, "documentation intent sidecar"); + assert_eq!(intent["structural_reviews"].as_array().unwrap().len(), 185); + + for file in [ + "registry.project.configuration_reference.v1.schema.json", + "registry.project.configuration_reference_coverage.v1.schema.json", + "registry.runtime.configuration_intent.v1.schema.json", + ] { + let document = read_json(schema_root.join("project-documentation").join(file)); + compile_schema(&document); + } + + let mut unknown_review = intent.clone(); + unknown_review["structural_reviews"][0]["unexpected"] = json!(true); + assert!(intent_schema.validate(&unknown_review).is_err()); + assert!( + serde_json::from_value::(unknown_review).is_err(), + "the DTO rejects an unknown structural-review field" + ); + + let mut unknown_intent = intent; + unknown_intent["unexpected"] = json!(true); + assert!(intent_schema.validate(&unknown_intent).is_err()); + assert!( + serde_json::from_value::(unknown_intent).is_err(), + "the DTO rejects an unknown top-level field" + ); + + let runtime_intent_schema = compile_schema(&read_json( + schema_root + .join("project-documentation") + .join("registry.runtime.configuration_intent.v1.schema.json"), + )); + for path in [ + crate_root().join("../registry-relay/config/documentation-intent.json"), + crate_root().join("../registry-notary-core/config/documentation-intent.json"), + ] { + let runtime_intent = read_json(path); + assert_valid( + &runtime_intent_schema, + &runtime_intent, + "product-owned runtime intent", + ); + let mut cross_product = runtime_intent.clone(); + cross_product["profiles"][0]["semantic_owner"] = + if cross_product["runtime_schema"] == "relay" { + json!("notary_runtime") + } else { + json!("relay_runtime") + }; + assert!( + runtime_intent_schema.validate(&cross_product).is_err(), + "the strict runtime intent schema rejects cross-product profile ownership" + ); + let mut unknown_assignment = runtime_intent; + unknown_assignment["assignments"][0]["unexpected"] = json!(true); + assert!(runtime_intent_schema.validate(&unknown_assignment).is_err()); + assert!( + serde_json::from_value::(unknown_assignment).is_err(), + "the runtime intent DTO rejects unknown assignment fields" + ); + } +} + +#[test] +fn complete_miniature_reference_is_deterministic_strict_and_value_free() { + let catalog = miniature_catalog(); + let document = miniature_schema(); + let schema = [DocumentationSchema { + published: PublishedSchema { + kind: SchemaKind::Project, + document: &document, + }, + source_name: "project.schema.json", + }]; + let intent = miniature_intent(); + + let first = generate_configuration_reference(&catalog, &schema, &intent) + .expect("complete miniature reference generates"); + let second = generate_configuration_reference(&catalog, &schema, &intent) + .expect("rerun generates the same reference"); + assert_eq!(first, second); + assert_eq!(first.schema_id, CONFIGURATION_REFERENCE_SCHEMA_ID); + assert_eq!(first.coverage.path_count, 3); + assert_eq!(first.fields.len(), 3); + + let value = serde_json::to_value(&first).expect("reference serializes"); + assert_eq!( + value, + read_json( + crate_root() + .join("tests/fixtures/project-documentation") + .join("configuration-reference.miniature.v1.json") + ), + "the canonical miniature documentation artifact is byte-model exact" + ); + let bytes = serde_json::to_vec(&value).expect("reference has canonical JSON data"); + assert!( + !bytes + .windows(b"COUNTRY_VALUE_SENTINEL".len()) + .any(|window| window == b"COUNTRY_VALUE_SENTINEL"), + "schema examples are described by availability and never copied as country-like values" + ); + let output_schema = compile_schema(&read_json( + crate_root() + .join("schemas/project-documentation") + .join("registry.project.configuration_reference.v1.schema.json"), + )); + assert_valid(&output_schema, &value, "generated configuration reference"); + let mut unknown = value; + unknown["fields"][0]["unexpected"] = json!(true); + assert!( + output_schema.validate(&unknown).is_err(), + "the strict reference contract rejects an unknown nested field" + ); +} + +#[test] +fn embedded_coverage_is_complete_and_generates_the_canonical_reference() { + let coverage = documentation::embedded_configuration_reference_coverage() + .expect("embedded coverage audit succeeds without opening a workspace"); + assert_eq!( + coverage.schema_id, + CONFIGURATION_REFERENCE_COVERAGE_SCHEMA_ID + ); + assert_eq!(coverage.coverage.schema_count, 7); + assert_eq!(coverage.coverage.path_count, 1758); + assert_eq!( + coverage.coverage.by_schema, + [ + (ConfigurationSchemaKind::Project, 219), + (ConfigurationSchemaKind::Environment, 191), + (ConfigurationSchemaKind::Integration, 138), + (ConfigurationSchemaKind::Fixture, 62), + (ConfigurationSchemaKind::Entity, 35), + (ConfigurationSchemaKind::Relay, 584), + (ConfigurationSchemaKind::Notary, 529), + ] + .into_iter() + .collect() + ); + assert_eq!( + coverage.coverage.by_path_kind, + [ + (FieldPathKind::Root, 7), + (FieldPathKind::Property, 1_406), + (FieldPathKind::MapKey, 25), + (FieldPathKind::MapValue, 47), + (FieldPathKind::ArrayItem, 177), + (FieldPathKind::Branch, 96), + ] + .into_iter() + .collect(), + "the exact reviewed structural taxonomy remains release-gated" + ); + assert_eq!(coverage.reviewed_intent_assignment_required_count, 1758); + assert_eq!( + coverage.reviewed_intent_assignment_covered_count + coverage.missing_intent.len(), + coverage.reviewed_intent_assignment_required_count + ); + assert_eq!(coverage.reviewed_intent_assignment_covered_count, 1758); + assert!( + coverage.distinct_reviewed_intent_count < coverage.reviewed_intent_assignment_covered_count, + "assignment coverage must not imply one unique explanation per path" + ); + assert!( + coverage.distinct_reviewed_intents_reused_count > 0 + && coverage.reviewed_intent_assignments_using_reused_intent_count + > coverage.distinct_reviewed_intents_reused_count, + "the coverage report must expose reuse separately from assignment completeness" + ); + assert_eq!( + ( + coverage.distinct_reviewed_intent_count, + coverage.distinct_reviewed_intents_reused_count, + coverage.reviewed_intent_assignments_using_reused_intent_count, + ), + (588, 83, 1_253), + "the exact intent-text reuse baseline must change intentionally with reviewed documentation" + ); + assert_eq!( + coverage.coverage.by_intent_profile.values().sum::(), + 1113, + "every Relay and Notary path, including both roots, records its exact reviewed profile" + ); + assert_eq!( + coverage.missing_intent.len(), + 0, + "every published field must have exact reviewed human intent" + ); + assert_eq!( + coverage + .missing_intent + .iter() + .map(|address| (&address.schema, &address.pointer, &address.key_path)) + .collect::>() + .len(), + coverage.missing_intent.len(), + "every unresolved human-intent gap has an exact unique address" + ); + + let value = serde_json::to_value(&coverage).expect("coverage serializes"); + let coverage_schema = compile_schema(&read_json( + crate_root() + .join("schemas/project-documentation") + .join("registry.project.configuration_reference_coverage.v1.schema.json"), + )); + assert_valid( + &coverage_schema, + &value, + "embedded configuration-reference coverage", + ); + let mut unknown = value; + unknown["unexpected"] = json!(true); + assert!( + coverage_schema.validate(&unknown).is_err(), + "the strict coverage contract rejects an unknown top-level field" + ); + + let reference = documentation::embedded_configuration_reference() + .expect("complete reviewed prose permits canonical reference generation"); + assert_eq!(reference.coverage, coverage.coverage); + assert_eq!( + reference.fields.len(), + coverage.reviewed_intent_assignment_required_count + ); + assert_eq!( + reference.reference_baseline, coverage.reference_baseline, + "reference and coverage must publish the same unreleased baseline provenance" + ); + assert_eq!( + reference.reference_baseline.generator_lifecycle, + documentation::GeneratorLifecycle::Unreleased + ); + assert_eq!( + reference.reference_baseline.field_history_status, + documentation::FieldHistoryStatus::NotVerified + ); + assert_eq!(reference.reference_baseline.published_release, None); + assert_eq!( + reference.reference_baseline.history_verification_method, + None + ); + assert!(reference.reference_baseline.compared_releases.is_empty()); + assert!(reference.fields.iter().all(|field| { + field.history_status == documentation::FieldHistoryStatus::NotVerified + && field.introduced_in.is_none() + && field.version_history.is_empty() + && field.default.source_version.is_none() + })); + let intent_counts = + reference + .fields + .iter() + .fold(BTreeMap::<&str, usize>::new(), |mut counts, field| { + *counts.entry(field.purpose.as_str()).or_default() += 1; + counts + }); + assert_eq!(coverage.distinct_reviewed_intent_count, intent_counts.len()); + assert_eq!( + coverage.distinct_reviewed_intents_reused_count, + intent_counts.values().filter(|count| **count > 1).count() + ); + assert_eq!( + coverage.reviewed_intent_assignments_using_reused_intent_count, + intent_counts + .values() + .filter(|count| **count > 1) + .sum::() + ); + for removed in [ + "/$defs/recordAttributeReleaseProfile/properties/subject/properties/input", + "/$defs/recordAttributeReleaseProfile/properties/response", + "/$defs/recordAttributeReleaseProfile/properties/response/properties/max_age_seconds", + ] { + assert!( + reference.fields.iter().all(|field| { + field.address.schema != ConfigurationSchemaKind::Project + || field.address.pointer != removed + }), + "removed project path {removed} must not survive in the reference" + ); + } + for removed in [ + "datasets[].entities[].attribute_release_profiles[].claims[].shareable", + "datasets[].entities[].attribute_release_profiles[].release_conditions.denied_code", + "datasets[].entities[].attribute_release_profiles[].response.max_age_seconds", + "datasets[].entities[].attribute_release_profiles[].subject.cardinality", + "datasets[].entities[].attribute_release_profiles[].subject.input", + ] { + assert!( + reference.fields.iter().all(|field| { + field.address.schema != ConfigurationSchemaKind::Relay + || field.address.key_path.as_deref() != Some(removed) + }), + "removed Relay path {removed} must not survive in the reference" + ); + } + for (pointer, required_prose) in [ + ( + "/$defs/recordsApi/properties/required_principal_filters", + "must be empty when attribute-release profiles are configured", + ), + ( + "/$defs/recordsApi/properties/pagination/properties/max_limit", + "must be at least 2 when attribute-release profiles are configured", + ), + ( + "/$defs/recordAttributeReleaseProfile/properties/version", + "portable path-segment version matching [A-Za-z0-9][A-Za-z0-9._-]{0,63}", + ), + ( + "/$defs/recordAttributeReleaseProfile/properties/purpose", + "bounded visible-ASCII header token", + ), + ( + "/$defs/recordAttributeReleaseProfile/properties/release_scope", + "exact entity-bound :identity_release scope", + ), + ( + "/$defs/recordAttributeReleaseProfile/properties/subject", + "projected source field and identifier type", + ), + ( + "/$defs/recordAttributeReleaseProfile/properties/subject/properties/source_field", + "projected entity field whose value is matched for exact-one subject resolution", + ), + ] { + let field = reference + .fields + .iter() + .find(|field| { + field.address.schema == ConfigurationSchemaKind::Project + && field.address.pointer == pointer + }) + .unwrap_or_else(|| panic!("project reference contains {pointer}")); + assert!( + field.purpose.contains(required_prose), + "project path {pointer} must explain {required_prose:?}, got {:?}", + field.purpose + ); + assert!( + !field.purpose.contains("request input"), + "project path {pointer} must not describe the removed request input" + ); + } + assert!( + reference + .fields + .iter() + .all(|field| !field.example.contains_country_values), + "all configuration documentation entries remain value-free" + ); + assert!( + reference.fields.iter().all(|field| { + let runtime = matches!( + field.address.schema, + ConfigurationSchemaKind::Relay | ConfigurationSchemaKind::Notary + ); + runtime == field.address.key_path.is_some() + && (field.address.pointer.is_empty() || field.address.pointer.starts_with('/')) + }), + "runtime entries keep their configuration key path separate from the authoritative JSON Schema pointer" + ); + let reference_value = serde_json::to_value(&reference).expect("reference serializes"); + let reference_schema = compile_schema(&read_json( + crate_root() + .join("schemas/project-documentation") + .join("registry.project.configuration_reference.v1.schema.json"), + )); + assert_valid( + &reference_schema, + &reference_value, + "embedded configuration reference", + ); + let mut fabricated_history = reference_value.clone(); + fabricated_history["fields"][0]["introduced_in"] = json!("0.13.0"); + assert!( + reference_schema.validate(&fabricated_history).is_err(), + "not-verified history cannot carry a fabricated introduced version" + ); + let mut missing_runtime_key_path = reference_value; + let runtime_field = missing_runtime_key_path["fields"] + .as_array_mut() + .expect("reference fields are an array") + .iter_mut() + .find(|field| field["address"]["schema"] == "relay") + .expect("embedded reference has Relay fields"); + runtime_field["address"] + .as_object_mut() + .expect("field address is an object") + .remove("key_path"); + assert!( + reference_schema.validate(&missing_runtime_key_path).is_err(), + "the strict reference contract requires a runtime key path separately from the schema pointer" + ); +} + +#[test] +fn coverage_gate_reports_drift_instead_of_deriving_prose_from_a_field_name() { + let catalog = miniature_catalog(); + let mut document = miniature_schema(); + document["properties"]["mode"] + .as_object_mut() + .expect("mode is an object") + .remove("description"); + let schema = [DocumentationSchema { + published: PublishedSchema { + kind: SchemaKind::Project, + document: &document, + }, + source_name: "project.schema.json", + }]; + let intent = miniature_intent(); + + let coverage = configuration_reference_coverage(&catalog, &schema, &intent) + .expect("coverage report remains available when prose is missing"); + assert_eq!(coverage.reviewed_intent_assignment_required_count, 3); + assert_eq!(coverage.reviewed_intent_assignment_covered_count, 2); + assert_eq!(coverage.missing_intent.len(), 1); + assert_eq!(coverage.missing_intent[0].pointer, "/properties/mode"); + assert!(generate_configuration_reference(&catalog, &schema, &intent) + .expect_err("reference generation fails closed") + .to_string() + .contains("project#/properties/mode")); +} + +#[test] +fn structural_taxonomy_requires_exact_path_reviews_and_rejects_invalid_reviews() { + let catalog = miniature_structural_catalog(); + let document = miniature_schema_with_unreviewed_structural_paths(); + let schema = [DocumentationSchema { + published: PublishedSchema { + kind: SchemaKind::Project, + document: &document, + }, + source_name: "project.schema.json", + }]; + let mut intent = miniature_intent(); + + let coverage = configuration_reference_coverage(&catalog, &schema, &intent) + .expect("unreviewed structural paths produce an incomplete coverage report"); + assert_eq!(coverage.reviewed_intent_assignment_required_count, 10); + assert_eq!(coverage.reviewed_intent_assignment_covered_count, 6); + assert_eq!( + coverage + .missing_intent + .iter() + .map(|address| (address.pointer.as_str(), address.path_kind)) + .collect::>(), + [ + ( + "/properties/structural_choice/not", + FieldPathKind::Branch, + ), + ( + "/properties/structural_list/items", + FieldPathKind::ArrayItem, + ), + ( + "/properties/structural_map/additionalProperties", + FieldPathKind::MapValue, + ), + ( + "/properties/structural_map/propertyNames", + FieldPathKind::MapKey, + ), + ] + .into_iter() + .collect(), + "generic taxonomy prose cannot silently cover a new branch, array item, map key, or map value" + ); + assert!(generate_configuration_reference(&catalog, &schema, &intent).is_err()); + + intent.structural_reviews = miniature_structural_reviews(); + let reviewed = generate_configuration_reference(&catalog, &schema, &intent) + .expect("exact reviewed structural addresses unlock shared taxonomy prose"); + assert_eq!(reviewed.fields.len(), 10); + assert_eq!( + reviewed + .fields + .iter() + .filter(|field| matches!( + field.address.path_kind, + FieldPathKind::MapKey + | FieldPathKind::MapValue + | FieldPathKind::ArrayItem + | FieldPathKind::Branch + )) + .filter(|field| field.purpose_source == HumanIntentSource::StructuralTaxonomy) + .count(), + 4 + ); + + let mut duplicate = miniature_intent(); + duplicate.structural_reviews = miniature_structural_reviews(); + let duplicate_review = duplicate.structural_reviews[0].clone(); + duplicate.structural_reviews.push(duplicate_review); + assert!( + configuration_reference_coverage(&catalog, &schema, &duplicate) + .expect_err("duplicate exact structural review fails closed") + .to_string() + .contains("duplicate structural review") + ); + + let mut mismatched = miniature_intent(); + mismatched.structural_reviews = miniature_structural_reviews(); + mismatched.structural_reviews[0].path_kind = FieldPathKind::Branch; + assert!( + configuration_reference_coverage(&catalog, &schema, &mismatched) + .expect_err("declared structural kind must match the schema path") + .to_string() + .contains("schema path is MapKey") + ); + + let mut unknown = miniature_intent(); + unknown.structural_reviews = vec![StructuralIntentReview { + schema: SchemaKind::Project, + pointer: "/properties/not_reviewed/items".to_owned(), + path_kind: FieldPathKind::ArrayItem, + }]; + assert!( + configuration_reference_coverage(&catalog, &schema, &unknown) + .expect_err("review of an unknown structural path fails closed") + .to_string() + .contains("targets unknown path") + ); + + let mut nonstructural = miniature_intent(); + nonstructural.structural_reviews = vec![StructuralIntentReview { + schema: SchemaKind::Project, + pointer: "/properties/version".to_owned(), + path_kind: FieldPathKind::Property, + }]; + assert!( + configuration_reference_coverage(&catalog, &schema, &nonstructural) + .expect_err("nonstructural review kind fails closed") + .to_string() + .contains("must use a structural path kind") + ); +} + +#[test] +fn runtime_intent_requires_exact_assignments_and_new_paths_cannot_inherit_profiles() { + let intent: RuntimeIntentCatalog = serde_json::from_value(read_json( + crate_root().join("../registry-relay/config/documentation-intent.json"), + )) + .expect("Relay runtime intent parses"); + let document = registry_relay::config::schema::document(); + assert_eq!( + runtime_configuration_intent_gaps(&document, &intent) + .expect("current Relay runtime intent is exact"), + [] + ); + + let mut expanded = document.clone(); + expanded["properties"]["unreviewed_runtime_field"] = json!({ + "type": "string", + "description": "A newly introduced Relay runtime field that has not received product-owned intent review." + }); + let gaps = runtime_configuration_intent_gaps(&expanded, &intent) + .expect("coverage remains reportable for an unassigned new runtime path"); + assert_eq!(gaps.len(), 1); + assert_eq!(gaps[0].schema, ConfigurationSchemaKind::Relay); + assert_eq!(gaps[0].pointer, "/properties/unreviewed_runtime_field"); + assert_eq!( + gaps[0].key_path.as_deref(), + Some("unreviewed_runtime_field") + ); + assert_eq!(gaps[0].path_kind, FieldPathKind::Property); + + let mut duplicate = intent.clone(); + duplicate.assignments.push(duplicate.assignments[0].clone()); + assert!(runtime_configuration_intent_gaps(&document, &duplicate) + .expect_err("duplicate runtime assignment fails closed") + .to_string() + .contains("duplicate")); + + let mut unknown_profile = intent.clone(); + unknown_profile.assignments[0].profile = "unreviewed_profile".to_owned(); + assert!( + runtime_configuration_intent_gaps(&document, &unknown_profile) + .expect_err("unknown runtime profile fails closed") + .to_string() + .contains("unknown profile") + ); + + let mut wrong_schema = intent.clone(); + wrong_schema.assignments[0].schema = ConfigurationSchemaKind::Notary; + assert!(runtime_configuration_intent_gaps(&document, &wrong_schema) + .expect_err("wrong runtime schema identity fails closed") + .to_string() + .contains("wrong product schema")); + + let mut stale_key_path = intent.clone(); + stale_key_path.assignments[0].key_path = "unreviewed_runtime_field".to_owned(); + assert!( + runtime_configuration_intent_gaps(&document, &stale_key_path) + .expect_err("stale runtime key path fails closed") + .to_string() + .contains("stale key path") + ); + + let mut stale_pointer = intent.clone(); + stale_pointer.assignments[0].pointer = "/properties/unreviewed_runtime_field".to_owned(); + assert!(runtime_configuration_intent_gaps(&document, &stale_pointer) + .expect_err("stale runtime schema pointer fails closed") + .to_string() + .contains("stale pointer")); + + let map_assignment = intent + .assignments + .iter() + .find(|assignment| assignment.path_kind == FieldPathKind::MapValue) + .expect("Relay publishes reviewed open maps"); + let mut missing_map_semantics = intent.clone(); + missing_map_semantics + .profiles + .iter_mut() + .find(|profile| profile.id == map_assignment.profile) + .expect("open-map profile exists") + .open_map_semantics = None; + assert!( + runtime_configuration_intent_gaps(&document, &missing_map_semantics) + .expect_err("open map without exact extension semantics fails closed") + .to_string() + .contains("lacks exact extension semantics") + ); + + let mut cross_product_diagnostic = intent.clone(); + cross_product_diagnostic.profiles[0].diagnostic = "registry.notary.config.invalid".to_owned(); + assert!( + runtime_configuration_intent_gaps(&document, &cross_product_diagnostic) + .expect_err("cross-product diagnostic code fails closed") + .to_string() + .contains("cross-product diagnostic code") + ); + + let mut wrong_kind = intent; + wrong_kind.assignments[0].path_kind = FieldPathKind::Branch; + assert!(runtime_configuration_intent_gaps(&document, &wrong_kind) + .expect_err("wrong runtime path kind fails closed") + .to_string() + .contains("wrong path kind")); +} diff --git a/crates/registryctl/tests/project_fixture_coverage.rs b/crates/registryctl/tests/project_fixture_coverage.rs new file mode 100644 index 000000000..31bbaed30 --- /dev/null +++ b/crates/registryctl/tests/project_fixture_coverage.rs @@ -0,0 +1,1064 @@ +// SPDX-License-Identifier: Apache-2.0 + +#![allow(dead_code)] + +#[path = "../src/project_authoring/knowledge.rs"] +mod knowledge; +#[path = "../src/project_authoring/report_contract.rs"] +mod report_contract; + +pub use report_contract::Sha256Digest; + +#[path = "../src/project_authoring/fixture_coverage.rs"] +mod fixture_coverage; + +use std::{ + collections::BTreeSet, + fs, + path::{Path, PathBuf}, + process::Command, + sync::OnceLock, +}; + +use registryctl::{ + FixtureCapability, FixtureCoverageChangeKind, FixtureCoverageComparisonInput, + FixtureCoverageDimensions, FixtureCoverageEvidenceKind, FixtureCoverageGapReason, + FixtureCoverageNotApplicableReason, FixtureCoverageNotEvaluatedReason, + FixtureCoverageRequirementState, FixtureCoverageTarget, FixtureCoverageTargetComparisonInput, + FixtureCoverageTargetSetState, FixturePassState, FixtureRequirementCoverage, + GeneratedRecipeApplicability, GeneratorRecipeId, ProjectFixtureCoverageReportV1, + RequiredFixtureCoverageRequirement, Sha256Digest as RegistrySha256Digest, +}; +use serde_json::{json, Value}; + +const SCHEMA: &str = + include_str!("../schemas/project-reports/registry.project.fixture_coverage.v1.schema.json"); +const REPRESENTATIVE_FIXTURE: &str = + include_str!("fixtures/project-reports/registry.project.fixture_coverage.v1.json"); +const NO_TARGET_FIXTURE: &str = + include_str!("fixtures/project-reports/registry.project.fixture_coverage.no-target.v1.json"); + +fn parse(input: &str) -> Value { + serde_json::from_str(input).expect("JSON parses") +} + +fn validator() -> jsonschema::JSONSchema { + jsonschema::JSONSchema::options() + .with_draft(jsonschema::Draft::Draft202012) + .compile(&parse(SCHEMA)) + .expect("fixture coverage schema compiles as Draft 2020-12") +} + +fn assert_schema_valid(document: &Value) { + if let Err(errors) = validator().validate(document) { + panic!( + "document should validate: {:?}", + errors.map(|error| error.to_string()).collect::>() + ); + } +} + +fn assert_schema_invalid(document: &Value) { + assert!( + validator().validate(document).is_err(), + "schema should reject the document" + ); +} + +fn assert_typed_invalid(document: Value) { + assert!( + serde_json::from_value::(document).is_err(), + "strict DTO should reject the document" + ); +} + +fn replace_requirement(document: &mut Value, requirement: &str, replacement: Value) { + let requirements = document["targets"][0]["requirements"] + .as_array_mut() + .expect("requirements are an array"); + let coverage = requirements + .iter_mut() + .find(|coverage| coverage["requirement"] == requirement) + .expect("requirement exists"); + let old_state = coverage["state"] + .as_str() + .expect("coverage state is a string") + .to_owned(); + let new_state = replacement["state"] + .as_str() + .expect("replacement state is a string") + .to_owned(); + *coverage = replacement; + if old_state != new_state { + let counts = document["summary"]["requirements"] + .as_object_mut() + .expect("summary counts are an object"); + let old = counts + .get(&old_state) + .and_then(Value::as_u64) + .expect("old count is numeric"); + let new = counts + .get(&new_state) + .and_then(Value::as_u64) + .expect("new count is numeric"); + counts.insert(old_state, json!(old - 1)); + counts.insert(new_state, json!(new + 1)); + } +} + +fn requirement(document: &Value, requirement: &str) -> Value { + document["targets"][0]["requirements"] + .as_array() + .expect("requirements are an array") + .iter() + .find(|coverage| coverage["requirement"] == requirement) + .expect("requirement exists") + .clone() +} + +fn project_root(name: &str) -> std::path::PathBuf { + let manifest = std::path::Path::new(env!("CARGO_MANIFEST_DIR")); + if name == "bounded-http-starter" { + manifest.join("assets/project-starters/bounded-http") + } else { + manifest.join("tests/fixtures/project-authoring").join(name) + } +} + +fn copy_project_tree(source: &Path, destination: &Path) { + fs::create_dir_all(destination).expect("destination directory is created"); + for entry in fs::read_dir(source).expect("source project directory is readable") { + let entry = entry.expect("source project entry is readable"); + let source_path = entry.path(); + let destination_path = destination.join(entry.file_name()); + if entry.file_type().expect("entry type is readable").is_dir() { + copy_project_tree(&source_path, &destination_path); + } else { + fs::copy(&source_path, &destination_path).expect("project file is copied"); + } + } +} + +fn replace_authored_text(project: &Path, relative_path: &str, old: &str, new: &str) { + let path = project.join(relative_path); + let authored = fs::read_to_string(&path).expect("authored project file is readable"); + assert!( + authored.contains(old), + "sentinel source text is present in {}", + path.display() + ); + fs::write(path, authored.replace(old, new)).expect("sentinel is planted"); +} + +fn registryctl_executable() -> &'static Path { + static STABLE_EXECUTABLE: OnceLock<(tempfile::TempDir, PathBuf)> = OnceLock::new(); + &STABLE_EXECUTABLE + .get_or_init(|| { + let directory = tempfile::tempdir().expect("stable executable directory is created"); + let executable = directory.path().join("registryctl"); + fs::copy(env!("CARGO_BIN_EXE_registryctl"), &executable) + .expect("registryctl executable is copied before fixture execution"); + (directory, executable) + }) + .1 +} + +fn generated_coverage_project(name: &str) -> registryctl::ProjectFixtureCoverageReportV1 { + let context = registryctl::ProjectExecutionContext::new(registryctl_executable()) + .expect("Cargo provides registryctl"); + registryctl::test_registry_project_with_context( + ®istryctl::ProjectTestOptions { + project_directory: project_root(name), + environment: None, + live: false, + }, + &context, + ) + .expect("coverage fixtures execute") + .fixture_coverage + .expect("full project test produces coverage") +} + +fn executable_fixture_coverage(project: &Path) -> ProjectFixtureCoverageReportV1 { + let output = Command::new(registryctl_executable()) + .args(["test", "--project-dir"]) + .arg(project) + .args(["--format", "json"]) + .env("REGISTRYCTL_NO_UPDATE_CHECK", "1") + .output() + .expect("registryctl test executes"); + assert!( + output.status.success(), + "registryctl test failed: {}", + String::from_utf8_lossy(&output.stderr) + ); + let report: registryctl::ProjectCommandReportV1 = + serde_json::from_slice(&output.stdout).expect("registryctl test emits JSON"); + report + .fixture_coverage + .expect("full project test emits fixture coverage") +} + +fn only_target(report: ®istryctl::ProjectFixtureCoverageReportV1) -> &FixtureCoverageTarget { + assert_eq!(report.targets.len(), 1); + &report.targets[0] +} + +fn contains_key(value: &Value, forbidden: &str) -> bool { + match value { + Value::Array(values) => values.iter().any(|value| contains_key(value, forbidden)), + Value::Object(object) => { + object.contains_key(forbidden) + || object.values().any(|value| contains_key(value, forbidden)) + } + _ => false, + } +} + +fn empty_dimensions() -> FixtureCoverageDimensions { + FixtureCoverageDimensions { + input_ids: Vec::new(), + output_ids: Vec::new(), + claim_ids: Vec::new(), + disclosure_modes: Vec::new(), + status_mappings: Vec::new(), + protocol_helpers: Vec::new(), + limits: Vec::new(), + script_branch_ids: Vec::new(), + } +} + +fn comparison_input_for(targets: &[FixtureCoverageTarget]) -> FixtureCoverageComparisonInput { + FixtureCoverageComparisonInput { + baseline_digest: RegistrySha256Digest::new(format!("sha256:{}", "1".repeat(64))).unwrap(), + candidate_digest: RegistrySha256Digest::new(format!("sha256:{}", "2".repeat(64))).unwrap(), + targets: targets + .iter() + .map(|target| FixtureCoverageTargetComparisonInput { + integration: target.identity.integration.clone(), + changed_input_ids: target + .declared + .input_ids + .first() + .cloned() + .into_iter() + .collect(), + changed_output_ids: target + .declared + .output_ids + .first() + .cloned() + .into_iter() + .collect(), + changed_claim_ids: target + .declared + .claim_ids + .first() + .cloned() + .into_iter() + .collect(), + source_contract_changed: true, + }) + .collect(), + } +} + +#[test] +fn canonical_representative_fixture_validates_and_roundtrips_exactly() { + let document = parse(REPRESENTATIVE_FIXTURE); + assert_schema_valid(&document); + let decoded: ProjectFixtureCoverageReportV1 = + serde_json::from_value(document.clone()).expect("canonical fixture decodes"); + assert_eq!(serde_json::to_value(&decoded).unwrap(), document); + assert_eq!(decoded.targets.len(), 1); + assert_eq!( + decoded.summary.target_set_state, + FixtureCoverageTargetSetState::TargetsPresent + ); + assert_eq!(decoded.summary.requirements.total, 35); + assert_eq!(decoded.targets[0].requirements.len(), 35); + assert!(!decoded.targets[0].fixture_inventory.is_empty()); + assert!(!decoded.targets[0].generated_cases.is_empty()); + assert!(decoded.targets[0] + .requirements + .iter() + .skip(RequiredFixtureCoverageRequirement::ALL.len() - FixtureCoverageChangeKind::ALL.len(),) + .all(|coverage| { + matches!( + coverage, + FixtureRequirementCoverage::NotEvaluated { + reason: FixtureCoverageNotEvaluatedReason::ComparisonInputAbsent, + evidence, + .. + } if evidence.is_empty() + ) + })); +} + +#[test] +fn canonical_representative_fixture_is_byte_reproducible_from_the_executable() { + let generated = executable_fixture_coverage(&project_root("bounded-http-starter")); + let canonical: ProjectFixtureCoverageReportV1 = + serde_json::from_str(REPRESENTATIVE_FIXTURE).expect("canonical fixture decodes"); + assert_eq!(generated, canonical); + assert_eq!( + format!("{}\n", serde_json::to_string_pretty(&generated).unwrap()), + REPRESENTATIVE_FIXTURE + ); +} + +#[test] +#[ignore = "explicit maintainer regeneration; byte-exact reproduction runs by default"] +fn regenerate_canonical_representative_fixture_from_the_executable() { + let generated = executable_fixture_coverage(&project_root("bounded-http-starter")); + let bytes = format!("{}\n", serde_json::to_string_pretty(&generated).unwrap()); + fs::write( + Path::new(env!("CARGO_MANIFEST_DIR")) + .join("tests/fixtures/project-reports/registry.project.fixture_coverage.v1.json"), + bytes, + ) + .expect("canonical representative fixture writes"); +} + +#[test] +fn explicit_no_target_fixture_validates_and_roundtrips_exactly() { + let document = parse(NO_TARGET_FIXTURE); + assert_schema_valid(&document); + let decoded: ProjectFixtureCoverageReportV1 = + serde_json::from_value(document.clone()).expect("no-target fixture decodes"); + assert_eq!(serde_json::to_value(&decoded).unwrap(), document); + assert!(decoded.targets.is_empty()); + assert_eq!( + decoded.summary.target_set_state, + FixtureCoverageTargetSetState::NoTargets + ); + assert_eq!(decoded.summary.requirements.total, 0); +} + +#[test] +fn generated_targets_have_exact_ordered_35_requirement_contracts() { + for (project, capability) in [ + ("bounded-http-starter", FixtureCapability::DeclarativeHttp), + ("dhis2-script", FixtureCapability::Script), + ("snapshot-exact", FixtureCapability::Snapshot), + ("opencrvs", FixtureCapability::Script), + ] { + let report = generated_coverage_project(project); + let document = serde_json::to_value(&report).unwrap(); + assert_schema_valid(&document); + assert_eq!( + report.summary.target_set_state, + FixtureCoverageTargetSetState::TargetsPresent + ); + let target = only_target(&report); + assert_eq!(target.identity.capability, capability); + assert_eq!(target.requirements.len(), 35); + assert_eq!( + target + .requirements + .iter() + .map(FixtureRequirementCoverage::requirement) + .collect::>(), + RequiredFixtureCoverageRequirement::ALL + ); + assert_eq!( + target + .requirements + .iter() + .map(FixtureRequirementCoverage::requirement) + .collect::>() + .len(), + 35 + ); + for requirement in target.requirements.iter().skip( + RequiredFixtureCoverageRequirement::ALL.len() - FixtureCoverageChangeKind::ALL.len(), + ) { + assert!(matches!( + requirement, + FixtureRequirementCoverage::NotEvaluated { + reason: FixtureCoverageNotEvaluatedReason::ComparisonInputAbsent, + evidence, + .. + } if evidence.is_empty() + )); + } + assert_eq!(report.summary.requirements.total, 35); + } +} + +#[test] +fn generated_cases_remain_executable_and_isolated_under_their_target() { + for project in [ + "bounded-http-starter", + "dhis2-script", + "snapshot-exact", + "opencrvs", + ] { + let report = generated_coverage_project(project); + let target = only_target(&report); + assert!(!target.fixture_inventory.is_empty()); + assert!(target + .fixture_inventory + .iter() + .all(|fixture| fixture.pass_state == FixturePassState::Passed)); + assert_eq!( + target.generated_cases.len(), + target.fixture_inventory.len() * GeneratorRecipeId::ALL.len() + ); + for case in &target.generated_cases { + assert!(target + .fixture_inventory + .iter() + .any( + |fixture| fixture.fixture_id == case.source_fixture.fixture_id + && fixture.fixture_digest == case.source_fixture.fixture_digest + )); + assert_eq!( + case.evidence.kind, + FixtureCoverageEvidenceKind::GeneratedCase + ); + assert!(case + .evidence + .id + .starts_with(&format!("target/{}/fixture/", target.identity.integration))); + } + } +} + +#[test] +fn no_targets_and_a_fixtureless_target_are_distinct_states() { + let no_targets: ProjectFixtureCoverageReportV1 = + serde_json::from_str(NO_TARGET_FIXTURE).unwrap(); + assert_eq!(no_targets.summary.target_count, 0); + assert_eq!(no_targets.summary.fixtureless_target_count, 0); + + let mut target = generated_coverage_project("dhis2-script") + .targets + .into_iter() + .next() + .unwrap(); + target.fixture_inventory.clear(); + target.generated_cases.clear(); + target.exercised = empty_dimensions(); + target.comparison = None; + target.fixture_set_state = registryctl::FixtureSetState::Fixtureless; + target.refresh_requirements(FixtureCoverageNotEvaluatedReason::ComparisonInputAbsent); + let report = ProjectFixtureCoverageReportV1::from_targets( + "fixtureless-project".to_owned(), + None, + vec![target], + ) + .expect("fixtureless target remains a valid explicit gap report"); + assert_eq!(report.summary.target_count, 1); + assert_eq!(report.summary.fixture_bearing_target_count, 0); + assert_eq!(report.summary.fixtureless_target_count, 1); + assert_eq!( + report.summary.target_set_state, + FixtureCoverageTargetSetState::TargetsPresent + ); + assert_eq!(report.targets[0].requirements.len(), 35); +} + +#[test] +fn declared_and_exercised_dimensions_do_not_relabel_semantics_as_coverage() { + let script_report = generated_coverage_project("dhis2-script"); + let script = only_target(&script_report); + assert_eq!(script.identity.capability, FixtureCapability::Script); + assert!(script.declared.script_branch_ids.is_empty()); + assert!(script.exercised.script_branch_ids.is_empty()); + assert!(matches!( + script + .requirements + .iter() + .find(|coverage| coverage.requirement() + == RequiredFixtureCoverageRequirement::ScriptBranches), + Some(FixtureRequirementCoverage::Missing { + reason: FixtureCoverageGapReason::ScriptBranchContractNotDeclared, + .. + }) + )); + if !script.declared.claim_ids.is_empty() { + assert!(!script.declared.disclosure_modes.is_empty()); + assert!(script.exercised.disclosure_modes.is_empty()); + assert!(matches!( + script + .requirements + .iter() + .find(|coverage| coverage.requirement() + == RequiredFixtureCoverageRequirement::ExercisedDisclosureModes), + Some(FixtureRequirementCoverage::Missing { + reason: FixtureCoverageGapReason::RuntimeDimensionNotObserved, + .. + }) + )); + } + assert!(script.declared.limits.len() > script.exercised.limits.len()); +} + +#[test] +fn boundary_evidence_and_not_applicable_states_preserve_supported_truth() { + let script_report = generated_coverage_project("dhis2-script"); + let script = only_target(&script_report); + assert!(matches!( + script + .requirements + .iter() + .find(|coverage| coverage.requirement() + == RequiredFixtureCoverageRequirement::TimeoutClassification), + Some(FixtureRequirementCoverage::Covered { .. }) + )); + assert!(matches!( + script + .requirements + .iter() + .find(|coverage| coverage.requirement() + == RequiredFixtureCoverageRequirement::NumericDeadlineEnforcement), + Some(FixtureRequirementCoverage::Missing { + reason: FixtureCoverageGapReason::NumericBoundaryNotExercised, + .. + }) + )); + assert!(matches!( + script + .requirements + .iter() + .find(|coverage| coverage.requirement() + == RequiredFixtureCoverageRequirement::RequestBytes), + Some(FixtureRequirementCoverage::Missing { + reason: FixtureCoverageGapReason::NumericBoundaryNotExercised, + .. + }) + )); + + let snapshot_report = generated_coverage_project("snapshot-exact"); + let snapshot = only_target(&snapshot_report); + for requirement in [ + RequiredFixtureCoverageRequirement::RequestRendering, + RequiredFixtureCoverageRequirement::ResponseBytes, + RequiredFixtureCoverageRequirement::TimeoutClassification, + RequiredFixtureCoverageRequirement::OutputMinimization, + ] { + assert!(matches!( + snapshot + .requirements + .iter() + .find(|coverage| coverage.requirement() == requirement), + Some(FixtureRequirementCoverage::NotApplicable { + reason: FixtureCoverageNotApplicableReason::NoRemoteSourceCapability, + .. + }) + )); + } +} + +#[test] +fn multi_target_evidence_cannot_cross_integration_boundaries() { + let mut targets = vec![ + generated_coverage_project("bounded-http-starter") + .targets + .into_iter() + .next() + .unwrap(), + generated_coverage_project("dhis2-script") + .targets + .into_iter() + .next() + .unwrap(), + ]; + targets.sort_by(|left, right| left.identity.integration.cmp(&right.identity.integration)); + let report = + ProjectFixtureCoverageReportV1::from_targets("multi-target".to_owned(), None, targets) + .expect("disjoint targets form one valid report"); + assert_eq!(report.targets.len(), 2); + assert_eq!(report.summary.requirements.total, 70); + + let mut document = serde_json::to_value(report).unwrap(); + let foreign_evidence = document["targets"][1]["fixture_inventory"][0]["evidence"].clone(); + let covered = document["targets"][0]["requirements"] + .as_array() + .unwrap() + .iter() + .position(|coverage| coverage["state"] == "covered") + .unwrap(); + document["targets"][0]["requirements"][covered]["evidence"] = json!([foreign_evidence]); + assert_typed_invalid(document); +} + +#[test] +fn exact_requirement_order_uniqueness_and_derived_summary_fail_closed() { + let report = generated_coverage_project("dhis2-script"); + let mut wrong_order = serde_json::to_value(&report).unwrap(); + wrong_order["targets"][0]["requirements"] + .as_array_mut() + .unwrap() + .swap(0, 1); + assert_schema_invalid(&wrong_order); + assert_typed_invalid(wrong_order); + + let mut duplicate = serde_json::to_value(&report).unwrap(); + duplicate["targets"][0]["requirements"][1] = duplicate["targets"][0]["requirements"][0].clone(); + assert_schema_invalid(&duplicate); + assert_typed_invalid(duplicate); + + let mut false_summary = serde_json::to_value(report).unwrap(); + false_summary["summary"]["requirements"]["covered"] = json!( + false_summary["summary"]["requirements"]["covered"] + .as_u64() + .unwrap() + + 1 + ); + assert_typed_invalid(false_summary); +} + +#[test] +fn root_and_deep_nested_unknown_fields_are_rejected() { + let report = generated_coverage_project("dhis2-script"); + let pointers = [ + "", + "/targets/0", + "/targets/0/identity", + "/targets/0/compiled_contract", + "/targets/0/fixture_inventory/0", + "/targets/0/fixture_inventory/0/evidence", + "/targets/0/generated_cases/0", + "/targets/0/generated_cases/0/recipe", + "/targets/0/generated_cases/0/source_fixture", + "/targets/0/generated_cases/0/applicability", + "/targets/0/platform_cases/0", + "/targets/0/declared", + "/targets/0/exercised", + "/targets/0/requirements/0", + "/summary", + "/summary/requirements", + ]; + for pointer in pointers { + let mut document = serde_json::to_value(&report).unwrap(); + document + .pointer_mut(pointer) + .and_then(Value::as_object_mut) + .expect("test pointer is an object") + .insert("runtime_value".to_owned(), json!("not reportable")); + assert_schema_invalid(&document); + assert_typed_invalid(document); + } +} + +#[test] +fn fixed_scope_sentinels_and_evidence_kinds_cannot_claim_live_compatibility() { + let report = generated_coverage_project("dhis2-script"); + for (field, value) in [ + ("evidence_scope", json!("live_country_source")), + ("compatibility_claim", json!("source_interoperable")), + ("live_compatibility", json!("compatible")), + ( + "governed_request_evidence", + json!("independent_caller_contract_compatible"), + ), + ] { + let mut document = serde_json::to_value(&report).unwrap(); + document[field] = value; + assert_schema_invalid(&document); + assert_typed_invalid(document); + } + + let mut omitted_boundary = serde_json::to_value(&report).unwrap(); + omitted_boundary + .as_object_mut() + .expect("coverage report is an object") + .remove("governed_request_evidence"); + assert_schema_invalid(&omitted_boundary); + assert_typed_invalid(omitted_boundary); + + let mut wrong_kind = serde_json::to_value(report).unwrap(); + wrong_kind["targets"][0]["fixture_inventory"][0]["evidence"]["kind"] = + json!("semantic_comparison"); + assert_typed_invalid(wrong_kind); +} + +#[test] +fn pre_witness_v1_report_is_intentionally_rejected_during_pre_one_point_zero() { + // The public compatibility promise starts at registryctl v1.0.0: + // docs/site/src/content/docs/spec/rs-pr-registryctl.mdx. Before that + // boundary, this closed report is replaced deliberately instead of being + // accepted with a misleading mapping-derived request claim. + let mut legacy = parse(REPRESENTATIVE_FIXTURE); + legacy + .as_object_mut() + .expect("legacy report is an object") + .remove("governed_request_evidence"); + let targets = legacy["targets"] + .as_array_mut() + .expect("targets are an array"); + let mut removed_states = Vec::new(); + for target in targets { + target["contract"] + .as_object_mut() + .expect("target contract is an object") + .remove("registry_backed_consultations"); + for fixture in target["fixture_inventory"] + .as_array_mut() + .expect("fixture inventory is an array") + { + fixture + .as_object_mut() + .expect("fixture record is an object") + .remove("request_to_consultation_binding"); + } + let requirements = target["requirements"] + .as_array_mut() + .expect("requirements are an array"); + let position = requirements + .iter() + .position(|coverage| coverage["requirement"] == "request_to_consultation_binding") + .expect("new request requirement is present"); + let removed = requirements.remove(position); + removed_states.push( + removed["state"] + .as_str() + .expect("removed requirement state is a string") + .to_owned(), + ); + } + let counts = legacy["summary"]["requirements"] + .as_object_mut() + .expect("summary counts are an object"); + for state in removed_states { + let count = counts[&state].as_u64().expect("state count is numeric"); + counts.insert(state, json!(count - 1)); + let total = counts["total"].as_u64().expect("total count is numeric"); + counts.insert("total".to_owned(), json!(total - 1)); + } + + assert_schema_invalid(&legacy); + assert_typed_invalid(legacy); +} + +#[test] +fn report_has_no_value_path_or_secret_bearing_fields() { + let temporary = tempfile::tempdir().expect("temporary directory"); + let project = temporary.path().join("sentinel-project"); + copy_project_tree(&project_root("bounded-http-starter"), &project); + replace_authored_text( + &project, + "environments/local.yaml", + "FICTIONAL_REGISTRY_TOKEN", + "SECRET_REFERENCE_SENTINEL", + ); + replace_authored_text( + &project, + "environments/local.yaml", + "/run/secrets/relay-workload-token", + "/private/PATH-SENTINEL", + ); + replace_authored_text( + &project, + "environments/local.yaml", + "https://citizen-registry.invalid", + "https://ORIGIN-SENTINEL.invalid", + ); + replace_authored_text( + &project, + "integrations/person-record/fixtures/active.yaml", + "AB-123456", + "FIXTURE-INPUT-SENTINEL", + ); + replace_authored_text( + &project, + "integrations/person-record/fixtures/active.yaml", + "body: { active: true }", + "body: { active: true, private: TOP-SECRET-CREDENTIAL }", + ); + + let context = registryctl::ProjectExecutionContext::new(registryctl_executable()) + .expect("Cargo provides registryctl"); + let report = registryctl::test_registry_project_with_context( + ®istryctl::ProjectTestOptions { + project_directory: project, + environment: Some("local".to_owned()), + live: false, + }, + &context, + ) + .expect("sentinel-bearing authored project executes offline") + .fixture_coverage + .expect("full project test produces coverage"); + let document = serde_json::to_value(report).unwrap(); + for forbidden_key in [ + "input", + "inputs", + "request", + "requests", + "path", + "fixture_path", + "origin", + "url", + "cidr", + "client_id", + "client_secret", + "authorization", + "headers", + "query", + "body", + "outputs", + "claims", + "values", + "cel", + "generated_at", + "country", + ] { + assert!( + !contains_key(&document, forbidden_key), + "forbidden report field: {forbidden_key}" + ); + } + let bytes = serde_json::to_vec(&document).unwrap(); + for sentinel in [ + b"SECRET_REFERENCE_SENTINEL".as_slice(), + b"FIXTURE-INPUT-SENTINEL".as_slice(), + b"TOP-SECRET-CREDENTIAL".as_slice(), + b"/private/PATH-SENTINEL".as_slice(), + b"https://ORIGIN-SENTINEL.invalid".as_slice(), + ] { + assert!(!bytes + .windows(sentinel.len()) + .any(|window| window == sentinel)); + } +} + +#[test] +fn repeated_execution_is_byte_deterministic() { + for project in ["bounded-http-starter", "dhis2-script", "snapshot-exact"] { + let left = serde_json::to_vec(&generated_coverage_project(project)).unwrap(); + let right = serde_json::to_vec(&generated_coverage_project(project)).unwrap(); + assert_eq!(left, right, "{project} coverage bytes drifted"); + } +} + +#[test] +fn comparison_input_is_strict_and_default_reports_do_not_fake_affected_sets() { + let valid = json!({ + "baseline_digest": format!("sha256:{}", "1".repeat(64)), + "candidate_digest": format!("sha256:{}", "2".repeat(64)), + "targets": [{ + "integration": "health", + "changed_input_ids": ["person_id"], + "changed_output_ids": [], + "changed_claim_ids": [], + "source_contract_changed": true + }] + }); + let _: FixtureCoverageComparisonInput = + serde_json::from_value(valid.clone()).expect("strict comparison input decodes"); + + let mut unknown = valid.clone(); + unknown["targets"][0]["country_value"] = json!("private"); + assert!(serde_json::from_value::(unknown).is_err()); + + let mut unsorted = valid; + unsorted["targets"][0]["changed_input_ids"] = json!(["z", "a"]); + assert!(serde_json::from_value::(unsorted).is_err()); + + let target_report = generated_coverage_project("dhis2-script"); + let target = only_target(&target_report); + assert!(target.comparison.is_none()); + assert!(target + .requirements + .iter() + .skip(RequiredFixtureCoverageRequirement::ALL.len() - FixtureCoverageChangeKind::ALL.len(),) + .all(|coverage| { + coverage.state() == FixtureCoverageRequirementState::NotEvaluated + && coverage.evidence().is_empty() + })); +} + +#[test] +fn requirement_states_and_evidence_fail_closed_across_all_evidence_classes() { + let report = generated_coverage_project("bounded-http-starter"); + let original = serde_json::to_value(&report).unwrap(); + let compiled_contract = original["targets"][0]["compiled_contract"].clone(); + + let semantic_match = requirement(&original, "semantic_match"); + assert_eq!(semantic_match["state"], "covered"); + let mut forged_authored_missing = original.clone(); + replace_requirement( + &mut forged_authored_missing, + "semantic_match", + json!({ + "state": "missing", + "requirement": "semantic_match", + "reason": "required_evidence_missing", + "evidence": semantic_match["evidence"].clone() + }), + ); + assert_schema_valid(&forged_authored_missing); + assert_typed_invalid(forged_authored_missing); + + let response_bytes = requirement(&original, "response_bytes"); + assert_eq!(response_bytes["state"], "covered"); + let mut forged_generated_evidence = original.clone(); + replace_requirement( + &mut forged_generated_evidence, + "response_bytes", + json!({ + "state": "covered", + "requirement": "response_bytes", + "evidence": [compiled_contract.clone()] + }), + ); + assert_schema_valid(&forged_generated_evidence); + assert_typed_invalid(forged_generated_evidence); + + let output_fields = requirement(&original, "output_fields"); + assert_eq!(output_fields["state"], "covered"); + let mut forged_declared_missing = original.clone(); + replace_requirement( + &mut forged_declared_missing, + "output_fields", + json!({ + "state": "missing", + "requirement": "output_fields", + "reason": "required_evidence_missing", + "evidence": output_fields["evidence"].clone() + }), + ); + assert_schema_valid(&forged_declared_missing); + assert_typed_invalid(forged_declared_missing); + + let request_bytes = requirement(&original, "request_bytes"); + assert_eq!(request_bytes["state"], "missing"); + let mut forged_missing_evidence = original.clone(); + replace_requirement( + &mut forged_missing_evidence, + "request_bytes", + json!({ + "state": "missing", + "requirement": "request_bytes", + "reason": "numeric_boundary_not_exercised", + "evidence": response_bytes["evidence"].clone() + }), + ); + assert_schema_valid(&forged_missing_evidence); + assert_typed_invalid(forged_missing_evidence); + + let mut forged_boundary_covered = original; + replace_requirement( + &mut forged_boundary_covered, + "request_bytes", + json!({ + "state": "covered", + "requirement": "request_bytes", + "evidence": [compiled_contract] + }), + ); + assert_schema_valid(&forged_boundary_covered); + assert_typed_invalid(forged_boundary_covered); +} + +#[test] +fn comparison_enabled_generation_validates_all_impacts_and_keeps_targets_isolated() { + let mut targets = vec![ + generated_coverage_project("bounded-http-starter") + .targets + .into_iter() + .next() + .unwrap(), + generated_coverage_project("dhis2-script") + .targets + .into_iter() + .next() + .unwrap(), + ]; + targets.sort_by(|left, right| left.identity.integration.cmp(&right.identity.integration)); + let input = comparison_input_for(&targets); + let report = ProjectFixtureCoverageReportV1::from_targets( + "comparison-project".to_owned(), + None, + targets, + ) + .expect("base multi-target report validates") + .with_comparison(&input) + .expect("comparison-enabled report generation validates"); + let document = serde_json::to_value(&report).unwrap(); + assert_schema_valid(&document); + let roundtrip: ProjectFixtureCoverageReportV1 = + serde_json::from_value(document.clone()).expect("all four impacts roundtrip"); + assert_eq!(roundtrip, report); + + for target in &report.targets { + let comparison = target.comparison.as_ref().expect("target was compared"); + assert_eq!( + comparison + .impacts + .iter() + .map(|impact| impact.kind) + .collect::>(), + FixtureCoverageChangeKind::ALL + ); + let local_fixture_ids = target + .fixture_inventory + .iter() + .map(|fixture| fixture.fixture_id.as_str()) + .collect::>(); + for impact in &comparison.impacts { + assert!(impact + .affected_fixture_ids + .iter() + .all(|fixture_id| local_fixture_ids.contains(fixture_id.as_str()))); + assert!(impact.evidence.id.starts_with(&format!( + "target/{}/semantic-comparison/", + target.identity.integration + ))); + } + assert!(target + .requirements + .iter() + .skip( + RequiredFixtureCoverageRequirement::ALL.len() + - FixtureCoverageChangeKind::ALL.len(), + ) + .all(|coverage| { + !matches!(coverage, FixtureRequirementCoverage::NotEvaluated { .. }) + && coverage.evidence().len() == 1 + && coverage.evidence()[0].kind + == FixtureCoverageEvidenceKind::SemanticComparison + })); + } + + let mut forged_comparison_state = document; + let changed_input = requirement(&forged_comparison_state, "changed_input_affected_fixtures"); + assert_eq!(changed_input["state"], "covered"); + replace_requirement( + &mut forged_comparison_state, + "changed_input_affected_fixtures", + json!({ + "state": "missing", + "requirement": "changed_input_affected_fixtures", + "reason": "required_evidence_missing", + "evidence": changed_input["evidence"].clone() + }), + ); + assert_schema_valid(&forged_comparison_state); + assert_typed_invalid(forged_comparison_state); +} + +#[test] +fn recipe_applicability_does_not_promote_inapplicable_cases_to_coverage() { + for project in [ + "bounded-http-starter", + "dhis2-script", + "snapshot-exact", + "opencrvs", + ] { + let report = generated_coverage_project(project); + let target = only_target(&report); + for case in &target.generated_cases { + if matches!( + case.applicability, + GeneratedRecipeApplicability::NotApplicable { .. } + ) { + assert_eq!(case.pass_state, FixturePassState::NotExecuted); + assert!(case.actual_safe_code.is_none()); + } + } + } +} diff --git a/crates/registryctl/tests/project_migration_command.rs b/crates/registryctl/tests/project_migration_command.rs new file mode 100644 index 000000000..0ed71d4b1 --- /dev/null +++ b/crates/registryctl/tests/project_migration_command.rs @@ -0,0 +1,596 @@ +// SPDX-License-Identifier: Apache-2.0 + +use std::collections::BTreeMap; +use std::fs; +use std::path::{Path, PathBuf}; +use std::process::Command; + +use registryctl::{ + check_registry_project_with_context, init_registry_project, + migrate_registry_project_with_context, AuthoringContract, MigrationBlockingReason, + MigrationCandidateEmission, MigrationDiagnosticCode, MigrationDisposition, MigrationFieldPath, + MigrationGateStatus, MigrationOperation, MigrationReviewStatus, MigrationVersionDirection, + ProjectAuthoringDiagnostics, ProjectCheckOptions, ProjectExecutionContext, ProjectInitOptions, + ProjectMigrationOptions, ProjectStarter, +}; + +const OLD_ATTRIBUTE_RELEASE: &str = "tests/fixtures/project-migration/old-40ec7a-attribute-release"; +const MIGRATION_SCHEMA: &str = + include_str!("../schemas/project-reports/registry.project.migration.v1.schema.json"); + +fn assert_schema_valid(document: &serde_json::Value) { + let schema: serde_json::Value = + serde_json::from_str(MIGRATION_SCHEMA).expect("migration schema parses"); + let validator = jsonschema::JSONSchema::options() + .with_draft(jsonschema::Draft::Draft202012) + .compile(&schema) + .expect("migration schema compiles"); + if let Err(errors) = validator.validate(document) { + let details = errors.map(|error| error.to_string()).collect::>(); + panic!("migration report should validate: {details:?}"); + }; +} + +fn worker() -> ProjectExecutionContext { + ProjectExecutionContext::new(env!("CARGO_BIN_EXE_registryctl")) + .expect("registryctl binary is a reviewed executable") +} + +fn initialized_project(parent: &Path) -> PathBuf { + let project = parent.join("source-project"); + init_registry_project(&ProjectInitOptions { + starter: ProjectStarter::Http, + directory: project.clone(), + }) + .expect("starter initializes"); + project +} + +fn copy_tree(source: &Path, destination: &Path) { + fs::create_dir_all(destination).expect("fixture destination is created"); + for entry in fs::read_dir(source).expect("fixture directory reads") { + let entry = entry.expect("fixture entry reads"); + let source_path = entry.path(); + let destination_path = destination.join(entry.file_name()); + if entry.file_type().expect("fixture type reads").is_dir() { + copy_tree(&source_path, &destination_path); + } else { + fs::copy(source_path, destination_path).expect("fixture file copies"); + } + } +} + +fn historical_attribute_release_project(parent: &Path) -> PathBuf { + let project = parent.join("historical-project"); + copy_tree( + &Path::new(env!("CARGO_MANIFEST_DIR")).join(OLD_ATTRIBUTE_RELEASE), + &project, + ); + project +} + +fn file_snapshot(root: &Path) -> BTreeMap> { + fn visit(root: &Path, directory: &Path, files: &mut BTreeMap>) { + for entry in fs::read_dir(directory).expect("project directory reads") { + let entry = entry.expect("project entry reads"); + let path = entry.path(); + let metadata = fs::symlink_metadata(&path).expect("project entry metadata reads"); + assert!(!metadata.file_type().is_symlink()); + if metadata.is_dir() { + visit(root, &path, files); + } else if metadata.is_file() { + files.insert( + path.strip_prefix(root) + .expect("entry remains in project") + .to_path_buf(), + fs::read(path).expect("project file reads"), + ); + } + } + } + + let mut files = BTreeMap::new(); + visit(root, root, &mut files); + files +} + +#[test] +fn current_starter_is_no_change_and_does_not_emit_a_formatting_candidate() { + let temporary = tempfile::tempdir().expect("temporary directory"); + let project = initialized_project(temporary.path()); + let before = file_snapshot(&project); + let execution_context = worker(); + let candidate = temporary.path().join("unneeded-candidate"); + let report = migrate_registry_project_with_context( + &ProjectMigrationOptions { + project_directory: project.clone(), + target_version: 1, + output_directory: Some(candidate.clone()), + write_candidate: true, + }, + &execution_context, + ) + .expect("current project migration check completes"); + assert_eq!( + report.disposition, + MigrationDisposition::NoMigrationRequired + ); + assert_eq!( + report.output.candidate_emission, + MigrationCandidateEmission::NotEmitted + ); + let fixture_transition = report + .version_transitions + .iter() + .find(|transition| transition.contract == AuthoringContract::Fixture) + .expect("fixture transition is present"); + assert_eq!(fixture_transition.source_version, Some(1)); + assert_eq!(fixture_transition.target_version, Some(1)); + assert!(!candidate.exists()); + assert_eq!(file_snapshot(&project), before); +} + +#[test] +fn historical_attribute_release_emits_only_the_reviewable_catalog_transform() { + let temporary = tempfile::tempdir().expect("temporary directory"); + let project = historical_attribute_release_project(temporary.path()); + let before = file_snapshot(&project); + let execution_context = worker(); + let check_error = check_registry_project_with_context( + &ProjectCheckOptions { + project_directory: project.clone(), + environment: "local".to_owned(), + explain: false, + against: None, + anchor: None, + }, + &execution_context, + ) + .expect_err("historical project requires a reviewed migration"); + let diagnostics = check_error + .downcast::() + .expect("historical project returns typed authoring diagnostics"); + assert_eq!(diagnostics.diagnostics.len(), 1, "{diagnostics:#?}"); + let diagnostic = &diagnostics.diagnostics[0]; + assert_eq!( + diagnostic.code, "registryctl.authoring.project.invalid", + "{diagnostics:#?}" + ); + assert_eq!( + diagnostic.remediation, + "Correct the project YAML using the project authoring schema. If this project passed with an earlier registryctl, run `registryctl migrate --project-dir --target-version 1` to check the reviewed compatibility catalog. It does not change or approve the source project; any candidate is separate and requires review." + ); + let rendered = diagnostic.remediation; + assert!(rendered.contains("")); + assert!(!rendered.contains(project.to_string_lossy().as_ref())); + assert!(!rendered.contains("solmara-nia-userinfo")); + assert!(!rendered.contains("individual_id")); + assert!(!rendered.contains("max_age_seconds")); + + let checked = migrate_registry_project_with_context( + &ProjectMigrationOptions { + project_directory: project.clone(), + target_version: 1, + output_directory: None, + write_candidate: false, + }, + &execution_context, + ) + .expect("historical migration check completes"); + assert_eq!(checked.disposition, MigrationDisposition::ReviewRequired); + assert!(checked + .reviews + .iter() + .any(|review| review.status == MigrationReviewStatus::RequiredPending)); + assert_eq!( + checked + .version_transitions + .iter() + .find(|transition| transition.contract == AuthoringContract::Fixture) + .expect("fixture transition is present") + .source_version, + None, + "a project without fixture YAML has no fixture contract transition" + ); + assert_eq!(file_snapshot(&project), before); + let cli = migration_cli(&project, "1"); + assert_eq!( + cli.status.code(), + Some(0), + "review_required is a successful check, not approval" + ); + let cli_report: registryctl::ProjectMigrationReportV1 = + serde_json::from_slice(&cli.stdout).expect("review report is JSON"); + assert_eq!(cli_report.disposition, MigrationDisposition::ReviewRequired); + assert!(cli_report + .reviews + .iter() + .any(|review| review.status == MigrationReviewStatus::RequiredPending)); + + let candidate = temporary.path().join("reviewable-candidate"); + let emitted = migrate_registry_project_with_context( + &ProjectMigrationOptions { + project_directory: project.clone(), + target_version: 1, + output_directory: Some(candidate.clone()), + write_candidate: true, + }, + &execution_context, + ) + .expect("migration candidate is emitted"); + assert_eq!(emitted.disposition, MigrationDisposition::ReviewRequired); + assert_eq!( + emitted.output.candidate_emission, + MigrationCandidateEmission::SeparateOutputCandidateEmitted + ); + assert!(emitted.blocking_reasons.is_empty()); + assert!(emitted.compatible_normalizations.iter().any(|change| { + change.address.path == MigrationFieldPath::AttributeReleaseSubjectInput + && change.operation == MigrationOperation::RemoveField + })); + assert!(emitted.semantic_changes.iter().any(|change| { + change.address.path == MigrationFieldPath::AttributeReleaseResponseMaxAge + && change.operation == MigrationOperation::RemoveField + })); + assert!(candidate.join("migration-report.json").is_file()); + assert_eq!(file_snapshot(&project), before); + assert_eq!( + fs::read(project.join("entities/population.yaml")).expect("source entity reads"), + fs::read(candidate.join("entities/population.yaml")).expect("candidate entity reads") + ); + assert_eq!( + fs::read(project.join("environments/local.yaml")).expect("source environment reads"), + fs::read(candidate.join("environments/local.yaml")).expect("candidate environment reads") + ); + let migrated_project = + fs::read_to_string(candidate.join("registry-stack.yaml")).expect("candidate project reads"); + assert!(!migrated_project.contains("input: individual_id")); + assert!(!migrated_project.contains("max_age_seconds")); + let migrated_value: serde_json::Value = + serde_norway::from_str(&migrated_project).expect("candidate YAML parses"); + assert!(migrated_value + .pointer("/services/nia-population-records/api/attribute_release_profiles/solmara-nia-userinfo/subject/input") + .is_none()); + assert!(migrated_value + .pointer("/services/nia-population-records/api/attribute_release_profiles/solmara-nia-userinfo/response") + .is_none()); + #[cfg(unix)] + { + use std::os::unix::fs::PermissionsExt as _; + assert_eq!( + fs::metadata(&candidate) + .expect("candidate metadata") + .permissions() + .mode() + & 0o777, + 0o700 + ); + assert_eq!( + fs::metadata(candidate.join("migration-report.json")) + .expect("report metadata") + .permissions() + .mode() + & 0o777, + 0o600 + ); + } + + check_registry_project_with_context( + &ProjectCheckOptions { + project_directory: candidate, + environment: "local".to_owned(), + explain: false, + against: None, + anchor: None, + }, + &execution_context, + ) + .expect("separate candidate remains valid authoring input"); + + let report = serde_json::to_string(&emitted).expect("report serializes"); + assert!(!report.contains(project.to_string_lossy().as_ref())); + assert!(!report.contains(temporary.path().to_string_lossy().as_ref())); +} + +#[test] +fn candidate_never_replaces_an_existing_destination() { + let temporary = tempfile::tempdir().expect("temporary directory"); + let project = initialized_project(temporary.path()); + let candidate = temporary.path().join("existing-candidate"); + fs::create_dir(&candidate).expect("candidate directory"); + fs::write(candidate.join("sentinel"), b"keep-me").expect("sentinel writes"); + + let error = migrate_registry_project_with_context( + &ProjectMigrationOptions { + project_directory: project, + target_version: 1, + output_directory: Some(candidate.clone()), + write_candidate: true, + }, + &worker(), + ) + .expect_err("existing candidate blocks publication"); + assert!(error + .to_string() + .contains("candidate destination must not already exist")); + assert_eq!( + fs::read(candidate.join("sentinel")).expect("sentinel remains"), + b"keep-me" + ); +} + +#[test] +fn unsupported_target_fails_closed_in_the_cli_without_writing() { + let temporary = tempfile::tempdir().expect("temporary directory"); + let project = initialized_project(temporary.path()); + let candidate = temporary.path().join("unsupported-candidate"); + for (target, expected_diagnostic) in [ + ("0", MigrationDiagnosticCode::TargetVersionOutOfBounds), + ("2", MigrationDiagnosticCode::TargetVersionUnsupported), + ("65536", MigrationDiagnosticCode::TargetVersionOutOfBounds), + ] { + let output = if target == "2" { + Command::new(env!("CARGO_BIN_EXE_registryctl")) + .args([ + "migrate", + "--project-dir", + project.to_str().expect("project path is Unicode"), + "--target-version", + target, + "--output", + candidate.to_str().expect("candidate path is Unicode"), + "--write-candidate", + "--format", + "json", + ]) + .output() + .expect("migration CLI runs") + } else { + migration_cli(&project, target) + }; + assert_eq!(output.status.code(), Some(1)); + assert!(output.stderr.is_empty()); + let document: serde_json::Value = + serde_json::from_slice(&output.stdout).expect("blocked report is JSON"); + assert_schema_valid(&document); + let report: registryctl::ProjectMigrationReportV1 = + serde_json::from_value(document).expect("blocked report enters through the DTO"); + assert_eq!(report.disposition, MigrationDisposition::Blocked); + assert_eq!( + report.blocking_reasons, + vec![MigrationBlockingReason::TargetVersionUnsupported] + ); + assert_eq!(report.diagnostics.len(), 1); + assert_eq!(report.diagnostics[0].code, expected_diagnostic); + assert!(report.version_transitions.iter().all(|transition| { + transition.target_version.is_none() + && transition.direction == MigrationVersionDirection::UnsupportedTarget + })); + assert!(report + .rerun_gates + .iter() + .all(|gate| gate.status == MigrationGateStatus::NotApplicable)); + assert!(report.compatible_normalizations.is_empty()); + assert!(report.semantic_changes.is_empty()); + assert!(report.reviews.is_empty()); + } + assert!(!candidate.exists()); + + let integration = project.join("integrations/person-record/integration.yaml"); + let source = fs::read_to_string(&integration).expect("integration reads"); + fs::write(&integration, source.replacen("version: 1", "version: 2", 1)) + .expect("unsupported integration version is authored"); + fs::create_dir_all(project.join("integrations/person-record/fixtures")) + .expect("fixture directory is created"); + fs::write( + project.join("integrations/person-record/fixtures/version-inheritance.yaml"), + "name: version-inheritance\n", + ) + .expect("fixture YAML is authored"); + let output = Command::new(env!("CARGO_BIN_EXE_registryctl")) + .args([ + "migrate", + "--project-dir", + project.to_str().expect("project path is Unicode"), + "--target-version", + "1", + "--format", + "json", + ]) + .output() + .expect("migration CLI runs"); + assert_eq!(output.status.code(), Some(1)); + let report: registryctl::ProjectMigrationReportV1 = + serde_json::from_slice(&output.stdout).expect("unsupported source report is JSON"); + assert!(report + .blocking_reasons + .contains(&MigrationBlockingReason::SourceVersionUnsupported)); + let integration_version = report + .version_transitions + .iter() + .find(|transition| transition.contract == AuthoringContract::Integration) + .expect("integration transition is present") + .source_version; + let fixture_version = report + .version_transitions + .iter() + .find(|transition| transition.contract == AuthoringContract::Fixture) + .expect("fixture transition is present") + .source_version; + assert_eq!( + fixture_version, integration_version, + "fixture version follows the integration that owns real fixture YAML" + ); + + fs::write(&integration, source).expect("supported integration version is restored"); + let local_environment = + fs::read_to_string(project.join("environments/local.yaml")).expect("environment reads"); + fs::write( + project.join("environments/staging.yaml"), + local_environment.replacen("version: 1", "version: 2", 1), + ) + .expect("mixed environment version is authored"); + let output = Command::new(env!("CARGO_BIN_EXE_registryctl")) + .args([ + "migrate", + "--project-dir", + project.to_str().expect("project path is Unicode"), + "--target-version", + "1", + "--format", + "json", + ]) + .output() + .expect("migration CLI runs"); + assert_eq!(output.status.code(), Some(1)); + let report: registryctl::ProjectMigrationReportV1 = + serde_json::from_slice(&output.stdout).expect("mixed-version source report is JSON"); + assert!(report + .blocking_reasons + .contains(&MigrationBlockingReason::SourceVersionUnsupported)); + assert!(report + .diagnostics + .iter() + .any(|diagnostic| diagnostic.code == MigrationDiagnosticCode::SourceVersionsMixed)); +} + +#[cfg(unix)] +#[test] +fn catalog_staging_rejects_symlinks_without_publishing_or_changing_source() { + use std::os::unix::fs::symlink; + + let temporary = tempfile::tempdir().expect("temporary directory"); + let project = historical_attribute_release_project(temporary.path()); + let before = fs::read(project.join("registry-stack.yaml")).expect("source project reads"); + symlink("README.md", project.join("linked-note")).expect("test symlink is created"); + let candidate = temporary.path().join("candidate"); + let error = migrate_registry_project_with_context( + &ProjectMigrationOptions { + project_directory: project.clone(), + target_version: 1, + output_directory: Some(candidate.clone()), + write_candidate: true, + }, + &worker(), + ) + .expect_err("a source symlink blocks catalog staging"); + assert!(error + .to_string() + .contains("symlinks are forbidden at the migration source boundary")); + assert!(!candidate.exists()); + assert_eq!( + fs::read(project.join("registry-stack.yaml")).expect("source project still reads"), + before + ); + assert!(fs::symlink_metadata(project.join("linked-note")) + .expect("source symlink remains") + .file_type() + .is_symlink()); +} + +#[test] +fn invalid_source_versions_are_structured_value_free_json() { + let cases = [ + ( + "missing", + "version: 1\n", + "", + MigrationDiagnosticCode::SourceVersionMissing, + ), + ( + "malformed", + "version: 1", + "version: one", + MigrationDiagnosticCode::SourceVersionMalformed, + ), + ( + "zero", + "version: 1", + "version: 0", + MigrationDiagnosticCode::SourceVersionZero, + ), + ( + "out-of-bounds", + "version: 1", + "version: 65536", + MigrationDiagnosticCode::SourceVersionOutOfBounds, + ), + ]; + for (name, from, to, expected) in cases { + let temporary = tempfile::tempdir().expect("temporary directory"); + let project = initialized_project(temporary.path()); + let path = project.join("registry-stack.yaml"); + let source = fs::read_to_string(&path).expect("project reads"); + fs::write(&path, source.replacen(from, to, 1)).expect("invalid version writes"); + let output = migration_cli(&project, "1"); + assert_eq!(output.status.code(), Some(1), "{name}"); + assert!(output.stderr.is_empty(), "{name}"); + let report: registryctl::ProjectMigrationReportV1 = + serde_json::from_slice(&output.stdout).expect("blocked report is strict JSON"); + assert_eq!(report.disposition, MigrationDisposition::Blocked, "{name}"); + assert!( + report + .diagnostics + .iter() + .any(|diagnostic| diagnostic.code == expected), + "{name}" + ); + let serialized = String::from_utf8(output.stdout).expect("JSON is UTF-8"); + assert!( + !serialized.contains(project.to_string_lossy().as_ref()), + "{name}" + ); + } +} + +#[test] +fn malformed_source_yaml_is_a_structured_inspection_boundary() { + let temporary = tempfile::tempdir().expect("temporary directory"); + let project = initialized_project(temporary.path()); + fs::write(project.join("registry-stack.yaml"), b"version: [\n") + .expect("malformed project writes"); + let output = migration_cli(&project, "1"); + assert_eq!(output.status.code(), Some(1)); + assert!(output.stderr.is_empty()); + let report: registryctl::ProjectMigrationReportV1 = + serde_json::from_slice(&output.stdout).expect("blocked report is strict JSON"); + assert!(report + .diagnostics + .iter() + .any(|diagnostic| diagnostic.code == MigrationDiagnosticCode::SourceYamlMalformed)); +} + +#[test] +fn malformed_referenced_yaml_is_a_structured_inspection_boundary() { + let temporary = tempfile::tempdir().expect("temporary directory"); + let project = initialized_project(temporary.path()); + fs::write( + project.join("integrations/person-record/integration.yaml"), + b"version: [\n", + ) + .expect("malformed integration writes"); + let output = migration_cli(&project, "1"); + assert_eq!(output.status.code(), Some(1)); + assert!(output.stderr.is_empty()); + let report: registryctl::ProjectMigrationReportV1 = + serde_json::from_slice(&output.stdout).expect("blocked report is strict JSON"); + assert!(report.diagnostics.iter().any(|diagnostic| { + diagnostic.code == MigrationDiagnosticCode::SourceYamlMalformed + && diagnostic.contract == Some(AuthoringContract::Integration) + })); +} + +fn migration_cli(project: &Path, target: &str) -> std::process::Output { + Command::new(env!("CARGO_BIN_EXE_registryctl")) + .args([ + "migrate", + "--project-dir", + project.to_str().expect("project path is Unicode"), + "--target-version", + target, + "--format", + "json", + ]) + .output() + .expect("migration CLI runs") +} diff --git a/crates/registryctl/tests/project_migration_contract.rs b/crates/registryctl/tests/project_migration_contract.rs new file mode 100644 index 000000000..6686958f6 --- /dev/null +++ b/crates/registryctl/tests/project_migration_contract.rs @@ -0,0 +1,1006 @@ +// SPDX-License-Identifier: Apache-2.0 + +use registryctl::{ + build_project_migration_report, AuthoringVersionSet, MigrationAffectedCount, + MigrationAffectedSurfaces, MigrationApplicationPolicy, MigrationArtifact, + MigrationAuthoredFilePolicy, MigrationBlockingReason, MigrationCandidateArtifact, + MigrationCandidateEligibility, MigrationCandidateEmission, MigrationChangeInput, + MigrationCompatibility, MigrationDecisionKind, MigrationDecisionOwner, MigrationDecisionScope, + MigrationDiagnostic, MigrationDiagnosticCode, MigrationDiagnosticPhase, + MigrationDiagnosticRemediation, MigrationDisposition, MigrationExecution, MigrationField, + MigrationGateResults, MigrationGateStatus, MigrationOperation, MigrationOutputMode, + MigrationOutputRequest, MigrationReplacementDisposition, MigrationReplacementInput, + MigrationReviewClass, MigrationSafety, MigrationSemanticEffect, MigrationVersionDirection, + MigrationVersionSupport, MigrationVersionSupportAssessment, MigrationWriteAuthority, + ProjectMigrationBuildError, ProjectMigrationInput, ProjectMigrationReportV1, + UnresolvedMigrationDecision, +}; +use serde_json::{json, Value}; + +const SCHEMA: &str = + include_str!("../schemas/project-reports/registry.project.migration.v1.schema.json"); +const FIXTURE: &str = include_str!("fixtures/project-reports/registry.project.migration.v1.json"); + +fn parse(input: &str) -> Value { + serde_json::from_str(input).expect("JSON parses") +} + +fn validator() -> jsonschema::JSONSchema { + jsonschema::JSONSchema::options() + .with_draft(jsonschema::Draft::Draft202012) + .compile(&parse(SCHEMA)) + .expect("migration schema compiles") +} + +fn assert_schema_valid(document: &Value) { + if let Err(errors) = validator().validate(document) { + let details = errors.map(|error| error.to_string()).collect::>(); + panic!("document should validate: {details:?}"); + } +} + +fn assert_schema_invalid(document: &Value) { + assert!( + validator().validate(document).is_err(), + "document should not validate" + ); +} + +fn versions(version: u32) -> AuthoringVersionSet { + AuthoringVersionSet { + project: Some(version), + integration: Some(version), + entity: Some(version), + fixture: Some(version), + environment: Some(version), + } +} + +fn supported() -> MigrationVersionSupportAssessment { + MigrationVersionSupportAssessment { + source: MigrationVersionSupport::Supported, + target: MigrationVersionSupport::Supported, + } +} + +fn all_passed() -> MigrationGateResults { + MigrationGateResults { + schema: MigrationGateStatus::Passed, + fixture: MigrationGateStatus::Passed, + check: MigrationGateStatus::Passed, + build: MigrationGateStatus::Passed, + generated_reference: MigrationGateStatus::Passed, + } +} + +fn all_not_applicable() -> MigrationGateResults { + MigrationGateResults { + schema: MigrationGateStatus::NotApplicable, + fixture: MigrationGateStatus::NotApplicable, + check: MigrationGateStatus::NotApplicable, + build: MigrationGateStatus::NotApplicable, + generated_reference: MigrationGateStatus::NotApplicable, + } +} + +fn absent_versions() -> AuthoringVersionSet { + AuthoringVersionSet { + project: None, + integration: None, + entity: None, + fixture: None, + environment: None, + } +} + +fn unaffected() -> MigrationAffectedSurfaces { + MigrationAffectedSurfaces { + fixtures: MigrationAffectedCount::known(0), + services: MigrationAffectedCount::known(0), + consultations: MigrationAffectedCount::known(0), + claims: MigrationAffectedCount::known(0), + environments: MigrationAffectedCount::known(0), + generated_artifacts: Vec::new(), + } +} + +fn normalization(field: MigrationField) -> MigrationChangeInput { + MigrationChangeInput { + field, + operation: MigrationOperation::NormalizeField, + semantic_effect: MigrationSemanticEffect::Preserved, + safety: MigrationSafety::Safe, + replacement: MigrationReplacementInput::NotApplicable, + } +} + +fn canonical_input() -> ProjectMigrationInput { + ProjectMigrationInput { + source_versions: versions(1), + target_versions: versions(1), + version_support: supported(), + changes: vec![ + normalization(MigrationField::EnvironmentDeployment), + normalization(MigrationField::ProjectRegistry), + ], + affected: MigrationAffectedSurfaces { + fixtures: MigrationAffectedCount::known(1), + services: MigrationAffectedCount::known(1), + consultations: MigrationAffectedCount::known(0), + claims: MigrationAffectedCount::known(0), + environments: MigrationAffectedCount::known(1), + generated_artifacts: vec![ + MigrationArtifact::GeneratedConfigurationReference, + MigrationArtifact::ProjectExplanation, + MigrationArtifact::RelayConfig, + ], + }, + approved_reviews: vec![ + MigrationReviewClass::Authoring, + MigrationReviewClass::Compatibility, + MigrationReviewClass::Migration, + MigrationReviewClass::Fixtures, + MigrationReviewClass::Relay, + MigrationReviewClass::Security, + MigrationReviewClass::Operations, + MigrationReviewClass::Documentation, + MigrationReviewClass::Release, + ], + output: MigrationOutputRequest { + mode: MigrationOutputMode::ReviewablePatch, + write_authority: MigrationWriteAuthority::ExplicitCandidateWriteGranted, + candidate_emission: MigrationCandidateEmission::NotEmitted, + }, + rerun_gates: all_passed(), + diagnostics: Vec::new(), + unresolved_decisions: Vec::new(), + } +} + +fn unsupported_target_input(code: MigrationDiagnosticCode) -> ProjectMigrationInput { + ProjectMigrationInput { + source_versions: versions(1), + target_versions: absent_versions(), + version_support: MigrationVersionSupportAssessment { + source: MigrationVersionSupport::Supported, + target: MigrationVersionSupport::Unsupported, + }, + changes: Vec::new(), + affected: unaffected(), + approved_reviews: Vec::new(), + output: MigrationOutputRequest { + mode: MigrationOutputMode::CheckOnly, + write_authority: MigrationWriteAuthority::NotGranted, + candidate_emission: MigrationCandidateEmission::NotEmitted, + }, + rerun_gates: all_not_applicable(), + diagnostics: vec![MigrationDiagnostic { + code, + phase: MigrationDiagnosticPhase::VersionInspection, + contract: None, + remediation: MigrationDiagnosticRemediation::SelectSupportedTargetVersion, + }], + unresolved_decisions: Vec::new(), + } +} + +#[test] +fn canonical_fixture_validates_and_roundtrips_exactly() { + let document = parse(FIXTURE); + assert_schema_valid(&document); + let decoded: ProjectMigrationReportV1 = + serde_json::from_value(document.clone()).expect("canonical fixture decodes"); + assert_eq!( + serde_json::to_value(decoded).expect("canonical fixture re-encodes"), + document + ); +} + +#[test] +fn pure_builder_is_deterministic_value_free_and_matches_fixture() { + let first = build_project_migration_report(canonical_input()).expect("report builds"); + let second = build_project_migration_report(canonical_input()).expect("report rebuilds"); + assert_eq!(first, second); + assert_eq!( + serde_json::to_value(&first).expect("report serializes"), + parse(FIXTURE) + ); + assert_eq!( + first.disposition, + MigrationDisposition::ReadyForExplicitWrite + ); + assert_eq!( + first.compatibility, + MigrationCompatibility::CompatibleNormalizationOnly + ); +} + +#[test] +fn compatible_normalization_is_separate_from_semantic_removal_and_rename() { + let report = build_project_migration_report(ProjectMigrationInput { + source_versions: versions(1), + target_versions: versions(1), + version_support: supported(), + changes: vec![ + MigrationChangeInput { + field: MigrationField::IntegrationInput, + operation: MigrationOperation::RenameField, + semantic_effect: MigrationSemanticEffect::Preserved, + safety: MigrationSafety::Safe, + replacement: MigrationReplacementInput::Field( + MigrationField::IntegrationCapability, + ), + }, + MigrationChangeInput { + field: MigrationField::Claim, + operation: MigrationOperation::RemoveField, + semantic_effect: MigrationSemanticEffect::Changed, + safety: MigrationSafety::Safe, + replacement: MigrationReplacementInput::Field(MigrationField::ServicePolicy), + }, + ], + affected: MigrationAffectedSurfaces { + fixtures: MigrationAffectedCount::known(1), + services: MigrationAffectedCount::known(1), + consultations: MigrationAffectedCount::known(0), + claims: MigrationAffectedCount::known(1), + environments: MigrationAffectedCount::known(0), + generated_artifacts: vec![MigrationArtifact::NotaryConfig], + }, + approved_reviews: Vec::new(), + output: MigrationOutputRequest { + mode: MigrationOutputMode::CheckOnly, + write_authority: MigrationWriteAuthority::NotGranted, + candidate_emission: MigrationCandidateEmission::NotEmitted, + }, + rerun_gates: all_passed(), + diagnostics: Vec::new(), + unresolved_decisions: Vec::new(), + }) + .expect("classified report builds"); + + assert_eq!(report.compatible_normalizations.len(), 1); + assert_eq!( + report.compatible_normalizations[0].operation, + MigrationOperation::RenameField + ); + assert_eq!( + report.compatible_normalizations[0].replacement.disposition, + MigrationReplacementDisposition::Field + ); + assert_eq!(report.semantic_changes.len(), 1); + assert_eq!( + report.semantic_changes[0].operation, + MigrationOperation::RemoveField + ); + assert_eq!( + report.compatibility, + MigrationCompatibility::SemanticReviewRequired + ); + assert_eq!(report.disposition, MigrationDisposition::ReviewRequired); +} + +#[test] +fn reviewed_same_v1_retirements_are_reviewable_without_claiming_semantic_equivalence() { + let report = build_project_migration_report(ProjectMigrationInput { + source_versions: versions(1), + target_versions: versions(1), + version_support: supported(), + changes: vec![ + MigrationChangeInput { + field: MigrationField::AttributeReleaseSubjectInput, + operation: MigrationOperation::RemoveField, + semantic_effect: MigrationSemanticEffect::Preserved, + safety: MigrationSafety::Safe, + replacement: MigrationReplacementInput::NoReplacement, + }, + MigrationChangeInput { + field: MigrationField::AttributeReleaseResponseMaxAge, + operation: MigrationOperation::RemoveField, + semantic_effect: MigrationSemanticEffect::Changed, + safety: MigrationSafety::Safe, + replacement: MigrationReplacementInput::NoReplacement, + }, + ], + affected: MigrationAffectedSurfaces { + fixtures: MigrationAffectedCount::known(0), + services: MigrationAffectedCount::known(1), + consultations: MigrationAffectedCount::known(0), + claims: MigrationAffectedCount::known(0), + environments: MigrationAffectedCount::known(0), + generated_artifacts: vec![MigrationArtifact::RelayConfig], + }, + approved_reviews: Vec::new(), + output: MigrationOutputRequest { + mode: MigrationOutputMode::CheckOnly, + write_authority: MigrationWriteAuthority::NotGranted, + candidate_emission: MigrationCandidateEmission::NotEmitted, + }, + rerun_gates: all_passed(), + diagnostics: Vec::new(), + unresolved_decisions: Vec::new(), + }) + .expect("reviewed same-v1 report builds"); + + assert_eq!(report.compatible_normalizations.len(), 1); + assert_eq!(report.semantic_changes.len(), 1); + assert_eq!(report.disposition, MigrationDisposition::ReviewRequired); + assert!(!report + .blocking_reasons + .contains(&MigrationBlockingReason::RemovedFieldWithoutReplacement)); + assert!(report + .reviews + .iter() + .any(|review| review.class == MigrationReviewClass::Privacy)); +} + +#[test] +fn unsafe_unresolved_or_incomplete_migration_fails_closed() { + let mut source = versions(2); + source.fixture = Some(1); + let mut target = versions(1); + target.fixture = None; + let report = build_project_migration_report(ProjectMigrationInput { + source_versions: source, + target_versions: target, + version_support: supported(), + changes: vec![MigrationChangeInput { + field: MigrationField::Claim, + operation: MigrationOperation::RemoveField, + semantic_effect: MigrationSemanticEffect::Changed, + safety: MigrationSafety::Unsafe, + replacement: MigrationReplacementInput::NoReplacement, + }], + affected: MigrationAffectedSurfaces { + fixtures: MigrationAffectedCount::unresolved(), + services: MigrationAffectedCount::known(1), + consultations: MigrationAffectedCount::known(1), + claims: MigrationAffectedCount::known(1), + environments: MigrationAffectedCount::known(1), + generated_artifacts: vec![MigrationArtifact::NotaryConfig], + }, + approved_reviews: Vec::new(), + output: MigrationOutputRequest { + mode: MigrationOutputMode::ReviewablePatch, + write_authority: MigrationWriteAuthority::NotGranted, + candidate_emission: MigrationCandidateEmission::NotEmitted, + }, + rerun_gates: MigrationGateResults { + schema: MigrationGateStatus::Failed, + fixture: MigrationGateStatus::NotRun, + check: MigrationGateStatus::NotRun, + build: MigrationGateStatus::NotRun, + generated_reference: MigrationGateStatus::NotRun, + }, + diagnostics: vec![registryctl::MigrationDiagnostic { + code: registryctl::MigrationDiagnosticCode::RerunGateFailed, + phase: registryctl::MigrationDiagnosticPhase::SchemaGate, + contract: None, + remediation: registryctl::MigrationDiagnosticRemediation::InspectCandidateSchema, + }], + unresolved_decisions: vec![ + UnresolvedMigrationDecision { + owner: MigrationDecisionOwner::CountryAuthority, + kind: MigrationDecisionKind::ClaimSemantics, + scope: MigrationDecisionScope::Claim, + }, + UnresolvedMigrationDecision { + owner: MigrationDecisionOwner::ProjectOperator, + kind: MigrationDecisionKind::OperatorTrust, + scope: MigrationDecisionScope::Environment, + }, + ], + }) + .expect("blocked report builds"); + + assert_schema_valid(&serde_json::to_value(&report).expect("blocked report serializes")); + assert_eq!(report.disposition, MigrationDisposition::Blocked); + assert_eq!( + report.compatibility, + MigrationCompatibility::UnsafeOrUnresolved + ); + for reason in [ + MigrationBlockingReason::DowngradeOrContractRemoval, + MigrationBlockingReason::UnsafeChange, + MigrationBlockingReason::RemovedFieldWithoutReplacement, + MigrationBlockingReason::AffectedSurfaceUnresolved, + MigrationBlockingReason::UnresolvedCountryOrOperatorDecision, + MigrationBlockingReason::RerunGateFailed, + MigrationBlockingReason::RerunGateNotRun, + MigrationBlockingReason::ExplicitWriteAuthorityMissing, + ] { + assert!(report.blocking_reasons.contains(&reason), "{reason:?}"); + } + assert_eq!(report.unresolved_decisions.len(), 2); + + let supported_downgrade = build_project_migration_report(ProjectMigrationInput { + source_versions: versions(2), + target_versions: versions(1), + version_support: supported(), + changes: vec![normalization(MigrationField::ProjectRegistry)], + affected: unaffected(), + approved_reviews: Vec::new(), + output: MigrationOutputRequest { + mode: MigrationOutputMode::CheckOnly, + write_authority: MigrationWriteAuthority::NotGranted, + candidate_emission: MigrationCandidateEmission::NotEmitted, + }, + rerun_gates: all_passed(), + diagnostics: Vec::new(), + unresolved_decisions: Vec::new(), + }) + .expect("supported downgrade report builds"); + assert_eq!( + supported_downgrade.compatibility, + MigrationCompatibility::UnsafeOrUnresolved + ); + assert!(supported_downgrade + .blocking_reasons + .contains(&MigrationBlockingReason::DowngradeOrContractRemoval)); +} + +#[test] +fn every_failed_gate_retains_one_closed_diagnostic_without_raw_error_text() { + use registryctl::{ + MigrationDiagnostic, MigrationDiagnosticCode, MigrationDiagnosticPhase, + MigrationDiagnosticRemediation, + }; + + let diagnostics = vec![ + MigrationDiagnostic { + code: MigrationDiagnosticCode::RerunGateFailed, + phase: MigrationDiagnosticPhase::SchemaGate, + contract: None, + remediation: MigrationDiagnosticRemediation::InspectCandidateSchema, + }, + MigrationDiagnostic { + code: MigrationDiagnosticCode::RerunGateFailed, + phase: MigrationDiagnosticPhase::FixtureGate, + contract: None, + remediation: MigrationDiagnosticRemediation::RepairFixtures, + }, + MigrationDiagnostic { + code: MigrationDiagnosticCode::RerunGateFailed, + phase: MigrationDiagnosticPhase::CheckGate, + contract: None, + remediation: MigrationDiagnosticRemediation::ResolveProjectCheck, + }, + MigrationDiagnostic { + code: MigrationDiagnosticCode::RerunGateFailed, + phase: MigrationDiagnosticPhase::BuildGate, + contract: None, + remediation: MigrationDiagnosticRemediation::ResolveProjectBuild, + }, + MigrationDiagnostic { + code: MigrationDiagnosticCode::RerunGateFailed, + phase: MigrationDiagnosticPhase::GeneratedReferenceGate, + contract: None, + remediation: MigrationDiagnosticRemediation::RegenerateConfigurationReference, + }, + ]; + let report = build_project_migration_report(ProjectMigrationInput { + source_versions: versions(1), + target_versions: versions(1), + version_support: supported(), + changes: vec![normalization(MigrationField::ProjectRegistry)], + affected: unaffected(), + approved_reviews: Vec::new(), + output: MigrationOutputRequest { + mode: MigrationOutputMode::CheckOnly, + write_authority: MigrationWriteAuthority::NotGranted, + candidate_emission: MigrationCandidateEmission::NotEmitted, + }, + rerun_gates: MigrationGateResults { + schema: MigrationGateStatus::Failed, + fixture: MigrationGateStatus::Failed, + check: MigrationGateStatus::Failed, + build: MigrationGateStatus::Failed, + generated_reference: MigrationGateStatus::Failed, + }, + diagnostics: diagnostics.clone(), + unresolved_decisions: Vec::new(), + }) + .expect("failed-gate report builds"); + + assert_eq!(report.disposition, MigrationDisposition::Blocked); + assert_eq!(report.diagnostics, diagnostics); + let serialized = serde_json::to_string(&report).expect("report serializes"); + for forbidden in ["raw_error", "source_path", "COUNTRY_", "https://"] { + assert!(!serialized.contains(forbidden), "{forbidden}"); + } +} + +#[test] +fn explicit_write_makes_a_candidate_eligible_without_applying_it() { + let ready = build_project_migration_report(canonical_input()).expect("ready report builds"); + assert_eq!(ready.migration_execution, MigrationExecution::NotPerformed); + assert_eq!( + ready.output.candidate_eligibility, + MigrationCandidateEligibility::EligibleToEmit + ); + assert_eq!( + ready.output.authored_file_policy, + MigrationAuthoredFilePolicy::NeverOverwriteAuthoredFiles + ); + assert_eq!( + ready.output.application_policy, + MigrationApplicationPolicy::ExplicitOperatorApplyRequired + ); + assert_eq!( + ready.output.candidate_emission, + MigrationCandidateEmission::NotEmitted + ); + + let mut separate_output = canonical_input(); + separate_output.output.mode = MigrationOutputMode::SeparateOutputDirectory; + let separate = + build_project_migration_report(separate_output).expect("separate output report builds"); + assert_eq!( + separate.output.candidate_artifact, + MigrationCandidateArtifact::SeparateOutputDirectory + ); + assert_eq!( + separate.output.candidate_eligibility, + MigrationCandidateEligibility::EligibleToEmit + ); + + let mut missing_authority = canonical_input(); + missing_authority.output.write_authority = MigrationWriteAuthority::NotGranted; + let blocked = build_project_migration_report(missing_authority).expect("blocked report builds"); + assert_eq!(blocked.disposition, MigrationDisposition::Blocked); + assert_eq!( + blocked.output.candidate_eligibility, + MigrationCandidateEligibility::Blocked + ); + assert!(blocked + .blocking_reasons + .contains(&MigrationBlockingReason::ExplicitWriteAuthorityMissing)); + + let mut mismatched_authority = canonical_input(); + mismatched_authority.output.mode = MigrationOutputMode::CheckOnly; + let blocked = + build_project_migration_report(mismatched_authority).expect("blocked report builds"); + assert!(blocked + .blocking_reasons + .contains(&MigrationBlockingReason::WriteAuthorityScopeMismatch)); +} + +#[test] +fn pending_reviews_allow_only_the_matching_review_candidate_emission() { + let mut input = canonical_input(); + input.approved_reviews.clear(); + input.output.candidate_emission = MigrationCandidateEmission::ReviewablePatchCandidateEmitted; + let report = + build_project_migration_report(input).expect("reviewable pending candidate report builds"); + assert_eq!(report.disposition, MigrationDisposition::ReviewRequired); + assert_eq!( + report.output.candidate_eligibility, + MigrationCandidateEligibility::EligibleToEmit + ); + assert_eq!( + report.output.candidate_emission, + MigrationCandidateEmission::ReviewablePatchCandidateEmitted + ); + assert!(report.blocking_reasons.is_empty()); + + let mut invalid = canonical_input(); + invalid.output.candidate_emission = MigrationCandidateEmission::SeparateOutputCandidateEmitted; + assert_eq!( + build_project_migration_report(invalid), + Err(ProjectMigrationBuildError::InvalidCandidateEmission) + ); +} + +#[test] +fn schema_and_dto_reject_unknown_fields_and_value_sentinels() { + for (pointer, field, sentinel) in [ + ("", "country", "COUNTRY_IDENTIFIER_SENTINEL"), + ( + "/compatible_normalizations/0", + "value", + "COUNTRY_VALUE_SENTINEL", + ), + ( + "/compatible_normalizations/1", + "secret_name", + "COUNTRY_SECRET_SENTINEL", + ), + ("/output", "output_path", "/COUNTRY/ABSOLUTE/PATH/SENTINEL"), + ( + "/affected", + "service_ids", + "COUNTRY_SERVICE_IDENTIFIER_SENTINEL", + ), + ] { + let mut document = parse(FIXTURE); + document + .pointer_mut(pointer) + .and_then(Value::as_object_mut) + .expect("test object exists") + .insert(field.to_owned(), json!(sentinel)); + assert_schema_invalid(&document); + assert!(serde_json::from_value::(document).is_err()); + } + + let mut path_sentinel = parse(FIXTURE); + path_sentinel["compatible_normalizations"][0]["address"]["path"] = + json!("/COUNTRY/PATH/SENTINEL"); + assert_schema_invalid(&path_sentinel); + assert!(serde_json::from_value::(path_sentinel).is_err()); + + for (pointer, false_claim) in [ + ("/migration_execution", json!("performed")), + ( + "/output/authored_file_policy", + json!("overwrite_authored_files"), + ), + ("/output/candidate_emission", json!("candidate_emitted")), + ( + "/evidence_limitations/3", + json!("authored_files_overwritten"), + ), + ] { + let mut document = parse(FIXTURE); + *document.pointer_mut(pointer).expect("test field exists") = false_claim; + assert_schema_invalid(&document); + assert!(serde_json::from_value::(document).is_err()); + } + + let serialized = serde_json::to_string( + &build_project_migration_report(canonical_input()).expect("report builds"), + ) + .expect("report serializes"); + for forbidden in [ + "COUNTRY_", + "https://", + "secret_name", + "secret_value", + "source_path", + "target_path", + "registry_id", + "service_id", + ] { + assert!(!serialized.contains(forbidden), "{forbidden}"); + } +} + +#[test] +fn dto_rejects_tampered_derived_decisions() { + for mutation in [ + ("disposition", json!("checked_safe")), + ("compatibility", json!("semantic_review_required")), + ] { + let mut document = parse(FIXTURE); + document[mutation.0] = mutation.1; + assert_schema_valid(&document); + assert!(serde_json::from_value::(document).is_err()); + } + + let mut owner = parse(FIXTURE); + owner["compatible_normalizations"][0]["owner"] = json!("country_author"); + assert_schema_valid(&owner); + assert!(serde_json::from_value::(owner).is_err()); + + let mut direction = parse(FIXTURE); + direction["version_transitions"][0]["direction"] = json!("upgrade"); + assert_schema_valid(&direction); + assert!(serde_json::from_value::(direction).is_err()); + + let mut review = parse(FIXTURE); + review["reviews"][0]["status"] = json!("required_pending"); + assert_schema_valid(&review); + assert!(serde_json::from_value::(review).is_err()); + + let mut gates = parse(FIXTURE); + gates["rerun_gates"] + .as_array_mut() + .expect("gates are an array") + .swap(0, 1); + assert_schema_invalid(&gates); + assert!(serde_json::from_value::(gates).is_err()); + + let mut incoherent_diagnostic = parse(FIXTURE); + incoherent_diagnostic["diagnostics"] = json!([{ + "code": "rerun_gate_failed", + "phase": "schema_gate", + "contract": null, + "remediation": "inspect_candidate_schema" + }]); + assert_schema_valid(&incoherent_diagnostic); + assert!( + serde_json::from_value::(incoherent_diagnostic).is_err(), + "the DTO enforces cross-array gate/diagnostic coherence" + ); +} + +#[test] +fn unsupported_target_reports_have_no_fictional_target_or_migration_work() { + for code in [ + MigrationDiagnosticCode::TargetVersionOutOfBounds, + MigrationDiagnosticCode::TargetVersionUnsupported, + ] { + let report = build_project_migration_report(unsupported_target_input(code)) + .expect("unsupported target report builds"); + assert_eq!(report.disposition, MigrationDisposition::Blocked); + assert_eq!( + report.compatibility, + MigrationCompatibility::UnsupportedTransition + ); + assert_eq!( + report.blocking_reasons, + vec![MigrationBlockingReason::TargetVersionUnsupported] + ); + assert!(report.compatible_normalizations.is_empty()); + assert!(report.semantic_changes.is_empty()); + assert!(report.reviews.is_empty()); + assert!(report.unresolved_decisions.is_empty()); + assert!(report.version_transitions.iter().all(|transition| { + transition.target_version.is_none() + && transition.direction == MigrationVersionDirection::UnsupportedTarget + })); + assert!(report + .rerun_gates + .iter() + .all(|gate| gate.status == MigrationGateStatus::NotApplicable)); + + let document = serde_json::to_value(&report).expect("report serializes"); + assert_schema_valid(&document); + assert_eq!( + serde_json::from_value::(document) + .expect("schema-valid unsupported target report enters through the DTO"), + report + ); + } +} + +#[test] +fn null_target_and_not_applicable_gates_are_rejected_outside_unsupported_targets() { + for index in 0..5 { + let mut supported_null = parse(FIXTURE); + supported_null["version_transitions"][index]["target_version"] = Value::Null; + assert_schema_invalid(&supported_null); + assert!( + serde_json::from_value::(supported_null).is_err(), + "supported transition {index} cannot claim null target with a non-null direction" + ); + + let mut unsupported_direction = parse(FIXTURE); + unsupported_direction["version_transitions"][index]["direction"] = + json!("unsupported_target"); + assert_schema_invalid(&unsupported_direction); + assert!( + serde_json::from_value::(unsupported_direction).is_err(), + "supported transition {index} cannot claim unsupported-target direction" + ); + } + + let unsupported = build_project_migration_report(unsupported_target_input( + MigrationDiagnosticCode::TargetVersionUnsupported, + )) + .expect("unsupported target report builds"); + + let mut invented_target = serde_json::to_value(&unsupported).expect("report serializes"); + invented_target["version_transitions"][0]["target_version"] = json!(2); + assert_schema_invalid(&invented_target); + assert!(serde_json::from_value::(invented_target).is_err()); + + let mut removed_contract = serde_json::to_value(&unsupported).expect("report serializes"); + removed_contract["version_transitions"][0]["direction"] = json!("removed_contract"); + assert_schema_invalid(&removed_contract); + assert!(serde_json::from_value::(removed_contract).is_err()); + + let mut misleading_gate = serde_json::to_value(&unsupported).expect("report serializes"); + misleading_gate["rerun_gates"][0]["status"] = json!("not_run"); + assert_schema_invalid(&misleading_gate); + assert!(serde_json::from_value::(misleading_gate).is_err()); + + let mut invalid = canonical_input(); + invalid.target_versions.project = None; + assert_eq!( + build_project_migration_report(invalid), + Err(ProjectMigrationBuildError::MissingProjectVersion) + ); + + let mut invalid = unsupported_target_input(MigrationDiagnosticCode::TargetVersionUnsupported); + invalid.target_versions = versions(2); + assert_eq!( + build_project_migration_report(invalid), + Err(ProjectMigrationBuildError::InvalidVersionSupportEvidence) + ); + + let mut invalid = unsupported_target_input(MigrationDiagnosticCode::TargetVersionUnsupported); + invalid.rerun_gates = all_passed(); + assert_eq!( + build_project_migration_report(invalid), + Err(ProjectMigrationBuildError::InvalidGateStatus) + ); + + let mut invalid = canonical_input(); + invalid.rerun_gates = all_not_applicable(); + assert_eq!( + build_project_migration_report(invalid), + Err(ProjectMigrationBuildError::InvalidGateStatus) + ); + + let mut invalid = unsupported_target_input(MigrationDiagnosticCode::TargetVersionUnsupported); + invalid.changes = vec![normalization(MigrationField::ProjectRegistry)]; + assert_eq!( + build_project_migration_report(invalid), + Err(ProjectMigrationBuildError::InvalidPreMigrationEvidence) + ); +} + +#[test] +fn invalid_change_version_count_and_capacity_are_rejected() { + let mut invalid = canonical_input(); + invalid.changes = vec![MigrationChangeInput { + field: MigrationField::ProjectRegistry, + operation: MigrationOperation::RenameField, + semantic_effect: MigrationSemanticEffect::Preserved, + safety: MigrationSafety::Safe, + replacement: MigrationReplacementInput::Field(MigrationField::ProjectRegistry), + }]; + assert_eq!( + build_project_migration_report(invalid), + Err(ProjectMigrationBuildError::InvalidChange) + ); + + let mut invalid = canonical_input(); + invalid.source_versions.project = Some(0); + assert_eq!( + build_project_migration_report(invalid), + Err(ProjectMigrationBuildError::InvalidAuthoringVersion) + ); + + let mut invalid = canonical_input(); + invalid.target_versions.project = Some(65_536); + assert_eq!( + build_project_migration_report(invalid), + Err(ProjectMigrationBuildError::InvalidAuthoringVersion) + ); + + let mut invalid = canonical_input(); + invalid.affected.fixtures = MigrationAffectedCount { + state: registryctl::MigrationAffectedState::Affected, + count: Some(0), + }; + assert_eq!( + build_project_migration_report(invalid), + Err(ProjectMigrationBuildError::InvalidAffectedCount) + ); + + let mut invalid = canonical_input(); + invalid.affected.fixtures = MigrationAffectedCount::known(1_000_001); + assert_eq!( + build_project_migration_report(invalid), + Err(ProjectMigrationBuildError::TooManyAffectedItems) + ); + + let repeated = normalization(MigrationField::ProjectRegistry); + let mut invalid = canonical_input(); + invalid.changes = vec![repeated; 257]; + assert_eq!( + build_project_migration_report(invalid), + Err(ProjectMigrationBuildError::TooManyChanges) + ); + + let decision = UnresolvedMigrationDecision { + owner: MigrationDecisionOwner::CountryAuthority, + kind: MigrationDecisionKind::CountrySemanticIntent, + scope: MigrationDecisionScope::Project, + }; + let mut invalid = canonical_input(); + invalid.unresolved_decisions = vec![decision; 65]; + assert_eq!( + build_project_migration_report(invalid), + Err(ProjectMigrationBuildError::TooManyDecisions) + ); +} + +#[test] +fn no_op_and_contract_coverage_remain_explicit() { + let report = build_project_migration_report(ProjectMigrationInput { + source_versions: versions(1), + target_versions: versions(1), + version_support: supported(), + changes: Vec::new(), + affected: unaffected(), + approved_reviews: Vec::new(), + output: MigrationOutputRequest { + mode: MigrationOutputMode::CheckOnly, + write_authority: MigrationWriteAuthority::NotGranted, + candidate_emission: MigrationCandidateEmission::NotEmitted, + }, + rerun_gates: MigrationGateResults { + schema: MigrationGateStatus::NotRequired, + fixture: MigrationGateStatus::NotRequired, + check: MigrationGateStatus::NotRequired, + build: MigrationGateStatus::NotRequired, + generated_reference: MigrationGateStatus::NotRequired, + }, + diagnostics: Vec::new(), + unresolved_decisions: Vec::new(), + }) + .expect("no-op report builds"); + assert_eq!( + report.disposition, + MigrationDisposition::NoMigrationRequired + ); + assert_eq!( + report.compatibility, + MigrationCompatibility::NoMigrationRequired + ); + assert_eq!(report.version_transitions.len(), 5); + assert!(report + .version_transitions + .iter() + .all(|transition| transition.direction == MigrationVersionDirection::Same)); + assert_eq!(report.rerun_gates.len(), 5); + + for field in MigrationField::ALL { + assert_eq!(MigrationField::from_address(field.address()), Some(field)); + } +} + +#[test] +fn every_affected_surface_artifact_and_review_class_is_covered() { + let mut generated_artifacts = MigrationArtifact::ALL.to_vec(); + generated_artifacts.reverse(); + let report = build_project_migration_report(ProjectMigrationInput { + source_versions: versions(1), + target_versions: versions(1), + version_support: supported(), + changes: vec![ + normalization(MigrationField::ProjectRegistry), + MigrationChangeInput { + field: MigrationField::ServicePolicy, + operation: MigrationOperation::ChangeSemantics, + semantic_effect: MigrationSemanticEffect::Changed, + safety: MigrationSafety::Safe, + replacement: MigrationReplacementInput::NotApplicable, + }, + MigrationChangeInput { + field: MigrationField::Consultation, + operation: MigrationOperation::ChangeSemantics, + semantic_effect: MigrationSemanticEffect::Changed, + safety: MigrationSafety::Safe, + replacement: MigrationReplacementInput::NotApplicable, + }, + ], + affected: MigrationAffectedSurfaces { + fixtures: MigrationAffectedCount::known(1), + services: MigrationAffectedCount::known(1), + consultations: MigrationAffectedCount::known(1), + claims: MigrationAffectedCount::known(1), + environments: MigrationAffectedCount::known(1), + generated_artifacts, + }, + approved_reviews: Vec::new(), + output: MigrationOutputRequest { + mode: MigrationOutputMode::CheckOnly, + write_authority: MigrationWriteAuthority::NotGranted, + candidate_emission: MigrationCandidateEmission::NotEmitted, + }, + rerun_gates: all_passed(), + diagnostics: Vec::new(), + unresolved_decisions: Vec::new(), + }) + .expect("coverage report builds"); + + assert_eq!( + report.affected.generated_artifacts, + MigrationArtifact::ALL.to_vec() + ); + assert_eq!( + report + .reviews + .iter() + .map(|review| review.class) + .collect::>(), + MigrationReviewClass::ALL + ); + assert!(report + .reviews + .iter() + .all(|review| review.status == registryctl::MigrationReviewStatus::RequiredPending)); +} diff --git a/crates/registryctl/tests/project_preflight.rs b/crates/registryctl/tests/project_preflight.rs new file mode 100644 index 000000000..ce01193a2 --- /dev/null +++ b/crates/registryctl/tests/project_preflight.rs @@ -0,0 +1,970 @@ +// SPDX-License-Identifier: Apache-2.0 + +#![allow(dead_code)] + +#[path = "../src/project_authoring/preflight.rs"] +mod preflight; + +use std::collections::{BTreeMap, BTreeSet}; +use std::ffi::OsString; +use std::fs; +use std::path::Path; +use std::sync::atomic::{AtomicUsize, Ordering}; + +use preflight::{ + run_offline_preflight_with_secret_lookup, OfflinePreflightInput, PreflightAttemptState, + PreflightCheckState, PreflightContact, PreflightDiagnosticCode, PreflightFieldAddress, + PreflightGenerationState, PreflightMode, PreflightRuntimeFileKind, PreflightSecretConsumer, + PreflightStaticCapability, PreflightStatus, PreflightWriteState, ProjectPreflightReportV1, + MAX_PREFLIGHT_CHECKS, MAX_PREFLIGHT_DIAGNOSTICS, +}; +use serde_json::{json, Value}; + +const SCHEMA: &str = + include_str!("../schemas/project-reports/registryctl.project_preflight.v1.schema.json"); +const FIXTURE: &str = + include_str!("fixtures/project-reports/registryctl.project_preflight.v1.json"); + +fn parse(input: &str) -> Value { + serde_json::from_str(input).expect("JSON parses") +} + +fn validator() -> jsonschema::JSONSchema { + jsonschema::JSONSchema::options() + .with_draft(jsonschema::Draft::Draft202012) + .compile(&parse(SCHEMA)) + .expect("Draft 2020-12 schema compiles") +} + +fn assert_schema_valid(document: &Value) { + if let Err(errors) = validator().validate(document) { + let details = errors.map(|error| error.to_string()).collect::>(); + panic!("document should validate: {details:?}"); + } +} + +fn assert_schema_invalid(document: &Value) { + assert!( + validator().validate(document).is_err(), + "document should not validate" + ); +} + +fn address(file: &str, pointer: &str) -> PreflightFieldAddress { + PreflightFieldAddress::new(file, pointer).expect("test address is valid") +} + +fn validated_input() -> OfflinePreflightInput { + let mut input = + OfflinePreflightInput::new("country-registry", "production").expect("valid input"); + let project = address("registry-stack.yaml", ""); + let environment = address("environments/production.yaml", ""); + input.record_static_validation(PreflightStaticCapability::ProjectModel, [project.clone()]); + input.record_static_validation( + PreflightStaticCapability::EnvironmentCompleteness, + [project.clone(), environment.clone()], + ); + input.record_static_validation( + PreflightStaticCapability::OriginRelationships, + [environment.clone()], + ); + input.record_static_validation(PreflightStaticCapability::NonWideningBounds, [environment]); + input +} + +fn run_with( + input: OfflinePreflightInput, + values: &BTreeMap, +) -> ProjectPreflightReportV1 { + run_offline_preflight_with_secret_lookup(input, &|name: &str| values.get(name).cloned()) +} + +#[test] +fn canonical_fixture_validates_and_roundtrips_exactly() { + let document = parse(FIXTURE); + assert_schema_valid(&document); + let decoded: ProjectPreflightReportV1 = + serde_json::from_value(document.clone()).expect("fixture decodes"); + assert_eq!( + serde_json::to_value(&decoded).expect("fixture re-encodes"), + document + ); + assert_eq!(decoded.status, PreflightStatus::Ready); + assert_eq!(decoded.execution.mode, PreflightMode::Offline); + assert_eq!(decoded.execution.contact, PreflightContact::None); + assert_eq!( + decoded.execution.network, + PreflightAttemptState::NotAttempted + ); + assert_eq!( + decoded.execution.build_output, + PreflightWriteState::NotWritten + ); +} + +#[test] +fn schema_and_dto_reject_root_and_deep_unknown_fields() { + let mut root = parse(FIXTURE); + root["future"] = json!(true); + assert_schema_invalid(&root); + assert!(serde_json::from_value::(root).is_err()); + + let mut nested = parse(FIXTURE); + nested["secret_checks"][0]["runtime_value"] = json!("must never appear"); + assert_schema_invalid(&nested); + assert!(serde_json::from_value::(nested).is_err()); + + let mut address_unknown = parse(FIXTURE); + address_unknown["runtime_files"][0]["addresses"][0]["absolute_path"] = + json!("/run/secrets/country.pem"); + assert_schema_invalid(&address_unknown); + assert!(serde_json::from_value::(address_unknown).is_err()); +} + +#[test] +fn schema_rejects_invalid_addresses_versions_states_and_generation_claims() { + let mut wrong_version = parse(FIXTURE); + wrong_version["schema_version"] = json!("registryctl.project_preflight.v2"); + assert_schema_invalid(&wrong_version); + + let mut absolute = parse(FIXTURE); + absolute["runtime_files"][0]["addresses"][0]["file"] = json!("/run/secrets/country.pem"); + assert_schema_invalid(&absolute); + + let mut invalid_pointer = parse(FIXTURE); + invalid_pointer["runtime_files"][0]["addresses"][0]["pointer"] = json!("/bad~escape"); + assert_schema_invalid(&invalid_pointer); + + let mut open_state = parse(FIXTURE); + open_state["runtime_files"][0]["state"] = json!("probably_available"); + assert_schema_invalid(&open_state); + + let mut inferred_generation = parse(FIXTURE); + inferred_generation["runtime_files"][1]["generation"] = json!("declared"); + assert_schema_invalid(&inferred_generation); +} + +#[test] +fn secret_missing_whitespace_and_present_states_never_expose_names_or_values() { + const MISSING_NAME: &str = "PREFLIGHT_SENTINEL_MISSING_NAME"; + const EMPTY_NAME: &str = "PREFLIGHT_SENTINEL_EMPTY_NAME"; + const PRESENT_NAME: &str = "PREFLIGHT_SENTINEL_PRESENT_NAME"; + const PRESENT_VALUE: &str = "PREFLIGHT_SENTINEL_SECRET_VALUE"; + + let mut input = validated_input(); + input + .add_secret_reference( + MISSING_NAME, + PreflightSecretConsumer::SourceBearerToken, + address( + "environments/production.yaml", + "/integrations/alpha/source/credential/token", + ), + ) + .expect("missing reference records"); + input + .add_secret_reference( + EMPTY_NAME, + PreflightSecretConsumer::IssuanceSigningKey, + address("environments/production.yaml", "/issuance/signing_key"), + ) + .expect("empty reference records"); + input + .add_secret_reference( + PRESENT_NAME, + PreflightSecretConsumer::CallerApiKeyFingerprint, + address( + "environments/production.yaml", + "/callers/health/api_key_fingerprint", + ), + ) + .expect("present reference records"); + let values = BTreeMap::from([ + (EMPTY_NAME.to_string(), OsString::from(" \t\n")), + (PRESENT_NAME.to_string(), OsString::from(PRESENT_VALUE)), + ]); + + let debug_input = format!("{input:?}"); + let report = run_with(input, &values); + let serialized = serde_json::to_string(&report).expect("report serializes"); + let debug_report = format!("{report:?}"); + for sentinel in [MISSING_NAME, EMPTY_NAME, PRESENT_NAME, PRESENT_VALUE] { + assert!(!debug_input.contains(sentinel)); + assert!(!serialized.contains(sentinel)); + assert!(!debug_report.contains(sentinel)); + } + assert_eq!( + report + .secret_checks + .iter() + .map(|check| check.state) + .collect::>(), + BTreeSet::from([ + PreflightCheckState::Available, + PreflightCheckState::Missing, + PreflightCheckState::Empty, + ]) + ); + assert_eq!(report.status, PreflightStatus::NotReady); +} + +#[test] +fn duplicate_secret_reference_is_looked_up_once_and_keeps_sorted_multi_addresses() { + const DUPLICATE_NAME: &str = "PREFLIGHT_DUPLICATE_REFERENCE"; + let mut input = validated_input(); + for (consumer, pointer) in [ + ( + PreflightSecretConsumer::SourceOauthClientSecret, + "/integrations/zeta/source/credential/client_secret", + ), + ( + PreflightSecretConsumer::SourceBearerToken, + "/integrations/alpha/source/credential/token", + ), + ( + PreflightSecretConsumer::SourceBearerToken, + "/integrations/alpha/source/credential/token", + ), + ] { + input + .add_secret_reference( + DUPLICATE_NAME, + consumer, + address("environments/production.yaml", pointer), + ) + .expect("duplicate reference records"); + } + let lookups = AtomicUsize::new(0); + let report = run_offline_preflight_with_secret_lookup(input, &|name: &str| { + assert_eq!(name, DUPLICATE_NAME); + lookups.fetch_add(1, Ordering::SeqCst); + None + }); + + assert_eq!(lookups.load(Ordering::SeqCst), 1); + assert_eq!(report.secret_checks.len(), 1); + assert_eq!(report.secret_checks[0].addresses.len(), 2); + assert_eq!(report.secret_checks[0].consumers.len(), 2); + assert!( + report.secret_checks[0].addresses[0] < report.secret_checks[0].addresses[1], + "addresses are canonical and sorted" + ); + let diagnostic = report + .diagnostics + .iter() + .find(|diagnostic| diagnostic.addresses.len() == 2) + .expect("one diagnostic carries the full shared identity"); + assert_eq!(diagnostic.addresses, report.secret_checks[0].addresses); +} + +#[cfg(unix)] +#[test] +fn runtime_files_close_missing_empty_regular_symlink_and_unsafe_modes() { + use std::os::unix::fs::{symlink, PermissionsExt as _}; + + let directory = tempfile::tempdir().expect("temporary directory"); + let regular = directory.path().join("regular.pem"); + let empty = directory.path().join("empty.pem"); + let unsafe_public = directory.path().join("unsafe-public.pem"); + let unsafe_private = directory.path().join("unsafe-private.token"); + let oversized = directory.path().join("oversized.pem"); + let symlink_path = directory.path().join("link.pem"); + let missing = directory.path().join("missing.pem"); + fs::write(®ular, b"certificate").expect("regular file writes"); + fs::write(&empty, b"").expect("empty file writes"); + fs::write(&unsafe_public, b"certificate").expect("unsafe public file writes"); + fs::write(&unsafe_private, b"token").expect("unsafe private file writes"); + fs::File::create(&oversized) + .expect("oversized file creates") + .set_len(1024 * 1024 + 1) + .expect("oversized file extends"); + fs::set_permissions(®ular, fs::Permissions::from_mode(0o600)).expect("regular mode sets"); + fs::set_permissions(&empty, fs::Permissions::from_mode(0o600)).expect("empty mode sets"); + fs::set_permissions(&unsafe_public, fs::Permissions::from_mode(0o666)) + .expect("unsafe public mode sets"); + fs::set_permissions(&unsafe_private, fs::Permissions::from_mode(0o640)) + .expect("unsafe private mode sets"); + fs::set_permissions(&oversized, fs::Permissions::from_mode(0o600)) + .expect("oversized mode sets"); + symlink(®ular, &symlink_path).expect("symlink creates"); + + let mut input = validated_input(); + for (path, kind, pointer) in [ + ( + regular.as_path(), + PreflightRuntimeFileKind::SourceCa, + "/integrations/regular/source/ca/file", + ), + ( + empty.as_path(), + PreflightRuntimeFileKind::SourceMtlsCertificate, + "/integrations/empty/source/mtls/certificate_file", + ), + ( + missing.as_path(), + PreflightRuntimeFileKind::SourceOauthCa, + "/integrations/missing/source/oauth/ca/file", + ), + ( + symlink_path.as_path(), + PreflightRuntimeFileKind::SourceJwksCa, + "/integrations/symlink/source/jwks/ca/file", + ), + ( + unsafe_public.as_path(), + PreflightRuntimeFileKind::RelayStateRootCertificate, + "/relay_state/postgresql/root_certificate_path", + ), + ( + unsafe_private.as_path(), + PreflightRuntimeFileKind::NotaryToRelayToken, + "/notary_relay/token_file", + ), + ( + oversized.as_path(), + PreflightRuntimeFileKind::SourceJwksMtlsCertificate, + "/integrations/oversized/source/jwks/mtls/certificate_file", + ), + ] { + input + .add_runtime_file(path, kind, address("environments/production.yaml", pointer)) + .expect("runtime file records"); + } + + let report = run_with(input, &BTreeMap::new()); + let states = report + .runtime_files + .iter() + .map(|check| (check.kind, check.state)) + .collect::>(); + assert_eq!( + states[&PreflightRuntimeFileKind::SourceCa], + PreflightCheckState::Available + ); + assert_eq!( + states[&PreflightRuntimeFileKind::SourceMtlsCertificate], + PreflightCheckState::Empty + ); + assert_eq!( + states[&PreflightRuntimeFileKind::SourceOauthCa], + PreflightCheckState::Missing + ); + assert_eq!( + states[&PreflightRuntimeFileKind::SourceJwksCa], + PreflightCheckState::NotRegular + ); + assert_eq!( + states[&PreflightRuntimeFileKind::RelayStateRootCertificate], + PreflightCheckState::UnsafeMode + ); + assert_eq!( + states[&PreflightRuntimeFileKind::NotaryToRelayToken], + PreflightCheckState::UnsafeMode + ); + assert_eq!( + states[&PreflightRuntimeFileKind::SourceJwksMtlsCertificate], + PreflightCheckState::NotRegular + ); +} + +#[cfg(unix)] +#[test] +fn public_trust_and_private_material_apply_distinct_unix_modes() { + use std::os::unix::fs::PermissionsExt as _; + + let directory = tempfile::tempdir().expect("temporary directory"); + let shared = directory.path().join("shared-material"); + fs::write(&shared, b"bounded material").expect("file writes"); + fs::set_permissions(&shared, fs::Permissions::from_mode(0o644)).expect("mode sets"); + + let mut input = validated_input(); + input + .add_runtime_file( + &shared, + PreflightRuntimeFileKind::SourceCa, + address( + "environments/production.yaml", + "/integrations/alpha/source/ca/file", + ), + ) + .expect("public trust records"); + input + .add_runtime_file( + &shared, + PreflightRuntimeFileKind::NotaryToRelayToken, + address("environments/production.yaml", "/notary_relay/token_file"), + ) + .expect("private material records"); + + let report = run_with(input, &BTreeMap::new()); + let states = report + .runtime_files + .iter() + .map(|check| (check.kind, check.state)) + .collect::>(); + assert_eq!( + states[&PreflightRuntimeFileKind::SourceCa], + PreflightCheckState::Available + ); + assert_eq!( + states[&PreflightRuntimeFileKind::NotaryToRelayToken], + PreflightCheckState::UnsafeMode + ); +} + +#[cfg(unix)] +#[test] +fn entity_provider_files_enforce_private_posture_and_relay_default_size_bound() { + use std::os::unix::fs::{symlink, PermissionsExt as _}; + + let directory = tempfile::tempdir().expect("temporary directory"); + let relay_sized = directory.path().join("relay-sized.csv"); + let shared = directory.path().join("shared.xlsx"); + let oversized = directory.path().join("oversized.parquet"); + let symlink_target = directory.path().join("target.parquet"); + let symlink_path = directory.path().join("link.parquet"); + fs::File::create(&relay_sized) + .expect("Relay-sized file creates") + .set_len(1024 * 1024 + 1) + .expect("Relay-sized file extends"); + fs::write(&shared, b"workbook").expect("shared file writes"); + fs::File::create(&oversized) + .expect("oversized entity file creates") + .set_len(256 * 1024 * 1024 + 1) + .expect("oversized entity file extends"); + fs::write(&symlink_target, b"parquet").expect("symlink target writes"); + fs::set_permissions(&relay_sized, fs::Permissions::from_mode(0o600)) + .expect("Relay-sized mode sets"); + fs::set_permissions(&shared, fs::Permissions::from_mode(0o644)).expect("shared mode sets"); + fs::set_permissions(&oversized, fs::Permissions::from_mode(0o600)) + .expect("oversized mode sets"); + fs::set_permissions(&symlink_target, fs::Permissions::from_mode(0o600)) + .expect("symlink target mode sets"); + symlink(&symlink_target, &symlink_path).expect("symlink creates"); + + let mut input = validated_input(); + for (path, kind, pointer) in [ + ( + relay_sized.as_path(), + PreflightRuntimeFileKind::EntityCsv, + "/entities/csv/provider/path", + ), + ( + shared.as_path(), + PreflightRuntimeFileKind::EntityXlsx, + "/entities/xlsx/provider/path", + ), + ( + oversized.as_path(), + PreflightRuntimeFileKind::EntityParquet, + "/entities/oversized/provider/path", + ), + ( + symlink_path.as_path(), + PreflightRuntimeFileKind::EntityParquet, + "/entities/symlink/provider/path", + ), + ] { + input + .add_runtime_file(path, kind, address("environments/production.yaml", pointer)) + .expect("entity provider file records"); + } + + let report = run_with(input, &BTreeMap::new()); + let states = report + .runtime_files + .iter() + .map(|check| (check.addresses[0].pointer.as_str(), check.state)) + .collect::>(); + assert_eq!( + states["/entities/csv/provider/path"], + PreflightCheckState::Available, + "entity files may use Relay's larger default source-file bound" + ); + assert_eq!( + states["/entities/xlsx/provider/path"], + PreflightCheckState::UnsafeMode, + "entity files are private material" + ); + assert_eq!( + states["/entities/oversized/provider/path"], + PreflightCheckState::NotRegular + ); + assert_eq!( + states["/entities/symlink/provider/path"], + PreflightCheckState::NotRegular + ); +} + +#[cfg(unix)] +#[test] +fn undeclared_generations_are_never_inferred_for_state_roots_or_workload_token() { + use std::os::unix::fs::PermissionsExt as _; + + let directory = tempfile::tempdir().expect("temporary directory"); + let path = directory.path().join("material"); + fs::write(&path, b"material").expect("file writes"); + fs::set_permissions(&path, fs::Permissions::from_mode(0o600)).expect("mode sets"); + + let mut input = validated_input(); + for (kind, pointer) in [ + ( + PreflightRuntimeFileKind::SourceCa, + "/integrations/alpha/source/ca/file", + ), + ( + PreflightRuntimeFileKind::RelayStateRootCertificate, + "/relay_state/postgresql/root_certificate_path", + ), + ( + PreflightRuntimeFileKind::NotaryStateRootCertificate, + "/notary_state/postgresql/root_certificate_path", + ), + ( + PreflightRuntimeFileKind::NotaryToRelayToken, + "/notary_relay/token_file", + ), + ] { + input + .add_runtime_file( + &path, + kind, + address("environments/production.yaml", pointer), + ) + .expect("runtime file records"); + } + + let report = run_with(input, &BTreeMap::new()); + let generations = report + .runtime_files + .iter() + .map(|check| (check.kind, check.generation)) + .collect::>(); + assert_eq!( + generations[&PreflightRuntimeFileKind::SourceCa], + PreflightGenerationState::Declared + ); + for kind in [ + PreflightRuntimeFileKind::RelayStateRootCertificate, + PreflightRuntimeFileKind::NotaryStateRootCertificate, + PreflightRuntimeFileKind::NotaryToRelayToken, + ] { + assert_eq!(generations[&kind], PreflightGenerationState::NotDeclared); + } +} + +#[test] +fn offline_boundary_has_no_network_or_external_process_surface() { + let authored_endpoints = [ + "https://source.country.invalid", + "https://issuer.country.invalid/jwks", + "https://relay.country.invalid", + ]; + assert!(authored_endpoints + .iter() + .all(|endpoint| endpoint.contains(".invalid"))); + + let source = include_str!("../src/project_authoring/preflight.rs"); + for forbidden_surface in [ + "TcpStream", + "ToSocketAddrs", + "ureq::", + "reqwest::", + "Command::new", + "std::process", + ] { + assert!( + !source.contains(forbidden_surface), + "offline preflight must not gain the {forbidden_surface} surface" + ); + } + + let report = run_with(validated_input(), &BTreeMap::new()); + assert_eq!(report.execution.contact, PreflightContact::None); + assert_eq!( + report.execution.network, + PreflightAttemptState::NotAttempted + ); + assert_eq!( + report.execution.live_reachability, + PreflightAttemptState::NotAttempted + ); + assert_eq!( + report.execution.external_processes, + PreflightAttemptState::NotAttempted + ); +} + +#[test] +fn command_adapter_keeps_invalid_endpoints_offline_and_has_no_build_side_effects() { + const SECRET_NAMES: [&str; 4] = [ + "PREFLIGHT_COMMAND_CLIENT_ID", + "PREFLIGHT_COMMAND_CLIENT_SECRET", + "PREFLIGHT_COMMAND_ISSUER_KEY", + "PREFLIGHT_COMMAND_CALLER_FINGERPRINT", + ]; + let directory = tempfile::tempdir().expect("temporary directory"); + let project = directory.path().join("project"); + copy_tree( + Path::new(env!("CARGO_MANIFEST_DIR")) + .join("tests/fixtures/project-authoring/opencrvs") + .as_path(), + &project, + ); + let environment_file = project.join("environments/local.yaml"); + let original = fs::read_to_string(&environment_file).expect("environment reads"); + let missing_token = directory.path().join("missing-workload-token"); + let authored = original + .replace("CIVIL_REGISTRY_CLIENT_ID", SECRET_NAMES[0]) + .replace("CIVIL_REGISTRY_CLIENT_SECRET", SECRET_NAMES[1]) + .replace("REGISTRY_NOTARY_ISSUER_JWK", SECRET_NAMES[2]) + .replace("BIRTH_VERIFIER_TOKEN_HASH", SECRET_NAMES[3]) + .replace( + "/run/secrets/relay-workload-token", + missing_token.to_str().expect("temporary path is UTF-8"), + ); + fs::write(&environment_file, authored).expect("environment writes"); + let fixture_path = project.join("integrations/birth-record/fixtures/match.yaml"); + let fixture_before = fs::read(&fixture_path).expect("fixture reads"); + + let report = registryctl::preflight_registry_project(®istryctl::ProjectPreflightOptions { + project_directory: project.clone(), + environment: "local".to_string(), + }) + .expect("offline preflight returns a closed report"); + let serialized = serde_json::to_string(&report).expect("report serializes"); + + assert_eq!(report.secret_checks.len(), SECRET_NAMES.len()); + assert_eq!(report.runtime_files.len(), 1); + assert_eq!( + report.runtime_files[0].state, + registryctl::PreflightCheckState::Missing + ); + assert_eq!( + report.execution.network, + registryctl::PreflightAttemptState::NotAttempted + ); + assert_eq!( + report.execution.fixture_execution, + registryctl::PreflightAttemptState::NotAttempted + ); + assert_eq!( + report.execution.build_output, + registryctl::PreflightWriteState::NotWritten + ); + assert!(!project.join(".registry-stack").exists()); + assert_eq!( + fs::read(&fixture_path).expect("fixture rereads"), + fixture_before + ); + for forbidden in SECRET_NAMES.into_iter().chain([ + "https://civil-registry.invalid", + "https://identity.civil-registry.invalid", + "https://trust.civil-registry.invalid", + missing_token.to_str().expect("temporary path is UTF-8"), + ]) { + assert!( + !serialized.contains(forbidden), + "report must not expose {forbidden}" + ); + } +} + +#[cfg(unix)] +#[test] +fn command_adapter_checks_csv_xlsx_and_parquet_entity_provider_paths() { + use std::os::unix::fs::PermissionsExt as _; + + for (provider_type, extension, kind) in [ + ( + "csv", + "csv", + registryctl::PreflightRuntimeFileKind::EntityCsv, + ), + ( + "xlsx", + "xlsx", + registryctl::PreflightRuntimeFileKind::EntityXlsx, + ), + ( + "parquet", + "parquet", + registryctl::PreflightRuntimeFileKind::EntityParquet, + ), + ] { + let directory = tempfile::tempdir().expect("temporary directory"); + let project = directory.path().join(format!("{provider_type}-project")); + copy_tree( + Path::new(env!("CARGO_MANIFEST_DIR")) + .join("tests/fixtures/project-authoring/relay-only-materialization") + .as_path(), + &project, + ); + let provider_path = directory.path().join(format!("people.{extension}")); + let provider = match provider_type { + "csv" => format!( + "{{ type: csv, path: {}, header_row: 1 }}", + provider_path.display() + ), + "xlsx" => format!( + "{{ type: xlsx, path: {}, sheet: People, header_row: 1 }}", + provider_path.display() + ), + "parquet" => format!("{{ type: parquet, path: {} }}", provider_path.display()), + _ => unreachable!("provider table is closed"), + }; + let environment_file = project.join("environments/local.yaml"); + let original = fs::read_to_string(&environment_file).expect("environment reads"); + let authored = original.replace( + " provider: { type: csv, path: /var/lib/registry/people.csv, header_row: 1 }", + &format!(" provider: {provider}"), + ); + assert_ne!(authored, original, "provider fixture replacement applies"); + fs::write(&environment_file, authored).expect("environment writes"); + + let options = registryctl::ProjectPreflightOptions { + project_directory: project, + environment: "local".to_string(), + }; + let missing = + registryctl::preflight_registry_project(&options).expect("missing preflight reports"); + assert_eq!(missing.status, registryctl::PreflightStatus::NotReady); + assert_eq!(missing.runtime_files.len(), 1); + assert_eq!(missing.runtime_files[0].kind, kind); + assert_eq!( + missing.runtime_files[0].generation, + registryctl::PreflightGenerationState::Declared + ); + assert_eq!( + missing.runtime_files[0].state, + registryctl::PreflightCheckState::Missing + ); + assert_eq!(missing.runtime_files[0].addresses.len(), 1); + assert_eq!( + missing.runtime_files[0].addresses[0].file.as_str(), + "environments/local.yaml" + ); + assert_eq!( + missing.runtime_files[0].addresses[0].pointer.as_str(), + "/entities/people/provider/path" + ); + assert!(missing.diagnostics.iter().any(|diagnostic| { + diagnostic.code == registryctl::PreflightDiagnosticCode::RuntimeFileMissing + && diagnostic.addresses == missing.runtime_files[0].addresses + })); + assert_schema_valid(&serde_json::to_value(&missing).expect("missing report serializes")); + + fs::write(&provider_path, b"bounded entity data").expect("provider file writes"); + fs::set_permissions(&provider_path, fs::Permissions::from_mode(0o600)) + .expect("provider mode sets"); + let available = + registryctl::preflight_registry_project(&options).expect("available preflight reports"); + assert_eq!(available.status, registryctl::PreflightStatus::Ready); + assert_eq!(available.runtime_files.len(), 1); + assert_eq!(available.runtime_files[0].kind, kind); + assert_eq!( + available.runtime_files[0].state, + registryctl::PreflightCheckState::Available + ); + assert!(available.diagnostics.is_empty()); + assert_schema_valid( + &serde_json::to_value(&available).expect("available report serializes"), + ); + } +} + +#[cfg(unix)] +#[test] +fn preflight_reads_only_declared_runtime_files_and_has_no_fixture_or_build_side_effects() { + use std::os::unix::fs::PermissionsExt as _; + + let directory = tempfile::tempdir().expect("temporary directory"); + let fixture = directory.path().join("fixture.yaml"); + let build_marker = directory.path().join("build-output.json"); + let runtime = directory.path().join("declared.pem"); + fs::write(&fixture, b"fixture sentinel").expect("fixture writes"); + fs::write(&build_marker, b"build sentinel").expect("build marker writes"); + fs::write(&runtime, b"certificate").expect("runtime file writes"); + fs::set_permissions(&runtime, fs::Permissions::from_mode(0o600)).expect("mode sets"); + let before = directory_snapshot(directory.path()); + + let mut input = validated_input(); + input + .add_runtime_file( + &runtime, + PreflightRuntimeFileKind::SourceCa, + address( + "environments/production.yaml", + "/integrations/alpha/source/ca/file", + ), + ) + .expect("runtime file records"); + let report = run_with(input, &BTreeMap::new()); + + assert_eq!(directory_snapshot(directory.path()), before); + assert_eq!( + fs::read(&fixture).expect("fixture reads"), + b"fixture sentinel" + ); + assert_eq!( + fs::read(&build_marker).expect("build marker reads"), + b"build sentinel" + ); + assert_eq!( + report.execution.fixture_execution, + PreflightAttemptState::NotAttempted + ); + assert_eq!( + report.execution.build_output, + PreflightWriteState::NotWritten + ); +} + +#[test] +fn reports_are_deterministic_capped_and_keep_cross_file_identity() { + let mut ascending = validated_input(); + let mut descending = validated_input(); + let mut requirements = (0..MAX_PREFLIGHT_CHECKS + 17) + .map(|index| { + ( + format!("PREFLIGHT_SECRET_{index:03}"), + address( + if index % 2 == 0 { + "environments/production.yaml" + } else { + "integrations/alpha/integration.yaml" + }, + &format!("/references/{index:03}"), + ), + ) + }) + .collect::>(); + for (name, field) in &requirements { + ascending + .add_secret_reference( + name.clone(), + PreflightSecretConsumer::SourceBearerToken, + field.clone(), + ) + .expect("ascending reference records"); + } + requirements.reverse(); + for (name, field) in &requirements { + descending + .add_secret_reference( + name.clone(), + PreflightSecretConsumer::SourceBearerToken, + field.clone(), + ) + .expect("descending reference records"); + } + + let left = run_with(ascending, &BTreeMap::new()); + let right = run_with(descending, &BTreeMap::new()); + assert_eq!( + serde_json::to_value(&left).expect("left serializes"), + serde_json::to_value(&right).expect("right serializes") + ); + assert_eq!(left.secret_checks.len(), MAX_PREFLIGHT_CHECKS); + assert!(left.diagnostics.len() <= MAX_PREFLIGHT_DIAGNOSTICS); + assert!(left.limits.truncated); + assert_eq!(left.status, PreflightStatus::NotReady); + assert!(left + .diagnostics + .iter() + .any(|diagnostic| { diagnostic.code == PreflightDiagnosticCode::ReportCapacityExceeded })); + assert!(left + .secret_checks + .iter() + .flat_map(|check| &check.addresses) + .any(|field| field.file.as_str() == "integrations/alpha/integration.yaml")); +} + +#[test] +fn all_declared_secret_consumer_classes_have_a_closed_report_identity() { + let consumers = [ + PreflightSecretConsumer::SourceBasicUsername, + PreflightSecretConsumer::SourceBasicPassword, + PreflightSecretConsumer::SourceBearerToken, + PreflightSecretConsumer::SourceOauthClientId, + PreflightSecretConsumer::SourceOauthClientSecret, + PreflightSecretConsumer::SourceApiKeyValue, + PreflightSecretConsumer::SourceMtlsPrivateKey, + PreflightSecretConsumer::SourceOauthMtlsPrivateKey, + PreflightSecretConsumer::SourceJwksMtlsPrivateKey, + PreflightSecretConsumer::EntityPostgresConnection, + PreflightSecretConsumer::IssuanceSigningKey, + PreflightSecretConsumer::CallerApiKeyFingerprint, + PreflightSecretConsumer::Oid4vciClientSigningKey, + PreflightSecretConsumer::Oid4vciAccessTokenSigningKey, + PreflightSecretConsumer::Oid4vciSensitiveStateKey, + ]; + assert_eq!(consumers.len(), 15); + let serialized = consumers + .iter() + .map(|consumer| serde_json::to_string(consumer).expect("consumer serializes")) + .collect::>(); + assert_eq!(serialized.len(), consumers.len()); + assert!(!serialized.iter().any(|value| value.contains("image"))); +} + +#[test] +fn invalid_addresses_and_runtime_paths_fail_without_echoing_values() { + for (file, pointer) in [ + ("/absolute/environment.yaml", ""), + ("../environment.yaml", ""), + ("environments/local.yaml", "not-a-pointer"), + ("environments/local.yaml", "/bad~escape"), + ] { + let error = PreflightFieldAddress::new(file, pointer).expect_err("address fails closed"); + let rendered = format!("{error:?} {error}"); + assert!(!rendered.contains(file)); + if !pointer.is_empty() { + assert!(!rendered.contains(pointer)); + } + } + + let mut input = validated_input(); + let unsafe_path = "/tmp/../host-sensitive-file"; + let error = input + .add_runtime_file( + unsafe_path, + PreflightRuntimeFileKind::SourceCa, + address( + "environments/production.yaml", + "/integrations/alpha/source/ca/file", + ), + ) + .expect_err("runtime path fails closed"); + let rendered = format!("{error:?} {error}"); + assert!(!rendered.contains(unsafe_path)); +} + +fn directory_snapshot(directory: &Path) -> BTreeMap> { + fs::read_dir(directory) + .expect("directory reads") + .map(|entry| { + let entry = entry.expect("entry reads"); + let name = entry.file_name().into_string().expect("test name is UTF-8"); + let bytes = if entry.file_type().expect("file type reads").is_file() { + fs::read(entry.path()).expect("file reads") + } else { + Vec::new() + }; + (name, bytes) + }) + .collect() +} + +fn copy_tree(source: &Path, destination: &Path) { + fs::create_dir_all(destination).expect("destination creates"); + for entry in fs::read_dir(source).expect("source directory reads") { + let entry = entry.expect("source entry reads"); + let destination_path = destination.join(entry.file_name()); + if entry.file_type().expect("source file type reads").is_dir() { + copy_tree(&entry.path(), &destination_path); + } else { + fs::copy(entry.path(), destination_path).expect("source file copies"); + } + } +} diff --git a/crates/registryctl/tests/project_promotion_command.rs b/crates/registryctl/tests/project_promotion_command.rs new file mode 100644 index 000000000..39f877480 --- /dev/null +++ b/crates/registryctl/tests/project_promotion_command.rs @@ -0,0 +1,750 @@ +// SPDX-License-Identifier: Apache-2.0 + +use std::path::{Path, PathBuf}; +use std::process::Command; + +use registryctl::{ + add_config_anchor_key, build_registry_project_with_context, init_config_anchor, + init_registry_project, promote_registry_project, sign_config_bundle, BundleSignOptions, + ProjectBuildOptions, ProjectExecutionContext, ProjectInitOptions, ProjectPromotionOptions, + ProjectPromotionReportV1, ProjectStarter, PromotionBlockingReason, PromotionChangeEffect, + PromotionChangeKind, PromotionCompatibilityComponent, PromotionCompatibilityState, + PromotionDisposition, PromotionProductAction, ReviewedCeilingAssessment, + ReviewedRevisionComparison, TrustResolutionAssessment, +}; + +const TEST_PRIVATE_JWK: &str = r#"{"kty":"OKP","crv":"Ed25519","d":"2oPoxdKuO7Kpd-3JLfNW_4xwpFxItbS-fxe03ZybYEw","x":"1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc","alg":"EdDSA","kid":"registryctl-test-private-key"}"#; +const TEST_PUBLIC_JWK: &str = r#"{"kty":"OKP","crv":"Ed25519","x":"1aj_rLJsGFgw-5v925EMmeZj5JqP44xegafEKfZbdxc","alg":"EdDSA","kid":"registryctl-test-private-key"}"#; +const PROMOTION_SCHEMA: &str = + include_str!("../schemas/project-reports/registry.project.promotion.v1.schema.json"); + +#[derive(Clone)] +struct SignedProductBaseline { + bundle: PathBuf, + anchor: PathBuf, +} + +struct SignedBaselines { + relay: SignedProductBaseline, + notary: SignedProductBaseline, +} + +fn write(path: &Path, contents: &str) { + std::fs::write(path, contents).expect("test file writes"); +} + +fn build_project_output(project: &Path) -> PathBuf { + let context = ProjectExecutionContext::new(env!("CARGO_BIN_EXE_registryctl")) + .expect("Cargo provides the exact registryctl executable"); + let build = build_registry_project_with_context( + &ProjectBuildOptions { + project_directory: project.to_path_buf(), + environment: "local".to_owned(), + against: None, + anchor: None, + }, + &context, + ) + .expect("baseline project builds"); + let reported = build.output.expect("build output is reported"); + let relative = Path::new(&reported); + assert!(!relative.is_absolute()); + project.join(relative) +} + +fn sign_product_baseline( + output: &Path, + temporary: &Path, + product: &str, + product_directory: &str, + suffix: &str, +) -> SignedProductBaseline { + let private_key = temporary.join(format!("promotion-{suffix}-private.jwk")); + let public_key = temporary.join(format!("promotion-{suffix}-public.jwk")); + let anchor = temporary.join(format!("promotion-{suffix}-anchor.json")); + let bundle = temporary.join(format!("promotion-{suffix}-baseline")); + write(&private_key, TEST_PRIVATE_JWK); + write(&public_key, TEST_PUBLIC_JWK); + init_config_anchor( + &anchor, + product.to_owned(), + "local".to_owned(), + format!("promotion-{suffix}"), + format!("promotion-{suffix}-instance"), + ) + .expect("anchor initializes"); + add_config_anchor_key(&anchor, &public_key, true).expect("anchor key adds"); + sign_config_bundle(BundleSignOptions { + input: output.join("private").join(product_directory), + key: private_key.display().to_string(), + product: product.to_owned(), + environment: "local".to_owned(), + stream_id: format!("promotion-{suffix}"), + instance_id: Some(format!("promotion-{suffix}-instance")), + sequence: 1, + bundle_id: format!("promotion-{suffix}-baseline"), + out: bundle.clone(), + }) + .expect("baseline bundle signs"); + SignedProductBaseline { bundle, anchor } +} + +fn signed_baselines(project: &Path, temporary: &Path) -> SignedBaselines { + let output = build_project_output(project); + SignedBaselines { + relay: sign_product_baseline(&output, temporary, "registry-relay", "relay", "relay"), + notary: sign_product_baseline(&output, temporary, "registry-notary", "notary", "notary"), + } +} + +fn promotion_options(project: &Path, baselines: &SignedBaselines) -> ProjectPromotionOptions { + ProjectPromotionOptions { + project_directory: project.to_path_buf(), + environment: "local".to_owned(), + against: None, + anchor: None, + relay_against: Some(baselines.relay.bundle.clone()), + relay_anchor: Some(baselines.relay.anchor.clone()), + notary_against: Some(baselines.notary.bundle.clone()), + notary_anchor: Some(baselines.notary.anchor.clone()), + } +} + +fn legacy_promotion_options( + project: &Path, + baseline: &SignedProductBaseline, +) -> ProjectPromotionOptions { + ProjectPromotionOptions { + project_directory: project.to_path_buf(), + environment: "local".to_owned(), + against: Some(baseline.bundle.clone()), + anchor: Some(baseline.anchor.clone()), + relay_against: None, + relay_anchor: None, + notary_against: None, + notary_anchor: None, + } +} + +fn run_promote(project: &Path, baselines: &SignedBaselines, format: &str) -> std::process::Output { + Command::new(env!("CARGO_BIN_EXE_registryctl")) + .args([ + "promote", + "--project-dir", + project.to_str().expect("project path is UTF-8"), + "--environment", + "local", + "--relay-against", + baselines + .relay + .bundle + .to_str() + .expect("Relay bundle path is UTF-8"), + "--relay-anchor", + baselines + .relay + .anchor + .to_str() + .expect("Relay anchor path is UTF-8"), + "--notary-against", + baselines + .notary + .bundle + .to_str() + .expect("Notary bundle path is UTF-8"), + "--notary-anchor", + baselines + .notary + .anchor + .to_str() + .expect("Notary anchor path is UTF-8"), + "--format", + format, + ]) + .env("REGISTRYCTL_NO_UPDATE_CHECK", "1") + .output() + .expect("registryctl promote runs") +} + +fn run_promote_legacy( + project: &Path, + baseline: &SignedProductBaseline, + format: &str, +) -> std::process::Output { + Command::new(env!("CARGO_BIN_EXE_registryctl")) + .args([ + "promote", + "--project-dir", + project.to_str().expect("project path is UTF-8"), + "--environment", + "local", + "--against", + baseline.bundle.to_str().expect("bundle path is UTF-8"), + "--anchor", + baseline.anchor.to_str().expect("anchor path is UTF-8"), + "--format", + format, + ]) + .env("REGISTRYCTL_NO_UPDATE_CHECK", "1") + .output() + .expect("registryctl promote runs") +} + +fn run_check_legacy(project: &Path, baseline: &SignedProductBaseline) -> std::process::Output { + Command::new(env!("CARGO_BIN_EXE_registryctl")) + .args([ + "check", + "--project-dir", + project.to_str().expect("project path is UTF-8"), + "--environment", + "local", + "--against", + baseline.bundle.to_str().expect("bundle path is UTF-8"), + "--anchor", + baseline.anchor.to_str().expect("anchor path is UTF-8"), + "--format", + "json", + ]) + .env("REGISTRYCTL_NO_UPDATE_CHECK", "1") + .output() + .expect("registryctl check runs") +} + +fn copy_tree(source: &Path, destination: &Path) { + std::fs::create_dir_all(destination).expect("destination directory creates"); + for entry in std::fs::read_dir(source).expect("source directory reads") { + let entry = entry.expect("directory entry reads"); + let source_path = entry.path(); + let destination_path = destination.join(entry.file_name()); + if entry.file_type().expect("entry type reads").is_dir() { + copy_tree(&source_path, &destination_path); + } else { + std::fs::copy(&source_path, &destination_path).expect("fixture file copies"); + } + } +} + +fn assert_conservative_blocked_report(report: &ProjectPromotionReportV1, forbidden: &[&str]) { + assert_eq!(report.disposition, PromotionDisposition::Blocked); + assert_eq!( + report.reviewed_revision, + ReviewedRevisionComparison::NotProven + ); + assert!(report.changes.is_empty()); + assert_eq!( + report.reviewed_ceiling, + ReviewedCeilingAssessment::UnresolvedBlocked + ); + assert_eq!(report.trust, TrustResolutionAssessment::UnresolvedBlocked); + assert_eq!( + report + .compatibility + .iter() + .map(|assessment| (assessment.component, assessment.state)) + .collect::>(), + vec![ + ( + PromotionCompatibilityComponent::Product, + PromotionCompatibilityState::Unresolved, + ), + ( + PromotionCompatibilityComponent::Capability, + PromotionCompatibilityState::Unresolved, + ), + ( + PromotionCompatibilityComponent::Schema, + PromotionCompatibilityState::Unresolved, + ), + ( + PromotionCompatibilityComponent::Abi, + PromotionCompatibilityState::Unresolved, + ), + ] + ); + for reason in [ + PromotionBlockingReason::ReviewedRevisionNotProven, + PromotionBlockingReason::ComparisonEvidenceIncomplete, + PromotionBlockingReason::ReviewedCeilingUnresolved, + PromotionBlockingReason::TrustUnresolved, + PromotionBlockingReason::CompatibilityUnresolved, + ] { + assert!( + report.blocking_reasons.contains(&reason), + "blocked report lacks {reason:?}" + ); + } + assert!(report.required_actions.review_classes.is_empty()); + assert_eq!( + report.required_actions.re_sign, + PromotionProductAction::None + ); + assert_eq!( + report.required_actions.reactivate, + PromotionProductAction::None + ); + assert_eq!( + report.required_actions.restart, + PromotionProductAction::None + ); + + let document = serde_json::to_value(report).expect("blocked report serializes"); + let schema: serde_json::Value = + serde_json::from_str(PROMOTION_SCHEMA).expect("promotion schema parses"); + let validator = jsonschema::JSONSchema::options() + .with_draft(jsonschema::Draft::Draft202012) + .compile(&schema) + .expect("promotion schema compiles"); + if let Err(errors) = validator.validate(&document) { + let details = errors.map(|error| error.to_string()).collect::>(); + panic!("blocked report must validate against the promotion schema: {details:?}"); + } + let serialized = serde_json::to_string(&document).expect("blocked report JSON serializes"); + let reparsed: ProjectPromotionReportV1 = + serde_json::from_str(&serialized).expect("blocked report decision evidence validates"); + assert_eq!(&reparsed, report); + for sentinel in forbidden { + assert!( + !serialized.contains(sentinel), + "blocked report must not contain {sentinel:?}" + ); + } +} + +fn assert_conservative_blocked_cli(output: &std::process::Output, forbidden: &[&str]) { + assert_eq!( + output.status.code(), + Some(1), + "{}", + String::from_utf8_lossy(&output.stderr) + ); + assert!( + output.stderr.is_empty(), + "{}", + String::from_utf8_lossy(&output.stderr) + ); + let report: ProjectPromotionReportV1 = + serde_json::from_slice(&output.stdout).expect("blocked CLI JSON parses"); + assert_conservative_blocked_report(&report, forbidden); + + let stdout = String::from_utf8_lossy(&output.stdout); + let stderr = String::from_utf8_lossy(&output.stderr); + for sentinel in forbidden { + assert!( + !stdout.contains(sentinel) && !stderr.contains(sentinel), + "blocked CLI output must not contain {sentinel:?}" + ); + } +} + +#[test] +fn promotion_requires_a_verified_reviewed_baseline_without_exposing_project_values() { + const SECRET_REFERENCE_SENTINEL: &str = "COUNTRY_SECRET_SENTINEL"; + + let temporary = tempfile::tempdir().expect("temporary directory creates"); + let project = temporary.path().join("country-promotion-project"); + init_registry_project(&ProjectInitOptions { + starter: ProjectStarter::Http, + directory: project.clone(), + }) + .expect("starter initializes"); + let environment_path = project.join("environments/local.yaml"); + let environment = std::fs::read_to_string(&environment_path).expect("environment reads"); + assert!(environment.contains("FICTIONAL_REGISTRY_TOKEN")); + let environment = environment.replace("FICTIONAL_REGISTRY_TOKEN", SECRET_REFERENCE_SENTINEL); + assert!(environment.contains(SECRET_REFERENCE_SENTINEL)); + write(&environment_path, &environment); + + let report = promote_registry_project(&ProjectPromotionOptions { + project_directory: project, + environment: "local".to_owned(), + against: None, + anchor: None, + relay_against: None, + relay_anchor: None, + notary_against: None, + notary_anchor: None, + }) + .expect("offline promotion report builds"); + + assert_eq!(report.disposition, PromotionDisposition::Blocked); + assert!(report + .blocking_reasons + .contains(&PromotionBlockingReason::ReviewedRevisionNotProven)); + assert!(report + .blocking_reasons + .contains(&PromotionBlockingReason::TrustUnresolved)); + + let serialized = serde_json::to_string(&report).expect("promotion report serializes"); + for sentinel in [ + "country-promotion-project", + SECRET_REFERENCE_SENTINEL, + temporary.path().to_str().expect("temporary path is UTF-8"), + ] { + assert!( + !serialized.contains(sentinel), + "promotion report must not contain {sentinel:?}" + ); + } +} + +#[test] +fn verified_baseline_supports_safe_actions_and_cli_exit_and_format_contracts() { + let temporary = tempfile::tempdir().expect("temporary directory creates"); + let project = temporary.path().join("promotion-project"); + init_registry_project(&ProjectInitOptions { + starter: ProjectStarter::Http, + directory: project.clone(), + }) + .expect("starter initializes"); + let baselines = signed_baselines(&project, temporary.path()); + + let unchanged = run_promote(&project, &baselines, "json"); + assert_eq!( + unchanged.status.code(), + Some(0), + "{}", + String::from_utf8_lossy(&unchanged.stderr) + ); + let unchanged_json: serde_json::Value = + serde_json::from_slice(&unchanged.stdout).expect("unchanged JSON output parses"); + assert_eq!(unchanged_json["disposition"], "ready"); + + let project_path = project.join("registry-stack.yaml"); + let baseline_project = std::fs::read_to_string(&project_path).expect("project reads"); + let changed_purpose = baseline_project.replace( + "purpose: public-service-person-verification", + "purpose: reviewed-public-service-person-verification", + ); + write(&project_path, &changed_purpose); + let purpose = promote_registry_project(&promotion_options(&project, &baselines)) + .expect("purpose change compares"); + assert_eq!( + purpose.disposition, + PromotionDisposition::ReadyAfterRequiredActions + ); + assert_eq!(purpose.changes.len(), 1); + assert_eq!(purpose.changes[0].kind, PromotionChangeKind::Purpose); + assert_eq!( + purpose.required_actions.re_sign, + PromotionProductAction::Notary + ); + assert_eq!( + purpose.required_actions.reactivate, + PromotionProductAction::Notary + ); + assert_eq!( + purpose.required_actions.restart, + PromotionProductAction::Notary + ); + write(&project_path, &baseline_project); + + let environment_path = project.join("environments/local.yaml"); + let environment = std::fs::read_to_string(&environment_path) + .expect("environment reads") + .replace( + "https://citizen-registry.invalid", + "https://reviewed-registry.invalid", + ); + write(&environment_path, &environment); + let changed = promote_registry_project(&promotion_options(&project, &baselines)) + .expect("safe origin change compares"); + assert_eq!( + changed.disposition, + PromotionDisposition::ReadyAfterRequiredActions + ); + assert_eq!(changed.changes.len(), 1); + assert_eq!(changed.changes[0].kind, PromotionChangeKind::Origin); + assert_eq!( + changed.changes[0].effect, + PromotionChangeEffect::ChangedWithinReviewedAuthority + ); + assert_eq!( + changed.required_actions.re_sign, + PromotionProductAction::Relay + ); + assert_eq!( + changed.required_actions.reactivate, + PromotionProductAction::Relay + ); + assert_eq!( + changed.required_actions.restart, + PromotionProductAction::Relay + ); + + let changed_json = run_promote(&project, &baselines, "json"); + assert_eq!(changed_json.status.code(), Some(0)); + let changed_json: serde_json::Value = + serde_json::from_slice(&changed_json.stdout).expect("changed JSON output parses"); + assert_eq!(changed_json["disposition"], "ready_after_required_actions"); + assert_eq!(changed_json["required_actions"]["re_sign"], "relay"); + assert_eq!(changed_json["required_actions"]["restart"], "relay"); + assert_eq!(changed_json["required_actions"]["reactivate"], "relay"); + + let changed_human = run_promote(&project, &baselines, "human"); + assert_eq!( + changed_human.status.code(), + Some(0), + "{}", + String::from_utf8_lossy(&changed_human.stderr) + ); + let human = String::from_utf8(changed_human.stdout).expect("human output is UTF-8"); + assert!(human.contains("Promotion: ReadyAfterRequiredActions")); + assert!(human.contains("Origin: ChangedWithinReviewedAuthority")); + assert!(human.contains("Re-sign: Relay")); + assert!(human.contains("restart: Relay")); + assert!(human.contains("reactivate: Relay")); + + let authored = std::fs::read_to_string(&project_path) + .expect("project reads") + .replace( + "scopes: [\"evidence:person:read\"]", + "scopes: [\"evidence:person:read\", \"evidence:person:admin\"]", + ); + write(&project_path, &authored); + let environment = std::fs::read_to_string(&environment_path) + .expect("environment rereads") + .replace( + "scopes: [\"evidence:person:read\"]", + "scopes: [\"evidence:person:read\", \"evidence:person:admin\"]", + ); + write(&environment_path, &environment); + + let blocked = run_promote(&project, &baselines, "json"); + assert_eq!(blocked.status.code(), Some(1)); + let blocked_json: serde_json::Value = + serde_json::from_slice(&blocked.stdout).expect("blocked JSON output parses"); + assert_eq!(blocked_json["disposition"], "blocked"); + assert!(blocked_json["blocking_reasons"] + .as_array() + .expect("blocking reasons are an array") + .iter() + .any(|reason| reason == "policy_widening")); + + let blocked_human = run_promote(&project, &baselines, "human"); + assert_eq!(blocked_human.status.code(), Some(1)); + let blocked_human = + String::from_utf8(blocked_human.stdout).expect("blocked human output is UTF-8"); + assert!(blocked_human.contains("Promotion: Blocked")); + assert!(blocked_human.contains("PolicyWidening")); + assert!(blocked_human.contains("Widened")); +} + +#[test] +fn combined_topology_requires_separate_product_owned_baselines() { + let temporary = tempfile::tempdir().expect("temporary directory creates"); + let project = temporary.path().join("combined-promotion-project"); + init_registry_project(&ProjectInitOptions { + starter: ProjectStarter::Http, + directory: project.clone(), + }) + .expect("starter initializes"); + let baselines = signed_baselines(&project, temporary.path()); + let temporary_path = temporary.path().to_str().expect("temporary path is UTF-8"); + let forbidden = [ + "combined-promotion-project", + "fictional-citizen-registry", + "FICTIONAL_REGISTRY_TOKEN", + "https://citizen-registry.invalid", + "public-service-person-verification", + "promotion-notary-baseline", + temporary_path, + ]; + + let missing_relay = run_promote_legacy(&project, &baselines.notary, "json"); + assert_conservative_blocked_cli(&missing_relay, &forbidden); + + let wrong_owner = promote_registry_project(&ProjectPromotionOptions { + project_directory: project.clone(), + environment: "local".to_owned(), + against: None, + anchor: None, + relay_against: Some(baselines.notary.bundle.clone()), + relay_anchor: Some(baselines.notary.anchor.clone()), + notary_against: Some(baselines.relay.bundle.clone()), + notary_anchor: Some(baselines.relay.anchor.clone()), + }) + .expect("wrong-product baselines fail closed as a report"); + assert_conservative_blocked_report(&wrong_owner, &forbidden); +} + +#[test] +fn relay_only_and_notary_only_topologies_accept_their_product_baseline() { + let fixture_root = + Path::new(env!("CARGO_MANIFEST_DIR")).join("tests/fixtures/project-authoring"); + for (fixture, product, product_directory) in [ + ("relay-only-materialization", "registry-relay", "relay"), + ("notary-only-evaluation", "registry-notary", "notary"), + ] { + let temporary = tempfile::tempdir().expect("temporary directory creates"); + let project = temporary.path().join(fixture); + copy_tree(&fixture_root.join(fixture), &project); + let output = build_project_output(&project); + let baseline = sign_product_baseline( + &output, + temporary.path(), + product, + product_directory, + product_directory, + ); + + let ready = run_promote_legacy(&project, &baseline, "json"); + assert_eq!( + ready.status.code(), + Some(0), + "{fixture}: {}", + String::from_utf8_lossy(&ready.stderr) + ); + let ready: serde_json::Value = + serde_json::from_slice(&ready.stdout).expect("single-product JSON parses"); + assert_eq!(ready["disposition"], "ready", "{fixture}"); + assert_eq!( + ready["compatibility"][0]["state"], "compatible", + "{fixture}" + ); + } +} + +#[test] +fn invalid_signed_baselines_fail_closed_with_valid_value_free_reports() { + const TAMPERED_BASELINE_SENTINEL: &str = "TAMPERED_BASELINE_VALUE_SENTINEL"; + const MALFORMED_PROJECTION_SENTINEL: &str = + "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"; + + let temporary = tempfile::tempdir().expect("temporary directory creates"); + let project = temporary.path().join("tamper-promotion-project"); + init_registry_project(&ProjectInitOptions { + starter: ProjectStarter::Http, + directory: project.clone(), + }) + .expect("starter initializes"); + let output = build_project_output(&project); + let baseline = sign_product_baseline( + &output, + temporary.path(), + "registry-notary", + "notary", + "notary-valid", + ); + + let tampered_bundle = temporary.path().join("tampered-notary-bundle"); + copy_tree(&baseline.bundle, &tampered_bundle); + let tampered_state = tampered_bundle.join("approval/project-state.json"); + let mut bytes = std::fs::read(&tampered_state).expect("signed approval state reads"); + bytes.extend_from_slice(TAMPERED_BASELINE_SENTINEL.as_bytes()); + std::fs::write(&tampered_state, bytes).expect("signed approval state tampers"); + let temporary_path = temporary.path().to_str().expect("temporary path is UTF-8"); + let forbidden = [ + "tamper-promotion-project", + "fictional-citizen-registry", + "FICTIONAL_REGISTRY_TOKEN", + "https://citizen-registry.invalid", + "public-service-person-verification", + "tampered-notary-bundle", + "notary-legacy-v1", + TAMPERED_BASELINE_SENTINEL, + temporary_path, + ]; + let tampered_baseline = SignedProductBaseline { + bundle: tampered_bundle, + anchor: baseline.anchor.clone(), + }; + let tampered = run_promote_legacy(&project, &tampered_baseline, "json"); + assert_conservative_blocked_cli(&tampered, &forbidden); + let tampered_direct = + promote_registry_project(&legacy_promotion_options(&project, &tampered_baseline)) + .expect("tampered baseline fails closed as a report"); + assert_conservative_blocked_report(&tampered_direct, &forbidden); + + let project_path = project.join("registry-stack.yaml"); + let valid_project = std::fs::read_to_string(&project_path).expect("current project reads"); + let invalid_project = + valid_project.replace("version: 1", "version: CURRENT_STATE_VALUE_SENTINEL"); + write(&project_path, &invalid_project); + promote_registry_project(&legacy_promotion_options(&project, &tampered_baseline)) + .expect_err("invalid current state remains an ordinary error"); + let invalid_current = run_promote_legacy(&project, &tampered_baseline, "json"); + assert_eq!(invalid_current.status.code(), Some(1)); + assert!(invalid_current.stdout.is_empty()); + assert!(!invalid_current.stderr.is_empty()); + write(&project_path, &valid_project); + + let approval_path = output.join("private/notary/approval/project-state.json"); + let mut approval: serde_json::Value = serde_json::from_slice( + &std::fs::read(&approval_path).expect("unsigned approval state reads"), + ) + .expect("unsigned approval state parses"); + + let mut legacy_v2 = approval.clone(); + legacy_v2["schema"] = serde_json::json!("registry.project.approval-state.v2"); + let mut legacy_v2_bytes = + serde_json::to_vec_pretty(&legacy_v2).expect("v2 approval state serializes"); + legacy_v2_bytes.push(b'\n'); + std::fs::write(&approval_path, legacy_v2_bytes).expect("v2 approval state writes"); + let legacy_v2_baseline = sign_product_baseline( + &output, + temporary.path(), + "registry-notary", + "notary", + "notary-legacy-v2", + ); + let legacy_v2 = run_check_legacy(&project, &legacy_v2_baseline); + assert_eq!( + legacy_v2.status.code(), + Some(0), + "{}", + String::from_utf8_lossy(&legacy_v2.stderr) + ); + + let mut legacy = approval.clone(); + legacy["schema"] = serde_json::json!("registry.project.approval-state.v1"); + legacy + .as_object_mut() + .expect("legacy state is an object") + .remove("promotion_projection"); + let mut legacy_bytes = + serde_json::to_vec_pretty(&legacy).expect("legacy approval state serializes"); + legacy_bytes.push(b'\n'); + std::fs::write(&approval_path, legacy_bytes).expect("legacy approval state writes"); + let legacy_baseline = sign_product_baseline( + &output, + temporary.path(), + "registry-notary", + "notary", + "notary-legacy-v1", + ); + let legacy = run_promote_legacy(&project, &legacy_baseline, "json"); + assert_conservative_blocked_cli(&legacy, &forbidden); + let legacy_direct = + promote_registry_project(&legacy_promotion_options(&project, &legacy_baseline)) + .expect("legacy baseline fails closed as a report"); + assert_conservative_blocked_report(&legacy_direct, &forbidden); + + approval["promotion_projection"]["fields"][0]["digest"] = + serde_json::json!(format!("sha256:{MALFORMED_PROJECTION_SENTINEL}")); + let mut malformed = serde_json::to_vec_pretty(&approval).expect("approval state serializes"); + malformed.push(b'\n'); + std::fs::write(&approval_path, malformed).expect("malformed projection writes"); + let malformed_projection = sign_product_baseline( + &output, + temporary.path(), + "registry-notary", + "notary", + "notary-malformed-projection", + ); + let malformed = run_promote_legacy(&project, &malformed_projection, "json"); + let malformed_forbidden = [ + "tamper-promotion-project", + "fictional-citizen-registry", + "FICTIONAL_REGISTRY_TOKEN", + "https://citizen-registry.invalid", + "public-service-person-verification", + "notary-malformed-projection", + MALFORMED_PROJECTION_SENTINEL, + temporary_path, + ]; + assert_conservative_blocked_cli(&malformed, &malformed_forbidden); + let malformed_direct = + promote_registry_project(&legacy_promotion_options(&project, &malformed_projection)) + .expect("malformed baseline fails closed as a report"); + assert_conservative_blocked_report(&malformed_direct, &malformed_forbidden); +} diff --git a/crates/registryctl/tests/project_promotion_contract.rs b/crates/registryctl/tests/project_promotion_contract.rs new file mode 100644 index 000000000..a5d71f210 --- /dev/null +++ b/crates/registryctl/tests/project_promotion_contract.rs @@ -0,0 +1,405 @@ +// SPDX-License-Identifier: Apache-2.0 + +#![allow(dead_code)] + +#[path = "../src/project_authoring/promotion.rs"] +mod promotion; + +use promotion::{ + build_project_promotion_report, ProjectPromotionBuildError, ProjectPromotionInput, + ProjectPromotionReportV1, PromotionBlockingReason, PromotionChangeEffect, PromotionChangeInput, + PromotionChangeKind, PromotionCompatibilityInput, PromotionCompatibilityState, + PromotionDisposition, PromotionFieldClassification, PromotionFieldOwnership, + PromotionProductAction, ReviewedCeilingInput, ReviewedRevisionComparison, TrustResolutionInput, + MAX_PROMOTION_CHANGES, +}; +use serde_json::{json, Value}; + +const SCHEMA: &str = + include_str!("../schemas/project-reports/registry.project.promotion.v1.schema.json"); +const FIXTURE: &str = include_str!("fixtures/project-reports/registry.project.promotion.v1.json"); + +fn parse(input: &str) -> Value { + serde_json::from_str(input).expect("JSON parses") +} + +fn validator() -> jsonschema::JSONSchema { + jsonschema::JSONSchema::options() + .with_draft(jsonschema::Draft::Draft202012) + .compile(&parse(SCHEMA)) + .expect("promotion schema compiles") +} + +fn assert_schema_valid(document: &Value) { + if let Err(errors) = validator().validate(document) { + let details = errors.map(|error| error.to_string()).collect::>(); + panic!("document should validate: {details:?}"); + } +} + +fn assert_schema_invalid(document: &Value) { + assert!( + validator().validate(document).is_err(), + "document should not validate" + ); +} + +fn compatible() -> PromotionCompatibilityInput { + PromotionCompatibilityInput { + product: PromotionCompatibilityState::Compatible, + capability: PromotionCompatibilityState::Compatible, + schema: PromotionCompatibilityState::Compatible, + abi: PromotionCompatibilityState::Compatible, + } +} + +fn change( + kind: PromotionChangeKind, + classification: PromotionFieldClassification, + ownership: PromotionFieldOwnership, + effect: PromotionChangeEffect, +) -> PromotionChangeInput { + PromotionChangeInput { + kind, + classification: Some(classification), + ownership, + effect, + } +} + +fn canonical_input() -> ProjectPromotionInput { + ProjectPromotionInput { + reviewed_revision: ReviewedRevisionComparison::DifferentReviewedSemanticRevision, + changes: vec![ + change( + PromotionChangeKind::CapabilityEnablement, + PromotionFieldClassification::Structural, + PromotionFieldOwnership::EnvironmentOwned, + PromotionChangeEffect::ChangedWithinReviewedAuthority, + ), + change( + PromotionChangeKind::Disclosure, + PromotionFieldClassification::Internal, + PromotionFieldOwnership::ReviewedProjectOwned, + PromotionChangeEffect::Narrowed, + ), + change( + PromotionChangeKind::Origin, + PromotionFieldClassification::Sensitive, + PromotionFieldOwnership::EnvironmentOwned, + PromotionChangeEffect::ChangedWithinReviewedAuthority, + ), + change( + PromotionChangeKind::Purpose, + PromotionFieldClassification::Internal, + PromotionFieldOwnership::ReviewedProjectOwned, + PromotionChangeEffect::ChangedWithinReviewedAuthority, + ), + change( + PromotionChangeKind::CredentialBinding, + PromotionFieldClassification::SecretReference, + PromotionFieldOwnership::EnvironmentOwned, + PromotionChangeEffect::ChangedWithinReviewedAuthority, + ), + change( + PromotionChangeKind::IntegrationCeiling, + PromotionFieldClassification::Structural, + PromotionFieldOwnership::ReviewedProjectOwned, + PromotionChangeEffect::Narrowed, + ), + change( + PromotionChangeKind::Trust, + PromotionFieldClassification::Sensitive, + PromotionFieldOwnership::EnvironmentOwned, + PromotionChangeEffect::ChangedWithinReviewedAuthority, + ), + change( + PromotionChangeKind::Operational, + PromotionFieldClassification::Internal, + PromotionFieldOwnership::EnvironmentOwned, + PromotionChangeEffect::ChangedWithinReviewedAuthority, + ), + change( + PromotionChangeKind::Claim, + PromotionFieldClassification::Internal, + PromotionFieldOwnership::ReviewedProjectOwned, + PromotionChangeEffect::ChangedWithinReviewedAuthority, + ), + change( + PromotionChangeKind::ProductEnablement, + PromotionFieldClassification::Structural, + PromotionFieldOwnership::EnvironmentOwned, + PromotionChangeEffect::ChangedWithinReviewedAuthority, + ), + change( + PromotionChangeKind::ServicePolicy, + PromotionFieldClassification::Internal, + PromotionFieldOwnership::ReviewedProjectOwned, + PromotionChangeEffect::Narrowed, + ), + change( + PromotionChangeKind::Caller, + PromotionFieldClassification::Sensitive, + PromotionFieldOwnership::EnvironmentOwned, + PromotionChangeEffect::Narrowed, + ), + ], + reviewed_ceiling: ReviewedCeilingInput::Narrowed, + trust: TrustResolutionInput::Resolved, + compatibility: compatible(), + } +} + +#[test] +fn canonical_fixture_validates_and_roundtrips_exactly() { + let document = parse(FIXTURE); + assert_schema_valid(&document); + let decoded: ProjectPromotionReportV1 = + serde_json::from_value(document.clone()).expect("canonical fixture decodes"); + assert_eq!( + serde_json::to_value(decoded).expect("canonical fixture re-encodes"), + document + ); +} + +#[test] +fn pure_builder_is_deterministic_value_free_and_matches_fixture() { + let first = build_project_promotion_report(canonical_input()).expect("report builds"); + let second = build_project_promotion_report(canonical_input()).expect("report rebuilds"); + assert_eq!(first, second); + assert_eq!( + serde_json::to_value(&first).expect("report serializes"), + parse(FIXTURE) + ); + assert_eq!( + first.disposition, + PromotionDisposition::ReadyAfterRequiredActions + ); + assert_eq!( + first.required_actions.re_sign, + PromotionProductAction::RelayAndNotary + ); + assert_eq!( + first.required_actions.reactivate, + PromotionProductAction::RelayAndNotary + ); + assert_eq!( + first.required_actions.restart, + PromotionProductAction::RelayAndNotary + ); + assert!(first.blocking_reasons.is_empty()); +} + +#[test] +fn policy_and_ceiling_widening_fail_closed() { + let report = build_project_promotion_report(ProjectPromotionInput { + reviewed_revision: ReviewedRevisionComparison::DifferentReviewedSemanticRevision, + changes: vec![change( + PromotionChangeKind::ServicePolicy, + PromotionFieldClassification::Internal, + PromotionFieldOwnership::ReviewedProjectOwned, + PromotionChangeEffect::Widened, + )], + reviewed_ceiling: ReviewedCeilingInput::Widened, + trust: TrustResolutionInput::Resolved, + compatibility: compatible(), + }) + .expect("blocked report builds"); + + assert_eq!(report.disposition, PromotionDisposition::Blocked); + assert!(report + .blocking_reasons + .contains(&PromotionBlockingReason::PolicyWidening)); + assert!(report + .blocking_reasons + .contains(&PromotionBlockingReason::ReviewedCeilingWidening)); +} + +#[test] +fn missing_incompatible_and_unresolved_compatibility_fail_closed() { + let report = build_project_promotion_report(ProjectPromotionInput { + reviewed_revision: ReviewedRevisionComparison::SameReviewedSemanticRevision, + changes: Vec::new(), + reviewed_ceiling: ReviewedCeilingInput::WithinReviewedCeiling, + trust: TrustResolutionInput::Unresolved, + compatibility: PromotionCompatibilityInput { + product: PromotionCompatibilityState::Compatible, + capability: PromotionCompatibilityState::Missing, + schema: PromotionCompatibilityState::Incompatible, + abi: PromotionCompatibilityState::Unresolved, + }, + }) + .expect("blocked report builds"); + + assert_eq!(report.disposition, PromotionDisposition::Blocked); + for reason in [ + PromotionBlockingReason::TrustUnresolved, + PromotionBlockingReason::MissingCapability, + PromotionBlockingReason::IncompatibleSchema, + PromotionBlockingReason::CompatibilityUnresolved, + ] { + assert!(report.blocking_reasons.contains(&reason)); + } +} + +#[test] +fn ownership_and_classification_boundaries_fail_closed() { + let report = build_project_promotion_report(ProjectPromotionInput { + reviewed_revision: ReviewedRevisionComparison::SameReviewedSemanticRevision, + changes: vec![ + change( + PromotionChangeKind::Origin, + PromotionFieldClassification::Sensitive, + PromotionFieldOwnership::ReviewedProjectOwned, + PromotionChangeEffect::ChangedWithinReviewedAuthority, + ), + PromotionChangeInput { + kind: PromotionChangeKind::Operational, + classification: None, + ownership: PromotionFieldOwnership::Unclassified, + effect: PromotionChangeEffect::Unresolved, + }, + change( + PromotionChangeKind::Claim, + PromotionFieldClassification::Internal, + PromotionFieldOwnership::ReviewedProjectOwned, + PromotionChangeEffect::ChangedWithinReviewedAuthority, + ), + ], + reviewed_ceiling: ReviewedCeilingInput::WithinReviewedCeiling, + trust: TrustResolutionInput::Resolved, + compatibility: compatible(), + }) + .expect("blocked report builds"); + + assert_eq!(report.disposition, PromotionDisposition::Blocked); + for reason in [ + PromotionBlockingReason::EnvironmentOwnershipViolation, + PromotionBlockingReason::UnclassifiedChange, + PromotionBlockingReason::UnresolvedChange, + ] { + assert!(report.blocking_reasons.contains(&reason)); + } +} + +#[test] +fn incomplete_revision_and_ceiling_evidence_fail_closed() { + let report = build_project_promotion_report(ProjectPromotionInput { + reviewed_revision: ReviewedRevisionComparison::DifferentReviewedSemanticRevision, + changes: vec![change( + PromotionChangeKind::Origin, + PromotionFieldClassification::Sensitive, + PromotionFieldOwnership::EnvironmentOwned, + PromotionChangeEffect::ChangedWithinReviewedAuthority, + )], + reviewed_ceiling: ReviewedCeilingInput::Narrowed, + trust: TrustResolutionInput::Resolved, + compatibility: compatible(), + }) + .expect("blocked report builds"); + assert_eq!(report.disposition, PromotionDisposition::Blocked); + assert!(report + .blocking_reasons + .contains(&PromotionBlockingReason::ComparisonEvidenceIncomplete)); +} + +#[test] +fn schema_and_dto_reject_unknown_fields_and_value_sentinels() { + for (pointer, field, sentinel) in [ + ("", "source_environment", "COUNTRY_ENVIRONMENT_SENTINEL"), + ( + "/changes/0", + "origin", + "https://COUNTRY_ORIGIN_SENTINEL.invalid", + ), + ("/changes/1", "secret_name", "COUNTRY_SECRET_NAME_SENTINEL"), + ("/changes/2", "client_id", "COUNTRY_CLIENT_ID_SENTINEL"), + ("/changes/3", "value", "COUNTRY_VALUE_SENTINEL"), + ("/changes/4", "digest", "COUNTRY_SENSITIVE_HASH_SENTINEL"), + ] { + let mut document = parse(FIXTURE); + document + .pointer_mut(pointer) + .and_then(Value::as_object_mut) + .expect("test object exists") + .insert(field.to_owned(), json!(sentinel)); + assert_schema_invalid(&document); + assert!(serde_json::from_value::(document).is_err()); + } + + let mut path_sentinel = parse(FIXTURE); + path_sentinel["changes"][0]["address"]["path"] = json!("/COUNTRY/PATH/SENTINEL"); + assert_schema_invalid(&path_sentinel); + assert!(serde_json::from_value::(path_sentinel).is_err()); + + let serialized = serde_json::to_string( + &build_project_promotion_report(canonical_input()).expect("report builds"), + ) + .expect("report serializes"); + for forbidden in [ + "COUNTRY_", + "https://", + "client_id", + "secret_name", + "source_environment", + "target_environment", + ] { + assert!(!serialized.contains(forbidden)); + } +} + +#[test] +fn report_cannot_claim_deployment_or_runtime_activation() { + let mut document = parse(FIXTURE); + document["deployment"] = json!("performed"); + assert_schema_invalid(&document); + + let mut document = parse(FIXTURE); + document["runtime_activation"] = json!("active"); + assert_schema_invalid(&document); + + let mut document = parse(FIXTURE); + document["evidence_limitations"][2] = json!("deployment_verified"); + assert_schema_invalid(&document); +} + +#[test] +fn dto_rejects_decisions_that_do_not_match_the_classified_evidence() { + let mut document = parse(FIXTURE); + document["disposition"] = json!("ready"); + assert!( + validator().validate(&document).is_ok(), + "the structural schema deliberately leaves cross-field decisions to the DTO" + ); + assert!(serde_json::from_value::(document).is_err()); + + let mut document = parse(FIXTURE); + document["changes"][0]["boundary"] = json!("allowed_environment_owned"); + assert!(serde_json::from_value::(document).is_err()); + + let mut document = parse(FIXTURE); + document["compatibility"] + .as_array_mut() + .expect("compatibility is an array") + .swap(0, 1); + assert_schema_invalid(&document); + assert!(serde_json::from_value::(document).is_err()); +} + +#[test] +fn change_capacity_is_bounded_before_report_construction() { + let repeated = change( + PromotionChangeKind::Origin, + PromotionFieldClassification::Sensitive, + PromotionFieldOwnership::EnvironmentOwned, + PromotionChangeEffect::ChangedWithinReviewedAuthority, + ); + let error = build_project_promotion_report(ProjectPromotionInput { + reviewed_revision: ReviewedRevisionComparison::SameReviewedSemanticRevision, + changes: vec![repeated; MAX_PROMOTION_CHANGES + 1], + reviewed_ceiling: ReviewedCeilingInput::WithinReviewedCeiling, + trust: TrustResolutionInput::Resolved, + compatibility: compatible(), + }); + assert_eq!(error, Err(ProjectPromotionBuildError::TooManyChanges)); +} diff --git a/crates/registryctl/tests/project_report_contract.rs b/crates/registryctl/tests/project_report_contract.rs new file mode 100644 index 000000000..92ba62320 --- /dev/null +++ b/crates/registryctl/tests/project_report_contract.rs @@ -0,0 +1,476 @@ +// SPDX-License-Identifier: Apache-2.0 + +#![allow(dead_code)] + +#[path = "../src/project_authoring/knowledge.rs"] +mod knowledge; +#[path = "../src/project_authoring/report_contract.rs"] +mod report_contract; +pub use report_contract::{ProjectRelativePath, Sha256Digest}; +#[path = "../src/project_authoring/fixture_coverage.rs"] +mod fixture_coverage; + +use fixture_coverage::ProjectFixtureCoverageReportV1; +use registryctl::ProjectSemanticComparisonReportV1; +use report_contract::{ + ClassifierApprovedJson, DimensionOnlySemanticChange, FieldSensitivity, JsonPointer, + ProjectArtifactManifestV1, ProjectCommandReportV1, ProjectExplanationReportV1, + ProjectSemanticImpactReportV1, SemanticDimension, +}; +use serde::de::DeserializeOwned; +use serde_json::{json, Value}; + +const PROJECT_COMMAND_SCHEMA_ID: &str = "https://id.registrystack.org/schemas/registryctl/project-reports/registryctl.project_command.v1.schema.json"; +const PROJECT_EXPLANATION_SCHEMA_ID: &str = "https://id.registrystack.org/schemas/registryctl/project-reports/registry.project.explanation.v1.schema.json"; +const PROJECT_SEMANTIC_IMPACT_SCHEMA_ID: &str = "https://id.registrystack.org/schemas/registryctl/project-reports/registry.project.semantic_impact.v1.schema.json"; +const PROJECT_ARTIFACT_MANIFEST_SCHEMA_ID: &str = "https://id.registrystack.org/schemas/registryctl/project-reports/registry.project.artifact_manifest.v1.schema.json"; +const PROJECT_FIXTURE_COVERAGE_SCHEMA_ID: &str = "https://id.registrystack.org/schemas/registryctl/project-reports/registry.project.fixture_coverage.v1.schema.json"; +const PROJECT_SEMANTIC_COMPARISON_SCHEMA_ID: &str = "https://id.registrystack.org/schemas/registryctl/project-reports/registry.project.semantic_comparison.v1.schema.json"; + +const PROJECT_COMMAND_SCHEMA: &str = + include_str!("../schemas/project-reports/registryctl.project_command.v1.schema.json"); +const PROJECT_EXPLANATION_SCHEMA: &str = + include_str!("../schemas/project-reports/registry.project.explanation.v1.schema.json"); +const PROJECT_SEMANTIC_IMPACT_SCHEMA: &str = + include_str!("../schemas/project-reports/registry.project.semantic_impact.v1.schema.json"); +const PROJECT_ARTIFACT_MANIFEST_SCHEMA: &str = + include_str!("../schemas/project-reports/registry.project.artifact_manifest.v1.schema.json"); +const PROJECT_FIXTURE_COVERAGE_SCHEMA: &str = + include_str!("../schemas/project-reports/registry.project.fixture_coverage.v1.schema.json"); +const PROJECT_SEMANTIC_COMPARISON_SCHEMA: &str = + include_str!("../schemas/project-reports/registry.project.semantic_comparison.v1.schema.json"); + +const PROJECT_COMMAND_FIXTURE: &str = + include_str!("fixtures/project-reports/registryctl.project_command.v1.json"); +const PROJECT_EXPLANATION_FIXTURE: &str = + include_str!("fixtures/project-reports/registry.project.explanation.v1.json"); +const PROJECT_SEMANTIC_IMPACT_FIXTURE: &str = + include_str!("fixtures/project-reports/registry.project.semantic_impact.v1.json"); +const PROJECT_ARTIFACT_MANIFEST_FIXTURE: &str = + include_str!("fixtures/project-reports/registry.project.artifact_manifest.v1.json"); +const PROJECT_FIXTURE_COVERAGE_FIXTURE: &str = + include_str!("fixtures/project-reports/registry.project.fixture_coverage.v1.json"); +const PROJECT_FIXTURE_COVERAGE_NO_TARGET_FIXTURE: &str = + include_str!("fixtures/project-reports/registry.project.fixture_coverage.no-target.v1.json"); +const PROJECT_SEMANTIC_COMPARISON_FIXTURE: &str = + include_str!("fixtures/project-reports/registry.project.semantic_comparison.v1.json"); + +fn parse(input: &str) -> Value { + serde_json::from_str(input).expect("JSON parses") +} + +fn validator(schema: &str) -> jsonschema::JSONSchema { + let mut options = jsonschema::JSONSchema::options(); + options + .with_draft(jsonschema::Draft::Draft202012) + .with_document( + PROJECT_COMMAND_SCHEMA_ID.to_string(), + parse(PROJECT_COMMAND_SCHEMA), + ) + .with_document( + PROJECT_EXPLANATION_SCHEMA_ID.to_string(), + parse(PROJECT_EXPLANATION_SCHEMA), + ) + .with_document( + PROJECT_SEMANTIC_IMPACT_SCHEMA_ID.to_string(), + parse(PROJECT_SEMANTIC_IMPACT_SCHEMA), + ) + .with_document( + PROJECT_ARTIFACT_MANIFEST_SCHEMA_ID.to_string(), + parse(PROJECT_ARTIFACT_MANIFEST_SCHEMA), + ) + .with_document( + PROJECT_FIXTURE_COVERAGE_SCHEMA_ID.to_string(), + parse(PROJECT_FIXTURE_COVERAGE_SCHEMA), + ) + .with_document( + PROJECT_SEMANTIC_COMPARISON_SCHEMA_ID.to_string(), + parse(PROJECT_SEMANTIC_COMPARISON_SCHEMA), + ); + options + .compile(&parse(schema)) + .expect("Draft 2020-12 schema compiles") +} + +fn assert_valid(schema: &str, document: &Value) { + if let Err(errors) = validator(schema).validate(document) { + let details = errors.map(|error| error.to_string()).collect::>(); + panic!("document should validate: {details:?}"); + } +} + +fn assert_invalid(schema: &str, document: &Value) { + assert!( + validator(schema).validate(document).is_err(), + "document should not validate" + ); +} + +fn assert_exact_roundtrip(fixture: &str) +where + T: DeserializeOwned + serde::Serialize + PartialEq + std::fmt::Debug, +{ + let document = parse(fixture); + let decoded: T = serde_json::from_value(document.clone()).expect("fixture decodes"); + let encoded = serde_json::to_value(&decoded).expect("fixture re-encodes"); + assert_eq!( + encoded, document, + "roundtrip preserves the canonical document" + ); + let decoded_again: T = serde_json::from_value(encoded).expect("roundtrip output decodes"); + assert_eq!(decoded_again, decoded); +} + +fn assert_typed_invalid(document: Value) +where + T: DeserializeOwned, +{ + assert!( + serde_json::from_value::(document).is_err(), + "strict DTO should reject the document" + ); +} + +#[test] +fn draft_2020_12_schemas_validate_all_canonical_fixtures() { + for (schema, fixture) in [ + (PROJECT_COMMAND_SCHEMA, PROJECT_COMMAND_FIXTURE), + (PROJECT_EXPLANATION_SCHEMA, PROJECT_EXPLANATION_FIXTURE), + ( + PROJECT_SEMANTIC_IMPACT_SCHEMA, + PROJECT_SEMANTIC_IMPACT_FIXTURE, + ), + ( + PROJECT_ARTIFACT_MANIFEST_SCHEMA, + PROJECT_ARTIFACT_MANIFEST_FIXTURE, + ), + ( + PROJECT_FIXTURE_COVERAGE_SCHEMA, + PROJECT_FIXTURE_COVERAGE_FIXTURE, + ), + ( + PROJECT_FIXTURE_COVERAGE_SCHEMA, + PROJECT_FIXTURE_COVERAGE_NO_TARGET_FIXTURE, + ), + ( + PROJECT_SEMANTIC_COMPARISON_SCHEMA, + PROJECT_SEMANTIC_COMPARISON_FIXTURE, + ), + ] { + assert_valid(schema, &parse(fixture)); + } +} + +#[test] +fn strict_dtos_roundtrip_canonical_fixtures_without_loss() { + assert_exact_roundtrip::(PROJECT_COMMAND_FIXTURE); + assert_exact_roundtrip::(PROJECT_EXPLANATION_FIXTURE); + assert_exact_roundtrip::(PROJECT_SEMANTIC_IMPACT_FIXTURE); + assert_exact_roundtrip::(PROJECT_ARTIFACT_MANIFEST_FIXTURE); + assert_exact_roundtrip::(PROJECT_FIXTURE_COVERAGE_FIXTURE); + assert_exact_roundtrip::( + PROJECT_FIXTURE_COVERAGE_NO_TARGET_FIXTURE, + ); + assert_exact_roundtrip::( + PROJECT_SEMANTIC_COMPARISON_FIXTURE, + ); + + for (schema, fixture, expected_version) in [ + ( + PROJECT_COMMAND_SCHEMA, + PROJECT_COMMAND_FIXTURE, + "registryctl.project_command.v1", + ), + ( + PROJECT_EXPLANATION_SCHEMA, + PROJECT_EXPLANATION_FIXTURE, + "registry.project.explanation.v1", + ), + ( + PROJECT_SEMANTIC_IMPACT_SCHEMA, + PROJECT_SEMANTIC_IMPACT_FIXTURE, + "registry.project.semantic_impact.v1", + ), + ( + PROJECT_ARTIFACT_MANIFEST_SCHEMA, + PROJECT_ARTIFACT_MANIFEST_FIXTURE, + "registry.project.artifact_manifest.v1", + ), + ( + PROJECT_FIXTURE_COVERAGE_SCHEMA, + PROJECT_FIXTURE_COVERAGE_FIXTURE, + "registry.project.fixture_coverage.v1", + ), + ( + PROJECT_SEMANTIC_COMPARISON_SCHEMA, + PROJECT_SEMANTIC_COMPARISON_FIXTURE, + "registry.project.semantic_comparison.v1", + ), + ] { + let mut wrong_version = parse(fixture); + assert_eq!(wrong_version["schema_version"], expected_version); + wrong_version["schema_version"] = json!("registry.project.future.v2"); + assert_invalid(schema, &wrong_version); + } +} + +#[test] +fn real_project_command_producers_match_the_strict_v1_contract() { + let temporary = tempfile::tempdir().expect("temporary directory"); + let project = temporary.path().join("registry-project"); + registryctl::init_registry_project(®istryctl::ProjectInitOptions { + starter: registryctl::ProjectStarter::Http, + directory: project.clone(), + }) + .expect("HTTP starter initializes"); + let execution_context = + registryctl::ProjectExecutionContext::new(env!("CARGO_BIN_EXE_registryctl")) + .expect("Cargo provides the real registryctl executable"); + + let reports = [ + registryctl::test_registry_project_with_context( + ®istryctl::ProjectTestOptions { + project_directory: project.clone(), + environment: None, + live: false, + }, + &execution_context, + ) + .expect("offline project test report"), + registryctl::check_registry_project_with_context( + ®istryctl::ProjectCheckOptions { + project_directory: project.clone(), + environment: "local".to_owned(), + explain: true, + against: None, + anchor: None, + }, + &execution_context, + ) + .expect("project check report"), + registryctl::build_registry_project_with_context( + ®istryctl::ProjectBuildOptions { + project_directory: project, + environment: "local".to_owned(), + against: None, + anchor: None, + }, + &execution_context, + ) + .expect("project build report"), + ]; + + for report in reports { + let document = serde_json::to_value(report).expect("real report serializes"); + assert_valid(PROJECT_COMMAND_SCHEMA, &document); + serde_json::from_value::(document) + .expect("real report decodes through the strict command DTO"); + } +} + +#[test] +fn project_command_rejects_root_and_nested_unknown_fields() { + let mut root = parse(PROJECT_COMMAND_FIXTURE); + root["future_field"] = json!(true); + assert_invalid(PROJECT_COMMAND_SCHEMA, &root); + assert_typed_invalid::(root); + + let mut nested = parse(PROJECT_COMMAND_FIXTURE); + nested["artifact_manifest"]["absolute_path"] = json!("/tmp/manifest.json"); + assert_invalid(PROJECT_COMMAND_SCHEMA, &nested); + assert_typed_invalid::(nested); +} + +#[test] +fn explanation_rejects_root_and_deeply_nested_unknown_fields() { + let mut root = parse(PROJECT_EXPLANATION_FIXTURE); + root["future_field"] = json!(true); + assert_invalid(PROJECT_EXPLANATION_SCHEMA, &root); + assert_typed_invalid::(root); + + let mut nested = parse(PROJECT_EXPLANATION_FIXTURE); + nested["fields"][0]["knowledge"]["runtime_value"] = json!("not reportable"); + assert_invalid(PROJECT_EXPLANATION_SCHEMA, &nested); + assert_typed_invalid::(nested); + + let mut non_pointer_address = parse(PROJECT_EXPLANATION_FIXTURE); + non_pointer_address["fields"][0]["address"]["path"] = + json!("integrations/person-record/integration.yaml"); + assert_invalid(PROJECT_EXPLANATION_SCHEMA, &non_pointer_address); + assert_typed_invalid::(non_pointer_address); +} + +#[test] +fn semantic_impact_rejects_root_and_deeply_nested_unknown_fields() { + let mut root = parse(PROJECT_SEMANTIC_IMPACT_FIXTURE); + root["future_field"] = json!(true); + assert_invalid(PROJECT_SEMANTIC_IMPACT_SCHEMA, &root); + assert_typed_invalid::(root); + + let mut nested = parse(PROJECT_SEMANTIC_IMPACT_FIXTURE); + nested["changes"][0]["requirements"]["restart_reason"] = json!("changed config"); + assert_invalid(PROJECT_SEMANTIC_IMPACT_SCHEMA, &nested); + assert_typed_invalid::(nested); +} + +#[test] +fn artifact_manifest_rejects_root_and_deeply_nested_unknown_fields() { + let mut root = parse(PROJECT_ARTIFACT_MANIFEST_FIXTURE); + root["future_field"] = json!(true); + assert_invalid(PROJECT_ARTIFACT_MANIFEST_SCHEMA, &root); + assert_typed_invalid::(root); + + let mut nested = parse(PROJECT_ARTIFACT_MANIFEST_FIXTURE); + nested["artifacts"][0]["last_deployed_at"] = json!("runtime observation"); + assert_invalid(PROJECT_ARTIFACT_MANIFEST_SCHEMA, &nested); + assert_typed_invalid::(nested); +} + +#[test] +fn semantic_precision_requires_a_field_address_only_for_field_precision() { + let mut missing_field = parse(PROJECT_SEMANTIC_IMPACT_FIXTURE); + missing_field["changes"][0]["precision"] = json!("field"); + assert_invalid(PROJECT_SEMANTIC_IMPACT_SCHEMA, &missing_field); + assert_typed_invalid::(missing_field); + + let mut dimension_with_field = parse(PROJECT_SEMANTIC_IMPACT_FIXTURE); + dimension_with_field["changes"][0]["field"] = json!({ + "document": "integration", + "integration": "person-record", + "path": "/http" + }); + assert_invalid(PROJECT_SEMANTIC_IMPACT_SCHEMA, &dimension_with_field); + assert_typed_invalid::(dimension_with_field); + + let mut precise_field = parse(PROJECT_SEMANTIC_IMPACT_FIXTURE); + precise_field["changes"][0]["precision"] = json!("field"); + precise_field["changes"][0]["field"] = json!({ + "document": "integration", + "integration": "person-record", + "path": "/http/request/timeout" + }); + assert_valid(PROJECT_SEMANTIC_IMPACT_SCHEMA, &precise_field); + let typed: ProjectSemanticImpactReportV1 = + serde_json::from_value(precise_field.clone()).expect("field-precise impact decodes"); + assert_eq!( + serde_json::to_value(typed).expect("field-precise impact re-encodes"), + precise_field + ); +} + +#[test] +fn dimension_only_projection_preserves_the_legacy_byte_shape() { + let impact: ProjectSemanticImpactReportV1 = + serde_json::from_str(PROJECT_SEMANTIC_IMPACT_FIXTURE).expect("impact fixture decodes"); + let projection = impact.dimension_only_changes(); + assert_eq!( + serde_json::to_string(&projection).expect("projection serializes"), + r#"[{"dimension":"integration"}]"# + ); + + let command: ProjectCommandReportV1 = + serde_json::from_str(PROJECT_COMMAND_FIXTURE).expect("command fixture decodes"); + assert_eq!(command.semantic_changes, projection); + assert_eq!(SemanticDimension::Integration, "integration"); + assert_eq!("integration", SemanticDimension::Integration); + assert_eq!( + serde_json::to_string(&DimensionOnlySemanticChange { + dimension: SemanticDimension::Integration, + }) + .expect("single compatibility record serializes"), + r#"{"dimension":"integration"}"# + ); +} + +#[test] +fn artifact_paths_fail_closed_before_the_report_can_be_constructed() { + for path in [ + "", + "/tmp/output.json", + "../output.json", + "build/../output.json", + r"C:\output.json", + "https://country.example/output.json", + "build//output.json", + ] { + assert!( + ProjectRelativePath::new(path).is_err(), + "{path:?} must not be accepted as a project-relative artifact path" + ); + } + + for path in [ + "registry-stack.yaml", + "environments/local.yaml", + ".registry-stack/build/local/artifact-manifest.json", + ] { + assert_eq!( + ProjectRelativePath::new(path).expect("safe path").as_str(), + path + ); + } + + for pointer in [ + "integrations/person-record/integration.yaml", + "#/integrations/person-record", + "/invalid~escape", + ] { + assert!( + JsonPointer::new(pointer).is_err(), + "{pointer:?} must not be accepted as an RFC 6901 pointer" + ); + } + assert_eq!( + JsonPointer::new("/integrations/person-record/~0key") + .expect("valid pointer") + .as_str(), + "/integrations/person-record/~0key" + ); +} + +#[test] +fn canonical_fixtures_exclude_runtime_and_country_sensitive_material() { + assert!( + ClassifierApprovedJson::after_classification( + FieldSensitivity::SecretReference, + false, + json!("sensitive-reference-name"), + ) + .is_none(), + "non-public classifier output cannot cross the value-bearing boundary" + ); + assert_eq!( + ClassifierApprovedJson::after_classification(FieldSensitivity::Public, false, json!("5s")) + .expect("public classified value") + .as_value(), + &json!("5s") + ); + + for fixture in [ + PROJECT_COMMAND_FIXTURE, + PROJECT_EXPLANATION_FIXTURE, + PROJECT_SEMANTIC_IMPACT_FIXTURE, + PROJECT_ARTIFACT_MANIFEST_FIXTURE, + PROJECT_FIXTURE_COVERAGE_FIXTURE, + PROJECT_SEMANTIC_COMPARISON_FIXTURE, + ] { + for forbidden in [ + "http://", + "https://", + "-----BEGIN", + "PRIVATE KEY", + "\"generated_at\"", + "\"observed_at\"", + "\"last_deployed_at\"", + "/Users/", + "/home/", + "10.0.0.0/", + "192.168.0.0/", + ] { + assert!( + !fixture.contains(forbidden), + "canonical fixture contains forbidden material {forbidden:?}" + ); + } + } +} diff --git a/crates/registryctl/tests/project_request_binding.rs b/crates/registryctl/tests/project_request_binding.rs new file mode 100644 index 000000000..b931aeaa2 --- /dev/null +++ b/crates/registryctl/tests/project_request_binding.rs @@ -0,0 +1,308 @@ +// SPDX-License-Identifier: Apache-2.0 + +use std::fs; +use std::path::{Path, PathBuf}; + +use registryctl::{ + test_registry_project_with_context, FixtureRequirementCoverage, GovernedRequestEvidence, + ProjectExecutionContext, ProjectTestOptions, RequiredFixtureCoverageRequirement, +}; +use serde_norway::Value; + +fn fixture_root(name: &str) -> PathBuf { + Path::new(env!("CARGO_MANIFEST_DIR")) + .join("tests/fixtures/project-authoring") + .join(name) +} + +fn copy_tree(source: &Path, destination: &Path) { + fs::create_dir_all(destination).expect("destination creates"); + let mut entries = fs::read_dir(source) + .expect("source reads") + .collect::>>() + .expect("entries read"); + entries.sort_by_key(|entry| entry.file_name()); + for entry in entries { + let source = entry.path(); + let destination = destination.join(entry.file_name()); + if entry.file_type().expect("type reads").is_dir() { + copy_tree(&source, &destination); + } else { + fs::copy(source, destination).expect("file copies"); + } + } +} + +fn read_yaml(path: &Path) -> Value { + serde_norway::from_slice(&fs::read(path).expect("YAML reads")).expect("YAML parses") +} + +fn write_yaml(path: &Path, value: &Value) { + fs::write( + path, + serde_norway::to_string(value).expect("YAML serializes"), + ) + .expect("YAML writes"); +} + +fn test_project(path: &Path) -> anyhow::Result { + test_registry_project_with_context( + &ProjectTestOptions { + project_directory: path.to_path_buf(), + environment: None, + live: false, + }, + &ProjectExecutionContext::new(env!("CARGO_BIN_EXE_registryctl")) + .expect("Cargo provides registryctl"), + ) +} + +fn custom_project() -> (tempfile::TempDir, PathBuf) { + let temporary = tempfile::tempdir().expect("temporary directory"); + let project = temporary.path().join("project"); + copy_tree(&fixture_root("custom-system"), &project); + (temporary, project) +} + +fn set_mapping_scheme(project: &Path, scheme: &str) { + let path = project.join("registry-stack.yaml"); + let mut document = read_yaml(&path); + document["services"]["household-eligibility"]["consultations"]["household"]["input"] + ["household_reference"] = Value::String(format!("request.target.identifiers.{scheme}")); + write_yaml(&path, &document); +} + +fn set_request_scheme(project: &Path, scheme: &str) { + let path = project.join("integrations/eligibility/fixtures/source-approved.yaml"); + let mut fixture = read_yaml(&path); + fixture["request"]["target"]["identifiers"][0]["scheme"] = Value::String(scheme.to_owned()); + write_yaml(&path, &fixture); +} + +fn assert_zero_call_binding_failure(project: &Path) -> String { + let error = test_project(project).expect_err("binding mismatch must fail"); + let rendered = format!("{error:#}"); + assert!( + rendered.contains("request_to_consultation_binding_invalid: relay_consultations=0"), + "{rendered}" + ); + rendered +} + +#[test] +fn governed_request_binding_fails_closed_for_either_one_sided_scheme_change() { + let (_temporary, project) = custom_project(); + set_mapping_scheme(&project, "country_household_id"); + assert_zero_call_binding_failure(&project); + + let (_temporary, project) = custom_project(); + set_request_scheme(&project, "country_household_id"); + assert_zero_call_binding_failure(&project); +} + +#[test] +fn governed_request_binding_remains_country_configurable_when_both_sides_change() { + let (_temporary, project) = custom_project(); + set_mapping_scheme(&project, "country_household_id"); + set_request_scheme(&project, "country_household_id"); + + let report = test_project(&project).expect("consistent country binding passes"); + let witness = report + .fixtures + .iter() + .find(|fixture| { + fixture + .fixture + .ends_with("::derived/request_to_consultation_binding") + }) + .expect("independent request witness is reported"); + assert!(witness.passed); + assert_eq!(witness.calls, ["notary-relay-consultation"]); + assert_eq!( + witness.source_access, + Some(true), + "an entered Relay consultation must not be reported as zero source access" + ); + assert_eq!(witness.claims, ["household-record-exists"]); +} + +#[test] +fn governed_request_coverage_requires_every_reachable_consultation() { + let (_temporary, project) = custom_project(); + let path = project.join("registry-stack.yaml"); + let mut document = read_yaml(&path); + let service = &mut document["services"]["household-eligibility"]; + service["consultations"]["alternate"] = serde_norway::from_str( + "{ integration: eligibility, input: { household_reference: request.target.identifiers.household_reference } }", + ) + .expect("alternate consultation parses"); + service["claims"]["alternate-record-exists"] = + serde_norway::from_str("{ cel: alternate.matched, disclosure: predicate }") + .expect("alternate claim parses"); + service["credential_profiles"]["household-eligibility"]["claims"] + .as_sequence_mut() + .expect("credential claims are a sequence") + .push(Value::String("alternate-record-exists".to_owned())); + write_yaml(&path, &document); + let fixture_path = project.join("integrations/eligibility/fixtures/source-approved.yaml"); + let mut fixture = read_yaml(&fixture_path); + fixture["expect"]["claims"]["alternate-record-exists"] = Value::Bool(true); + write_yaml(&fixture_path, &fixture); + let no_match_path = project.join("integrations/eligibility/fixtures/no-match.yaml"); + let mut no_match = read_yaml(&no_match_path); + no_match["expect"]["claims"]["alternate-record-exists"] = Value::Bool(false); + write_yaml(&no_match_path, &no_match); + + let report = test_project(&project).expect("project test remains executable"); + let coverage = report + .fixture_coverage + .expect("fixture coverage is reported"); + assert_eq!( + coverage.governed_request_evidence, + GovernedRequestEvidence::PerConsultationAuthoredRequestWitnessEvaluation, + "the root marker describes the proof method, not a false global pass state" + ); + let target = coverage.targets.first().expect("target is reported"); + assert_eq!(target.contract.registry_backed_consultations.len(), 2); + assert_eq!( + target + .fixture_inventory + .iter() + .flat_map(|fixture| { fixture.request_to_consultation_binding.consultations.iter() }) + .count(), + 1, + "one request witness must not claim both reachable consultations" + ); + assert!(matches!( + target.requirements.iter().find(|coverage| { + coverage.requirement() + == RequiredFixtureCoverageRequirement::RequestToConsultationBinding + }), + Some(FixtureRequirementCoverage::Missing { .. }) + )); +} + +#[test] +fn governed_request_boundary_rejects_closed_contract_mismatches_before_relay() { + type Mutation = (&'static str, Box); + let mutations: Vec = vec![ + ( + "target type", + Box::new(|fixture| { + fixture["request"]["target"]["type"] = Value::String("Household".to_owned()); + }), + ), + ( + "purpose", + Box::new(|fixture| { + fixture["request"]["purpose"] = Value::String("unknown-purpose".to_owned()); + }), + ), + ( + "claim", + Box::new(|fixture| { + fixture["request"]["claims"][0] = Value::String("unknown-claim".to_owned()); + }), + ), + ( + "disclosure", + Box::new(|fixture| { + fixture["request"]["disclosure"] = Value::String("value".to_owned()); + }), + ), + ( + "format", + Box::new(|fixture| { + fixture["request"]["format"] = Value::String("application/json".to_owned()); + }), + ), + ( + "missing identifier", + Box::new(|fixture| { + fixture["request"]["target"]["identifiers"] = Value::Sequence(Vec::new()); + }), + ), + ( + "extra identifier", + Box::new(|fixture| { + fixture["request"]["target"]["identifiers"] + .as_sequence_mut() + .expect("identifiers are a sequence") + .push( + serde_norway::from_str("{ scheme: extra, value: synthetic }") + .expect("identifier parses"), + ); + }), + ), + ]; + + for (name, mutate) in mutations { + let (_temporary, project) = custom_project(); + let path = project.join("integrations/eligibility/fixtures/source-approved.yaml"); + let mut fixture = read_yaml(&path); + mutate(&mut fixture); + write_yaml(&path, &fixture); + let failure = assert_zero_call_binding_failure(&project); + assert!( + !failure.contains("HH-AB12CD34"), + "{name} leaked fixture data" + ); + } +} + +#[test] +fn governed_request_requires_synthetic_classification_and_rejects_secret_references() { + for replacement in ["classification: reviewed", "classification: production"] { + let (_temporary, project) = custom_project(); + let path = project.join("integrations/eligibility/fixtures/source-approved.yaml"); + let fixture = fs::read_to_string(&path).expect("fixture reads"); + fs::write( + &path, + fixture.replace("classification: synthetic", replacement), + ) + .expect("fixture writes"); + assert!(test_project(&project).is_err()); + } + + let (_temporary, project) = custom_project(); + let integration_path = project.join("integrations/eligibility/integration.yaml"); + let mut integration = read_yaml(&integration_path); + let household_reference = integration["input"]["household_reference"] + .as_mapping_mut() + .expect("household reference contract is an object"); + household_reference.remove("pattern"); + household_reference.insert("maxLength".into(), Value::Number(128.into())); + write_yaml(&integration_path, &integration); + + let path = project.join("integrations/eligibility/fixtures/source-approved.yaml"); + let mut fixture = read_yaml(&path); + fixture["request"]["target"]["identifiers"][0]["value"] = + Value::String("${COUNTRY_IDENTIFIER}".to_owned()); + write_yaml(&path, &fixture); + let rendered = format!( + "{:#}", + test_project(&project).expect_err("secret ref must fail") + ); + assert!( + rendered.contains("fixture governed request contains a forbidden credential-like field"), + "{rendered}" + ); + assert!(!rendered.contains("COUNTRY_IDENTIFIER")); +} + +#[test] +fn governed_request_witness_executes_for_http_script_and_snapshot() { + for project in ["custom-system", "dhis2-script", "snapshot-exact"] { + let report = test_project(&fixture_root(project)) + .unwrap_or_else(|error| panic!("{project} request witness failed: {error:#}")); + assert!( + report.fixtures.iter().any(|fixture| { + fixture + .fixture + .ends_with("::derived/request_to_consultation_binding") + && fixture.passed + }), + "{project} lacks a passing request witness" + ); + } +} diff --git a/crates/registryctl/tests/project_semantic_comparison.rs b/crates/registryctl/tests/project_semantic_comparison.rs new file mode 100644 index 000000000..b2a1b16a6 --- /dev/null +++ b/crates/registryctl/tests/project_semantic_comparison.rs @@ -0,0 +1,493 @@ +// SPDX-License-Identifier: Apache-2.0 + +use std::fs; +use std::path::Path; +use std::process::Command; + +use registryctl::{ + compare_registry_project_environments_semantically, + compare_registry_project_to_embedded_starter_semantically, + compare_registry_projects_semantically, init_registry_project, FieldSensitivity, + ProjectEnvironmentSemanticComparisonOptions, ProjectInitOptions, + ProjectSemanticComparisonOptions, ProjectStarter, ProjectStarterSemanticComparisonOptions, + SemanticComparisonActivationRequirement, SemanticComparisonAssurance, + SemanticComparisonChangeSource, SemanticComparisonConsumer, SemanticComparisonDimension, + SemanticComparisonDirection, SemanticComparisonEquivalence, + SemanticComparisonGeneratedArtifact, SemanticComparisonRequiredAction, + SemanticComparisonRestartRequirement, SemanticComparisonReviewPlanState, + SemanticComparisonSchemaFamily, SemanticComparisonSigningRequirement, +}; +use serde_json::Value; + +fn init_http_project(root: &Path) { + init_registry_project(&ProjectInitOptions { + starter: ProjectStarter::Http, + directory: root.to_path_buf(), + }) + .expect("HTTP project initializes"); +} + +fn rewrite_yaml(path: &Path, update: impl FnOnce(&mut Value)) { + let bytes = fs::read(path).expect("YAML reads"); + let mut document: Value = serde_norway::from_slice(&bytes).expect("YAML parses"); + update(&mut document); + fs::write( + path, + serde_norway::to_string(&document).expect("YAML serializes"), + ) + .expect("YAML writes"); +} + +fn compare_projects( + current: &Path, + baseline: &Path, +) -> registryctl::ProjectSemanticComparisonReportV1 { + compare_registry_projects_semantically(&ProjectSemanticComparisonOptions { + current_project_directory: current.to_path_buf(), + current_environment: "local".to_owned(), + baseline_project_directory: baseline.to_path_buf(), + baseline_environment: "local".to_owned(), + }) + .expect("projects compare") +} + +#[test] +fn local_project_comparison_is_semantic_and_deterministic() { + let temporary = tempfile::tempdir().expect("temporary directory"); + let baseline = temporary.path().join("baseline"); + let current = temporary.path().join("current"); + init_http_project(&baseline); + init_http_project(¤t); + + rewrite_yaml(¤t.join("registry-stack.yaml"), |document| { + document["services"]["person-verification"]["purpose"] = + Value::String("changed-purpose".to_owned()); + }); + let first = compare_projects(¤t, &baseline); + let second = compare_projects(¤t, &baseline); + assert_eq!(first.equivalence, SemanticComparisonEquivalence::Different); + assert_eq!( + first.review_plan.state, + SemanticComparisonReviewPlanState::GeneratedPendingReview + ); + assert!(first + .changes + .iter() + .any(|change| change.dimension == SemanticComparisonDimension::ServicePolicy)); + assert!(first.changes.iter().any(|change| { + change.address.schema_family == SemanticComparisonSchemaFamily::GeneratedApproval + })); + assert_eq!( + first.canonical_json_bytes().expect("canonical report"), + second.canonical_json_bytes().expect("canonical report") + ); + assert!(first + .changes + .windows(2) + .all(|pair| pair[0].address <= pair[1].address)); +} + +#[test] +fn formatting_and_explicit_equivalent_defaults_produce_zero_changes() { + let temporary = tempfile::tempdir().expect("temporary directory"); + let baseline = temporary.path().join("baseline"); + let current = temporary.path().join("current"); + init_http_project(&baseline); + init_http_project(¤t); + + let project_path = current.join("registry-stack.yaml"); + let original = fs::read_to_string(&project_path).expect("project reads"); + fs::write( + &project_path, + format!("# formatting-only comment\n\n{original}\n"), + ) + .expect("formatting changes"); + let formatting_only = compare_projects(¤t, &baseline); + assert_eq!( + formatting_only.equivalence, + SemanticComparisonEquivalence::Equivalent + ); + assert!(formatting_only.changes.is_empty()); + + rewrite_yaml(¤t.join("environments/local.yaml"), |document| { + document["issuance"]["algorithm"] = Value::String("EdDSA".to_owned()); + }); + let report = compare_projects(¤t, &baseline); + assert_eq!( + report.equivalence, + SemanticComparisonEquivalence::Equivalent + ); + assert!(report.changes.is_empty()); + assert!(report.required_actions.is_empty()); +} + +#[test] +fn registry_id_change_requires_redeploying_both_products_without_reporting_values() { + const BASELINE_ID: &str = "semantic-comparison-baseline"; + const CURRENT_ID: &str = "semantic-comparison-current"; + + let temporary = tempfile::tempdir().expect("temporary directory"); + let baseline = temporary.path().join("baseline"); + let current = temporary.path().join("current"); + init_http_project(&baseline); + init_http_project(¤t); + rewrite_yaml(&baseline.join("registry-stack.yaml"), |document| { + document["registry"]["id"] = Value::String(BASELINE_ID.to_owned()); + }); + rewrite_yaml(¤t.join("registry-stack.yaml"), |document| { + document["registry"]["id"] = Value::String(CURRENT_ID.to_owned()); + }); + + let report = compare_projects(¤t, &baseline); + assert_eq!(report.equivalence, SemanticComparisonEquivalence::Different); + let registry_id_change = report + .changes + .iter() + .find(|change| { + change.address.schema_family == SemanticComparisonSchemaFamily::Project + && change.address.field.as_str() == "/properties/registry/properties/id" + }) + .expect("registry.id change is classified"); + assert_eq!( + registry_id_change.source, + SemanticComparisonChangeSource::Authored + ); + assert_eq!( + registry_id_change.dimension, + SemanticComparisonDimension::Project + ); + assert_eq!( + registry_id_change.direction, + SemanticComparisonDirection::Changed + ); + assert_eq!(registry_id_change.sensitivity, FieldSensitivity::Internal); + assert_eq!(registry_id_change.occurrences, 1); + assert_eq!( + registry_id_change.consumers, + vec![ + SemanticComparisonConsumer::RegistryctlAuthoring, + SemanticComparisonConsumer::RegistryRelay, + SemanticComparisonConsumer::RegistryNotary, + SemanticComparisonConsumer::EditorTooling, + SemanticComparisonConsumer::DocsGenerator, + SemanticComparisonConsumer::BundleSigner, + SemanticComparisonConsumer::DeploymentTooling, + SemanticComparisonConsumer::Operator, + ] + ); + assert_eq!( + registry_id_change.generated_artifacts, + vec![ + SemanticComparisonGeneratedArtifact::EditorSchemas, + SemanticComparisonGeneratedArtifact::ProjectBuild, + SemanticComparisonGeneratedArtifact::RelayConfig, + SemanticComparisonGeneratedArtifact::NotaryConfig, + SemanticComparisonGeneratedArtifact::FieldReference, + ] + ); + assert_eq!( + registry_id_change.requirements.signing, + SemanticComparisonSigningRequirement::RelayAndNotaryBundles + ); + assert_eq!( + registry_id_change.requirements.activation, + SemanticComparisonActivationRequirement::ApplyRelayAndNotaryConfig + ); + assert_eq!( + registry_id_change.requirements.restart, + SemanticComparisonRestartRequirement::RegistryRelayAndNotary + ); + assert_eq!( + report.required_actions, + vec![ + SemanticComparisonRequiredAction::ReviewSemanticChanges, + SemanticComparisonRequiredAction::RunAffectedFixtures, + SemanticComparisonRequiredAction::RegenerateGeneratedArtifacts, + SemanticComparisonRequiredAction::ResignRelayBundle, + SemanticComparisonRequiredAction::ResignNotaryBundle, + SemanticComparisonRequiredAction::ReactivateRelayConfiguration, + SemanticComparisonRequiredAction::ReactivateNotaryConfiguration, + SemanticComparisonRequiredAction::RestartRegistryRelay, + SemanticComparisonRequiredAction::RestartRegistryNotary, + ] + ); + + let json = String::from_utf8(report.canonical_json_bytes().expect("report serializes")) + .expect("JSON is UTF-8"); + for value in [BASELINE_ID, CURRENT_ID] { + assert!(!json.contains(value)); + assert!(!report.human_safe_summary().contains(value)); + assert!(!format!("{report:?}").contains(value)); + } +} + +#[test] +fn same_project_environment_comparison_detects_sensitive_changes_without_leaking_them() { + const SENTINEL: &str = "SEMANTIC_COMPARISON_SECRET_SENTINEL"; + + let temporary = tempfile::tempdir().expect("temporary directory"); + let project = temporary.path().join("project"); + init_http_project(&project); + let current_environment = project.join("environments/candidate.yaml"); + fs::copy( + project.join("environments/local.yaml"), + ¤t_environment, + ) + .expect("environment copies"); + rewrite_yaml(¤t_environment, |document| { + document["integrations"]["person-record"]["source"]["credential"]["token"]["secret"] = + Value::String(SENTINEL.to_owned()); + }); + + let report = compare_registry_project_environments_semantically( + &ProjectEnvironmentSemanticComparisonOptions { + project_directory: project, + current_environment: "candidate".to_owned(), + baseline_environment: "local".to_owned(), + }, + ) + .expect("environments compare"); + assert_eq!(report.equivalence, SemanticComparisonEquivalence::Different); + assert!(report + .changes + .iter() + .any(|change| change.dimension == SemanticComparisonDimension::OperatorSecurity)); + let json = String::from_utf8(report.canonical_json_bytes().expect("report serializes")) + .expect("report is UTF-8"); + assert!(!json.contains(SENTINEL)); + assert!(!report.human_safe_summary().contains(SENTINEL)); + assert!(!format!("{report:?}").contains(SENTINEL)); +} + +#[test] +fn embedded_starter_comparison_distinguishes_unchanged_adapted_and_stale() { + const STALE_SENTINEL: &str = "SEMANTIC_COMPARISON_STALE_SENTINEL"; + + let temporary = tempfile::tempdir().expect("temporary directory"); + let project = temporary.path().join("project"); + init_http_project(&project); + let options = ProjectStarterSemanticComparisonOptions { + project_directory: project.clone(), + environment: "local".to_owned(), + starter: None, + }; + let unchanged = compare_registry_project_to_embedded_starter_semantically(&options) + .expect("unchanged starter compares"); + assert_eq!( + unchanged.assurance, + SemanticComparisonAssurance::EmbeddedExactRelease + ); + assert_eq!( + unchanged.equivalence, + SemanticComparisonEquivalence::Equivalent + ); + + rewrite_yaml(&project.join("registry-stack.yaml"), |document| { + document["services"]["person-verification"]["purpose"] = + Value::String("adapted-purpose".to_owned()); + }); + let adapted = compare_registry_project_to_embedded_starter_semantically(&options) + .expect("adapted starter compares"); + assert_eq!( + adapted.equivalence, + SemanticComparisonEquivalence::Different + ); + + rewrite_yaml(&project.join("registry-stack.yaml"), |document| { + document["starter"]["release"] = Value::String(STALE_SENTINEL.to_owned()); + }); + let error = compare_registry_project_to_embedded_starter_semantically(&options) + .expect_err("stale provenance fails closed"); + let error = format!("{error:#}"); + assert!(!error.contains(STALE_SENTINEL)); + assert_eq!( + error, + "project starter provenance cannot be proved by this binary" + ); +} + +#[test] +fn every_public_starter_compares_equivalent_to_its_exact_embedded_release() { + for starter in [ + ProjectStarter::Http, + ProjectStarter::Dhis2Tracker, + ProjectStarter::OpencrvsDci, + ProjectStarter::FhirR4, + ProjectStarter::Snapshot, + ] { + let temporary = tempfile::tempdir().expect("temporary directory"); + let project = temporary.path().join("project"); + init_registry_project(&ProjectInitOptions { + starter, + directory: project.clone(), + }) + .unwrap_or_else(|error| panic!("{starter:?} starter initializes: {error:#}")); + let report = compare_registry_project_to_embedded_starter_semantically( + &ProjectStarterSemanticComparisonOptions { + project_directory: project, + environment: "local".to_owned(), + starter: Some(starter), + }, + ) + .unwrap_or_else(|error| panic!("{starter:?} starter compares: {error:#}")); + assert_eq!( + report.assurance, + SemanticComparisonAssurance::EmbeddedExactRelease, + "{starter:?}" + ); + assert_eq!( + report.equivalence, + SemanticComparisonEquivalence::Equivalent, + "{starter:?}" + ); + assert!(report.changes.is_empty(), "{starter:?}"); + assert!(report.required_actions.is_empty(), "{starter:?}"); + } +} + +#[test] +fn explicit_starter_kind_must_match_recorded_project_provenance() { + let temporary = tempfile::tempdir().expect("temporary directory"); + let project = temporary.path().join("project"); + init_http_project(&project); + + let error = compare_registry_project_to_embedded_starter_semantically( + &ProjectStarterSemanticComparisonOptions { + project_directory: project, + environment: "local".to_owned(), + starter: Some(ProjectStarter::Snapshot), + }, + ) + .expect_err("a mismatched explicit starter kind fails closed"); + assert_eq!( + error.to_string(), + "selected embedded starter does not match project starter provenance" + ); +} + +#[test] +fn compare_cli_emits_value_free_human_and_strict_json_reports() { + let temporary = tempfile::tempdir().expect("temporary directory"); + let project = temporary.path().join("project"); + init_http_project(&project); + let project_argument = project.to_str().expect("temporary path is UTF-8"); + + let json_output = Command::new(env!("CARGO_BIN_EXE_registryctl")) + .args([ + "compare", + "--project-dir", + project_argument, + "--environment", + "local", + "--from-starter", + "--format", + "json", + ]) + .output() + .expect("registryctl compare runs"); + assert!( + json_output.status.success(), + "{}", + String::from_utf8_lossy(&json_output.stderr) + ); + let report: registryctl::ProjectSemanticComparisonReportV1 = + serde_json::from_slice(&json_output.stdout).expect("JSON report is strict and typed"); + assert_eq!( + report.equivalence, + SemanticComparisonEquivalence::Equivalent + ); + let serialized = String::from_utf8(json_output.stdout).expect("JSON output is UTF-8"); + assert!(!serialized.contains(project_argument)); + + let explicit_output = Command::new(env!("CARGO_BIN_EXE_registryctl")) + .args([ + "compare", + "--project-dir", + project_argument, + "--environment", + "local", + "--from-starter", + "http", + "--format", + "json", + ]) + .output() + .expect("registryctl explicit starter comparison runs"); + assert!( + explicit_output.status.success(), + "{}", + String::from_utf8_lossy(&explicit_output.stderr) + ); + let explicit_report: registryctl::ProjectSemanticComparisonReportV1 = + serde_json::from_slice(&explicit_output.stdout) + .expect("explicit starter JSON report is strict and typed"); + assert_eq!( + explicit_report.equivalence, + SemanticComparisonEquivalence::Equivalent + ); + + let mismatch = Command::new(env!("CARGO_BIN_EXE_registryctl")) + .args([ + "compare", + "--project-dir", + project_argument, + "--environment", + "local", + "--from-starter", + "snapshot", + ]) + .output() + .expect("registryctl mismatched starter comparison runs"); + assert!(!mismatch.status.success()); + assert_eq!( + String::from_utf8_lossy(&mismatch.stderr).trim(), + "Error: selected embedded starter does not match project starter provenance" + ); + assert!(!String::from_utf8_lossy(&mismatch.stderr).contains(project_argument)); + + let human_output = Command::new(env!("CARGO_BIN_EXE_registryctl")) + .args([ + "compare", + "--project-dir", + project_argument, + "--environment", + "local", + "--from-starter", + ]) + .output() + .expect("registryctl compare human output runs"); + assert!(human_output.status.success()); + let human = String::from_utf8(human_output.stdout).expect("human output is UTF-8"); + assert!(human.contains("semantic comparison: equivalent")); + assert!(human.contains("External approval: not evaluated")); + assert!(!human.contains(project_argument)); +} + +#[test] +fn fixture_change_is_included_in_the_generated_pending_review_plan() { + let temporary = tempfile::tempdir().expect("temporary directory"); + let baseline = temporary.path().join("baseline"); + let current = temporary.path().join("current"); + init_http_project(&baseline); + init_http_project(¤t); + rewrite_yaml( + ¤t.join("integrations/person-record/fixtures/active.yaml"), + |document| { + document["interactions"][0]["respond"]["body"]["active"] = Value::Bool(false); + document["expect"]["outputs"]["active"] = Value::Bool(false); + document["expect"]["claims"]["person-active"] = Value::Bool(false); + }, + ); + let report = compare_projects(¤t, &baseline); + assert_eq!( + report.review_plan.state, + SemanticComparisonReviewPlanState::GeneratedPendingReview + ); + assert!(report + .changes + .iter() + .any(|change| change.dimension == SemanticComparisonDimension::Fixture)); + assert!(report.changes.iter().any(|change| { + change.address.schema_family == SemanticComparisonSchemaFamily::GeneratedApproval + })); +} diff --git a/crates/registryctl/tests/project_semantic_comparison_contract.rs b/crates/registryctl/tests/project_semantic_comparison_contract.rs new file mode 100644 index 000000000..300766141 --- /dev/null +++ b/crates/registryctl/tests/project_semantic_comparison_contract.rs @@ -0,0 +1,91 @@ +// SPDX-License-Identifier: Apache-2.0 + +use jsonschema::{Draft, JSONSchema}; +use registryctl::ProjectSemanticComparisonReportV1; +use serde_json::{json, Value}; + +const SCHEMA: &str = + include_str!("../schemas/project-reports/registry.project.semantic_comparison.v1.schema.json"); +const FIXTURE: &str = + include_str!("fixtures/project-reports/registry.project.semantic_comparison.v1.json"); + +fn parse(input: &str) -> Value { + serde_json::from_str(input).expect("JSON parses") +} + +fn validator() -> JSONSchema { + JSONSchema::options() + .with_draft(Draft::Draft202012) + .compile(&parse(SCHEMA)) + .expect("semantic-comparison schema compiles") +} + +fn assert_invalid(document: &Value) { + assert!( + validator().validate(document).is_err(), + "document should fail the strict schema" + ); +} + +#[test] +fn canonical_fixture_validates_and_roundtrips_exactly() { + let document = parse(FIXTURE); + if let Err(errors) = validator().validate(&document) { + panic!( + "fixture should validate: {:?}", + errors.map(|error| error.to_string()).collect::>() + ); + } + let decoded: ProjectSemanticComparisonReportV1 = + serde_json::from_value(document.clone()).expect("fixture decodes"); + let encoded = serde_json::to_value(decoded).expect("fixture re-encodes"); + assert_eq!(encoded, document); +} + +#[test] +fn root_and_nested_unknown_fields_fail_closed() { + let mut root = parse(FIXTURE); + root["future"] = json!(true); + assert_invalid(&root); + assert!(serde_json::from_value::(root).is_err()); + + let mut nested = parse(FIXTURE); + nested["changes"][0]["address"]["runtime_value"] = json!("forbidden"); + assert_invalid(&nested); + assert!(serde_json::from_value::(nested).is_err()); +} + +#[test] +fn schema_enforces_change_occurrence_and_array_bounds() { + let fixture = parse(FIXTURE); + + let mut zero_occurrences = fixture.clone(); + zero_occurrences["changes"][0]["occurrences"] = json!(0); + assert_invalid(&zero_occurrences); + + let mut excessive_occurrences = fixture.clone(); + excessive_occurrences["changes"][0]["occurrences"] = json!(8193); + assert_invalid(&excessive_occurrences); + + let mut excessive_changes = fixture; + let change = excessive_changes["changes"][0].clone(); + excessive_changes["changes"] = Value::Array(vec![change; 1025]); + assert_invalid(&excessive_changes); +} + +#[test] +fn fixed_evidence_limitations_cannot_be_reordered_or_extended() { + let mut reordered = parse(FIXTURE); + reordered["evidence_limitations"] + .as_array_mut() + .expect("limitations array") + .swap(0, 1); + assert_invalid(&reordered); + + let mut extended = parse(FIXTURE); + extended["evidence_limitations"] + .as_array_mut() + .expect("limitations array") + .push(json!("future_limitation")); + assert_invalid(&extended); +} diff --git a/docs/site/.markdownlint-cli2.yaml b/docs/site/.markdownlint-cli2.yaml index afc98087b..eee34856f 100644 --- a/docs/site/.markdownlint-cli2.yaml +++ b/docs/site/.markdownlint-cli2.yaml @@ -31,6 +31,9 @@ config: - QuickstartMeta - ProjectStarterSequence - ProjectWorkspaceJourneys + - AuthoringConfigurationReference + - DiagnosticReference + - StandardJourney - Steps globs: - "**/*.{md,mdx}" diff --git a/docs/site/README.md b/docs/site/README.md index 45afc29c8..9f970a545 100644 --- a/docs/site/README.md +++ b/docs/site/README.md @@ -63,5 +63,12 @@ Data-backed reference tables are generated from: - `src/data/contracts.yaml` - `src/data/standards.yaml` - `src/data/openapi-sources.yaml` +- `registryctl authoring reference` for the five project-authoring schemas and the generated Relay + and Notary runtime schemas +- `registryctl authoring reference --coverage` for reviewed field-intent coverage Run `npm run generate` after editing these files. +Generation refuses to publish the authoring reference when any reachable schema path lacks reviewed +intent or when the reference and coverage contracts disagree. The generator reads committed schemas, +typed field knowledge, and reviewed product-owned intent sidecars. It never reads a country workspace, +runtime configuration, environment value, or secret. diff --git a/docs/site/astro.config.mjs b/docs/site/astro.config.mjs index 141103674..6bbb2da49 100644 --- a/docs/site/astro.config.mjs +++ b/docs/site/astro.config.mjs @@ -105,7 +105,7 @@ export default defineConfig({ // to their new homes so old links and search results keep resolving. redirects: { '/start/': internalRedirect('/'), - '/start/see-it-live/': internalRedirect('/tutorials/publish-spreadsheet-secured-registry-api/'), + '/start/see-it-live/': internalRedirect('/journeys/spreadsheet-protected-api/'), '/explanation/trust-posture-and-security-guarantees/': internalRedirect('/security/'), '/reference/security-self-assessment/': internalRedirect('/security/self-assessment/'), '/reference/openssf-evidence/': internalRedirect('/security/openssf-evidence/'), @@ -251,114 +251,112 @@ export default defineConfig({ href: 'https://github.com/registrystack/registry-stack/tree/main/docs/site', }, ], - // Diataxis IA: Get started, Tutorials, Products, Explanation, Reference. - // The per-product groups are generated from src/data/repo-docs.yaml by - // scripts/generate-sidebar.mjs (the productSidebar array), so each - // product menu follows its doc_type/nav_order and never drifts from the - // manifest. Within a product, pages are sub-grouped by Diataxis type - // once the product grows past a threshold; smaller products stay flat. - // generatedProduct() lifts each group into its own top-level product - // section; hand-authored operator tutorials append after the generated - // items. - // - // "Get started" leads with the promoted local first-run journey. The - // hosted pages remain visible but held until their fresh-reader gates - // pass. Named source-system paths live under Integrations. + // Task-oriented IA: Start, Journeys, Configure, Verify, Generated + // artifacts, Operate, Reference, and Specifications. The product + // groups remain generated from src/data/repo-docs.yaml, so Relay and + // Notary retain their complete product navigation while project + // authoring is a first-class stack surface rather than an integration + // sub-section. Product pages keep their established URLs; the sidebar + // changes discovery, not the public route contract. sidebar: [ { - label: 'Get started', + label: 'Start', items: [ - // Short nav labels to avoid wrapping in the narrow sidebar; page - // titles keep the full wording. { label: 'Overview', link: '/' }, - { label: 'Your first registry API', slug: 'tutorials/publish-spreadsheet-secured-registry-api' }, - { label: 'Your first claim check', slug: 'tutorials/verify-claim-registry-api' }, { label: 'When to use', slug: 'start/when-to-use' }, - { label: 'Run Solmara Lab', slug: 'tutorials/first-run-with-solmara-lab' }, - { label: 'Hosted Relay demo (held)', slug: 'start/quickstart' }, - ], - }, - { - label: 'Registry Relay', - collapsed: true, - items: [ - ...generatedProduct('Relay').items, - { label: 'Deploy with own data', slug: 'tutorials/deploy-standalone-with-own-data' }, + { label: 'Test one current source revision', slug: 'start/test-current-source-revision' }, + { label: 'Architecture', slug: 'explanation/architecture' }, + { label: 'Boundaries and map', slug: 'map/boundaries-and-map' }, ], }, { - label: 'Registry Notary', - collapsed: true, + label: 'Journeys', items: [ - ...generatedProduct('Notary').items, - { label: 'Production signing', slug: 'tutorials/move-notary-to-production-signing' }, + { label: 'Overview', slug: 'journeys' }, + { label: 'Spreadsheet protected API', slug: 'journeys/spreadsheet-protected-api' }, + { label: 'Instance OpenAPI', slug: 'journeys/instance-openapi' }, + { label: 'Bounded HTTP', slug: 'journeys/bounded-http' }, + { label: 'Bounded multi-call script', slug: 'journeys/bounded-multi-call-script' }, + { label: 'Exact snapshot', slug: 'journeys/exact-snapshot' }, + { label: 'Registry-backed Notary claim', slug: 'journeys/registry-backed-notary-claim' }, + { label: 'Product-input lifecycle', slug: 'journeys/product-input-lifecycle' }, ], }, { - label: 'Registry Manifest', - collapsed: true, - items: generatedProduct('Manifest').items, - }, - { - label: 'Integrations', + label: 'Configure', items: [ + { label: 'Overview', slug: 'configure' }, { label: 'Author a Registry Stack project', slug: 'tutorials/author-registry-project' }, { label: 'API-key source authentication', slug: 'tutorials/configure-project-api-key-authentication' }, { label: 'FHIR R4 integration', slug: 'tutorials/configure-project-fhir-r4' }, { label: 'Snapshot materialization', slug: 'tutorials/configure-project-snapshot-materialization' }, { label: 'Script source adapter', slug: 'tutorials/configure-project-script-adapter' }, - { label: 'OpenCRVS claims', slug: 'tutorials/verify-opencrvs-claims' }, + { + label: 'Registry Relay', + collapsed: true, + items: [ + ...generatedProduct('Relay').items, + { label: 'Deploy with own data', slug: 'tutorials/deploy-standalone-with-own-data' }, + ], + }, + { + label: 'Registry Notary', + collapsed: true, + items: [ + ...generatedProduct('Notary').items, + { label: 'Production signing', slug: 'tutorials/move-notary-to-production-signing' }, + ], + }, ], }, { - label: 'Concepts', - collapsed: true, + label: 'Verify', items: [ - { label: 'Architecture', slug: 'explanation/architecture' }, - { label: 'Records stay home', slug: 'explanation/records-stay-home' }, - { label: 'Boundaries and map', slug: 'map/boundaries-and-map' }, - { label: 'Relay protected read flow', slug: 'explanation/consultation-flow' }, - { label: 'Evidence issuance', slug: 'explanation/evidence-issuance' }, - { label: 'Disclosure modes', slug: 'explanation/disclosure-modes-and-computed-answers' }, - { label: 'Data minimization', slug: 'explanation/data-minimization-and-purpose-limitation' }, - { label: 'Trusted context', slug: 'explanation/trusted-context-constraints' }, - { label: 'Integration patterns', slug: 'explanation/integration-patterns' }, - { label: 'DPI safeguards', slug: 'explanation/dpi-safeguards-alignment' }, + { label: 'Overview', slug: 'verify' }, + { label: 'Evaluate a registry-backed claim', slug: 'tutorials/verify-claim-registry-api' }, + { label: 'Configure OpenCRVS claims', slug: 'tutorials/verify-opencrvs-claims' }, + { label: 'Security self-assessment', slug: 'security/self-assessment' }, + { label: 'OpenSSF and release trust', slug: 'security/openssf-evidence' }, ], }, { - // The reviewer/auditor-facing rail: the enforced model, the threat - // model, the canonical limits hub, and the public evidence a - // security reviewer can check. - label: 'Security', + label: 'Generated artifacts', collapsed: true, items: [ - { label: 'Overview', slug: 'security' }, - { label: 'Threat model', slug: 'explanation/threat-model' }, - { label: 'Known limitations', slug: 'explanation/known-limitations' }, - { label: 'Harden a deployment', slug: 'security/hardening-checklist' }, - { label: 'Report a vulnerability', slug: 'security/report-a-vulnerability' }, - { label: 'Security support window', slug: 'security/support-window' }, - { label: 'Self-assessment', slug: 'security/self-assessment' }, - { label: 'OpenSSF evidence', slug: 'security/openssf-evidence' }, + { label: 'Overview', slug: 'generated-artifacts' }, + { label: 'Project configuration', slug: 'reference/project-configuration' }, + { + label: 'Registry Manifest', + collapsed: true, + items: generatedProduct('Manifest').items, + }, + { label: 'Contracts', slug: 'reference/contracts' }, + { label: 'API references', slug: 'reference/apis' }, ], }, { - // Stack-wide operator procedures that span both products. Product- - // specific ops pages stay inside each product's generated group. + // Stack-wide operator procedures span the runtime products. The + // product-specific procedures remain in their Relay and Notary + // product navigation under Configure. label: 'Operate', collapsed: true, items: [ + { label: 'Overview', slug: 'operate' }, { label: 'Single-node Compose', slug: 'operate/single-node-compose-behind-proxy' }, { label: 'Backup and restore', slug: 'operate/backup-and-restore' }, { label: 'Retention and state', slug: 'operate/retention-and-persistent-state' }, { label: 'Upgrade and roll back', slug: 'operate/upgrade-and-rollback' }, + { label: 'Advanced operations', slug: 'operate/advanced' }, + { label: 'Harden a deployment', slug: 'security/hardening-checklist' }, + { label: 'Report a vulnerability', slug: 'security/report-a-vulnerability' }, + { label: 'Security support window', slug: 'security/support-window' }, ], }, { label: 'Reference', collapsed: true, items: [ + { label: 'Overview', slug: 'reference' }, { label: 'API reference', collapsed: true, @@ -372,13 +370,39 @@ export default defineConfig({ }, { label: 'registryctl CLI', slug: 'reference/registryctl' }, { label: 'Errors and status codes', slug: 'reference/errors' }, + { + label: 'Diagnostic catalogs', + collapsed: true, + items: [ + { label: 'Authoring diagnostics', slug: 'reference/diagnostics/authoring' }, + { label: 'Fixture diagnostics', slug: 'reference/diagnostics/fixture' }, + { label: 'Operator diagnostics', slug: 'reference/diagnostics/operator' }, + ], + }, { label: 'Environment variables', slug: 'reference/environment-variables' }, - { label: 'Contracts', slug: 'reference/contracts' }, { label: 'API stability and versioning', slug: 'reference/api-stability' }, { label: 'Deprecation policy', slug: 'reference/deprecation-policy' }, { label: 'Standards', slug: 'reference/standards' }, { label: 'ITB and SEMIC evidence', slug: 'reference/itb-semic-evidence' }, { label: 'Glossary', slug: 'reference/glossary' }, + { + label: 'Concepts', + collapsed: true, + items: [ + { label: 'Records stay home', slug: 'explanation/records-stay-home' }, + { label: 'Relay protected read flow', slug: 'explanation/consultation-flow' }, + { label: 'Evidence issuance', slug: 'explanation/evidence-issuance' }, + { label: 'Disclosure modes', slug: 'explanation/disclosure-modes-and-computed-answers' }, + { label: 'Data minimization', slug: 'explanation/data-minimization-and-purpose-limitation' }, + { label: 'Trusted context', slug: 'explanation/trusted-context-constraints' }, + { label: 'Integration patterns', slug: 'explanation/integration-patterns' }, + { label: 'DPI safeguards', slug: 'explanation/dpi-safeguards-alignment' }, + { label: 'Security overview', slug: 'security' }, + { label: 'Threat model', slug: 'explanation/threat-model' }, + { label: 'Known limitations', slug: 'explanation/known-limitations' }, + ], + }, + { label: 'Changelog', slug: 'changelog' }, ], }, { @@ -401,7 +425,6 @@ export default defineConfig({ { label: 'RS-DM-MANIFEST · Portable metadata model', slug: 'spec/rs-dm-manifest' }, ], }, - { label: 'Changelog', slug: 'changelog' }, ], }), ...(isArchivedBuild ? [disabledSitemap] : [sitemap()]), diff --git a/docs/site/package.json b/docs/site/package.json index c120afd41..b242280fc 100644 --- a/docs/site/package.json +++ b/docs/site/package.json @@ -14,7 +14,9 @@ "assemble:archives": "node scripts/assemble-archives.mjs", "archive:snapshot": "node scripts/archive-lock.mjs snapshot", "preview": "astro preview", - "generate": "node scripts/generate-data.mjs && node scripts/generate-project-starters.mjs && node scripts/fetch-openapi.mjs && node scripts/sync-repo-docs.mjs && node scripts/generate-sidebar.mjs", + "generate": "node scripts/generate-data.mjs && node scripts/generate-project-starters.mjs && node scripts/generate-authoring-reference.mjs && node scripts/generate-diagnostic-references.mjs && node scripts/fetch-openapi.mjs && node scripts/generate-standard-journeys.mjs && node scripts/sync-repo-docs.mjs && node scripts/generate-sidebar.mjs", + "generate:archive": "node scripts/generate-data.mjs && node scripts/fetch-openapi.mjs && node scripts/sync-repo-docs.mjs && node scripts/generate-sidebar.mjs", + "pretest": "cargo --version", "test": "node --test \"scripts/**/*.test.mjs\"", "check:llms:built": "node scripts/check-llms.mjs", "check:docset": "node scripts/check-docset.mjs", diff --git a/docs/site/public/generated/configuration-reference-coverage.v1.json b/docs/site/public/generated/configuration-reference-coverage.v1.json new file mode 100644 index 000000000..096de7d05 --- /dev/null +++ b/docs/site/public/generated/configuration-reference-coverage.v1.json @@ -0,0 +1,157 @@ +{ + "schema_id": "https://id.registrystack.org/schemas/registryctl/project-documentation/registry.project.configuration_reference_coverage.v1.schema.json", + "format_version": "1.0", + "status": "complete", + "reference_baseline": { + "generator_lifecycle": "unreleased", + "published_release": null, + "field_history_status": "not_verified", + "history_verification_method": null, + "compared_releases": [] + }, + "source_contract": { + "schemas": [ + "project", + "environment", + "integration", + "fixture", + "entity", + "relay", + "notary" + ], + "schema_sources": [ + "project.schema.json", + "environment.schema.json", + "integration.schema.json", + "fixture.schema.json", + "entity.schema.json", + "registry-relay.config.schema.json", + "registry-notary.config.schema.json" + ], + "field_knowledge": "schemas/project-authoring/parity-coverage.json#field_knowledge", + "human_intent": "schemas/project-authoring/documentation-intent.json", + "runtime_intent": [ + "crates/registry-relay/config/documentation-intent.json", + "crates/registry-notary-core/config/documentation-intent.json" + ], + "reads_country_workspaces": false, + "reads_runtime_configuration": false + }, + "coverage": { + "schema_count": 7, + "path_count": 1758, + "reference_count": 482, + "by_schema": { + "project": 219, + "environment": 191, + "integration": 138, + "fixture": 62, + "entity": 35, + "relay": 584, + "notary": 529 + }, + "by_path_kind": { + "root": 7, + "property": 1406, + "map_key": 25, + "map_value": 47, + "array_item": 177, + "branch": 96 + }, + "by_sensitivity": { + "public": 16, + "internal": 1140, + "sensitive": 396, + "secret_reference": 41, + "redacted_fixture": 50, + "structural": 115 + }, + "by_intent_source": { + "schema_description": 503, + "reviewed_override": 243, + "structural_taxonomy": 121, + "reviewed_profile": 891 + }, + "by_intent_profile": { + "notary_audit_internal": 4, + "notary_audit_secret_reference": 1, + "notary_audit_sensitive": 2, + "notary_auth_internal": 13, + "notary_auth_oidc_scope_map_open_map": 1, + "notary_auth_secret_reference": 4, + "notary_auth_sensitive": 95, + "notary_cel_internal": 14, + "notary_config_trust_internal": 1, + "notary_config_trust_sensitive": 4, + "notary_credential_status_sensitive": 4, + "notary_deployment_internal": 13, + "notary_deployment_sensitive": 1, + "notary_evidence_claims_evidence_mode_consultations_inputs_open_map": 1, + "notary_evidence_claims_evidence_mode_consultations_open_map": 1, + "notary_evidence_claims_evidence_mode_consultations_outputs_open_map": 1, + "notary_evidence_claims_rule_bindings_claims_open_map": 1, + "notary_evidence_credential_profiles_open_map": 1, + "notary_evidence_internal": 91, + "notary_evidence_secret_reference": 5, + "notary_evidence_sensitive": 40, + "notary_evidence_signing_keys_open_map": 1, + "notary_evidence_variables_open_map": 1, + "notary_federation_internal": 43, + "notary_federation_secret_reference": 1, + "notary_federation_sensitive": 5, + "notary_instance_internal": 5, + "notary_instance_sensitive": 1, + "notary_oid4vci_credential_configurations_open_map": 1, + "notary_oid4vci_internal": 33, + "notary_oid4vci_sensitive": 48, + "notary_root_structural": 1, + "notary_server_internal": 13, + "notary_server_sensitive": 2, + "notary_state_internal": 6, + "notary_state_secret_reference": 2, + "notary_state_sensitive": 1, + "notary_subject_access_sensitive": 67, + "relay_audit_internal": 9, + "relay_audit_secret_reference": 1, + "relay_audit_sensitive": 1, + "relay_auth_internal": 15, + "relay_auth_oidc_scope_map_open_map": 1, + "relay_auth_secret_reference": 4, + "relay_auth_sensitive": 15, + "relay_catalog_internal": 1, + "relay_catalog_public": 6, + "relay_catalog_sensitive": 1, + "relay_config_trust_internal": 1, + "relay_config_trust_sensitive": 4, + "relay_consultation_internal": 26, + "relay_consultation_secret_reference": 8, + "relay_consultation_sensitive": 20, + "relay_datasets_internal": 391, + "relay_datasets_secret_reference": 1, + "relay_datasets_sensitive": 7, + "relay_deployment_internal": 12, + "relay_deployment_sensitive": 2, + "relay_instance_internal": 1, + "relay_instance_public": 4, + "relay_metadata_internal": 6, + "relay_metadata_sensitive": 1, + "relay_root_structural": 1, + "relay_server_internal": 13, + "relay_server_sensitive": 5, + "relay_standards_internal": 18, + "relay_standards_sensitive": 3, + "relay_standards_spdci_registries_expression_fields_open_map": 1, + "relay_standards_spdci_registries_identifiers_open_map": 1, + "relay_standards_spdci_registries_open_map": 1, + "relay_standards_spdci_registries_response_fields_open_map": 1, + "relay_vocabularies_internal": 1, + "relay_vocabularies_open_map": 1 + } + }, + "reviewed_intent_assignment_required_count": 1758, + "reviewed_intent_assignment_covered_count": 1758, + "distinct_reviewed_intent_count": 588, + "distinct_reviewed_intents_reused_count": 83, + "reviewed_intent_assignments_using_reused_intent_count": 1253, + "missing_intent": [] +} diff --git a/docs/site/public/generated/configuration-reference.v1.json b/docs/site/public/generated/configuration-reference.v1.json new file mode 100644 index 000000000..6026660c6 --- /dev/null +++ b/docs/site/public/generated/configuration-reference.v1.json @@ -0,0 +1,149733 @@ +{ + "schema_id": "https://id.registrystack.org/schemas/registryctl/project-documentation/registry.project.configuration_reference.v1.schema.json", + "format_version": "1.0", + "reference_baseline": { + "generator_lifecycle": "unreleased", + "published_release": null, + "field_history_status": "not_verified", + "history_verification_method": null, + "compared_releases": [] + }, + "source_contract": { + "schemas": [ + "project", + "environment", + "integration", + "fixture", + "entity", + "relay", + "notary" + ], + "schema_sources": [ + "project.schema.json", + "environment.schema.json", + "integration.schema.json", + "fixture.schema.json", + "entity.schema.json", + "registry-relay.config.schema.json", + "registry-notary.config.schema.json" + ], + "field_knowledge": "schemas/project-authoring/parity-coverage.json#field_knowledge", + "human_intent": "schemas/project-authoring/documentation-intent.json", + "runtime_intent": [ + "crates/registry-relay/config/documentation-intent.json", + "crates/registry-notary-core/config/documentation-intent.json" + ], + "reads_country_workspaces": false, + "reads_runtime_configuration": false + }, + "coverage": { + "schema_count": 7, + "path_count": 1758, + "reference_count": 482, + "by_schema": { + "project": 219, + "environment": 191, + "integration": 138, + "fixture": 62, + "entity": 35, + "relay": 584, + "notary": 529 + }, + "by_path_kind": { + "root": 7, + "property": 1406, + "map_key": 25, + "map_value": 47, + "array_item": 177, + "branch": 96 + }, + "by_sensitivity": { + "public": 16, + "internal": 1140, + "sensitive": 396, + "secret_reference": 41, + "redacted_fixture": 50, + "structural": 115 + }, + "by_intent_source": { + "schema_description": 503, + "reviewed_override": 243, + "structural_taxonomy": 121, + "reviewed_profile": 891 + }, + "by_intent_profile": { + "notary_audit_internal": 4, + "notary_audit_secret_reference": 1, + "notary_audit_sensitive": 2, + "notary_auth_internal": 13, + "notary_auth_oidc_scope_map_open_map": 1, + "notary_auth_secret_reference": 4, + "notary_auth_sensitive": 95, + "notary_cel_internal": 14, + "notary_config_trust_internal": 1, + "notary_config_trust_sensitive": 4, + "notary_credential_status_sensitive": 4, + "notary_deployment_internal": 13, + "notary_deployment_sensitive": 1, + "notary_evidence_claims_evidence_mode_consultations_inputs_open_map": 1, + "notary_evidence_claims_evidence_mode_consultations_open_map": 1, + "notary_evidence_claims_evidence_mode_consultations_outputs_open_map": 1, + "notary_evidence_claims_rule_bindings_claims_open_map": 1, + "notary_evidence_credential_profiles_open_map": 1, + "notary_evidence_internal": 91, + "notary_evidence_secret_reference": 5, + "notary_evidence_sensitive": 40, + "notary_evidence_signing_keys_open_map": 1, + "notary_evidence_variables_open_map": 1, + "notary_federation_internal": 43, + "notary_federation_secret_reference": 1, + "notary_federation_sensitive": 5, + "notary_instance_internal": 5, + "notary_instance_sensitive": 1, + "notary_oid4vci_credential_configurations_open_map": 1, + "notary_oid4vci_internal": 33, + "notary_oid4vci_sensitive": 48, + "notary_root_structural": 1, + "notary_server_internal": 13, + "notary_server_sensitive": 2, + "notary_state_internal": 6, + "notary_state_secret_reference": 2, + "notary_state_sensitive": 1, + "notary_subject_access_sensitive": 67, + "relay_audit_internal": 9, + "relay_audit_secret_reference": 1, + "relay_audit_sensitive": 1, + "relay_auth_internal": 15, + "relay_auth_oidc_scope_map_open_map": 1, + "relay_auth_secret_reference": 4, + "relay_auth_sensitive": 15, + "relay_catalog_internal": 1, + "relay_catalog_public": 6, + "relay_catalog_sensitive": 1, + "relay_config_trust_internal": 1, + "relay_config_trust_sensitive": 4, + "relay_consultation_internal": 26, + "relay_consultation_secret_reference": 8, + "relay_consultation_sensitive": 20, + "relay_datasets_internal": 391, + "relay_datasets_secret_reference": 1, + "relay_datasets_sensitive": 7, + "relay_deployment_internal": 12, + "relay_deployment_sensitive": 2, + "relay_instance_internal": 1, + "relay_instance_public": 4, + "relay_metadata_internal": 6, + "relay_metadata_sensitive": 1, + "relay_root_structural": 1, + "relay_server_internal": 13, + "relay_server_sensitive": 5, + "relay_standards_internal": 18, + "relay_standards_sensitive": 3, + "relay_standards_spdci_registries_expression_fields_open_map": 1, + "relay_standards_spdci_registries_identifiers_open_map": 1, + "relay_standards_spdci_registries_open_map": 1, + "relay_standards_spdci_registries_response_fields_open_map": 1, + "relay_vocabularies_internal": 1, + "relay_vocabularies_open_map": 1 + } + }, + "fields": [ + { + "address": { + "schema": "project", + "pointer": "", + "path_kind": "root" + }, + "purpose": "Declares the product-neutral Registry Stack project graph: integrations, materialized entities, and Relay or Notary services.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": true + }, + "requiredness": "not_applicable", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": true, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "version", + "registry", + "services" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/access/properties/scopes", + "path_kind": "property" + }, + "purpose": "Lists the scopes a caller must hold to use the enclosing evidence service.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 16 + }, + { + "keyword": "minItems", + "value": 1 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/access/properties/scopes/items", + "path_kind": "array_item" + }, + "purpose": "Non-empty token without commas, whitespace, or control characters.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/token", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/token" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/claimValue/properties/max_bytes", + "path_kind": "property" + }, + "purpose": "Bounds the encoded size of a source-free claim value.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 65536 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/claimValue/properties/nullable", + "path_kind": "property" + }, + "purpose": "States whether the source-free claim value may be null.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/claimValue/properties/type", + "path_kind": "property" + }, + "purpose": "Declares the boolean, integer, string, or date type of a source-free claim value.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "boolean", + "integer", + "string", + "date" + ] + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/consultations/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "integration", + "input" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/consultations/additionalProperties/properties/input", + "path_kind": "property" + }, + "purpose": "Maps integration input names to reviewed target-request identifier or attribute bindings.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 16 + }, + { + "keyword": "minProperties", + "value": 1 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/consultations/additionalProperties/properties/input/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Closed target request binding. Attribute values are bounded typed caller-supplied context, not authenticated identifiers.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/targetRequestMapping", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 128 + }, + { + "keyword": "pattern", + "value": "^request\\.target\\.(?:id|identifiers\\.[A-Za-z][A-Za-z0-9._-]{0,95}|attributes\\.[a-z][a-z0-9_]{0,63})$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/targetRequestMapping" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/consultations/additionalProperties/properties/input/propertyNames", + "path_kind": "map_key" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/consultations/additionalProperties/properties/integration", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/consultations/propertyNames", + "path_kind": "map_key" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/disclosure/oneOf/0", + "path_kind": "branch" + }, + "purpose": "Maximum detail a claim may disclose.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "local_reference": "#/$defs/disclosureMode", + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "value", + "predicate", + "redacted" + ] + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/disclosureMode" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/disclosure/oneOf/1", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "default", + "allowed" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/disclosure/oneOf/1/properties/allowed", + "path_kind": "property" + }, + "purpose": "Lists the disclosure modes that may be selected in addition to the policy's declared default.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "minItems", + "value": 1 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/disclosure/oneOf/1/properties/allowed/items", + "path_kind": "array_item" + }, + "purpose": "Maximum detail a claim may disclose.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "local_reference": "#/$defs/disclosureMode", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "value", + "predicate", + "redacted" + ] + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/disclosureMode" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/disclosure/oneOf/1/properties/default", + "path_kind": "property" + }, + "purpose": "Maximum detail a claim may disclose.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "local_reference": "#/$defs/disclosureMode", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "value", + "predicate", + "redacted" + ] + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/disclosureMode" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/access", + "path_kind": "property" + }, + "purpose": "Scopes a caller must hold to use an evidence service.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/access", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "scopes" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/access" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/claims", + "path_kind": "property" + }, + "purpose": "Maps evidence claim identifiers to an output or CEL expression, value contract, and disclosure policy.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 64 + }, + { + "keyword": "minProperties", + "value": 1 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/claims/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": true + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "disclosure" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/claims/additionalProperties/oneOf/0", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "output" + ] + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/claims/additionalProperties/oneOf/1", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "cel" + ] + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/claims/additionalProperties/properties/cel", + "path_kind": "property" + }, + "purpose": "Provides the CEL expression used for a source-free evaluation-only evidence claim.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/claims/additionalProperties/properties/disclosure", + "path_kind": "property" + }, + "purpose": "Fixed disclosure mode or a default constrained by explicitly allowed alternatives.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/disclosure", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [], + "local_reference": { + "schema": "project", + "pointer": "/$defs/disclosure" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/claims/additionalProperties/properties/output", + "path_kind": "property" + }, + "purpose": "Selects the exact Relay consultation output that backs this evidence claim.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/claims/additionalProperties/properties/value", + "path_kind": "property" + }, + "purpose": "Explicit claim value type, nullability, and encoded-size bound for source-free evaluation. A source-free claim cannot be selected by a credential profile.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/claimValue", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "type" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/claimValue" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/claims/propertyNames", + "path_kind": "map_key" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/consent", + "path_kind": "property" + }, + "purpose": "States whether evaluation of this evidence service requires consent.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "not_required", + "required" + ] + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/consultations", + "path_kind": "property" + }, + "purpose": "Relay consultations and their closed bindings to target request identifiers or caller-supplied target attributes.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/consultations", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 16 + }, + { + "keyword": "minProperties", + "value": 1 + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/consultations" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/credential_profiles", + "path_kind": "property" + }, + "purpose": "Credential profiles may select only claims backed by an exact Relay consultation. Source-free claim evaluation cannot be exposed as credential capability.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 32 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/credential_profiles/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "format", + "type", + "validity", + "claims" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/credential_profiles/additionalProperties/properties/claims", + "path_kind": "property" + }, + "purpose": "Lists the registry-backed evidence claims selected into this credential profile.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "minItems", + "value": 1 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/credential_profiles/additionalProperties/properties/claims/items", + "path_kind": "array_item" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/credential_profiles/additionalProperties/properties/format", + "path_kind": "property" + }, + "purpose": "Non-empty token without commas, whitespace, or control characters.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/token", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/token" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/credential_profiles/additionalProperties/properties/type", + "path_kind": "property" + }, + "purpose": "Declares the credential type identifier emitted for this reviewed credential profile.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 2048 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/credential_profiles/additionalProperties/properties/validity", + "path_kind": "property" + }, + "purpose": "Bounds the lifetime of credentials issued from this profile using a positive duration.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[1-9][0-9]*(?:s|m|h)$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/credential_profiles/propertyNames", + "path_kind": "map_key" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/kind", + "path_kind": "property" + }, + "purpose": "Identifies this service declaration as a Notary evidence policy.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": "evidence" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/legal_basis", + "path_kind": "property" + }, + "purpose": "Non-empty token without commas, whitespace, or control characters.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/token", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/token" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/purpose", + "path_kind": "property" + }, + "purpose": "Non-empty token without commas, whitespace, or control characters.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/token", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/token" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/variables", + "path_kind": "property" + }, + "purpose": "Typed request variables exposed to evidence evaluation.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/variables", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 16 + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/variables" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/version", + "path_kind": "property" + }, + "purpose": "Assigns the positive authored version used to track this evidence-service policy contract.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/fieldList/items", + "path_kind": "array_item" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/filterOperators/items", + "path_kind": "array_item" + }, + "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "eq", + "in", + "gte", + "lte", + "between" + ] + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregate/anyOf/0", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "measures" + ] + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregate/anyOf/1", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "indicators" + ] + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregate/properties/access", + "path_kind": "property" + }, + "purpose": "Defines optional metadata and aggregate scopes and whether execution is restricted to aggregate-only access.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/recordAggregateAccess", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/recordAggregateAccess" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregate/properties/allowed_filters", + "path_kind": "property" + }, + "purpose": "Maps aggregate filter fields to the comparison operators permitted for each field.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregate/properties/allowed_filters/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Allowed operators for one queryable field.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "array" + ], + "local_reference": "#/$defs/filterOperators", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "minItems", + "value": 1 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/filterOperators" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregate/properties/default_group_by", + "path_kind": "property" + }, + "purpose": "Bounded unique list of entity field identifiers.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "array" + ], + "local_reference": "#/$defs/fieldList", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 16 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/fieldList" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregate/properties/description", + "path_kind": "property" + }, + "purpose": "Bounded human-readable project metadata.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/text", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 2048 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/text" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregate/properties/dimensions", + "path_kind": "property" + }, + "purpose": "Lists the labeled entity fields available as governed aggregate dimensions.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregate/properties/dimensions/items", + "path_kind": "array_item" + }, + "purpose": "Named grouping dimension backed by one entity field.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/recordAggregateDimension", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id", + "label", + "field" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/recordAggregateDimension" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregate/properties/disclosure_control", + "path_kind": "property" + }, + "purpose": "Defines the minimum group size and suppression behavior applied before aggregate results are disclosed.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregate/properties/disclosure_control/properties/min_group_size", + "path_kind": "property" + }, + "purpose": "Sets the smallest result group that may be disclosed without suppression.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregate/properties/disclosure_control/properties/suppression", + "path_kind": "property" + }, + "purpose": "Selects whether undersized aggregate groups are omitted, masked, or represented as null.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "omit", + "mask", + "null" + ] + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregate/properties/group_by", + "path_kind": "property" + }, + "purpose": "Bounded unique list of entity field identifiers.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "array" + ], + "local_reference": "#/$defs/fieldList", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 16 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/fieldList" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregate/properties/indicators", + "path_kind": "property" + }, + "purpose": "Lists the named aggregate indicators, functions, source columns, and measurement metadata.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregate/properties/indicators/items", + "path_kind": "array_item" + }, + "purpose": "SDMX-style aggregate indicator with units and display metadata.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/recordAggregateIndicator", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id", + "label", + "function", + "column", + "unit_measure" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/recordAggregateIndicator" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregate/properties/joins", + "path_kind": "property" + }, + "purpose": "Bounded unique list of entity field identifiers.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "array" + ], + "local_reference": "#/$defs/fieldList", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 16 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/fieldList" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregate/properties/measures", + "path_kind": "property" + }, + "purpose": "Lists the named aggregation functions and entity columns used to compute this aggregate.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "minItems", + "value": 1 + }, + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregate/properties/measures/items", + "path_kind": "array_item" + }, + "purpose": "Named aggregate calculation over one entity column.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/recordAggregateMeasure", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "name", + "function", + "column" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/recordAggregateMeasure" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregate/properties/required_principal_filters", + "path_kind": "property" + }, + "purpose": "Bounded unique list of entity field identifiers.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "array" + ], + "local_reference": "#/$defs/fieldList", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 16 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/fieldList" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregate/properties/spatial", + "path_kind": "property" + }, + "purpose": "Defines the reviewed administrative-area spatial aggregation and geometry materialization bindings.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/recordAggregateSpatial", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "mode", + "dimension", + "geometry_entity", + "geometry_id_field", + "geometry_field" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/recordAggregateSpatial" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregate/properties/temporal_field", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregate/properties/title", + "path_kind": "property" + }, + "purpose": "Bounded human-readable project metadata.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/text", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 2048 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/text" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateAccess/properties/aggregate_only_execution", + "path_kind": "property" + }, + "purpose": "Restricts this definition to aggregate execution so it cannot be used as a record-level result path.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateAccess/properties/aggregate_scope", + "path_kind": "property" + }, + "purpose": "Authorization scope token.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/scope", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 128 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/scope" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateAccess/properties/metadata_scope", + "path_kind": "property" + }, + "purpose": "Authorization scope token.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/scope", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 128 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/scope" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateDimension/properties/codelist", + "path_kind": "property" + }, + "purpose": "Bounded human-readable project metadata.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/text", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 2048 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/text" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateDimension/properties/field", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateDimension/properties/id", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateDimension/properties/label", + "path_kind": "property" + }, + "purpose": "Bounded human-readable project metadata.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/text", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 2048 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/text" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateIndicator/properties/column", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateIndicator/properties/decimals", + "path_kind": "property" + }, + "purpose": "Sets the non-negative decimal precision published for this aggregate indicator.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateIndicator/properties/definition_uri", + "path_kind": "property" + }, + "purpose": "Bounded human-readable project metadata.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/text", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 2048 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/text" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateIndicator/properties/frequency", + "path_kind": "property" + }, + "purpose": "Bounded human-readable project metadata.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/text", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 2048 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/text" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateIndicator/properties/function", + "path_kind": "property" + }, + "purpose": "Selects the aggregation function used to compute this named indicator.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "local_reference": "#/$defs/recordAggregateFunction", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "count", + "sum", + "avg", + "min", + "max", + "median", + "count_distinct", + "stddev" + ] + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/recordAggregateFunction" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateIndicator/properties/id", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateIndicator/properties/label", + "path_kind": "property" + }, + "purpose": "Bounded human-readable project metadata.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/text", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 2048 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/text" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateIndicator/properties/unit_measure", + "path_kind": "property" + }, + "purpose": "Bounded human-readable project metadata.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/text", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 2048 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/text" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateIndicator/properties/unit_mult", + "path_kind": "property" + }, + "purpose": "Declares the base-ten unit multiplier published with this aggregate indicator.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 2147483647 + }, + { + "keyword": "minimum", + "value": -2147483648 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateMeasure/properties/column", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateMeasure/properties/function", + "path_kind": "property" + }, + "purpose": "Selects the aggregation function applied to the optional source column for this measure.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "local_reference": "#/$defs/recordAggregateFunction", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "count", + "sum", + "avg", + "min", + "max", + "median", + "count_distinct", + "stddev" + ] + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/recordAggregateFunction" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateMeasure/properties/name", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateSpatial/properties/bbox_fields", + "path_kind": "property" + }, + "purpose": "Maps the geometry entity fields that provide the minimum and maximum coordinates of its bounding box.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/recordSpatialBbox", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "min_x", + "min_y", + "max_x", + "max_y" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/recordSpatialBbox" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateSpatial/properties/collection_id", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateSpatial/properties/dimension", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateSpatial/properties/geometry_entity", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateSpatial/properties/geometry_field", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateSpatial/properties/geometry_id_field", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateSpatial/properties/max_geometry_vertices", + "path_kind": "property" + }, + "purpose": "Caps the number of vertices accepted when materializing one administrative-area geometry.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateSpatial/properties/mode", + "path_kind": "property" + }, + "purpose": "Selects the supported administrative-area aggregation mode for this spatial definition.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": "admin_area" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseExpression/properties/cel", + "path_kind": "property" + }, + "purpose": "Provides the bounded CEL expression evaluated only against the projected source object.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 4096 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims", + "path_kind": "property" + }, + "purpose": "Maps released claim names to their reviewed source or expression, requiredness, and sensitivity.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 32 + }, + { + "keyword": "minProperties", + "value": 1 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": true + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "required", + "sensitivity" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/additionalProperties/oneOf/0", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "source_field" + ] + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/additionalProperties/oneOf/1", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "expression" + ] + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/additionalProperties/properties/expression", + "path_kind": "property" + }, + "purpose": "Bounded CEL evaluated only against the projected source object.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/recordAttributeReleaseExpression", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "cel" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseExpression" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/additionalProperties/properties/required", + "path_kind": "property" + }, + "purpose": "States whether failure to produce this released claim makes the attribute-release result invalid.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/additionalProperties/properties/sensitivity", + "path_kind": "property" + }, + "purpose": "Classifies the released claim as a direct identifier, personal, public, or pseudonymous value.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "direct_identifier", + "personal", + "public", + "pseudonymous" + ] + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/additionalProperties/properties/source_field", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/propertyNames", + "path_kind": "map_key" + }, + "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9_]{0,63}$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfile/properties/description", + "path_kind": "property" + }, + "purpose": "Bounded human-readable project metadata.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/text", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 2048 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/text" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfile/properties/purpose", + "path_kind": "property" + }, + "purpose": "Binds the release to one permitted records purpose and requires a bounded visible-ASCII header token.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/token", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/token" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfile/properties/release_conditions", + "path_kind": "property" + }, + "purpose": "Contains the bounded expression that must authorize this purpose-bound attribute release.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "expression" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfile/properties/release_conditions/properties/expression", + "path_kind": "property" + }, + "purpose": "Bounded CEL evaluated only against the projected source object.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/recordAttributeReleaseExpression", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "cel" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseExpression" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfile/properties/release_scope", + "path_kind": "property" + }, + "purpose": "Requires the exact entity-bound :identity_release scope and keeps release access distinct from records API scopes.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/scope", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 128 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/scope" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfile/properties/subject", + "path_kind": "property" + }, + "purpose": "Defines the projected source field and identifier type used for exact-one subject resolution.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "source_field", + "id_type" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfile/properties/subject/properties/id_type", + "path_kind": "property" + }, + "purpose": "Labels the identifier type represented by the resolved subject identifier.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 64 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfile/properties/subject/properties/source_field", + "path_kind": "property" + }, + "purpose": "Selects the projected entity field whose value is matched for exact-one subject resolution.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfile/properties/title", + "path_kind": "property" + }, + "purpose": "Bounded human-readable project metadata.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/text", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 2048 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/text" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfile/properties/version", + "path_kind": "property" + }, + "purpose": "Assigns a portable path-segment version matching [A-Za-z0-9][A-Za-z0-9._-]{0,63} to identify one attribute-release profile contract.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 64 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfiles/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "One purpose-bound, minimized identity release compiled into the owning Relay entity.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/recordAttributeReleaseProfile", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "version", + "purpose", + "release_scope", + "subject", + "release_conditions", + "claims" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfile" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfiles/propertyNames", + "path_kind": "map_key" + }, + "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9_-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordFieldMap/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordFieldMap/propertyNames", + "path_kind": "map_key" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpatial/properties/bbox_fields", + "path_kind": "property" + }, + "purpose": "Maps optional entity fields containing precomputed minimum and maximum bounding-box coordinates.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/recordSpatialBbox", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "min_x", + "min_y", + "max_x", + "max_y" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/recordSpatialBbox" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpatial/properties/collection_id", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpatial/properties/datetime_field", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpatial/properties/description", + "path_kind": "property" + }, + "purpose": "Bounded human-readable project metadata.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/text", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 2048 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/text" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpatial/properties/geometry", + "path_kind": "property" + }, + "purpose": "Defines whether feature geometry comes from point-coordinate fields or one encoded geometry field.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/recordSpatialGeometry", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [], + "local_reference": { + "schema": "project", + "pointer": "/$defs/recordSpatialGeometry" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpatial/properties/max_bbox_degrees", + "path_kind": "property" + }, + "purpose": "Caps the geographic span accepted for one bounding-box query.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "number" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "exclusiveMinimum", + "value": 0 + }, + { + "keyword": "type", + "value": "number" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpatial/properties/max_geometry_vertices", + "path_kind": "property" + }, + "purpose": "Caps the number of vertices accepted when returning one feature geometry.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpatial/properties/title", + "path_kind": "property" + }, + "purpose": "Bounded human-readable project metadata.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/text", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 2048 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/text" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpatialBbox/properties/max_x", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpatialBbox/properties/max_y", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpatialBbox/properties/min_x", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpatialBbox/properties/min_y", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpatialGeometry/oneOf/0", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "kind", + "longitude_field", + "latitude_field", + "crs" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpatialGeometry/oneOf/0/properties/crs", + "path_kind": "property" + }, + "purpose": "Non-empty token without commas, whitespace, or control characters.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/token", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/token" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpatialGeometry/oneOf/0/properties/kind", + "path_kind": "property" + }, + "purpose": "Selects geometry assembled from separate longitude and latitude entity fields.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": "point" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpatialGeometry/oneOf/0/properties/latitude_field", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpatialGeometry/oneOf/0/properties/longitude_field", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpatialGeometry/oneOf/1", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "kind", + "field", + "crs" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpatialGeometry/oneOf/1/properties/crs", + "path_kind": "property" + }, + "purpose": "Non-empty token without commas, whitespace, or control characters.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/token", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/token" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpatialGeometry/oneOf/1/properties/field", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpatialGeometry/oneOf/1/properties/kind", + "path_kind": "property" + }, + "purpose": "Selects the GeoJSON, WKT, or WKB encoding used by the configured geometry field.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "geojson", + "wkt", + "wkb" + ] + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpdci/properties/expression_fields", + "path_kind": "property" + }, + "purpose": "Maps SP-DCI expression input names to the entity fields available during expression evaluation.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/recordFieldMap", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 64 + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/recordFieldMap" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpdci/properties/identifiers", + "path_kind": "property" + }, + "purpose": "Maps SP-DCI identifier names to the entity fields used to identify a record.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/recordFieldMap", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 64 + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/recordFieldMap" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpdci/properties/record_type", + "path_kind": "property" + }, + "purpose": "Non-empty token without commas, whitespace, or control characters.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/token", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/token" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpdci/properties/registry", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpdci/properties/registry_type", + "path_kind": "property" + }, + "purpose": "Non-empty token without commas, whitespace, or control characters.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/token", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/token" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpdci/properties/response_fields", + "path_kind": "property" + }, + "purpose": "Maps SP-DCI response names to the entity fields returned for an authorized record.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/recordFieldMap", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 64 + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/recordFieldMap" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/aggregates", + "path_kind": "property" + }, + "purpose": "Maps aggregate identifiers to governed aggregate definitions exposed by the records API.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 64 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/aggregates/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Governed aggregate definition with disclosure controls.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/recordAggregate", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "description", + "disclosure_control" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/recordAggregate" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/aggregates/propertyNames", + "path_kind": "map_key" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/attribute_release_profiles", + "path_kind": "property" + }, + "purpose": "Purpose-bound, exact-one identity releases keyed by stable profile id. Generated Relay responses omit source metadata and are never cacheable.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/recordAttributeReleaseProfiles", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 16 + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfiles" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/filters", + "path_kind": "property" + }, + "purpose": "Maps filterable entity fields to the comparison operators the records API permits for each field.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 256 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/filters/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Allowed operators for one queryable field.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "array" + ], + "local_reference": "#/$defs/filterOperators", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "minItems", + "value": 1 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/filterOperators" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/filters/propertyNames", + "path_kind": "map_key" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/pagination", + "path_kind": "property" + }, + "purpose": "Defines the default and maximum row limits enforced by records API pagination.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "default_limit", + "max_limit" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/pagination/properties/default_limit", + "path_kind": "property" + }, + "purpose": "Sets the row limit applied when a records request does not supply its own limit.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 10000 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/pagination/properties/max_limit", + "path_kind": "property" + }, + "purpose": "Caps the row limit that any records request may select; it must be at least 2 when attribute-release profiles are configured so ambiguous subjects can be detected.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 10000 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/projection", + "path_kind": "property" + }, + "purpose": "Lists the entity fields that the records API is permitted to project into row responses.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 256 + }, + { + "keyword": "minItems", + "value": 1 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/projection/items", + "path_kind": "array_item" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/purposes", + "path_kind": "property" + }, + "purpose": "Lists the bounded purpose identifiers accepted by this records API policy.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 32 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/purposes/items", + "path_kind": "array_item" + }, + "purpose": "Non-empty token without commas, whitespace, or control characters.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/token", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/token" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/relationships", + "path_kind": "property" + }, + "purpose": "Declares the bounded named relationships that records queries may follow between authored entities.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 64 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/relationships/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "kind", + "target", + "foreign_key" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/relationships/additionalProperties/properties/concept_uri", + "path_kind": "property" + }, + "purpose": "Bounded human-readable project metadata.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/text", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 2048 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/text" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/relationships/additionalProperties/properties/foreign_key", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/relationships/additionalProperties/properties/kind", + "path_kind": "property" + }, + "purpose": "Selects whether one declared records relationship belongs to, has many, or has one target record.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "belongs_to", + "has_many", + "has_one" + ] + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/relationships/additionalProperties/properties/target", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/relationships/propertyNames", + "path_kind": "map_key" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/required_principal_filters", + "path_kind": "property" + }, + "purpose": "Lists principal-bound fields required for records queries; it must be empty when attribute-release profiles are configured because subject lookup cannot supply principal filters.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "array" + ], + "local_reference": "#/$defs/fieldList", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 16 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/fieldList" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/scopes", + "path_kind": "property" + }, + "purpose": "Groups the authorization scopes required for records metadata, row access, aggregates, and evidence verification.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "metadata", + "rows" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/scopes/properties/aggregate", + "path_kind": "property" + }, + "purpose": "Authorization scope token.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/scope", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 128 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/scope" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/scopes/properties/evidence_verification", + "path_kind": "property" + }, + "purpose": "Authorization scope token.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/scope", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 128 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/scope" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/scopes/properties/metadata", + "path_kind": "property" + }, + "purpose": "Authorization scope token.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/scope", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 128 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/scope" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/scopes/properties/rows", + "path_kind": "property" + }, + "purpose": "Authorization scope token.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/scope", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 128 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/scope" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/standards", + "path_kind": "property" + }, + "purpose": "Declares whether this records API exposes its reviewed OGC Features and SP-DCI standards profiles.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "ogc_features", + "sp_dci" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/standards/properties/ogc_features", + "path_kind": "property" + }, + "purpose": "Disables OGC API Features support or supplies the reviewed spatial profile used to enable it.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": true + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/standards/properties/ogc_features/oneOf/0", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "const", + "value": false + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/standards/properties/ogc_features/oneOf/1", + "path_kind": "branch" + }, + "purpose": "OGC API Features collection metadata and bounded geometry mapping.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/recordSpatial", + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "geometry" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/recordSpatial" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/standards/properties/sp_dci", + "path_kind": "property" + }, + "purpose": "Disables SP-DCI support or supplies the reviewed registry mapping used to enable it.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": true + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/standards/properties/sp_dci/oneOf/0", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "const", + "value": false + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/standards/properties/sp_dci/oneOf/1", + "path_kind": "branch" + }, + "purpose": "SP-DCI registry identity and field mappings for a records service.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/recordSpdci", + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "registry", + "registry_type", + "record_type", + "identifiers", + "expression_fields" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/recordSpdci" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsService/properties/access_rights", + "path_kind": "property" + }, + "purpose": "Classifies the records service as public, restricted, or non-public for catalog and access metadata.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "public", + "restricted", + "non_public" + ] + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsService/properties/api", + "path_kind": "property" + }, + "purpose": "Relay records API behavior, authorization, query bounds, and standards profiles.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/recordsApi", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "scopes", + "projection", + "pagination", + "standards" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/recordsApi" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsService/properties/conforms_to", + "path_kind": "property" + }, + "purpose": "Lists the standards or specifications to which the records service declares conformance.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 32 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsService/properties/conforms_to/items", + "path_kind": "array_item" + }, + "purpose": "Bounded human-readable project metadata.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/text", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 2048 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/text" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsService/properties/description", + "path_kind": "property" + }, + "purpose": "Bounded human-readable project metadata.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/text", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 2048 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/text" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsService/properties/entity", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsService/properties/kind", + "path_kind": "property" + }, + "purpose": "Identifies this service declaration as a Relay records API backed by an authored entity.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": "records_api" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsService/properties/owner", + "path_kind": "property" + }, + "purpose": "Bounded human-readable project metadata.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/text", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 2048 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/text" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsService/properties/sensitivity", + "path_kind": "property" + }, + "purpose": "Classifies the overall sensitivity of records exposed by this service declaration.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "public", + "internal", + "personal", + "confidential", + "secret" + ] + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsService/properties/title", + "path_kind": "property" + }, + "purpose": "Bounded human-readable project metadata.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/text", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 2048 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/text" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsService/properties/update_frequency", + "path_kind": "property" + }, + "purpose": "Declares the reviewed cadence at which the records service's backing data is updated.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "continuous", + "daily", + "weekly", + "termly", + "monthly", + "quarterly", + "annual", + "irregular", + "as_needed", + "unknown" + ] + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/service/oneOf/0", + "path_kind": "branch" + }, + "purpose": "Notary evidence policy, consultations, claims, and registry-backed credential profiles. Source-free claims remain evaluation-only and cannot be selected by a credential profile.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/evidenceService", + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "kind", + "version", + "purpose", + "legal_basis", + "consent", + "access", + "claims" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/evidenceService" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/service/oneOf/1", + "path_kind": "branch" + }, + "purpose": "Relay records API backed by one authored materialized entity.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/recordsService", + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "kind", + "entity", + "api" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/recordsService" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/variables/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "from", + "type" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/variables/additionalProperties/properties/from", + "path_kind": "property" + }, + "purpose": "Binds one evidence variable to its caller-supplied request variable path.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^request\\.variables\\.[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/variables/additionalProperties/properties/type", + "path_kind": "property" + }, + "purpose": "Declares the request variable as a date value for typed evidence evaluation.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": "date" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/variables/propertyNames", + "path_kind": "map_key" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/anyOf/0", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "integrations" + ] + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/anyOf/0/properties/integrations", + "path_kind": "property" + }, + "purpose": "Requires at least one authored integration when the project satisfies the integration-content alternative.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "minProperties", + "value": 1 + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/anyOf/1", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "entities" + ] + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/anyOf/1/properties/entities", + "path_kind": "property" + }, + "purpose": "Requires at least one authored entity when the project satisfies the entity-content alternative.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "minProperties", + "value": 1 + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/anyOf/2", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "services" + ] + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/anyOf/2/properties/services", + "path_kind": "property" + }, + "purpose": "Requires at least one authored service when the project satisfies the service-content alternative.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "minProperties", + "value": 1 + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/properties/entities", + "path_kind": "property" + }, + "purpose": "Materialized entity definitions keyed by project-local entity identifier.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 32 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/properties/entities/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "file" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/properties/entities/additionalProperties/properties/file", + "path_kind": "property" + }, + "purpose": "Selects the project-relative authored entity document for this project-local entity identifier.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/relativePath", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 4096 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^(?!/)(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/relativePath" + } + }, + { + "address": { + "schema": "project", + "pointer": "/properties/entities/propertyNames", + "path_kind": "map_key" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/properties/integrations", + "path_kind": "property" + }, + "purpose": "Source adaptation definitions keyed by project-local integration identifier.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 16 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/properties/integrations/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "file" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/properties/integrations/additionalProperties/properties/file", + "path_kind": "property" + }, + "purpose": "Selects the project-relative authored integration document for this project-local integration identifier.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/relativePath", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 4096 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^(?!/)(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/relativePath" + } + }, + { + "address": { + "schema": "project", + "pointer": "/properties/integrations/propertyNames", + "path_kind": "map_key" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/properties/registry", + "path_kind": "property" + }, + "purpose": "Stable identity of the Registry Stack project.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/properties/registry/properties/id", + "path_kind": "property" + }, + "purpose": "Assigns the stable project-local registry identifier used to bind generated product inputs and review artifacts.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/properties/services", + "path_kind": "property" + }, + "purpose": "Relay records APIs and Notary evidence services exposed by the project.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 32 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/properties/services/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Closed choice between a Notary evidence service and a Relay records service.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "local_reference": "#/$defs/service", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [], + "local_reference": { + "schema": "project", + "pointer": "/$defs/service" + } + }, + { + "address": { + "schema": "project", + "pointer": "/properties/services/propertyNames", + "path_kind": "map_key" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/properties/starter", + "path_kind": "property" + }, + "purpose": "Immutable provenance for a workspace initialized from a Registry Stack starter. The digest excludes this content_digest field and covers the starter's authored project files.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id", + "release", + "content_digest" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/properties/starter/properties/content_digest", + "path_kind": "property" + }, + "purpose": "Digest of the initialized starter authoring content, used to report later workspace divergence.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^sha256:[0-9a-f]{64}$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/properties/starter/properties/id", + "path_kind": "property" + }, + "purpose": "Registry Stack starter identifier.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/properties/starter/properties/release", + "path_kind": "property" + }, + "purpose": "Registry Stack release that supplied the starter.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/token", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/token" + } + }, + { + "address": { + "schema": "project", + "pointer": "/properties/version", + "path_kind": "property" + }, + "purpose": "Project authoring format version.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "public", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": 1 + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "", + "path_kind": "root" + }, + "purpose": "Binds a Registry Stack project to environment-specific services, sources, credentials, and deployment topology.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": true + }, + "requiredness": "not_applicable", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": true, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "version", + "deployment" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/ca/properties/file", + "path_kind": "property" + }, + "purpose": "Normalized absolute path without dot segments or duplicate separators.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/absolutePath", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 4096 + }, + { + "keyword": "minLength", + "value": 2 + }, + { + "keyword": "pattern", + "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/absolutePath" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/ca/properties/generation", + "path_kind": "property" + }, + "purpose": "Records the operator-controlled trust-root generation used for explicit certificate-authority rotation.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 18446744073709551615 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/credential/oneOf/0", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "username", + "password", + "generation" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/credential/oneOf/0/properties/generation", + "path_kind": "property" + }, + "purpose": "Records the generation of the operator-managed basic-authentication credential references.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 18446744073709551615 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/credential/oneOf/0/properties/password", + "path_kind": "property" + }, + "purpose": "Reference to a process-environment variable; secret values are never authored here.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/secret", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "secret" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/secret" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/credential/oneOf/0/properties/username", + "path_kind": "property" + }, + "purpose": "Reference to a process-environment variable; secret values are never authored here.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/secret", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "secret" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/secret" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/credential/oneOf/1", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "token", + "generation" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/credential/oneOf/1/properties/generation", + "path_kind": "property" + }, + "purpose": "Records the generation of the operator-managed bearer-token credential reference.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 18446744073709551615 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/credential/oneOf/1/properties/token", + "path_kind": "property" + }, + "purpose": "Reference to a process-environment variable; secret values are never authored here.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/secret", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "secret" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/secret" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/credential/oneOf/2", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "client_id", + "client_secret", + "generation" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/credential/oneOf/2/properties/client_id", + "path_kind": "property" + }, + "purpose": "Reference to a process-environment variable; secret values are never authored here.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/secret", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "secret" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/secret" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/credential/oneOf/2/properties/client_secret", + "path_kind": "property" + }, + "purpose": "Reference to a process-environment variable; secret values are never authored here.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/secret", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "secret" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/secret" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/credential/oneOf/2/properties/generation", + "path_kind": "property" + }, + "purpose": "Records the generation of the operator-managed OAuth client credential references.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 18446744073709551615 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/credential/oneOf/3", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "value", + "generation" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/credential/oneOf/3/properties/generation", + "path_kind": "property" + }, + "purpose": "Records the generation of the operator-managed API-key credential reference.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 18446744073709551615 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/credential/oneOf/3/properties/value", + "path_kind": "property" + }, + "purpose": "Reference to a process-environment variable; secret values are never authored here.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/secret", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "secret" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/secret" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/endpoint/properties/allowed_private_cidrs", + "path_kind": "property" + }, + "purpose": "Explicit private network ranges this source may resolve to.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "array" + ], + "local_reference": "#/$defs/privateCidrs", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 16 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/privateCidrs" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/endpoint/properties/ca", + "path_kind": "property" + }, + "purpose": "Pinned certificate-authority file and its rotation generation.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/ca", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "file", + "generation" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/ca" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/endpoint/properties/generation", + "path_kind": "property" + }, + "purpose": "Records the operator-controlled private-endpoint generation used for explicit binding rotation.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 18446744073709551615 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/endpoint/properties/mtls", + "path_kind": "property" + }, + "purpose": "Client certificate and private-key reference for mutual TLS.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/mtls", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "certificate_file", + "private_key", + "generation" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/mtls" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/endpoint/properties/origin", + "path_kind": "property" + }, + "purpose": "HTTPS origin without path, query, or fragment.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/origin", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "format", + "value": "uri" + }, + { + "keyword": "pattern", + "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/origin" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/endpoint/properties/path", + "path_kind": "property" + }, + "purpose": "Binds a reviewed private endpoint path beneath its separately configured origin.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 4096 + }, + { + "keyword": "minLength", + "value": 2 + }, + { + "keyword": "pattern", + "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//)(?!.*[?#]).+$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/entity/properties/columns", + "path_kind": "property" + }, + "purpose": "Maps authored entity field names to columns supplied by the environment-owned provider.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "minProperties", + "value": 1 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/entity/properties/columns/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/entity/properties/columns/propertyNames", + "path_kind": "map_key" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/entity/properties/generation", + "path_kind": "property" + }, + "purpose": "Records the operator-controlled generation of this entity materialization binding.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/entity/properties/provider", + "path_kind": "property" + }, + "purpose": "Environment-specific physical provider for a materialized entity.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/provider", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/provider" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/entity/properties/source_revision", + "path_kind": "property" + }, + "purpose": "Records the operator-supplied revision label of the bound entity source.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/integration/properties/source", + "path_kind": "property" + }, + "purpose": "Runtime source connection policy for one authored integration.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/source", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "origin" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/source" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/internalOrigin/anyOf/0", + "path_kind": "branch" + }, + "purpose": "HTTPS origin without path, query, or fragment.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/origin", + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "format", + "value": "uri" + }, + { + "keyword": "pattern", + "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/origin" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/internalOrigin/anyOf/1", + "path_kind": "branch" + }, + "purpose": "HTTP IP-loopback origin; public Relay and issuer fields restrict it to the local profile, while internal Notary-to-Relay connections allow it in any profile.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/localLoopbackOrigin", + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "format", + "value": "uri" + }, + { + "keyword": "pattern", + "value": "^[hH][tT][tT][pP]://(?:127(?:\\.[0-9]{1,3}){3}|\\[::1\\])(?::[0-9]+)?/?$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/localLoopbackOrigin" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/mtls/properties/certificate_file", + "path_kind": "property" + }, + "purpose": "Normalized absolute path without dot segments or duplicate separators.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/absolutePath", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 4096 + }, + { + "keyword": "minLength", + "value": 2 + }, + { + "keyword": "pattern", + "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/absolutePath" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/mtls/properties/generation", + "path_kind": "property" + }, + "purpose": "Records the operator-controlled mutual-TLS generation used for explicit certificate and key rotation.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 18446744073709551615 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/mtls/properties/private_key", + "path_kind": "property" + }, + "purpose": "Reference to a process-environment variable; secret values are never authored here.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/secret", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "secret" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/secret" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/access_token", + "path_kind": "property" + }, + "purpose": "Dedicated Notary access-token signing key and published key identifier.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "signing_key", + "signing_kid" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/access_token/properties/signing_key", + "path_kind": "property" + }, + "purpose": "Reference to a process-environment variable; secret values are never authored here.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/secret", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "secret" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/secret" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/access_token/properties/signing_kid", + "path_kind": "property" + }, + "purpose": "Bounded visible-ASCII token, including full verification-method identifiers.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/token2048", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 2048 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^[!-~]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/token2048" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/allowed_wallet_origins", + "path_kind": "property" + }, + "purpose": "Exact HTTPS browser origins admitted to the wallet-facing Notary routes.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 16 + }, + { + "keyword": "minItems", + "value": 1 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/allowed_wallet_origins/items", + "path_kind": "array_item" + }, + "purpose": "HTTPS origin without path, query, or fragment.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/origin", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uri" + }, + { + "keyword": "pattern", + "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/origin" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/authorization_server", + "path_kind": "property" + }, + "purpose": "Pinned eSignet issuer and exact endpoints used for login and token validation.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "issuer", + "jwks_url", + "userinfo_url", + "authorize_url", + "token_url" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/authorization_server/properties/authorize_url", + "path_kind": "property" + }, + "purpose": "Relay authentication resource using HTTPS, or HTTP IP-loopback under the local profile.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "local_reference": "#/$defs/relayResource", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/relayResource" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/authorization_server/properties/issuer", + "path_kind": "property" + }, + "purpose": "Relay or issuer origin using HTTPS, or HTTP IP-loopback under the local profile.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "local_reference": "#/$defs/relayOrigin", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/relayOrigin" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/authorization_server/properties/jwks_url", + "path_kind": "property" + }, + "purpose": "Relay authentication resource using HTTPS, or HTTP IP-loopback under the local profile.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "local_reference": "#/$defs/relayResource", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/relayResource" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/authorization_server/properties/token_url", + "path_kind": "property" + }, + "purpose": "Relay authentication resource using HTTPS, or HTTP IP-loopback under the local profile.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "local_reference": "#/$defs/relayResource", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/relayResource" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/authorization_server/properties/userinfo_url", + "path_kind": "property" + }, + "purpose": "Relay authentication resource using HTTPS, or HTTP IP-loopback under the local profile.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "local_reference": "#/$defs/relayResource", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/relayResource" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/client", + "path_kind": "property" + }, + "purpose": "eSignet relying-party identity and dedicated private-key reference.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id", + "signing_key", + "signing_kid" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/client/properties/id", + "path_kind": "property" + }, + "purpose": "Bounded visible-ASCII protocol token.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/token256", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^[!-~]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/token256" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/client/properties/signing_key", + "path_kind": "property" + }, + "purpose": "Reference to a process-environment variable; secret values are never authored here.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/secret", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "secret" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/secret" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/client/properties/signing_kid", + "path_kind": "property" + }, + "purpose": "Bounded visible-ASCII token, including full verification-method identifiers.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/token2048", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 2048 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^[!-~]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/token2048" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/credential", + "path_kind": "property" + }, + "purpose": "Existing project service and credential profile exposed through OID4VCI.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "service", + "profile" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/credential/properties/profile", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/credential/properties/service", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/public_base_url", + "path_kind": "property" + }, + "purpose": "Relay or issuer origin using HTTPS, or HTTP IP-loopback under the local profile.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "local_reference": "#/$defs/relayOrigin", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/relayOrigin" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/redirect_uri", + "path_kind": "property" + }, + "purpose": "Relay authentication resource using HTTPS, or HTTP IP-loopback under the local profile.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "local_reference": "#/$defs/relayResource", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/relayResource" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/sensitive_state_key", + "path_kind": "property" + }, + "purpose": "Reference to a process-environment variable; secret values are never authored here.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/secret", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "secret" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/secret" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/subject", + "path_kind": "property" + }, + "purpose": "Verified eSignet userinfo claim bound exactly to the credential subject identifier.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "token_claim", + "id_type" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/subject/properties/id_type", + "path_kind": "property" + }, + "purpose": "Bounded visible-ASCII protocol token.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/token256", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^[!-~]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/token256" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/subject/properties/token_claim", + "path_kind": "property" + }, + "purpose": "Bounded visible-ASCII protocol token.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/token256", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^[!-~]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/token256" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/tx_code", + "path_kind": "property" + }, + "purpose": "Transaction-code policy. Omit for the secure required-PIN default. Set required=false only for a bounded bearer-offer interoperability profile; the compiler fixes the offer lifetime at 300 seconds.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/tx_code/properties/required", + "path_kind": "property" + }, + "purpose": "States whether OID4VCI authorization requires a transaction code before credential issuance.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "schema_value": true + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/privateCidrs/items", + "path_kind": "array_item" + }, + "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 64 + }, + { + "keyword": "minLength", + "value": 3 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/provider/oneOf/0", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "type", + "path" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/provider/oneOf/0/properties/delimiter", + "path_kind": "property" + }, + "purpose": "Selects the byte used to delimit fields in the bound CSV source.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 255 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/provider/oneOf/0/properties/header_row", + "path_kind": "property" + }, + "purpose": "Selects the one-based CSV row containing source column headers.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/provider/oneOf/0/properties/path", + "path_kind": "property" + }, + "purpose": "Normalized absolute path without dot segments or duplicate separators.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/absolutePath", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 4096 + }, + { + "keyword": "minLength", + "value": 2 + }, + { + "keyword": "pattern", + "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/absolutePath" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/provider/oneOf/0/properties/quote", + "path_kind": "property" + }, + "purpose": "Selects the byte used to quote fields in the bound CSV source.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 255 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/provider/oneOf/0/properties/type", + "path_kind": "property" + }, + "purpose": "Selects CSV as the environment-owned materialization provider for an authored entity.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": "csv" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/provider/oneOf/1", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "type", + "path", + "sheet" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/provider/oneOf/1/properties/data_range", + "path_kind": "property" + }, + "purpose": "Restricts entity materialization to the reviewed range within the selected worksheet.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/provider/oneOf/1/properties/header_row", + "path_kind": "property" + }, + "purpose": "Selects the one-based XLSX row containing source column headers.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/provider/oneOf/1/properties/path", + "path_kind": "property" + }, + "purpose": "Normalized absolute path without dot segments or duplicate separators.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/absolutePath", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 4096 + }, + { + "keyword": "minLength", + "value": 2 + }, + { + "keyword": "pattern", + "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/absolutePath" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/provider/oneOf/1/properties/sheet", + "path_kind": "property" + }, + "purpose": "Names the worksheet read from the environment-owned XLSX source.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/provider/oneOf/1/properties/type", + "path_kind": "property" + }, + "purpose": "Selects XLSX as the environment-owned materialization provider for an authored entity.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": "xlsx" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/provider/oneOf/2", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "type", + "path" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/provider/oneOf/2/properties/path", + "path_kind": "property" + }, + "purpose": "Normalized absolute path without dot segments or duplicate separators.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/absolutePath", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 4096 + }, + { + "keyword": "minLength", + "value": 2 + }, + { + "keyword": "pattern", + "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/absolutePath" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/provider/oneOf/2/properties/type", + "path_kind": "property" + }, + "purpose": "Selects Parquet as the environment-owned materialization provider for an authored entity.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": "parquet" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/provider/oneOf/3", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "type", + "connection", + "schema", + "table" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/provider/oneOf/3/properties/connection", + "path_kind": "property" + }, + "purpose": "Reference to a process-environment variable; secret values are never authored here.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/secret", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "secret" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/secret" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/provider/oneOf/3/properties/schema", + "path_kind": "property" + }, + "purpose": "Portable unquoted PostgreSQL schema or table identifier.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/postgresIdentifier", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9_]{0,62}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/postgresIdentifier" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/provider/oneOf/3/properties/table", + "path_kind": "property" + }, + "purpose": "Portable unquoted PostgreSQL schema or table identifier.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/postgresIdentifier", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9_]{0,62}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/postgresIdentifier" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/provider/oneOf/3/properties/type", + "path_kind": "property" + }, + "purpose": "Selects PostgreSQL as the environment-owned materialization provider for an authored entity.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": "postgres" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/relayOrigin/anyOf/0", + "path_kind": "branch" + }, + "purpose": "HTTPS origin without path, query, or fragment.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/origin", + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "format", + "value": "uri" + }, + { + "keyword": "pattern", + "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/origin" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/relayOrigin/anyOf/1", + "path_kind": "branch" + }, + "purpose": "HTTP IP-loopback origin; public Relay and issuer fields restrict it to the local profile, while internal Notary-to-Relay connections allow it in any profile.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/localLoopbackOrigin", + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "format", + "value": "uri" + }, + { + "keyword": "pattern", + "value": "^[hH][tT][tT][pP]://(?:127(?:\\.[0-9]{1,3}){3}|\\[::1\\])(?::[0-9]+)?/?$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/localLoopbackOrigin" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/relayResource/anyOf/0", + "path_kind": "branch" + }, + "purpose": "Exact HTTPS resource without query or fragment.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/httpsResource", + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "format", + "value": "uri" + }, + { + "keyword": "pattern", + "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/[^?#]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/httpsResource" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/relayResource/anyOf/1", + "path_kind": "branch" + }, + "purpose": "HTTP IP-loopback resource accepted only with the local deployment profile.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/localLoopbackResource", + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "format", + "value": "uri" + }, + { + "keyword": "pattern", + "value": "^[hH][tT][tT][pP]://(?:127(?:\\.[0-9]{1,3}){3}|\\[::1\\])(?::[0-9]+)?/[^?#]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/localLoopbackResource" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/secret/properties/secret", + "path_kind": "property" + }, + "purpose": "Names the operator-managed environment secret reference without containing the secret value.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[A-Z_][A-Z0-9_]{0,127}$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/service/properties/service", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/source/properties/allowed_private_cidrs", + "path_kind": "property" + }, + "purpose": "Explicit private network ranges this source may resolve to.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "array" + ], + "local_reference": "#/$defs/privateCidrs", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 16 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/privateCidrs" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/source/properties/ca", + "path_kind": "property" + }, + "purpose": "Pinned certificate-authority file and its rotation generation.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/ca", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "file", + "generation" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/ca" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/source/properties/concurrency", + "path_kind": "property" + }, + "purpose": "Caps the number of requests that may be in flight concurrently for this source.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 64 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/source/properties/credential", + "path_kind": "property" + }, + "purpose": "One supported source credential shape, containing references rather than values.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/credential", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/credential" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/source/properties/jwks", + "path_kind": "property" + }, + "purpose": "Security-bound HTTPS endpoint with optional private-network, CA, and mTLS policy.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/endpoint", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "origin", + "path", + "generation" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/endpoint" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/source/properties/mtls", + "path_kind": "property" + }, + "purpose": "Client certificate and private-key reference for mutual TLS.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/mtls", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "certificate_file", + "private_key", + "generation" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/mtls" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/source/properties/oauth", + "path_kind": "property" + }, + "purpose": "Security-bound HTTPS endpoint with optional private-network, CA, and mTLS policy.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/endpoint", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "origin", + "path", + "generation" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/endpoint" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/source/properties/origin", + "path_kind": "property" + }, + "purpose": "HTTPS origin without path, query, or fragment.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/origin", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "format", + "value": "uri" + }, + { + "keyword": "pattern", + "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/origin" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/source/properties/rate", + "path_kind": "property" + }, + "purpose": "Defines the per-minute request rate and burst bounds applied to one environment source.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "per_minute", + "burst" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/source/properties/rate/properties/burst", + "path_kind": "property" + }, + "purpose": "Caps the short request burst permitted by the source rate limiter.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 1024 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/source/properties/rate/properties/per_minute", + "path_kind": "property" + }, + "purpose": "Caps the number of requests permitted to this source during one minute.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 60000 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/source/properties/timeout", + "path_kind": "property" + }, + "purpose": "Bounds the elapsed time allowed for one request to this environment source.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[1-9][0-9]*(?:ms|s)$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/0", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/0/else", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/0/else/not", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "relay" + ] + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/0/if", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "deployment" + ] + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/0/if/properties/deployment", + "path_kind": "property" + }, + "purpose": "Matches environments whose deployment declaration enables Relay so the corresponding Relay binding is required.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "relay" + ] + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/0/then", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "relay" + ] + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/1", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/1/if", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "notary_relay" + ] + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/1/then", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/1/then/properties/deployment", + "path_kind": "property" + }, + "purpose": "Requires both Relay and Notary deployment services when a Notary-to-Relay binding is present.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "relay", + "notary" + ] + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/2", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/2/if", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "relay_state" + ] + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/2/then", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/2/then/properties/deployment", + "path_kind": "property" + }, + "purpose": "Requires the Relay deployment service when Relay state storage is configured.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "relay" + ] + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/3", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/3/if", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "notary_state" + ] + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/3/then", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/3/then/properties/deployment", + "path_kind": "property" + }, + "purpose": "Requires the Notary deployment service when Notary state storage is configured.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "notary" + ] + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/4", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/4/if", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "notary_cel" + ] + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/4/then", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/4/then/properties/deployment", + "path_kind": "property" + }, + "purpose": "Requires the Notary deployment service when a Notary CEL worker memory bound is configured.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "notary" + ] + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/5", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/5/else", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/5/else/properties/callers", + "path_kind": "property" + }, + "purpose": "When callers are authored without OID4VCI, requires the caller map to contain at least one binding; cross-file validation separately requires callers for Notary environments and rejects them for Relay-only topology.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "minProperties", + "value": 1 + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/5/if", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "oid4vci" + ] + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/5/then", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "notary_state" + ] + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/5/then/properties/deployment", + "path_kind": "property" + }, + "purpose": "Requires the Notary deployment service when OID4VCI issuance is configured.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "notary" + ] + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/6", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/6/else", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/6/else/properties/oid4vci", + "path_kind": "property" + }, + "purpose": "Applies non-local HTTPS constraints to public OID4VCI endpoints.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/6/else/properties/oid4vci/properties/authorization_server", + "path_kind": "property" + }, + "purpose": "Applies non-local HTTPS constraints to all configured OID4VCI authorization-server endpoints.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/6/else/properties/oid4vci/properties/authorization_server/properties/authorize_url", + "path_kind": "property" + }, + "purpose": "Exact HTTPS resource without query or fragment.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/httpsResource", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "format", + "value": "uri" + }, + { + "keyword": "pattern", + "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/[^?#]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/httpsResource" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/6/else/properties/oid4vci/properties/authorization_server/properties/issuer", + "path_kind": "property" + }, + "purpose": "HTTPS origin without path, query, or fragment.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/origin", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "format", + "value": "uri" + }, + { + "keyword": "pattern", + "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/origin" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/6/else/properties/oid4vci/properties/authorization_server/properties/jwks_url", + "path_kind": "property" + }, + "purpose": "Exact HTTPS resource without query or fragment.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/httpsResource", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "format", + "value": "uri" + }, + { + "keyword": "pattern", + "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/[^?#]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/httpsResource" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/6/else/properties/oid4vci/properties/authorization_server/properties/token_url", + "path_kind": "property" + }, + "purpose": "Exact HTTPS resource without query or fragment.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/httpsResource", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "format", + "value": "uri" + }, + { + "keyword": "pattern", + "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/[^?#]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/httpsResource" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/6/else/properties/oid4vci/properties/authorization_server/properties/userinfo_url", + "path_kind": "property" + }, + "purpose": "Exact HTTPS resource without query or fragment.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/httpsResource", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "format", + "value": "uri" + }, + { + "keyword": "pattern", + "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/[^?#]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/httpsResource" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/6/else/properties/oid4vci/properties/public_base_url", + "path_kind": "property" + }, + "purpose": "HTTPS origin without path, query, or fragment.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/origin", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "format", + "value": "uri" + }, + { + "keyword": "pattern", + "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/origin" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/6/else/properties/oid4vci/properties/redirect_uri", + "path_kind": "property" + }, + "purpose": "Exact HTTPS resource without query or fragment.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/httpsResource", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "format", + "value": "uri" + }, + { + "keyword": "pattern", + "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/[^?#]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/httpsResource" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/6/else/properties/relay", + "path_kind": "property" + }, + "purpose": "Applies non-local HTTPS constraints to the Relay origin, issuer, and key-set bindings.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/6/else/properties/relay/properties/issuer", + "path_kind": "property" + }, + "purpose": "HTTPS origin without path, query, or fragment.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/origin", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "format", + "value": "uri" + }, + { + "keyword": "pattern", + "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/origin" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/6/else/properties/relay/properties/jwks_url", + "path_kind": "property" + }, + "purpose": "Exact HTTPS resource without query or fragment.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/httpsResource", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "format", + "value": "uri" + }, + { + "keyword": "pattern", + "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/[^?#]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/httpsResource" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/6/else/properties/relay/properties/origin", + "path_kind": "property" + }, + "purpose": "HTTPS origin without path, query, or fragment.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/origin", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "format", + "value": "uri" + }, + { + "keyword": "pattern", + "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/origin" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/6/if", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/6/if/properties/deployment", + "path_kind": "property" + }, + "purpose": "Matches the local deployment profile before relaxing public endpoint transport constraints.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "profile" + ] + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/6/if/properties/deployment/properties/profile", + "path_kind": "property" + }, + "purpose": "Selects the local-profile condition used by the environment transport-validation branch.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": "local" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/callers", + "path_kind": "property" + }, + "purpose": "Notary API-key caller identities and the scopes each identity receives.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 64 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/callers/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "api_key_fingerprint", + "scopes" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/callers/additionalProperties/properties/api_key_fingerprint", + "path_kind": "property" + }, + "purpose": "Names the secret reference used to verify one caller API key; neither the key nor fingerprint value is authored here.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/secret", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "secret" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/secret" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/callers/additionalProperties/properties/scopes", + "path_kind": "property" + }, + "purpose": "Narrows one caller to the explicitly reviewed service scopes available in this environment.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 16 + }, + { + "keyword": "minItems", + "value": 1 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/callers/additionalProperties/properties/scopes/items", + "path_kind": "array_item" + }, + "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 128 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/callers/propertyNames", + "path_kind": "map_key" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/deployment", + "path_kind": "property" + }, + "purpose": "Products deployed in this environment and the operational profile they use.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": true + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "profile" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/deployment/anyOf/0", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "relay" + ] + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/deployment/anyOf/1", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "notary" + ] + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/deployment/properties/notary", + "path_kind": "property" + }, + "purpose": "Binds an authored product role to a deployed service identifier.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/service", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "service" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/service" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/deployment/properties/profile", + "path_kind": "property" + }, + "purpose": "Selects the deployment assurance profile whose service and transport conditions the environment must satisfy.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "local", + "hosted_lab", + "production", + "evidence_grade" + ] + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/deployment/properties/relay", + "path_kind": "property" + }, + "purpose": "Binds an authored product role to a deployed service identifier.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/service", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "service" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/service" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/entities", + "path_kind": "property" + }, + "purpose": "Environment-specific source bindings keyed by entity identifier.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 32 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/entities/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Maps an authored entity to provider columns and immutable source-generation identifiers.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/entity", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "provider", + "columns", + "source_revision", + "generation" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/entity" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/entities/propertyNames", + "path_kind": "map_key" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/integrations", + "path_kind": "property" + }, + "purpose": "Environment bindings keyed by authored integration identifier.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 16 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/integrations/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Environment binding for an authored source integration.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/integration", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "source" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/integration" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/integrations/propertyNames", + "path_kind": "map_key" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/issuance", + "path_kind": "property" + }, + "purpose": "Notary issuer and signing-key bindings for credential issuance.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "issuer", + "signing_key", + "signing_kid", + "generation" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/issuance/properties/algorithm", + "path_kind": "property" + }, + "purpose": "Credential issuer signing algorithm. Holder proof remains EdDSA with did:jwk.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "schema_value": "EdDSA" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "EdDSA", + "ES256" + ] + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/issuance/properties/generation", + "path_kind": "property" + }, + "purpose": "Records the operator-controlled issuance-key generation used for explicit rotation and rollback checks.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 18446744073709551615 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/issuance/properties/issuer", + "path_kind": "property" + }, + "purpose": "Binds the operator-approved credential issuer identifier without granting claim or disclosure authority.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/issuance/properties/signing_key", + "path_kind": "property" + }, + "purpose": "Names the operator-managed secret reference for credential signing; the signing key value is never authored or reported.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/secret", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "secret" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/secret" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/issuance/properties/signing_kid", + "path_kind": "property" + }, + "purpose": "Selects the reviewed signing-key identifier exposed in issued credential metadata without containing private key material.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/token2048", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 2048 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^[!-~]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/token2048" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/notary_cel", + "path_kind": "property" + }, + "purpose": "Optional per-worker data/address-space ceiling for dedicated Notary CEL processes. The Notary default is 134217728 bytes; 1073741824 is the maximum emulation-compatible exception and remains a limit, not an allocation.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "worker_memory_bytes" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/notary_cel/properties/worker_memory_bytes", + "path_kind": "property" + }, + "purpose": "Caps the memory available to one isolated Notary CEL worker.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 1073741824 + }, + { + "keyword": "minimum", + "value": 33554432 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/notary_relay", + "path_kind": "property" + }, + "purpose": "Deployment-internal Relay connection, Notary workload identity, and token file used only when Notary consults Relay.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "base_url", + "workload_client_id", + "token_file" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/notary_relay/properties/base_url", + "path_kind": "property" + }, + "purpose": "Binds Notary to the operator-reviewed Relay origin used for governed evidence consultations.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "local_reference": "#/$defs/internalOrigin", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/internalOrigin" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/notary_relay/properties/token_file", + "path_kind": "property" + }, + "purpose": "Selects the operator-managed token-file binding for Notary-to-Relay authentication without exposing its contents.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 4096 + }, + { + "keyword": "minLength", + "value": 2 + }, + { + "keyword": "pattern", + "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/notary_relay/properties/workload_client_id", + "path_kind": "property" + }, + "purpose": "Identifies the Notary workload client authorized to request reviewed Relay consultations.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/notary_state", + "path_kind": "property" + }, + "purpose": "Optional deployment binding for Notary-owned PostgreSQL state transport trust.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "postgresql" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/notary_state/properties/postgresql", + "path_kind": "property" + }, + "purpose": "Selects the PostgreSQL trust binding used by Notary state storage.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "root_certificate_path" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/notary_state/properties/postgresql/properties/root_certificate_path", + "path_kind": "property" + }, + "purpose": "Binds Notary state storage to an operator-managed PostgreSQL trust root at a deployment-local path.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/absolutePath", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 4096 + }, + { + "keyword": "minLength", + "value": 2 + }, + { + "keyword": "pattern", + "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/absolutePath" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/oid4vci", + "path_kind": "property" + }, + "purpose": "Explicit registry-backed holder-wallet OID4VCI binding for one authored Notary credential profile.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/oid4vci", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "public_base_url", + "credential", + "authorization_server", + "client", + "access_token", + "sensitive_state_key", + "subject", + "redirect_uri", + "allowed_wallet_origins" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/oid4vci" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/relay", + "path_kind": "property" + }, + "purpose": "Public Relay identity and token-validation settings for a Relay deployment.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "origin", + "issuer", + "jwks_url", + "audience", + "allowed_clients" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/relay/properties/allowed_clients", + "path_kind": "property" + }, + "purpose": "Narrows Relay authentication to the operator-reviewed client identifiers listed for this environment.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 64 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/relay/properties/allowed_clients/items", + "path_kind": "array_item" + }, + "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/relay/properties/audience", + "path_kind": "property" + }, + "purpose": "Binds the token audience Relay requires so tokens issued for another service are rejected.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/relay/properties/issuer", + "path_kind": "property" + }, + "purpose": "Binds the expected token issuer for Relay authentication in this deployment environment.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "local_reference": "#/$defs/relayOrigin", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/relayOrigin" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/relay/properties/jwks_url", + "path_kind": "property" + }, + "purpose": "Binds the operator-reviewed key-set endpoint Relay uses to verify caller tokens.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "local_reference": "#/$defs/relayResource", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/relayResource" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/relay/properties/origin", + "path_kind": "property" + }, + "purpose": "Binds the externally visible Relay origin reviewed by the operator and local network policy.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "local_reference": "#/$defs/relayOrigin", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/relayOrigin" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/relay_state", + "path_kind": "property" + }, + "purpose": "Optional deployment binding for Relay-owned consultation PostgreSQL state transport trust.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "postgresql" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/relay_state/properties/postgresql", + "path_kind": "property" + }, + "purpose": "Selects the PostgreSQL trust binding used by Relay state storage.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "root_certificate_path" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/relay_state/properties/postgresql/properties/root_certificate_path", + "path_kind": "property" + }, + "purpose": "Binds Relay state storage to an operator-managed PostgreSQL trust root at a deployment-local path.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/absolutePath", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 4096 + }, + { + "keyword": "minLength", + "value": 2 + }, + { + "keyword": "pattern", + "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/absolutePath" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/version", + "path_kind": "property" + }, + "purpose": "Environment authoring format version.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "public", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": 1 + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "", + "path_kind": "root" + }, + "purpose": "Defines a product-neutral source adaptation contract using bounded HTTP, Rhai script, or exact snapshot capabilities.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": true, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "version", + "id", + "revision", + "input", + "capability", + "outputs" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/allowRule/properties/method", + "path_kind": "property" + }, + "purpose": "Selects the GET or POST method permitted by one reviewed source allow rule.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "GET", + "POST" + ] + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/allowRule/properties/path", + "path_kind": "property" + }, + "purpose": "Defines one reviewed source path template; concrete private endpoints and identifiers remain environment-owned.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 4096 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^/[^?#]*$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/allowRule/properties/semantics", + "path_kind": "property" + }, + "purpose": "Declares that the permitted source operation has read-only semantics.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": "read_only" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/byteSize/oneOf/0", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 18446744073709551615 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/byteSize/oneOf/1", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[1-9][0-9]*(?:KiB|MiB)$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/capability/oneOf/0", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "http" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/capability/oneOf/0/properties/http", + "path_kind": "property" + }, + "purpose": "Selects the single-request declarative HTTP capability and its expected response semantics.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "request" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/capability/oneOf/0/properties/http/properties/request", + "path_kind": "property" + }, + "purpose": "Bounded read-only HTTP request template.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/httpRequest", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "method", + "path" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/httpRequest" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/capability/oneOf/0/properties/http/properties/response", + "path_kind": "property" + }, + "purpose": "Rules for translating upstream status and body cardinality into normalized outcomes.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/httpResponse", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/httpResponse" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/capability/oneOf/1", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "script" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/capability/oneOf/1/properties/script", + "path_kind": "property" + }, + "purpose": "Selects the reviewed project-relative script capability and its optional modules.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "file" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/capability/oneOf/1/properties/script/properties/file", + "path_kind": "property" + }, + "purpose": "Project-relative path without traversal or duplicate separators.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/relativePath", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 4096 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^(?!/)(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/relativePath" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/capability/oneOf/1/properties/script/properties/modules", + "path_kind": "property" + }, + "purpose": "Lists the reviewed project-relative modules available to the integration script.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 32 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/capability/oneOf/1/properties/script/properties/modules/items", + "path_kind": "array_item" + }, + "purpose": "Project-relative path without traversal or duplicate separators.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/relativePath", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 4096 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^(?!/)(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/relativePath" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/capability/oneOf/2", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "snapshot" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/capability/oneOf/2/properties/snapshot", + "path_kind": "property" + }, + "purpose": "Selects an offline entity snapshot capability with exact input matching and freshness control.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "entity", + "exact", + "freshness" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/capability/oneOf/2/properties/snapshot/properties/entity", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/capability/oneOf/2/properties/snapshot/properties/exact", + "path_kind": "property" + }, + "purpose": "Maps entity fields to integration inputs that must match exactly in the snapshot lookup.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 8 + }, + { + "keyword": "minProperties", + "value": 1 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/capability/oneOf/2/properties/snapshot/properties/exact/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Reference to a declared integration input.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/inputReference", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "input" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/inputReference" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/capability/oneOf/2/properties/snapshot/properties/freshness", + "path_kind": "property" + }, + "purpose": "Sets the maximum accepted age of the materialized entity snapshot.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[1-9][0-9]*(?:ms|s|m|h|d)$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/credential/oneOf/0", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "type" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/credential/oneOf/0/properties/type", + "path_kind": "property" + }, + "purpose": "Selects an unauthenticated, basic-authentication, or static-bearer credential interface.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "none", + "basic", + "static_bearer" + ] + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/credential/oneOf/1", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "type", + "name", + "max_value_bytes" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/credential/oneOf/1/properties/max_value_bytes", + "path_kind": "property" + }, + "purpose": "Caps the credential value size accepted by the fixed-header API-key interface.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 4096 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/credential/oneOf/1/properties/name", + "path_kind": "property" + }, + "purpose": "Declares the fixed HTTP header name used by the API-key credential interface.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[A-Za-z][A-Za-z0-9_-]{0,63}$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/credential/oneOf/1/properties/type", + "path_kind": "property" + }, + "purpose": "Selects the fixed-header API-key credential interface for this source contract.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": "api_key_header" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/credential/oneOf/2", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "type", + "name", + "max_value_bytes" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/credential/oneOf/2/properties/max_value_bytes", + "path_kind": "property" + }, + "purpose": "Caps the credential value size accepted by the fixed-query API-key interface.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 4096 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/credential/oneOf/2/properties/name", + "path_kind": "property" + }, + "purpose": "Declares the fixed query parameter name used by the API-key credential interface.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[A-Za-z_][A-Za-z0-9._:~-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/credential/oneOf/2/properties/type", + "path_kind": "property" + }, + "purpose": "Selects the fixed-query-parameter API-key credential interface for this source contract.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": "api_key_query" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/credential/oneOf/3", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "type", + "request", + "response_profile" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/credential/oneOf/3/properties/audience", + "path_kind": "property" + }, + "purpose": "Constrains OAuth token acquisition to the reviewed source audience and is treated as sensitive operational metadata.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 2048 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/credential/oneOf/3/properties/refresh_skew", + "path_kind": "property" + }, + "purpose": "Sets the positive interval before token expiry at which the OAuth credential is refreshed.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[1-9][0-9]*(?:ms|s)$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/credential/oneOf/3/properties/request", + "path_kind": "property" + }, + "purpose": "Selects form-encoded or JSON token requests for the OAuth client-credentials interface.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "form", + "json" + ] + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/credential/oneOf/3/properties/response_profile", + "path_kind": "property" + }, + "purpose": "Requires the bounded OAuth bearer-token response profile supported by the source adapter.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": "oauth2_bearer" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/credential/oneOf/3/properties/scope", + "path_kind": "property" + }, + "purpose": "Declares the bounded OAuth scope string requested for this source credential.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 1024 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/credential/oneOf/3/properties/type", + "path_kind": "property" + }, + "purpose": "Selects the OAuth 2.0 client-credentials interface for source authentication.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": "oauth2_client_credentials" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/httpRequest/properties/body", + "path_kind": "property" + }, + "purpose": "Defines the optional authored body template sent by the declarative HTTP request.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/httpRequest/properties/headers", + "path_kind": "property" + }, + "purpose": "Maps reviewed request header names to authored values and input substitutions.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 32 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/httpRequest/properties/headers/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Request value supplied from a declared input or an authored scalar literal.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "boolean", + "integer", + "string" + ], + "local_reference": "#/$defs/inputOrLiteral", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/inputOrLiteral" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/httpRequest/properties/method", + "path_kind": "property" + }, + "purpose": "Selects the single GET or POST request performed by a declarative HTTP capability.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "GET", + "POST" + ] + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/httpRequest/properties/path", + "path_kind": "property" + }, + "purpose": "Defines the reviewed source path template used by the declarative HTTP request.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 4096 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^/[^?#]*$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/httpRequest/properties/query", + "path_kind": "property" + }, + "purpose": "Maps reviewed query parameter names to authored request values and input substitutions.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 64 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/httpRequest/properties/query/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Request value supplied from a declared input or an authored scalar literal.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "boolean", + "integer", + "string" + ], + "local_reference": "#/$defs/inputOrLiteral", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/inputOrLiteral" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/httpRequest/properties/semantics", + "path_kind": "property" + }, + "purpose": "Declares that the declarative HTTP request has read-only source semantics.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": "read_only" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/httpResponse/properties/ambiguous", + "path_kind": "property" + }, + "purpose": "Lists HTTP response statuses that produce the integration's ambiguous outcome.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/httpResponse/properties/ambiguous/items", + "path_kind": "array_item" + }, + "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 599 + }, + { + "keyword": "minimum", + "value": 100 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/httpResponse/properties/no_match", + "path_kind": "property" + }, + "purpose": "Lists HTTP response statuses that produce the integration's no-match outcome.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/httpResponse/properties/no_match/items", + "path_kind": "array_item" + }, + "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 599 + }, + { + "keyword": "minimum", + "value": 100 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/httpResponse/properties/shape", + "path_kind": "property" + }, + "purpose": "Declares whether a successful response is a singleton or a bounded collection.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/httpResponse/properties/shape/oneOf/0", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "const", + "value": "singleton" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/httpResponse/properties/shape/oneOf/1", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "records", + "cardinality" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/httpResponse/properties/shape/oneOf/1/properties/cardinality", + "path_kind": "property" + }, + "purpose": "Requires two-record probing so collection results distinguish one match from ambiguity.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": "probe_two" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/httpResponse/properties/shape/oneOf/1/properties/records", + "path_kind": "property" + }, + "purpose": "Selects the canonical response location containing collection records.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^/(?:[^/~]|~[01])+(?:/(?:[^/~]|~[01])+)*$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/input/properties/canonicalization", + "path_kind": "property" + }, + "purpose": "Selects the reviewed normalization rule applied before an input is compared, interpolated, or sent to a source.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "identity", + "ascii_lowercase" + ] + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/input/properties/format", + "path_kind": "property" + }, + "purpose": "Applies the full-date semantic format to a string-valued integration input.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": "date" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/input/properties/maxLength", + "path_kind": "property" + }, + "purpose": "Caps the character length accepted for a string-valued integration input.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 16384 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/input/properties/maximum", + "path_kind": "property" + }, + "purpose": "Sets the inclusive upper bound accepted for an integer-valued integration input.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 9223372036854775807 + }, + { + "keyword": "minimum", + "value": -9223372036854775808 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/input/properties/minLength", + "path_kind": "property" + }, + "purpose": "Sets the minimum character length accepted for a string-valued integration input.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 16384 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/input/properties/minimum", + "path_kind": "property" + }, + "purpose": "Sets the inclusive lower bound accepted for an integer-valued integration input.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 9223372036854775807 + }, + { + "keyword": "minimum", + "value": -9223372036854775808 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/input/properties/pattern", + "path_kind": "property" + }, + "purpose": "Constrains a string-valued integration input with the authored regular expression.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 16384 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/input/properties/role", + "path_kind": "property" + }, + "purpose": "Declares how one typed authoring input participates in source lookup, selection, or result shaping.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "selector", + "parameter" + ] + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/input/properties/type", + "path_kind": "property" + }, + "purpose": "Declares the closed scalar or array type accepted for one integration input.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "array" + ], + "local_reference": "#/$defs/scalarType", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/scalarType" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/inputOrLiteral/oneOf/0", + "path_kind": "branch" + }, + "purpose": "Reference to a declared integration input.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/inputReference", + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "input" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/inputReference" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/inputOrLiteral/oneOf/1", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "boolean", + "integer", + "string" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "boolean", + "integer" + ] + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/inputReference/properties/input", + "path_kind": "property" + }, + "purpose": "Portable lowercase name for an integration input or output.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/inputName", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9_]{0,63}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/inputName" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/limits/properties/calls", + "path_kind": "property" + }, + "purpose": "Caps the number of high-level source calls available to a script integration.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 16 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/limits/properties/deadline", + "path_kind": "property" + }, + "purpose": "Caps total integration execution time with a positive duration no greater than sixty seconds.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[1-9][0-9]*(?:ms|s)$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/limits/properties/request_bytes", + "path_kind": "property" + }, + "purpose": "Positive byte count expressed as an integer or a KiB/MiB quantity.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "integer", + "string" + ], + "local_reference": "#/$defs/byteSize", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/byteSize" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/limits/properties/source_bytes", + "path_kind": "property" + }, + "purpose": "Positive byte count expressed as an integer or a KiB/MiB quantity.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "integer", + "string" + ], + "local_reference": "#/$defs/byteSize", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/byteSize" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/notApplicable/properties/ambiguity", + "path_kind": "property" + }, + "purpose": "Why the reviewed source contract cannot produce more than one matching record.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/notApplicableReason", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "rationale", + "request_fixture" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/notApplicableReason" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/notApplicable/properties/subject_mismatch", + "path_kind": "property" + }, + "purpose": "Why the reviewed response contract contains no identifier comparable with a requested selector.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/notApplicableReason", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "rationale", + "request_fixture" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/notApplicableReason" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/notApplicableReason/properties/rationale", + "path_kind": "property" + }, + "purpose": "Why the named normally required outcome cannot occur for this source contract.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 512 + }, + { + "keyword": "minLength", + "value": 24 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/notApplicableReason/properties/request_fixture", + "path_kind": "property" + }, + "purpose": "Fixture name containing the supporting bounded source request.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/output/properties/format", + "path_kind": "property" + }, + "purpose": "Applies the full-date semantic format to a string-valued integration output.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": "date" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/output/properties/maxLength", + "path_kind": "property" + }, + "purpose": "Caps the character length produced for a string-valued integration output.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 16384 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/output/properties/maximum", + "path_kind": "property" + }, + "purpose": "Sets the inclusive upper bound produced for an integer-valued integration output.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 9223372036854775807 + }, + { + "keyword": "minimum", + "value": -9223372036854775808 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/output/properties/minimum", + "path_kind": "property" + }, + "purpose": "Sets the inclusive lower bound produced for an integer-valued integration output.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 9223372036854775807 + }, + { + "keyword": "minimum", + "value": -9223372036854775808 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/output/properties/type", + "path_kind": "property" + }, + "purpose": "Supported scalar type, optionally paired with null for nullable values.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "array" + ], + "local_reference": "#/$defs/scalarType", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/scalarType" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/output/properties/x-registry-source", + "path_kind": "property" + }, + "purpose": "Selects the canonical source-response location from which the HTTP output is extracted.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^/(?:[^/~]|~[01])+(?:/(?:[^/~]|~[01])+)*$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/protocol/properties/signed_dci", + "path_kind": "property" + }, + "purpose": "Enables the bounded signed DCI search helper and declares its protocol and selector bindings.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "profile", + "path", + "jwks_profile", + "sender", + "receiver", + "registry_type", + "record_type", + "locale", + "selectors" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/protocol/properties/signed_dci/properties/jwks_profile", + "path_kind": "property" + }, + "purpose": "Selects the supported RSA signing-key-set profile used to verify signed DCI responses.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": "rsa-signing-jwks-v1" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/protocol/properties/signed_dci/properties/locale", + "path_kind": "property" + }, + "purpose": "Declares the language or locale tag carried by signed DCI search requests.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[A-Za-z]{2,8}(?:-[A-Za-z0-9]{1,8})*$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/protocol/properties/signed_dci/properties/path", + "path_kind": "property" + }, + "purpose": "Declares the exact private source path used for signed DCI search requests.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^/[^?#]*$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/protocol/properties/signed_dci/properties/profile", + "path_kind": "property" + }, + "purpose": "Selects the supported DCI search request profile used by the signed protocol helper.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": "dci-search-v1" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/protocol/properties/signed_dci/properties/receiver", + "path_kind": "property" + }, + "purpose": "Declares the signed DCI receiver identifier included in protocol requests.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/protocol/properties/signed_dci/properties/record_type", + "path_kind": "property" + }, + "purpose": "Declares the record type requested through the signed DCI search profile.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 128 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/protocol/properties/signed_dci/properties/registry_type", + "path_kind": "property" + }, + "purpose": "Declares the registry type requested through the signed DCI search profile.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 128 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors", + "path_kind": "property" + }, + "purpose": "Maps every selector input to its signed DCI request field and response location.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 8 + }, + { + "keyword": "minProperties", + "value": 1 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "field", + "response_pointer" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors/additionalProperties/properties/field", + "path_kind": "property" + }, + "purpose": "Declares the signed DCI identifier field bound to one selector input.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 160 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors/additionalProperties/properties/response_pointer", + "path_kind": "property" + }, + "purpose": "Selects the canonical signed-record response location used to recover one selector value.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^/(?:[^/~]|~[01])+(?:/(?:[^/~]|~[01])+)*$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors/propertyNames", + "path_kind": "map_key" + }, + "purpose": "Portable lowercase name for an integration input or output.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/inputName", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9_]{0,63}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/inputName" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/protocol/properties/signed_dci/properties/sender", + "path_kind": "property" + }, + "purpose": "Declares the signed DCI sender identifier included in protocol requests.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/scalarType/oneOf/0", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "string", + "boolean", + "integer" + ] + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/scalarType/oneOf/1", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 2 + }, + { + "keyword": "minItems", + "value": 2 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/scalarType/oneOf/1/prefixItems/0", + "path_kind": "array_item" + }, + "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "string", + "boolean", + "integer" + ] + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/scalarType/oneOf/1/prefixItems/1", + "path_kind": "array_item" + }, + "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "const", + "value": "null" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/source/properties/allow", + "path_kind": "property" + }, + "purpose": "Constrains source access to the explicitly reviewed method and path templates in this integration contract.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 16 + }, + { + "keyword": "minItems", + "value": 1 + }, + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/source/properties/allow/items", + "path_kind": "array_item" + }, + "purpose": "One read-only upstream method and path pattern the adapter may call.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/allowRule", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "method", + "path" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/allowRule" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/source/properties/auth", + "path_kind": "property" + }, + "purpose": "Declares the credential interface the source contract permits without embedding an environment credential value.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/credential", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/credential" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/source/properties/product", + "path_kind": "property" + }, + "purpose": "Names the source product whose version labels are classified by this integration contract.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/source/properties/protocol", + "path_kind": "property" + }, + "purpose": "Optional interoperable protocol profiles layered over the source transport.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/protocol", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "minProperties", + "value": 1 + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/protocol" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/source/properties/request_headers", + "path_kind": "property" + }, + "purpose": "Lists the bounded source request header names available to the integration adapter.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 32 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/source/properties/request_headers/items", + "path_kind": "array_item" + }, + "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[A-Za-z][A-Za-z0-9-]{0,63}$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/source/properties/response", + "path_kind": "property" + }, + "purpose": "Defines the reviewed source response representation and optional byte bound.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/source/properties/response/properties/format", + "path_kind": "property" + }, + "purpose": "Selects JSON decoding or text handling for reviewed source responses.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "json", + "text" + ] + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/source/properties/response/properties/max_bytes", + "path_kind": "property" + }, + "purpose": "Positive byte count expressed as an integer or a KiB/MiB quantity.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "integer", + "string" + ], + "local_reference": "#/$defs/byteSize", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/byteSize" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/source/properties/response_headers", + "path_kind": "property" + }, + "purpose": "Lists the bounded source response header names available to the integration adapter.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 32 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/source/properties/response_headers/items", + "path_kind": "array_item" + }, + "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[A-Za-z][A-Za-z0-9-]{0,63}$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/source/properties/versions", + "path_kind": "property" + }, + "purpose": "Source versions tested by the project and versions explicitly accepted as unverified.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/versions", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/versions" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/versionList/items", + "path_kind": "array_item" + }, + "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/versions/anyOf/0", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "tested" + ] + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/versions/anyOf/0/properties/tested", + "path_kind": "property" + }, + "purpose": "Requires at least one source product version to be classified as tested in this integration contract.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "minItems", + "value": 1 + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/versions/anyOf/1", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "unverified" + ] + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/versions/anyOf/1/properties/unverified", + "path_kind": "property" + }, + "purpose": "Requires at least one source product version to be classified as unverified in this integration contract.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "minItems", + "value": 1 + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/versions/properties/tested", + "path_kind": "property" + }, + "purpose": "Bounded list of source version labels.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "array" + ], + "local_reference": "#/$defs/versionList", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 32 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/versionList" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/versions/properties/unverified", + "path_kind": "property" + }, + "purpose": "Bounded list of source version labels.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "array" + ], + "local_reference": "#/$defs/versionList", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 32 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/versionList" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/properties/capability", + "path_kind": "property" + }, + "purpose": "Exactly one bounded execution mechanism for the source adaptation.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/capability", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/capability" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/properties/id", + "path_kind": "property" + }, + "purpose": "Stable project-local identifier for the integration.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/properties/input", + "path_kind": "property" + }, + "purpose": "Typed selector and parameter inputs accepted by this integration.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 16 + }, + { + "keyword": "minProperties", + "value": 1 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/properties/input/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Type, validation, and canonicalization rules for one authored input.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/input", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "role", + "type" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/input" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/properties/input/propertyNames", + "path_kind": "map_key" + }, + "purpose": "Portable lowercase name for an integration input or output.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/inputName", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9_]{0,63}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/inputName" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/properties/limits", + "path_kind": "property" + }, + "purpose": "Optional tighter resource limits for one integration execution.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/limits", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/limits" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/properties/not_applicable", + "path_kind": "property" + }, + "purpose": "Explicit rationale and request-fixture evidence for a normally required outcome that the source contract cannot produce.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/notApplicable", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "minProperties", + "value": 1 + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/notApplicable" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/properties/outputs", + "path_kind": "property" + }, + "purpose": "Named typed outputs, or a shorthand list of output names inferred by the authoring compiler.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "array", + "object" + ], + "composed": true + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [] + }, + { + "address": { + "schema": "integration", + "pointer": "/properties/outputs/oneOf/0", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 64 + }, + { + "keyword": "minProperties", + "value": 1 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/properties/outputs/oneOf/0/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Type and optional source pointer for one normalized integration output.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/output", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "type" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/output" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/properties/outputs/oneOf/0/propertyNames", + "path_kind": "map_key" + }, + "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": true + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [] + }, + { + "address": { + "schema": "integration", + "pointer": "/properties/outputs/oneOf/0/propertyNames/allOf/0", + "path_kind": "branch" + }, + "purpose": "Portable lowercase name for an integration input or output.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/inputName", + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9_]{0,63}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/inputName" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/properties/outputs/oneOf/0/propertyNames/allOf/1", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [] + }, + { + "address": { + "schema": "integration", + "pointer": "/properties/outputs/oneOf/0/propertyNames/allOf/1/not", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "matched", + "outcome" + ] + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/properties/outputs/oneOf/1", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 64 + }, + { + "keyword": "minItems", + "value": 1 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/properties/outputs/oneOf/1/items", + "path_kind": "array_item" + }, + "purpose": "Portable lowercase name for an integration input or output.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/inputName", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9_]{0,63}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/inputName" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/properties/revision", + "path_kind": "property" + }, + "purpose": "Monotonically increasing revision of this integration contract.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": true, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/properties/source", + "path_kind": "property" + }, + "purpose": "Optional source product metadata and transport policy; capabilities remain product-neutral.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/source", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "auth" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/source" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/properties/version", + "path_kind": "property" + }, + "purpose": "Integration authoring format version.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "public", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": 1 + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "", + "path_kind": "root" + }, + "purpose": "Defines one synthetic, deterministic integration scenario for offline adapter verification.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "environment_independent", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": true, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "name", + "classification", + "input", + "interactions", + "expect" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/expectation/properties/claims", + "path_kind": "property" + }, + "purpose": "States the synthetic Notary claim outcomes expected after the reviewed Relay consultation behavior.", + "purpose_source": "reviewed_override", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 64 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/expectation/properties/error", + "path_kind": "property" + }, + "purpose": "States the bounded error identifier expected from a failing offline fixture.", + "purpose_source": "reviewed_override", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/expectation/properties/outcome", + "path_kind": "property" + }, + "purpose": "States whether the offline fixture is expected to match, find no match, or remain ambiguous.", + "purpose_source": "reviewed_override", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "match", + "no_match", + "ambiguous" + ] + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/expectation/properties/outputs", + "path_kind": "property" + }, + "purpose": "Maps integration output names to the synthetic values expected after fixture execution.", + "purpose_source": "reviewed_override", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 64 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/fixtureBody/oneOf/0", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "environment_independent", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "file" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/fixtureBody/oneOf/0/properties/file", + "path_kind": "property" + }, + "purpose": "Selects a fixture-local synthetic body file beneath the reserved bodies directory.", + "purpose_source": "reviewed_override", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 4096 + }, + { + "keyword": "minLength", + "value": 8 + }, + { + "keyword": "pattern", + "value": "^bodies/(?!\\.\\.?/)(?!.*(?:/)\\.\\.?/)(?!.*//).+$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/fixtureBody/oneOf/1", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "environment_independent", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/fixtureBody/oneOf/1/not", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "environment_independent", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "file" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/governedClaimRef/oneOf/0", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "environment_independent", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/governedClaimRef/oneOf/1", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "environment_independent", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/governedClaimRef/oneOf/1/properties/id", + "path_kind": "property" + }, + "purpose": "Names one authored claim requested by this fixture witness.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/governedClaimRef/oneOf/1/properties/version", + "path_kind": "property" + }, + "purpose": "Pins the requested claim to one authored claim-policy version.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/governedIdentifier/properties/scheme", + "path_kind": "property" + }, + "purpose": "Names the authored identifier scheme selected by a consultation input mapping.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 96 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/governedIdentifier/properties/value", + "path_kind": "property" + }, + "purpose": "Supplies the synthetic string value bound to this identifier scheme.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/governedRequest/properties/claims", + "path_kind": "property" + }, + "purpose": "Lists the authored claims evaluated by this synthetic request witness.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 64 + }, + { + "keyword": "minItems", + "value": 1 + }, + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/governedRequest/properties/claims/items", + "path_kind": "array_item" + }, + "purpose": "A requested claim ID, optionally pinned to one authored claim version.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "object", + "string" + ], + "local_reference": "#/$defs/governedClaimRef", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted", + "array_items_share_element_contract" + ], + "constraints": [], + "local_reference": { + "schema": "fixture", + "pointer": "/$defs/governedClaimRef" + } + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/governedRequest/properties/disclosure", + "path_kind": "property" + }, + "purpose": "Selects the disclosure mode requested from the authored claim policy.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/governedRequest/properties/format", + "path_kind": "property" + }, + "purpose": "Selects the claim-result media type requested from the governed Notary path.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/governedRequest/properties/purpose", + "path_kind": "property" + }, + "purpose": "Names the authored service purpose exercised by this synthetic request witness.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/governedRequest/properties/target", + "path_kind": "property" + }, + "purpose": "The synthetic subject target presented to the same governed request boundary as a live Notary evaluation.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/governedTarget", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "type" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "fixture", + "pointer": "/$defs/governedTarget" + } + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/governedRequest/properties/variables", + "path_kind": "property" + }, + "purpose": "Supplies synthetic date variables to the governed evaluation request.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 16 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/governedRequest/properties/variables/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "format", + "value": "date" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/governedRequest/properties/variables/propertyNames", + "path_kind": "map_key" + }, + "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/governedTarget/properties/attributes", + "path_kind": "property" + }, + "purpose": "Supplies independently authored typed target attributes for consultation input mapping.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 16 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/governedTarget/properties/attributes/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "boolean", + "integer", + "null", + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "boolean", + "integer", + "null" + ] + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/governedTarget/properties/id", + "path_kind": "property" + }, + "purpose": "Supplies an optional synthetic direct target identifier.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/governedTarget/properties/identifiers", + "path_kind": "property" + }, + "purpose": "Supplies independently authored synthetic identifiers for consultation input mapping.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 16 + }, + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/governedTarget/properties/identifiers/items", + "path_kind": "array_item" + }, + "purpose": "One synthetic target identifier with an authored scheme and string value.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/governedIdentifier", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "scheme", + "value" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "fixture", + "pointer": "/$defs/governedIdentifier" + } + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/governedTarget/properties/type", + "path_kind": "property" + }, + "purpose": "Names the authored target entity type used for claim evaluation.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 64 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/interaction/properties/expect", + "path_kind": "property" + }, + "purpose": "Exact HTTP request shape the adapter must produce.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/request", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "method", + "path" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "fixture", + "pointer": "/$defs/request" + } + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/interaction/properties/respond", + "path_kind": "property" + }, + "purpose": "Synthetic HTTP response or timeout returned to the adapter.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/response", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [], + "local_reference": { + "schema": "fixture", + "pointer": "/$defs/response" + } + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/request/properties/body", + "path_kind": "property" + }, + "purpose": "Defines the synthetic request body expectation or fixture-local file reference without reading a source.", + "purpose_source": "reviewed_override", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/fixtureBody", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [], + "local_reference": { + "schema": "fixture", + "pointer": "/$defs/fixtureBody" + } + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/request/properties/headers", + "path_kind": "property" + }, + "purpose": "States the synthetic request headers expected from one offline fixture interaction.", + "purpose_source": "reviewed_override", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 32 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/request/properties/headers/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 8192 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/request/properties/headers/propertyNames", + "path_kind": "map_key" + }, + "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[A-Za-z][A-Za-z0-9-]{0,63}$" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/request/properties/method", + "path_kind": "property" + }, + "purpose": "States the synthetic request method expected from the offline integration fixture.", + "purpose_source": "reviewed_override", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "GET", + "POST" + ] + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/request/properties/path", + "path_kind": "property" + }, + "purpose": "States the synthetic request path expected from the offline integration fixture.", + "purpose_source": "reviewed_override", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 4096 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^/[^?#]*$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/request/properties/query", + "path_kind": "property" + }, + "purpose": "States the synthetic query parameters expected from one offline fixture interaction.", + "purpose_source": "reviewed_override", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 64 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/request/properties/query/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "array", + "boolean", + "integer", + "null", + "string" + ], + "composed": true + }, + "requiredness": "not_applicable", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/request/properties/query/additionalProperties/oneOf/0", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "boolean", + "integer", + "null", + "string" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "environment_independent", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "boolean", + "integer", + "null" + ] + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/request/properties/query/additionalProperties/oneOf/1", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "environment_independent", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 64 + }, + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/request/properties/query/additionalProperties/oneOf/1/items", + "path_kind": "array_item" + }, + "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "boolean", + "integer", + "null", + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "boolean", + "integer", + "null" + ] + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/response/oneOf/0", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "environment_independent", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "status" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/response/oneOf/0/properties/body", + "path_kind": "property" + }, + "purpose": "Defines the synthetic response body returned by the offline fixture harness to the integration.", + "purpose_source": "reviewed_override", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/fixtureBody", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [], + "local_reference": { + "schema": "fixture", + "pointer": "/$defs/fixtureBody" + } + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/response/oneOf/0/properties/headers", + "path_kind": "property" + }, + "purpose": "Defines the synthetic HTTP response headers returned by the offline fixture harness.", + "purpose_source": "reviewed_override", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 32 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/response/oneOf/0/properties/headers/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 8192 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/response/oneOf/0/properties/status", + "path_kind": "property" + }, + "purpose": "Selects the synthetic HTTP status returned by the offline fixture harness.", + "purpose_source": "reviewed_override", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 599 + }, + { + "keyword": "minimum", + "value": 100 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/response/oneOf/1", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "environment_independent", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "timeout" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/response/oneOf/1/properties/timeout", + "path_kind": "property" + }, + "purpose": "Selects the synthetic timeout duration returned instead of an HTTP response.", + "purpose_source": "reviewed_override", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[1-9][0-9]*(?:ms|s)$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/properties/classification", + "path_kind": "property" + }, + "purpose": "Declares that fixture data is synthetic and safe for offline testing.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "public", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": "synthetic" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/properties/expect", + "path_kind": "property" + }, + "purpose": "Observable adapter result required for the scenario to pass.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/expectation", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "minProperties", + "value": 1 + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "fixture", + "pointer": "/$defs/expectation" + } + }, + { + "address": { + "schema": "fixture", + "pointer": "/properties/input", + "path_kind": "property" + }, + "purpose": "Typed consultation inputs supplied to the adapter under test.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 16 + }, + { + "keyword": "minProperties", + "value": 1 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/properties/input/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "boolean", + "integer", + "null", + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "boolean", + "integer", + "null" + ] + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/properties/input/propertyNames", + "path_kind": "map_key" + }, + "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9_]{0,63}$" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/properties/interactions", + "path_kind": "property" + }, + "purpose": "Ordered upstream request and response exchanges expected during execution.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 16 + }, + { + "keyword": "minItems", + "value": 1 + }, + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/properties/interactions/items", + "path_kind": "array_item" + }, + "purpose": "One expected upstream request paired with its synthetic response.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/interaction", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "expect", + "respond" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "fixture", + "pointer": "/$defs/interaction" + } + }, + { + "address": { + "schema": "fixture", + "pointer": "/properties/name", + "path_kind": "property" + }, + "purpose": "Human-readable scenario name shown in test output.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "public", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": true, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/properties/request", + "path_kind": "property" + }, + "purpose": "Optional independently authored synthetic Notary request used to prove the request-to-consultation binding before Relay access.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/governedRequest", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "target", + "claims", + "purpose" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "fixture", + "pointer": "/$defs/governedRequest" + } + }, + { + "address": { + "schema": "fixture", + "pointer": "/properties/variables", + "path_kind": "property" + }, + "purpose": "Named date values available to deterministic fixture interpolation.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 16 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/properties/variables/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "format", + "value": "date" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/properties/variables/propertyNames", + "path_kind": "map_key" + }, + "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + } + ] + }, + { + "address": { + "schema": "entity", + "pointer": "", + "path_kind": "root" + }, + "purpose": "Defines a bounded, materialized entity that Relay can query without coupling the project to a specific source product.", + "purpose_source": "schema_description", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": true, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "version", + "id", + "revision", + "primary_key", + "schema", + "materialization" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "entity", + "pointer": "/$defs/fieldSchema/properties/const", + "path_kind": "property" + }, + "purpose": "Requires one entity field to equal the single authored value supplied by this schema constraint.", + "purpose_source": "reviewed_override", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [] + }, + { + "address": { + "schema": "entity", + "pointer": "/$defs/fieldSchema/properties/enum", + "path_kind": "property" + }, + "purpose": "Restricts one entity field to the unique authored values listed by this schema constraint.", + "purpose_source": "reviewed_override", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "minItems", + "value": 1 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ] + }, + { + "address": { + "schema": "entity", + "pointer": "/$defs/fieldSchema/properties/format", + "path_kind": "property" + }, + "purpose": "Adds a reviewed semantic format constraint to one string-valued entity field.", + "purpose_source": "reviewed_override", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": "date" + } + ] + }, + { + "address": { + "schema": "entity", + "pointer": "/$defs/fieldSchema/properties/maxLength", + "path_kind": "property" + }, + "purpose": "Caps the character length accepted for one string-valued entity field.", + "purpose_source": "reviewed_override", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 65536 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "entity", + "pointer": "/$defs/fieldSchema/properties/maximum", + "path_kind": "property" + }, + "purpose": "Sets the inclusive upper numeric bound accepted for one entity field.", + "purpose_source": "reviewed_override", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 9223372036854775807 + }, + { + "keyword": "minimum", + "value": -9223372036854775808 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "entity", + "pointer": "/$defs/fieldSchema/properties/minLength", + "path_kind": "property" + }, + "purpose": "Sets the minimum character length accepted for one string-valued entity field.", + "purpose_source": "reviewed_override", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 65536 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "entity", + "pointer": "/$defs/fieldSchema/properties/minimum", + "path_kind": "property" + }, + "purpose": "Sets the inclusive lower numeric bound accepted for one entity field.", + "purpose_source": "reviewed_override", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 9223372036854775807 + }, + { + "keyword": "minimum", + "value": -9223372036854775808 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "entity", + "pointer": "/$defs/fieldSchema/properties/pattern", + "path_kind": "property" + }, + "purpose": "Constrains a string-valued entity field with the authored regular expression.", + "purpose_source": "reviewed_override", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 1024 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "entity", + "pointer": "/$defs/fieldSchema/properties/type", + "path_kind": "property" + }, + "purpose": "Declares the closed scalar, array, or object type accepted for one entity field.", + "purpose_source": "reviewed_override", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [ + "array" + ], + "local_reference": "#/$defs/scalarType", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [], + "local_reference": { + "schema": "entity", + "pointer": "/$defs/scalarType" + } + }, + { + "address": { + "schema": "entity", + "pointer": "/$defs/objectSchema/properties/additionalProperties", + "path_kind": "property" + }, + "purpose": "Controls whether the entity object accepts fields outside its declared closed property set.", + "purpose_source": "reviewed_override", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": false + } + ] + }, + { + "address": { + "schema": "entity", + "pointer": "/$defs/objectSchema/properties/properties", + "path_kind": "property" + }, + "purpose": "Maps every declared entity property name to its closed field schema.", + "purpose_source": "reviewed_override", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 256 + }, + { + "keyword": "minProperties", + "value": 1 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "entity", + "pointer": "/$defs/objectSchema/properties/properties/additionalProperties", + "path_kind": "property" + }, + "purpose": "Bounded schema keywords supported for one scalar materialized field.", + "purpose_source": "schema_description", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/fieldSchema", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "type" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "entity", + "pointer": "/$defs/fieldSchema" + } + }, + { + "address": { + "schema": "entity", + "pointer": "/$defs/objectSchema/properties/properties/propertyNames", + "path_kind": "property" + }, + "purpose": "Portable lowercase record field name.", + "purpose_source": "schema_description", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/propertyName", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9_]{0,63}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "entity", + "pointer": "/$defs/propertyName" + } + }, + { + "address": { + "schema": "entity", + "pointer": "/$defs/objectSchema/properties/required", + "path_kind": "property" + }, + "purpose": "Lists the entity properties that every validated materialized record must contain.", + "purpose_source": "reviewed_override", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 256 + }, + { + "keyword": "minItems", + "value": 1 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ] + }, + { + "address": { + "schema": "entity", + "pointer": "/$defs/objectSchema/properties/required/items", + "path_kind": "array_item" + }, + "purpose": "Portable lowercase record field name.", + "purpose_source": "schema_description", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/propertyName", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9_]{0,63}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "entity", + "pointer": "/$defs/propertyName" + } + }, + { + "address": { + "schema": "entity", + "pointer": "/$defs/objectSchema/properties/type", + "path_kind": "property" + }, + "purpose": "Declares the materialized entity record schema as an object.", + "purpose_source": "reviewed_override", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": "object" + } + ] + }, + { + "address": { + "schema": "entity", + "pointer": "/$defs/scalarType/oneOf/0", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "string", + "boolean", + "integer" + ] + } + ] + }, + { + "address": { + "schema": "entity", + "pointer": "/$defs/scalarType/oneOf/1", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 2 + }, + { + "keyword": "minItems", + "value": 2 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ] + }, + { + "address": { + "schema": "entity", + "pointer": "/$defs/scalarType/oneOf/1/prefixItems/0", + "path_kind": "array_item" + }, + "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "string", + "boolean", + "integer" + ] + } + ] + }, + { + "address": { + "schema": "entity", + "pointer": "/$defs/scalarType/oneOf/1/prefixItems/1", + "path_kind": "array_item" + }, + "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "const", + "value": "null" + } + ] + }, + { + "address": { + "schema": "entity", + "pointer": "/properties/id", + "path_kind": "property" + }, + "purpose": "Stable project-local identifier for the entity.", + "purpose_source": "schema_description", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "entity", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "entity", + "pointer": "/properties/materialization", + "path_kind": "property" + }, + "purpose": "Authored resource, refresh, and bounded recovery-set retention applied while building entity generations.", + "purpose_source": "schema_description", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "max_records", + "max_bytes", + "refresh", + "retain_generations" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "entity", + "pointer": "/properties/materialization/properties/max_bytes", + "path_kind": "property" + }, + "purpose": "Maximum encoded size of one generation, as bytes or a KiB/MiB quantity.", + "purpose_source": "schema_description", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [ + "integer", + "string" + ], + "composed": true + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": true, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [] + }, + { + "address": { + "schema": "entity", + "pointer": "/properties/materialization/properties/max_bytes/oneOf/0", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 18446744073709551615 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "entity", + "pointer": "/properties/materialization/properties/max_bytes/oneOf/1", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[1-9][0-9]*(?:KiB|MiB)$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "entity", + "pointer": "/properties/materialization/properties/max_records", + "path_kind": "property" + }, + "purpose": "Maximum number of records allowed in one generation.", + "purpose_source": "schema_description", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": true, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 18446744073709551615 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "entity", + "pointer": "/properties/materialization/properties/refresh", + "path_kind": "property" + }, + "purpose": "Refresh cadence, or manual when an operator initiates every refresh.", + "purpose_source": "schema_description", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": true + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": true, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [] + }, + { + "address": { + "schema": "entity", + "pointer": "/properties/materialization/properties/refresh/oneOf/0", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "const", + "value": "manual" + } + ] + }, + { + "address": { + "schema": "entity", + "pointer": "/properties/materialization/properties/refresh/oneOf/1", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[1-9][0-9]*(?:ms|s|m|h|d)$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "entity", + "pointer": "/properties/materialization/properties/retain_generations", + "path_kind": "property" + }, + "purpose": "Number of completed cache generations, including the active generation, retained as a bounded recovery set after successful publication. This does not make arbitrary retained generations selectable for rollback.", + "purpose_source": "schema_description", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": true, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 16 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "entity", + "pointer": "/properties/primary_key", + "path_kind": "property" + }, + "purpose": "Field whose value uniquely identifies each materialized record.", + "purpose_source": "schema_description", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "entity", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "entity", + "pointer": "/properties/revision", + "path_kind": "property" + }, + "purpose": "Monotonically increasing revision of this entity definition.", + "purpose_source": "schema_description", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": true, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "entity", + "pointer": "/properties/schema", + "path_kind": "property" + }, + "purpose": "Closed JSON object schema for materialized records.", + "purpose_source": "schema_description", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/objectSchema", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "type", + "additionalProperties", + "required", + "properties" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "entity", + "pointer": "/$defs/objectSchema" + } + }, + { + "address": { + "schema": "entity", + "pointer": "/properties/version", + "path_kind": "property" + }, + "purpose": "Entity authoring format version.", + "purpose_source": "schema_description", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "public", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": 1 + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "", + "key_path": "", + "path_kind": "root" + }, + "purpose": "Root configuration document. Parsed from YAML at startup.", + "purpose_source": "schema_description", + "intent_profile": "relay_root_structural", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "structural", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "server", + "catalog", + "auth", + "audit", + "datasets" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_only_execution", + "key_path": "datasets[].aggregates[].access.aggregate_only_execution", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_only_execution", + "key_path": "datasets[].entities[].aggregates[].access.aggregate_only_execution", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_only_execution", + "key_path": "datasets[].tables[].aggregates[].access.aggregate_only_execution", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_scope", + "key_path": "datasets[].aggregates[].access.aggregate_scope", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_scope", + "key_path": "datasets[].entities[].aggregates[].access.aggregate_scope", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_scope", + "key_path": "datasets[].tables[].aggregates[].access.aggregate_scope", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateAccessConfig/properties/metadata_scope", + "key_path": "datasets[].aggregates[].access.metadata_scope", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateAccessConfig/properties/metadata_scope", + "key_path": "datasets[].entities[].aggregates[].access.metadata_scope", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateAccessConfig/properties/metadata_scope", + "key_path": "datasets[].tables[].aggregates[].access.metadata_scope", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/access", + "key_path": "datasets[].aggregates[].access", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/access", + "key_path": "datasets[].entities[].aggregates[].access", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/access", + "key_path": "datasets[].tables[].aggregates[].access", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/allowed_filters", + "key_path": "datasets[].aggregates[].allowed_filters", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/allowed_filters", + "key_path": "datasets[].entities[].aggregates[].allowed_filters", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/allowed_filters", + "key_path": "datasets[].tables[].aggregates[].allowed_filters", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/allowed_filters/items", + "key_path": "datasets[].aggregates[].allowed_filters[]", + "path_kind": "array_item" + }, + "purpose": "A single allowed filter: field name + permitted operators.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AllowedFilter", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "field", + "ops" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AllowedFilter" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/allowed_filters/items", + "key_path": "datasets[].entities[].aggregates[].allowed_filters[]", + "path_kind": "array_item" + }, + "purpose": "A single allowed filter: field name + permitted operators.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AllowedFilter", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "field", + "ops" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AllowedFilter" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/allowed_filters/items", + "key_path": "datasets[].tables[].aggregates[].allowed_filters[]", + "path_kind": "array_item" + }, + "purpose": "A single allowed filter: field name + permitted operators.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AllowedFilter", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "field", + "ops" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AllowedFilter" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/default_group_by", + "key_path": "datasets[].aggregates[].default_group_by", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/default_group_by", + "key_path": "datasets[].entities[].aggregates[].default_group_by", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/default_group_by", + "key_path": "datasets[].tables[].aggregates[].default_group_by", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/default_group_by/items", + "key_path": "datasets[].aggregates[].default_group_by[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/default_group_by/items", + "key_path": "datasets[].entities[].aggregates[].default_group_by[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/default_group_by/items", + "key_path": "datasets[].tables[].aggregates[].default_group_by[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/description", + "key_path": "datasets[].aggregates[].description", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/description", + "key_path": "datasets[].entities[].aggregates[].description", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/description", + "key_path": "datasets[].tables[].aggregates[].description", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/dimensions", + "key_path": "datasets[].aggregates[].dimensions", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/dimensions", + "key_path": "datasets[].entities[].aggregates[].dimensions", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/dimensions", + "key_path": "datasets[].tables[].aggregates[].dimensions", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/dimensions/items", + "key_path": "datasets[].aggregates[].dimensions[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AggregateDimensionConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id", + "label", + "field" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AggregateDimensionConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/dimensions/items", + "key_path": "datasets[].entities[].aggregates[].dimensions[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AggregateDimensionConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id", + "label", + "field" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AggregateDimensionConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/dimensions/items", + "key_path": "datasets[].tables[].aggregates[].dimensions[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AggregateDimensionConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id", + "label", + "field" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AggregateDimensionConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/disclosure_control", + "key_path": "datasets[].aggregates[].disclosure_control", + "path_kind": "property" + }, + "purpose": "Disclosure control settings per aggregate. Defaults to\n`min_group_size: 5`, `suppression: omit`.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/DisclosureControlConfig", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/disclosure_control", + "key_path": "datasets[].entities[].aggregates[].disclosure_control", + "path_kind": "property" + }, + "purpose": "Disclosure control settings per aggregate. Defaults to\n`min_group_size: 5`, `suppression: omit`.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/DisclosureControlConfig", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/disclosure_control", + "key_path": "datasets[].tables[].aggregates[].disclosure_control", + "path_kind": "property" + }, + "purpose": "Disclosure control settings per aggregate. Defaults to\n`min_group_size: 5`, `suppression: omit`.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/DisclosureControlConfig", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/group_by", + "key_path": "datasets[].aggregates[].group_by", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/group_by", + "key_path": "datasets[].entities[].aggregates[].group_by", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/group_by", + "key_path": "datasets[].tables[].aggregates[].group_by", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/group_by/items", + "key_path": "datasets[].aggregates[].group_by[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/group_by/items", + "key_path": "datasets[].entities[].aggregates[].group_by[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/group_by/items", + "key_path": "datasets[].tables[].aggregates[].group_by[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/id", + "key_path": "datasets[].aggregates[].id", + "path_kind": "property" + }, + "purpose": "Aggregate identifier within a resource.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/AggregateId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9_]*$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AggregateId" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/id", + "key_path": "datasets[].entities[].aggregates[].id", + "path_kind": "property" + }, + "purpose": "Aggregate identifier within a resource.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/AggregateId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9_]*$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AggregateId" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/id", + "key_path": "datasets[].tables[].aggregates[].id", + "path_kind": "property" + }, + "purpose": "Aggregate identifier within a resource.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/AggregateId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9_]*$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AggregateId" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/indicators", + "key_path": "datasets[].aggregates[].indicators", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/indicators", + "key_path": "datasets[].entities[].aggregates[].indicators", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/indicators", + "key_path": "datasets[].tables[].aggregates[].indicators", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/indicators/items", + "key_path": "datasets[].aggregates[].indicators[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AggregateIndicatorConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id", + "label", + "function", + "column", + "unit_measure" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/indicators/items", + "key_path": "datasets[].entities[].aggregates[].indicators[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AggregateIndicatorConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id", + "label", + "function", + "column", + "unit_measure" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/indicators/items", + "key_path": "datasets[].tables[].aggregates[].indicators[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AggregateIndicatorConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id", + "label", + "function", + "column", + "unit_measure" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/joins", + "key_path": "datasets[].aggregates[].joins", + "path_kind": "property" + }, + "purpose": "Legacy entity-local aggregate fields. These stay parseable while\nthe public surface moves to dataset-level aggregates.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/joins", + "key_path": "datasets[].entities[].aggregates[].joins", + "path_kind": "property" + }, + "purpose": "Legacy entity-local aggregate fields. These stay parseable while\nthe public surface moves to dataset-level aggregates.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/joins", + "key_path": "datasets[].tables[].aggregates[].joins", + "path_kind": "property" + }, + "purpose": "Legacy entity-local aggregate fields. These stay parseable while\nthe public surface moves to dataset-level aggregates.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/joins/items", + "key_path": "datasets[].aggregates[].joins[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AggregateJoinConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "relationship" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AggregateJoinConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/joins/items", + "key_path": "datasets[].entities[].aggregates[].joins[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AggregateJoinConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "relationship" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AggregateJoinConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/joins/items", + "key_path": "datasets[].tables[].aggregates[].joins[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AggregateJoinConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "relationship" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AggregateJoinConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/measures", + "key_path": "datasets[].aggregates[].measures", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/measures", + "key_path": "datasets[].entities[].aggregates[].measures", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/measures", + "key_path": "datasets[].tables[].aggregates[].measures", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/measures/items", + "key_path": "datasets[].aggregates[].measures[]", + "path_kind": "array_item" + }, + "purpose": "One measure inside an aggregate.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AggregateMeasure", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "name", + "function", + "column" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AggregateMeasure" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/measures/items", + "key_path": "datasets[].entities[].aggregates[].measures[]", + "path_kind": "array_item" + }, + "purpose": "One measure inside an aggregate.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AggregateMeasure", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "name", + "function", + "column" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AggregateMeasure" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/measures/items", + "key_path": "datasets[].tables[].aggregates[].measures[]", + "path_kind": "array_item" + }, + "purpose": "One measure inside an aggregate.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AggregateMeasure", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "name", + "function", + "column" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AggregateMeasure" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings", + "key_path": "datasets[].aggregates[].required_filter_bindings", + "path_kind": "property" + }, + "purpose": "Principal-derived bindings that both satisfy the required filter gate\nand are applied to the aggregate query.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings", + "key_path": "datasets[].entities[].aggregates[].required_filter_bindings", + "path_kind": "property" + }, + "purpose": "Principal-derived bindings that both satisfy the required filter gate\nand are applied to the aggregate query.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings", + "key_path": "datasets[].tables[].aggregates[].required_filter_bindings", + "path_kind": "property" + }, + "purpose": "Principal-derived bindings that both satisfy the required filter gate\nand are applied to the aggregate query.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings/items", + "key_path": "datasets[].aggregates[].required_filter_bindings[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/RequiredFilterBindingConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "field" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/RequiredFilterBindingConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings/items", + "key_path": "datasets[].entities[].aggregates[].required_filter_bindings[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/RequiredFilterBindingConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "field" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/RequiredFilterBindingConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings/items", + "key_path": "datasets[].tables[].aggregates[].required_filter_bindings[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/RequiredFilterBindingConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "field" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/RequiredFilterBindingConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/required_filters", + "key_path": "datasets[].aggregates[].required_filters", + "path_kind": "property" + }, + "purpose": "Alternative fields or dimensions that can satisfy the aggregate gate. A\nprincipal-bound equality filter on any listed field is sufficient, so\nlist multiple fields only when each is an acceptable boundary.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/required_filters", + "key_path": "datasets[].entities[].aggregates[].required_filters", + "path_kind": "property" + }, + "purpose": "Alternative fields or dimensions that can satisfy the aggregate gate. A\nprincipal-bound equality filter on any listed field is sufficient, so\nlist multiple fields only when each is an acceptable boundary.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/required_filters", + "key_path": "datasets[].tables[].aggregates[].required_filters", + "path_kind": "property" + }, + "purpose": "Alternative fields or dimensions that can satisfy the aggregate gate. A\nprincipal-bound equality filter on any listed field is sufficient, so\nlist multiple fields only when each is an acceptable boundary.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/required_filters/items", + "key_path": "datasets[].aggregates[].required_filters[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/required_filters/items", + "key_path": "datasets[].entities[].aggregates[].required_filters[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/required_filters/items", + "key_path": "datasets[].tables[].aggregates[].required_filters[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/source_entity", + "key_path": "datasets[].aggregates[].source_entity", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/source_entity", + "key_path": "datasets[].entities[].aggregates[].source_entity", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/source_entity", + "key_path": "datasets[].tables[].aggregates[].source_entity", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/spatial", + "key_path": "datasets[].aggregates[].spatial", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "mode", + "dimension", + "geometry_entity", + "geometry_id_field", + "geometry_field" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/spatial", + "key_path": "datasets[].entities[].aggregates[].spatial", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "mode", + "dimension", + "geometry_entity", + "geometry_id_field", + "geometry_field" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/spatial", + "key_path": "datasets[].tables[].aggregates[].spatial", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "mode", + "dimension", + "geometry_entity", + "geometry_id_field", + "geometry_field" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/temporal_field", + "key_path": "datasets[].aggregates[].temporal_field", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/temporal_field", + "key_path": "datasets[].entities[].aggregates[].temporal_field", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/temporal_field", + "key_path": "datasets[].tables[].aggregates[].temporal_field", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/title", + "key_path": "datasets[].aggregates[].title", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/title", + "key_path": "datasets[].entities[].aggregates[].title", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/title", + "key_path": "datasets[].tables[].aggregates[].title", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateDimensionConfig/properties/codelist", + "key_path": "datasets[].aggregates[].dimensions[].codelist", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateDimensionConfig/properties/codelist", + "key_path": "datasets[].entities[].aggregates[].dimensions[].codelist", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateDimensionConfig/properties/codelist", + "key_path": "datasets[].tables[].aggregates[].dimensions[].codelist", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateDimensionConfig/properties/field", + "key_path": "datasets[].aggregates[].dimensions[].field", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateDimensionConfig/properties/field", + "key_path": "datasets[].entities[].aggregates[].dimensions[].field", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateDimensionConfig/properties/field", + "key_path": "datasets[].tables[].aggregates[].dimensions[].field", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateDimensionConfig/properties/id", + "key_path": "datasets[].aggregates[].dimensions[].id", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateDimensionConfig/properties/id", + "key_path": "datasets[].entities[].aggregates[].dimensions[].id", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateDimensionConfig/properties/id", + "key_path": "datasets[].tables[].aggregates[].dimensions[].id", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateDimensionConfig/properties/label", + "key_path": "datasets[].aggregates[].dimensions[].label", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateDimensionConfig/properties/label", + "key_path": "datasets[].entities[].aggregates[].dimensions[].label", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateDimensionConfig/properties/label", + "key_path": "datasets[].tables[].aggregates[].dimensions[].label", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/column", + "key_path": "datasets[].aggregates[].indicators[].column", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/column", + "key_path": "datasets[].entities[].aggregates[].indicators[].column", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/column", + "key_path": "datasets[].tables[].aggregates[].indicators[].column", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/decimals", + "key_path": "datasets[].aggregates[].indicators[].decimals", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer", + "null" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": [ + "integer", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/decimals", + "key_path": "datasets[].entities[].aggregates[].indicators[].decimals", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer", + "null" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": [ + "integer", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/decimals", + "key_path": "datasets[].tables[].aggregates[].indicators[].decimals", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer", + "null" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": [ + "integer", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/definition_uri", + "key_path": "datasets[].aggregates[].indicators[].definition_uri", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/definition_uri", + "key_path": "datasets[].entities[].aggregates[].indicators[].definition_uri", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/definition_uri", + "key_path": "datasets[].tables[].aggregates[].indicators[].definition_uri", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/frequency", + "key_path": "datasets[].aggregates[].indicators[].frequency", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/frequency", + "key_path": "datasets[].entities[].aggregates[].indicators[].frequency", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/frequency", + "key_path": "datasets[].tables[].aggregates[].indicators[].frequency", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/function", + "key_path": "datasets[].aggregates[].indicators[].function", + "path_kind": "property" + }, + "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/AggregateFunction", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "count", + "sum", + "avg", + "min", + "max", + "median", + "count_distinct", + "stddev" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AggregateFunction" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/function", + "key_path": "datasets[].entities[].aggregates[].indicators[].function", + "path_kind": "property" + }, + "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/AggregateFunction", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "count", + "sum", + "avg", + "min", + "max", + "median", + "count_distinct", + "stddev" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AggregateFunction" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/function", + "key_path": "datasets[].tables[].aggregates[].indicators[].function", + "path_kind": "property" + }, + "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/AggregateFunction", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "count", + "sum", + "avg", + "min", + "max", + "median", + "count_distinct", + "stddev" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AggregateFunction" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/id", + "key_path": "datasets[].aggregates[].indicators[].id", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/id", + "key_path": "datasets[].entities[].aggregates[].indicators[].id", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/id", + "key_path": "datasets[].tables[].aggregates[].indicators[].id", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/label", + "key_path": "datasets[].aggregates[].indicators[].label", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/label", + "key_path": "datasets[].entities[].aggregates[].indicators[].label", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/label", + "key_path": "datasets[].tables[].aggregates[].indicators[].label", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_measure", + "key_path": "datasets[].aggregates[].indicators[].unit_measure", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_measure", + "key_path": "datasets[].entities[].aggregates[].indicators[].unit_measure", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_measure", + "key_path": "datasets[].tables[].aggregates[].indicators[].unit_measure", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_mult", + "key_path": "datasets[].aggregates[].indicators[].unit_mult", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer", + "null" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "int32" + }, + { + "keyword": "maximum", + "value": 2147483647 + }, + { + "keyword": "minimum", + "value": -2147483648 + }, + { + "keyword": "type", + "value": [ + "integer", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_mult", + "key_path": "datasets[].entities[].aggregates[].indicators[].unit_mult", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer", + "null" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "int32" + }, + { + "keyword": "maximum", + "value": 2147483647 + }, + { + "keyword": "minimum", + "value": -2147483648 + }, + { + "keyword": "type", + "value": [ + "integer", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_mult", + "key_path": "datasets[].tables[].aggregates[].indicators[].unit_mult", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer", + "null" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "int32" + }, + { + "keyword": "maximum", + "value": 2147483647 + }, + { + "keyword": "minimum", + "value": -2147483648 + }, + { + "keyword": "type", + "value": [ + "integer", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateJoinConfig/properties/relationship", + "key_path": "datasets[].aggregates[].joins[].relationship", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateJoinConfig/properties/relationship", + "key_path": "datasets[].entities[].aggregates[].joins[].relationship", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateJoinConfig/properties/relationship", + "key_path": "datasets[].tables[].aggregates[].joins[].relationship", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateMeasure/properties/column", + "key_path": "datasets[].aggregates[].measures[].column", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateMeasure/properties/column", + "key_path": "datasets[].entities[].aggregates[].measures[].column", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateMeasure/properties/column", + "key_path": "datasets[].tables[].aggregates[].measures[].column", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateMeasure/properties/function", + "key_path": "datasets[].aggregates[].measures[].function", + "path_kind": "property" + }, + "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/AggregateFunction", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "count", + "sum", + "avg", + "min", + "max", + "median", + "count_distinct", + "stddev" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AggregateFunction" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateMeasure/properties/function", + "key_path": "datasets[].entities[].aggregates[].measures[].function", + "path_kind": "property" + }, + "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/AggregateFunction", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "count", + "sum", + "avg", + "min", + "max", + "median", + "count_distinct", + "stddev" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AggregateFunction" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateMeasure/properties/function", + "key_path": "datasets[].tables[].aggregates[].measures[].function", + "path_kind": "property" + }, + "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/AggregateFunction", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "count", + "sum", + "avg", + "min", + "max", + "median", + "count_distinct", + "stddev" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AggregateFunction" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateMeasure/properties/name", + "key_path": "datasets[].aggregates[].measures[].name", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateMeasure/properties/name", + "key_path": "datasets[].entities[].aggregates[].measures[].name", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateMeasure/properties/name", + "key_path": "datasets[].tables[].aggregates[].measures[].name", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/bbox_fields", + "key_path": "datasets[].aggregates[].spatial.bbox_fields", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "min_x", + "min_y", + "max_x", + "max_y" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/bbox_fields", + "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "min_x", + "min_y", + "max_x", + "max_y" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/bbox_fields", + "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "min_x", + "min_y", + "max_x", + "max_y" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/collection_id", + "key_path": "datasets[].aggregates[].spatial.collection_id", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/collection_id", + "key_path": "datasets[].entities[].aggregates[].spatial.collection_id", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/collection_id", + "key_path": "datasets[].tables[].aggregates[].spatial.collection_id", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/dimension", + "key_path": "datasets[].aggregates[].spatial.dimension", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/dimension", + "key_path": "datasets[].entities[].aggregates[].spatial.dimension", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/dimension", + "key_path": "datasets[].tables[].aggregates[].spatial.dimension", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_entity", + "key_path": "datasets[].aggregates[].spatial.geometry_entity", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_entity", + "key_path": "datasets[].entities[].aggregates[].spatial.geometry_entity", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_entity", + "key_path": "datasets[].tables[].aggregates[].spatial.geometry_entity", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_field", + "key_path": "datasets[].aggregates[].spatial.geometry_field", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_field", + "key_path": "datasets[].entities[].aggregates[].spatial.geometry_field", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_field", + "key_path": "datasets[].tables[].aggregates[].spatial.geometry_field", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_id_field", + "key_path": "datasets[].aggregates[].spatial.geometry_id_field", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_id_field", + "key_path": "datasets[].entities[].aggregates[].spatial.geometry_id_field", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_id_field", + "key_path": "datasets[].tables[].aggregates[].spatial.geometry_id_field", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/max_geometry_vertices", + "key_path": "datasets[].aggregates[].spatial.max_geometry_vertices", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/max_geometry_vertices", + "key_path": "datasets[].entities[].aggregates[].spatial.max_geometry_vertices", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/max_geometry_vertices", + "key_path": "datasets[].tables[].aggregates[].spatial.max_geometry_vertices", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/mode", + "key_path": "datasets[].aggregates[].spatial.mode", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "const", + "value": "admin_area" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/mode", + "key_path": "datasets[].entities[].aggregates[].spatial.mode", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "const", + "value": "admin_area" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/mode", + "key_path": "datasets[].tables[].aggregates[].spatial.mode", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "const", + "value": "admin_area" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AllowedFilter/properties/field", + "key_path": "datasets[].aggregates[].allowed_filters[].field", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AllowedFilter/properties/field", + "key_path": "datasets[].entities[].aggregates[].allowed_filters[].field", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AllowedFilter/properties/field", + "key_path": "datasets[].entities[].api.allowed_filters[].field", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AllowedFilter/properties/field", + "key_path": "datasets[].tables[].aggregates[].allowed_filters[].field", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AllowedFilter/properties/field", + "key_path": "datasets[].tables[].api.allowed_filters[].field", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AllowedFilter/properties/ops", + "key_path": "datasets[].aggregates[].allowed_filters[].ops", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AllowedFilter/properties/ops", + "key_path": "datasets[].entities[].aggregates[].allowed_filters[].ops", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AllowedFilter/properties/ops", + "key_path": "datasets[].entities[].api.allowed_filters[].ops", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AllowedFilter/properties/ops", + "key_path": "datasets[].tables[].aggregates[].allowed_filters[].ops", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AllowedFilter/properties/ops", + "key_path": "datasets[].tables[].api.allowed_filters[].ops", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AllowedFilter/properties/ops/items", + "key_path": "datasets[].aggregates[].allowed_filters[].ops[]", + "path_kind": "array_item" + }, + "purpose": "Filter operator opted into per field.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/FilterOp", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "eq", + "in", + "gte", + "lte", + "between" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/FilterOp" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AllowedFilter/properties/ops/items", + "key_path": "datasets[].entities[].aggregates[].allowed_filters[].ops[]", + "path_kind": "array_item" + }, + "purpose": "Filter operator opted into per field.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/FilterOp", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "eq", + "in", + "gte", + "lte", + "between" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/FilterOp" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AllowedFilter/properties/ops/items", + "key_path": "datasets[].entities[].api.allowed_filters[].ops[]", + "path_kind": "array_item" + }, + "purpose": "Filter operator opted into per field.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/FilterOp", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "eq", + "in", + "gte", + "lte", + "between" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/FilterOp" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AllowedFilter/properties/ops/items", + "key_path": "datasets[].tables[].aggregates[].allowed_filters[].ops[]", + "path_kind": "array_item" + }, + "purpose": "Filter operator opted into per field.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/FilterOp", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "eq", + "in", + "gte", + "lte", + "between" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/FilterOp" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AllowedFilter/properties/ops/items", + "key_path": "datasets[].tables[].api.allowed_filters[].ops[]", + "path_kind": "array_item" + }, + "purpose": "Filter operator opted into per field.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/FilterOp", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "eq", + "in", + "gte", + "lte", + "between" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/FilterOp" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ApiKeyConfig/properties/fingerprint", + "key_path": "auth.api_keys[].fingerprint", + "path_kind": "property" + }, + "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_auth_secret_reference", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/CredentialFingerprintSchema", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + [ + "provider", + "name" + ], + [ + "provider", + "path" + ] + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/CredentialFingerprintSchema" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ApiKeyConfig/properties/id", + "key_path": "auth.api_keys[].id", + "path_kind": "property" + }, + "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_auth_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ApiKeyConfig/properties/scopes", + "key_path": "auth.api_keys[].scopes", + "path_kind": "property" + }, + "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_auth_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ApiKeyConfig/properties/scopes/items", + "key_path": "auth.api_keys[].scopes[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_auth_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AttributeReleaseProfile/properties/claims", + "key_path": "datasets[].entities[].attribute_release_profiles[].claims", + "path_kind": "property" + }, + "purpose": "Claims released on success. Non-empty; at least one `required`.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AttributeReleaseProfile/properties/claims/items", + "key_path": "datasets[].entities[].attribute_release_profiles[].claims[]", + "path_kind": "array_item" + }, + "purpose": "A single released claim. Exactly one of `source_field` or `expression`\nmust be set: a claim is either a direct source-field projection or a\nCEL-computed value.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/ReleaseClaimConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "name" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ReleaseClaimConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AttributeReleaseProfile/properties/description", + "key_path": "datasets[].entities[].attribute_release_profiles[].description", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AttributeReleaseProfile/properties/id", + "key_path": "datasets[].entities[].attribute_release_profiles[].id", + "path_kind": "property" + }, + "purpose": "Profile identifier, lower-kebab/snake (`^[a-z][a-z0-9_-]*$`). Globally\nunique with `version`.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AttributeReleaseProfile/properties/purpose", + "key_path": "datasets[].entities[].attribute_release_profiles[].purpose", + "path_kind": "property" + }, + "purpose": "Data-purpose this profile is bound to. When the backing entity declares\n`governed_policy.permitted_purposes`, this must be a member.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AttributeReleaseProfile/properties/release_conditions", + "key_path": "datasets[].entities[].attribute_release_profiles[].release_conditions", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "expression" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AttributeReleaseProfile/properties/release_scope", + "key_path": "datasets[].entities[].attribute_release_profiles[].release_scope", + "path_kind": "property" + }, + "purpose": "Dataset-bound scope a caller must hold to invoke this release. The\nstable profile is exactly `:identity_release`.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AttributeReleaseProfile/properties/response", + "key_path": "datasets[].entities[].attribute_release_profiles[].response", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/ReleaseResponseConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ReleaseResponseConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AttributeReleaseProfile/properties/subject", + "key_path": "datasets[].entities[].attribute_release_profiles[].subject", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/ReleaseSubjectConfig", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "source_field", + "id_type" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ReleaseSubjectConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AttributeReleaseProfile/properties/title", + "key_path": "datasets[].entities[].attribute_release_profiles[].title", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AttributeReleaseProfile/properties/version", + "key_path": "datasets[].entities[].attribute_release_profiles[].version", + "path_kind": "property" + }, + "purpose": "Profile version. Globally unique with `id`; no silent \"latest\".", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AuditConfig/oneOf/0/properties/sink", + "key_path": "audit.sink", + "path_kind": "property" + }, + "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_audit_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": [ + "file", + "stdout", + "syslog" + ] + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AuditConfig/oneOf/1/properties/path", + "key_path": "audit.path", + "path_kind": "property" + }, + "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_audit_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AuditConfig/oneOf/1/properties/rotate", + "key_path": "audit.rotate", + "path_kind": "property" + }, + "purpose": "In-process rotation for the `file` audit sink.", + "purpose_source": "schema_description", + "intent_profile": "relay_audit_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/RotateConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "max_size_mb", + "max_files" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/RotateConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AuditConfig/properties/chain", + "key_path": "audit.chain", + "path_kind": "property" + }, + "purpose": "Retains the compatibility switch in the authored contract; Relay audit envelopes remain integrity-chained regardless of this setting.", + "purpose_source": "reviewed_override", + "intent_profile": "relay_audit_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AuditConfig/properties/format", + "key_path": "audit.format", + "path_kind": "property" + }, + "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_audit_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/AuditFormat", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": "jsonl" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AuditFormat" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AuditConfig/properties/hash_secret_env", + "key_path": "audit.hash_secret_env", + "path_kind": "property" + }, + "purpose": "Name of the environment variable holding the per-deploy secret\nused to HMAC sensitive audit values (single-record primary keys,\nsensitive query parameters). Runtime startup fails closed when\nthis field is unset, empty, or points to a missing, empty, or\nweak secret. Direct middleware tests can opt into the explicit\nunkeyed dev-only hasher without using runtime config.", + "purpose_source": "schema_description", + "intent_profile": "relay_audit_secret_reference", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[^=\\x00]*[^=\\x00\\x09-\\x0D\\x20\\x85\\u00A0\\u1680\\u2000-\\u200A\\u2028\\u2029\\u202F\\u205F\\u3000][^=\\x00]*$" + }, + { + "keyword": "type", + "value": [ + "null", + "string" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AuditConfig/properties/include_health", + "key_path": "audit.include_health", + "path_kind": "property" + }, + "purpose": "Include `/healthz` liveness probes in the audit stream. `/ready` is\nalways excluded because auditing it would advance the chain after its\nzero-backlog shipping check and self-invalidate the next probe.", + "purpose_source": "schema_description", + "intent_profile": "relay_audit_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AuditConfig/properties/write_policy", + "key_path": "audit.write_policy", + "path_kind": "property" + }, + "purpose": "Behavior when an audit record fails to write.\n\n`fail_closed` (default) fails the request with a stable error code so\nthat no request outcome is returned without a durable audit record.\n`availability_first` logs the failure and lets the request succeed for\ndeployments that explicitly accept best-effort audit durability.\nPer-route-family selection is out of scope; this is a single\ndeployment-wide policy.", + "purpose_source": "schema_description", + "intent_profile": "relay_audit_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/AuditWritePolicySchema", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "availability_first", + "fail_closed", + "fail_closed_route_families" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AuditWritePolicySchema" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AuditPseudonymMaterialCatalogConfig/items", + "key_path": "consultation.audit_pseudonym_materials[]", + "path_kind": "array_item" + }, + "purpose": "One public epoch id bound to one secret source reference.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AuditPseudonymMaterialConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "key_id", + "source" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AuditPseudonymMaterialConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AuditPseudonymMaterialConfig/properties/key_id", + "key_path": "consultation.audit_pseudonym_materials[].key_id", + "path_kind": "property" + }, + "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_consultation_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/AuditPseudonymKeyIdSchema", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z0-9][a-z0-9._-]{0,63}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AuditPseudonymKeyIdSchema" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AuditPseudonymMaterialConfig/properties/source", + "key_path": "consultation.audit_pseudonym_materials[].source", + "path_kind": "property" + }, + "purpose": "Closed v1 set of audit-pseudonym secret source providers.\n\nThe configured name is a reference only. Secret values cannot be embedded\nin this model and are loaded exactly once during runtime compilation.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AuditPseudonymSecretSourceConfig", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "provider", + "name" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AuditPseudonymSecretSourceConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AuditPseudonymSecretSourceConfig/oneOf/0/properties/name", + "key_path": "consultation.audit_pseudonym_materials[].source.name", + "path_kind": "property" + }, + "purpose": "Portable environment-variable name used only as a secret reference.\n\nDebug output is redacted even though the name is not itself key material,\npreventing configuration diagnostics from disclosing secret topology.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_secret_reference", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/AuditPseudonymSecretEnvironmentName", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AuditPseudonymSecretEnvironmentName" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AuditPseudonymSecretSourceConfig/oneOf/0/properties/provider", + "key_path": "consultation.audit_pseudonym_materials[].source.provider", + "path_kind": "property" + }, + "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_consultation_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "const", + "value": "environment" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AuthConfig/properties/api_keys", + "key_path": "auth.api_keys", + "path_kind": "property" + }, + "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_auth_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AuthConfig/properties/api_keys/items", + "key_path": "auth.api_keys[]", + "path_kind": "array_item" + }, + "purpose": "One configured API key, identified by an id and a fingerprint reference.\nThe raw key never appears in config.", + "purpose_source": "schema_description", + "intent_profile": "relay_auth_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/ApiKeyConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id", + "fingerprint" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ApiKeyConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AuthConfig/properties/failure_throttle", + "key_path": "auth.failure_throttle", + "path_kind": "property" + }, + "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_auth_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AuthFailureThrottleConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AuthFailureThrottleConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AuthConfig/properties/mode", + "key_path": "auth.mode", + "path_kind": "property" + }, + "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_auth_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/AuthMode", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "const", + "value": [ + "api_key", + "oidc" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AuthMode" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AuthConfig/properties/oidc", + "key_path": "auth.oidc", + "path_kind": "property" + }, + "purpose": "OIDC / OAuth2 resource-server configuration. The relay validates\nincoming bearer JWTs against a configured external IdP. No tokens\nare minted here.", + "purpose_source": "schema_description", + "intent_profile": "relay_auth_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "issuer", + "audiences" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AuthFailureThrottleConfig/properties/enabled", + "key_path": "auth.failure_throttle.enabled", + "path_kind": "property" + }, + "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_auth_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AuthFailureThrottleConfig/properties/max_failures", + "key_path": "auth.failure_throttle.max_failures", + "path_kind": "property" + }, + "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_auth_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AuthFailureThrottleConfig/properties/window_seconds", + "key_path": "auth.failure_throttle.window_seconds", + "path_kind": "property" + }, + "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_auth_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "maximum", + "value": 18446744073709551615 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/CatalogConfig/properties/authority_type", + "key_path": "catalog.authority_type", + "path_kind": "property" + }, + "purpose": "BRegDCAT-AP: type IRI for the `foaf:Agent` publisher. When set, emits\n`dcterms:type` on the publisher node.\n\nBRegDCAT-AP 2.1.0 SHACL checks publisher type values against the ADMS\npublishertype scheme (`http://purl.org/adms/publishertype/...`).\nThe relay does not enforce a vocabulary: any IRI passes through.", + "purpose_source": "schema_description", + "intent_profile": "relay_catalog_public", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "public", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/CatalogConfig/properties/base_url", + "key_path": "catalog.base_url", + "path_kind": "property" + }, + "purpose": "Controls Relay catalog identity and public metadata exposed for governed discovery.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_catalog_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/CatalogConfig/properties/default_spatial_coverage", + "key_path": "catalog.default_spatial_coverage", + "path_kind": "property" + }, + "purpose": "BRegDCAT-AP: default `dcterms:spatial` IRI applied to datasets that\ndo not declare their own `spatial_coverage`. Typically an EU\nauthority country IRI under\n`http://publications.europa.eu/resource/authority/country/`.", + "purpose_source": "schema_description", + "intent_profile": "relay_catalog_public", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "public", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/CatalogConfig/properties/participant_id", + "key_path": "catalog.participant_id", + "path_kind": "property" + }, + "purpose": "Identifies the participant in catalog output; when omitted, Relay derives the participant identifier from the reviewed catalog base URL.", + "purpose_source": "reviewed_override", + "intent_profile": "relay_catalog_public", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "public", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/CatalogConfig/properties/publisher", + "key_path": "catalog.publisher", + "path_kind": "property" + }, + "purpose": "Publishes the reviewed Relay catalog identity and descriptive metadata used for governed discovery.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_catalog_public", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "public", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/CatalogConfig/properties/publisher_iri", + "key_path": "catalog.publisher_iri", + "path_kind": "property" + }, + "purpose": "BRegDCAT-AP: identifier IRI for the `foaf:Agent` publisher. Use a\ncontrolled-vocabulary corporate body IRI when publishing strict\nBRegDCAT-AP.", + "purpose_source": "schema_description", + "intent_profile": "relay_catalog_public", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "public", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/CatalogConfig/properties/title", + "key_path": "catalog.title", + "path_kind": "property" + }, + "purpose": "Publishes the reviewed Relay catalog identity and descriptive metadata used for governed discovery.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_catalog_public", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "public", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConfigTrustConfig/properties/antirollback_state_path", + "key_path": "config_trust.antirollback_state_path", + "path_kind": "property" + }, + "purpose": "Controls Relay verification of signed configuration bundles, trust anchors, and rollback protection.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_config_trust_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConfigTrustConfig/properties/break_glass_override_path", + "key_path": "config_trust.break_glass_override_path", + "path_kind": "property" + }, + "purpose": "Controls Relay verification of signed configuration bundles, trust anchors, and rollback protection.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_config_trust_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConfigTrustConfig/properties/bundle_path", + "key_path": "config_trust.bundle_path", + "path_kind": "property" + }, + "purpose": "Controls Relay verification of signed configuration bundles, trust anchors, and rollback protection.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_config_trust_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConfigTrustConfig/properties/trust_anchor_path", + "key_path": "config_trust.trust_anchor_path", + "path_kind": "property" + }, + "purpose": "Controls Relay verification of signed configuration bundles, trust anchors, and rollback protection.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_config_trust_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/evidence", + "key_path": "consultation.artifacts.evidence", + "path_kind": "property" + }, + "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_consultation_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/evidence/items", + "key_path": "consultation.artifacts.evidence[]", + "path_kind": "array_item" + }, + "purpose": "One bounded, hash-pinned integration evidence file.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/ConsultationEvidenceArtifactConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "class", + "path", + "sha256" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ConsultationEvidenceArtifactConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/integration_packs", + "key_path": "consultation.artifacts.integration_packs", + "path_kind": "property" + }, + "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_consultation_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/integration_packs/items", + "key_path": "consultation.artifacts.integration_packs[]", + "path_kind": "array_item" + }, + "purpose": "One hash-pinned public contract or reviewed integration pack.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/ConsultationTypedArtifactReferenceConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "path", + "hash", + "sha256" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/private_bindings", + "key_path": "consultation.artifacts.private_bindings", + "path_kind": "property" + }, + "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_consultation_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/private_bindings/items", + "key_path": "consultation.artifacts.private_bindings[]", + "path_kind": "array_item" + }, + "purpose": "One hash-pinned public contract or reviewed integration pack.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/ConsultationTypedArtifactReferenceConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "path", + "hash", + "sha256" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/public_contracts", + "key_path": "consultation.artifacts.public_contracts", + "path_kind": "property" + }, + "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_consultation_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/public_contracts/items", + "key_path": "consultation.artifacts.public_contracts[]", + "path_kind": "array_item" + }, + "purpose": "One hash-pinned public contract or reviewed integration pack.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/ConsultationTypedArtifactReferenceConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "path", + "hash", + "sha256" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/rhai_scripts", + "key_path": "consultation.artifacts.rhai_scripts", + "path_kind": "property" + }, + "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_consultation_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/rhai_scripts/items", + "key_path": "consultation.artifacts.rhai_scripts[]", + "path_kind": "array_item" + }, + "purpose": "One hash-pinned private binding or standalone Rhai script.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/ConsultationArtifactReferenceConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "path", + "sha256" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ConsultationArtifactReferenceConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationArtifactReferenceConfig/properties/path", + "key_path": "consultation.artifacts.rhai_scripts[].path", + "path_kind": "property" + }, + "purpose": "Normalized bundle-root-relative path.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationArtifactReferenceConfig/properties/sha256", + "key_path": "consultation.artifacts.rhai_scripts[].sha256", + "path_kind": "property" + }, + "purpose": "Raw file hash recorded by Registry Config Bundle v1.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^sha256:[0-9a-f]{64}$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationConfig/properties/artifacts", + "key_path": "consultation.artifacts", + "path_kind": "property" + }, + "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_consultation_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "public_contracts", + "integration_packs", + "private_bindings", + "evidence" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationConfig/properties/audit_pseudonym_materials", + "key_path": "consultation.audit_pseudonym_materials", + "path_kind": "property" + }, + "purpose": "Bounded startup catalog of audit-pseudonym material references.\n\nThe 1..=32 bound and cross-entry uniqueness are enforced by config\nvalidation and repeated by the material provider before loading secrets.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "local_reference": "#/$defs/AuditPseudonymMaterialCatalogConfig", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AuditPseudonymMaterialCatalogConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationConfig/properties/authorized_workload", + "key_path": "consultation.authorized_workload", + "path_kind": "property" + }, + "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_consultation_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/ConsultationWorkloadConfig", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "audience", + "client_claim_selector", + "client_value", + "principal_id" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ConsultationWorkloadConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationConfig/properties/source_credentials", + "key_path": "consultation.source_credentials", + "path_kind": "property" + }, + "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_consultation_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "local_reference": "#/$defs/ConsultationSourceCredentialCatalogConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ConsultationSourceCredentialCatalogConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationConfig/properties/state_plane", + "key_path": "consultation.state_plane", + "path_kind": "property" + }, + "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_consultation_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/ConsultationStatePlaneConfig", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "database_url_env", + "chain_key_epoch_id", + "serving_fence_lock_key", + "audit_pseudonym_keyring_lock_key" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ConsultationStatePlaneConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationEvidenceArtifactConfig/properties/class", + "key_path": "consultation.artifacts.evidence[].class", + "path_kind": "property" + }, + "purpose": "Closed evidence classes understood by consultation source-plan v1.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/ConsultationEvidenceClassConfig", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "conformance", + "negative_security", + "minimization" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ConsultationEvidenceClassConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationEvidenceArtifactConfig/properties/path", + "key_path": "consultation.artifacts.evidence[].path", + "path_kind": "property" + }, + "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_consultation_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationEvidenceArtifactConfig/properties/sha256", + "key_path": "consultation.artifacts.evidence[].sha256", + "path_kind": "property" + }, + "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_consultation_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^sha256:[0-9a-f]{64}$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationSourceCredentialCatalogConfig/items", + "key_path": "consultation.source_credentials[]", + "path_kind": "array_item" + }, + "purpose": "Closed V1 source-credential provider configuration.\n\nEnvironment names are opaque references and are redacted from `Debug`.\nThere is deliberately no field capable of carrying an embedded username,\npassword, bearer token, or provider-specific extension.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/ConsultationSourceCredentialConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + [ + "type", + "ref", + "generation", + "client_id_env", + "client_secret_env" + ], + [ + "type", + "ref", + "generation", + "token_env" + ], + [ + "type", + "ref", + "generation", + "username_env", + "password_env" + ], + [ + "type", + "ref", + "generation", + "value_env" + ] + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ConsultationSourceCredentialConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/generation", + "key_path": "consultation.source_credentials[].generation", + "path_kind": "property" + }, + "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_consultation_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "maximum", + "value": 18446744073709551615 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/password_env", + "key_path": "consultation.source_credentials[].password_env", + "path_kind": "property" + }, + "purpose": "Portable environment-variable name used only as a credential reference.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_secret_reference", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/ConsultationCredentialEnvironmentName", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ConsultationCredentialEnvironmentName" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/ref", + "key_path": "consultation.source_credentials[].ref", + "path_kind": "property" + }, + "purpose": "Exact private-binding credential reference grammar.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/ConsultationSourceCredentialReference", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ConsultationSourceCredentialReference" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/type", + "key_path": "consultation.source_credentials[].type", + "path_kind": "property" + }, + "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_consultation_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "const", + "value": [ + "api_key_header", + "api_key_query", + "basic", + "oauth_client_credentials", + "static_bearer" + ] + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/username_env", + "key_path": "consultation.source_credentials[].username_env", + "path_kind": "property" + }, + "purpose": "Portable environment-variable name used only as a credential reference.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_secret_reference", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/ConsultationCredentialEnvironmentName", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ConsultationCredentialEnvironmentName" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/1/properties/token_env", + "key_path": "consultation.source_credentials[].token_env", + "path_kind": "property" + }, + "purpose": "Portable environment-variable name used only as a credential reference.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_secret_reference", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/ConsultationCredentialEnvironmentName", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ConsultationCredentialEnvironmentName" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/2/properties/value_env", + "key_path": "consultation.source_credentials[].value_env", + "path_kind": "property" + }, + "purpose": "Portable environment-variable name used only as a credential reference.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_secret_reference", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/ConsultationCredentialEnvironmentName", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ConsultationCredentialEnvironmentName" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/4/properties/client_id_env", + "key_path": "consultation.source_credentials[].client_id_env", + "path_kind": "property" + }, + "purpose": "Portable environment-variable name used only as a credential reference.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_secret_reference", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/ConsultationCredentialEnvironmentName", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ConsultationCredentialEnvironmentName" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/4/properties/client_secret_env", + "key_path": "consultation.source_credentials[].client_secret_env", + "path_kind": "property" + }, + "purpose": "Portable environment-variable name used only as a credential reference.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_secret_reference", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/ConsultationCredentialEnvironmentName", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ConsultationCredentialEnvironmentName" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationStatePlaneConfig/properties/audit_pseudonym_keyring_lock_key", + "key_path": "consultation.state_plane.audit_pseudonym_keyring_lock_key", + "path_kind": "property" + }, + "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_consultation_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "int64" + }, + { + "keyword": "maximum", + "value": 9223372036854775807 + }, + { + "keyword": "minimum", + "value": -9223372036854775808 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationStatePlaneConfig/properties/chain_key_epoch_id", + "key_path": "consultation.state_plane.chain_key_epoch_id", + "path_kind": "property" + }, + "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_consultation_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationStatePlaneConfig/properties/database_url_env", + "key_path": "consultation.state_plane.database_url_env", + "path_kind": "property" + }, + "purpose": "Portable environment-variable name that resolves the state-plane URL.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_secret_reference", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/ConsultationDatabaseUrlEnvironmentName", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ConsultationDatabaseUrlEnvironmentName" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationStatePlaneConfig/properties/root_certificate_path", + "key_path": "consultation.state_plane.root_certificate_path", + "path_kind": "property" + }, + "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_consultation_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationStatePlaneConfig/properties/serving_fence_lock_key", + "key_path": "consultation.state_plane.serving_fence_lock_key", + "path_kind": "property" + }, + "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_consultation_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "int64" + }, + { + "keyword": "maximum", + "value": 9223372036854775807 + }, + { + "keyword": "minimum", + "value": -9223372036854775808 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/hash", + "key_path": "consultation.artifacts.integration_packs[].hash", + "path_kind": "property" + }, + "purpose": "Domain-separated typed artifact hash consumed by the source-plan compiler.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^sha256:[0-9a-f]{64}$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/hash", + "key_path": "consultation.artifacts.private_bindings[].hash", + "path_kind": "property" + }, + "purpose": "Domain-separated typed artifact hash consumed by the source-plan compiler.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^sha256:[0-9a-f]{64}$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/hash", + "key_path": "consultation.artifacts.public_contracts[].hash", + "path_kind": "property" + }, + "purpose": "Domain-separated typed artifact hash consumed by the source-plan compiler.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^sha256:[0-9a-f]{64}$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/path", + "key_path": "consultation.artifacts.integration_packs[].path", + "path_kind": "property" + }, + "purpose": "Normalized bundle-root-relative path.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/path", + "key_path": "consultation.artifacts.private_bindings[].path", + "path_kind": "property" + }, + "purpose": "Normalized bundle-root-relative path.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/path", + "key_path": "consultation.artifacts.public_contracts[].path", + "path_kind": "property" + }, + "purpose": "Normalized bundle-root-relative path.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/sha256", + "key_path": "consultation.artifacts.integration_packs[].sha256", + "path_kind": "property" + }, + "purpose": "Raw file hash recorded by Registry Config Bundle v1.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^sha256:[0-9a-f]{64}$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/sha256", + "key_path": "consultation.artifacts.private_bindings[].sha256", + "path_kind": "property" + }, + "purpose": "Raw file hash recorded by Registry Config Bundle v1.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^sha256:[0-9a-f]{64}$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/sha256", + "key_path": "consultation.artifacts.public_contracts[].sha256", + "path_kind": "property" + }, + "purpose": "Raw file hash recorded by Registry Config Bundle v1.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^sha256:[0-9a-f]{64}$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationWorkloadConfig/properties/audience", + "key_path": "consultation.authorized_workload.audience", + "path_kind": "property" + }, + "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_consultation_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationWorkloadConfig/properties/client_claim_selector", + "key_path": "consultation.authorized_workload.client_claim_selector", + "path_kind": "property" + }, + "purpose": "Closed set of verified OAuth claims that may identify Registry Notary.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/ConsultationClientClaimSelectorConfig", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "azp", + "client_id" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ConsultationClientClaimSelectorConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationWorkloadConfig/properties/client_value", + "key_path": "consultation.authorized_workload.client_value", + "path_kind": "property" + }, + "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_consultation_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationWorkloadConfig/properties/principal_id", + "key_path": "consultation.authorized_workload.principal_id", + "path_kind": "property" + }, + "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_consultation_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/CorsConfig/properties/allowed_origins", + "key_path": "server.cors.allowed_origins", + "path_kind": "property" + }, + "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_server_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/CorsConfig/properties/allowed_origins/items", + "key_path": "server.cors.allowed_origins[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_server_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/CredentialFingerprintSchema/oneOf/0/properties/name", + "key_path": "auth.api_keys[].fingerprint.name", + "path_kind": "property" + }, + "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_auth_secret_reference", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/RuntimeEnvironmentNameSchema", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[^=\\x00]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/RuntimeEnvironmentNameSchema" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/CredentialFingerprintSchema/oneOf/0/properties/provider", + "key_path": "auth.api_keys[].fingerprint.provider", + "path_kind": "property" + }, + "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_auth_secret_reference", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "const", + "value": [ + "env", + "file" + ] + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/CredentialFingerprintSchema/oneOf/1/properties/path", + "key_path": "auth.api_keys[].fingerprint.path", + "path_kind": "property" + }, + "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_auth_secret_reference", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/CsvFormatConfig/properties/delimiter", + "key_path": "datasets[].tables[].source.format.csv.delimiter", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer", + "null" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint8" + }, + { + "keyword": "maximum", + "value": 255 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": [ + "integer", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/CsvFormatConfig/properties/header_row", + "key_path": "datasets[].tables[].source.format.csv.header_row", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer", + "null" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": [ + "integer", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/CsvFormatConfig/properties/quote", + "key_path": "datasets[].tables[].source.format.csv.quote", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer", + "null" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint8" + }, + { + "keyword": "maximum", + "value": 255 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": [ + "integer", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/access_rights", + "key_path": "datasets[].access_rights", + "path_kind": "property" + }, + "purpose": "Access rights classification, mirrors DCAT-AP `dcterms:accessRights`.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/AccessRights", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "public", + "restricted", + "non_public" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AccessRights" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/aggregates", + "key_path": "datasets[].aggregates", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/aggregates/items", + "key_path": "datasets[].aggregates[]", + "path_kind": "array_item" + }, + "purpose": "Aggregate declaration: group-by columns, measures, disclosure\ncontrol.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AggregateConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id", + "description", + "disclosure_control" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/applicable_legislation", + "key_path": "datasets[].applicable_legislation", + "path_kind": "property" + }, + "purpose": "DCAT-AP `dcatap:applicableLegislation` IRIs. This is evidence\npublished for standard consumers, not an application-specific\nauthorization or source-of-truth verdict.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/applicable_legislation/items", + "key_path": "datasets[].applicable_legislation[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/conforms_to", + "key_path": "datasets[].conforms_to", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/conforms_to/items", + "key_path": "datasets[].conforms_to[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/defaults", + "key_path": "datasets[].defaults", + "path_kind": "property" + }, + "purpose": "Optional table defaults for reducing repetition within one dataset.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/DatasetDefaultsConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/DatasetDefaultsConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/description", + "key_path": "datasets[].description", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/entities", + "key_path": "datasets[].entities", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/entities/items", + "key_path": "datasets[].entities[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/EntityConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "name", + "table", + "access", + "api" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/EntityConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/id", + "key_path": "datasets[].id", + "path_kind": "property" + }, + "purpose": "Dataset identifier. Lower-snake, starts with a letter.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/DatasetId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9_]*$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/DatasetId" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/owner", + "key_path": "datasets[].owner", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/public_services", + "key_path": "datasets[].public_services", + "path_kind": "property" + }, + "purpose": "CPSV public services that produce this dataset. Registry Relay emits\nthem as standard `cpsv:PublicService` nodes; consumers decide how to\ninterpret that evidence.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/public_services/items", + "key_path": "datasets[].public_services[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/PublicServiceConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "title" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/PublicServiceConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/sensitivity", + "key_path": "datasets[].sensitivity", + "path_kind": "property" + }, + "purpose": "Sensitivity classification. Operator-defined values cover common\npersonal and public dataset classifications in V1.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/Sensitivity", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "public", + "internal", + "personal", + "confidential", + "secret" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/Sensitivity" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/spatial_coverage", + "key_path": "datasets[].spatial_coverage", + "path_kind": "property" + }, + "purpose": "BRegDCAT-AP: `dct:spatial` IRI for this dataset. Overrides the\ncatalog-level `default_spatial_coverage` when set.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/status", + "key_path": "datasets[].status", + "path_kind": "property" + }, + "purpose": "Publishes the dataset lifecycle status; when omitted, Relay emits its weakest lifecycle claim instead of inferring a stronger status.", + "purpose_source": "reviewed_override", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "under_development", + "completed", + "deprecated", + "withdrawn" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "string" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/tables", + "key_path": "datasets[].tables", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/tables/items", + "key_path": "datasets[].tables[]", + "path_kind": "array_item" + }, + "purpose": "One private storage table under a dataset.\n\nThe public API should not expose these ids. Entity config maps one\nresource into one domain resource, with optional field renaming and\nrelationship declarations.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/ResourceConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id", + "source", + "schema" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ResourceConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/title", + "key_path": "datasets[].title", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/update_frequency", + "key_path": "datasets[].update_frequency", + "path_kind": "property" + }, + "purpose": "Update cadence; mirrors DCAT-AP `dcterms:accrualPeriodicity`. The\nV1 set is the codes used by the example plus the common alternates.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/UpdateFrequency", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "continuous", + "daily", + "weekly", + "termly", + "monthly", + "quarterly", + "annual", + "irregular", + "as_needed", + "unknown" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/UpdateFrequency" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DatasetDefaultsConfig/properties/materialization", + "key_path": "datasets[].defaults.materialization", + "path_kind": "property" + }, + "purpose": "How a configured private table is registered for query planning.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "snapshot" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "string" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DatasetDefaultsConfig/properties/refresh", + "key_path": "datasets[].defaults.refresh", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + [ + "mode", + "interval" + ], + [ + "mode" + ] + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DeploymentConfig/properties/evidence", + "key_path": "deployment.evidence", + "path_kind": "property" + }, + "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_deployment_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/DeploymentEvidenceConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/DeploymentEvidenceConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DeploymentConfig/properties/profile", + "key_path": "deployment.profile", + "path_kind": "property" + }, + "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_deployment_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "local", + "hosted_lab", + "production", + "evidence_grade" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "string" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DeploymentConfig/properties/waivers", + "key_path": "deployment.waivers", + "path_kind": "property" + }, + "purpose": "Per-deployment waivers. Each names one finding id, a required operator\nreference, an optional summary, and a mandatory expiry date. Expired\nwaivers stop suppressing their finding and raise\n`deployment.waiver_expired`.", + "purpose_source": "schema_description", + "intent_profile": "relay_deployment_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DeploymentConfig/properties/waivers/items", + "key_path": "deployment.waivers[]", + "path_kind": "array_item" + }, + "purpose": "One declared waiver. `expires` is an ISO 8601 `YYYY-MM-DD` date; format is\nvalidated at load time. The reference and optional summary are validated by\nthe shared operations contract before either can reach posture or logs.", + "purpose_source": "schema_description", + "intent_profile": "relay_deployment_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/DeploymentWaiverConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "finding", + "reference", + "expires" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/DeploymentWaiverConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DeploymentEvidenceConfig/properties/api_key_rotation", + "key_path": "deployment.evidence.api_key_rotation", + "path_kind": "property" + }, + "purpose": "Operator asserts an API-key rotation process is in place.", + "purpose_source": "schema_description", + "intent_profile": "relay_deployment_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_ack_cursor_path", + "key_path": "deployment.evidence.audit_ack_cursor_path", + "path_kind": "property" + }, + "purpose": "Optional path to a `registry.audit.ack_cursor.v1` file maintained by\nwhatever ships audit events off-host. When set, the runtime reads it to\nobserve shipping freshness and surfaces it as posture shipping health;\nabsent, shipping health stays `unverified` and only the declared\nshipping target is reported.", + "purpose_source": "schema_description", + "intent_profile": "relay_deployment_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_ack_max_age_secs", + "key_path": "deployment.evidence.audit_ack_max_age_secs", + "path_kind": "property" + }, + "purpose": "Optional freshness window in seconds for the ack cursor's `acked_at`\ntimestamp. Defaults to `DEFAULT_AUDIT_ACK_MAX_AGE` (900) when unset. A\nwindow without `audit_ack_cursor_path` is rejected at load, since a\nfreshness window is meaningless without a cursor to observe.", + "purpose_source": "schema_description", + "intent_profile": "relay_deployment_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer", + "null" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "maximum", + "value": 18446744073709551615 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": [ + "integer", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_offhost_shipping", + "key_path": "deployment.evidence.audit_offhost_shipping", + "path_kind": "property" + }, + "purpose": "Operator asserts audit records are shipped off-host (for example to a\nlog collector or SIEM) rather than relying solely on local retention.", + "purpose_source": "schema_description", + "intent_profile": "relay_deployment_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DeploymentEvidenceConfig/properties/ingress_rate_limit", + "key_path": "deployment.evidence.ingress_rate_limit", + "path_kind": "property" + }, + "purpose": "Operator asserts ingress rate limiting is enforced (for example by a\ngateway or reverse proxy in front of the relay).", + "purpose_source": "schema_description", + "intent_profile": "relay_deployment_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DeploymentWaiverConfig/properties/expires", + "key_path": "deployment.waivers[].expires", + "path_kind": "property" + }, + "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_deployment_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DeploymentWaiverConfig/properties/finding", + "key_path": "deployment.waivers[].finding", + "path_kind": "property" + }, + "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_deployment_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DeploymentWaiverConfig/properties/reference", + "key_path": "deployment.waivers[].reference", + "path_kind": "property" + }, + "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_deployment_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/DeploymentWaiverReference", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 128 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^(?!.*\\.\\.)[A-Za-z0-9._:-]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/DeploymentWaiverReference" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DeploymentWaiverConfig/properties/summary", + "key_path": "deployment.waivers[].summary", + "path_kind": "property" + }, + "purpose": "Structurally valid deployment-waiver summary. Contextual authorization-value and private-key marker exclusions require semantic producer validation.", + "purpose_source": "schema_description", + "intent_profile": "relay_deployment_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/DeploymentWaiverSummary", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/DeploymentWaiverSummary" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/method", + "key_path": "datasets[].aggregates[].disclosure_control.method", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/method", + "key_path": "datasets[].entities[].aggregates[].disclosure_control.method", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/method", + "key_path": "datasets[].tables[].aggregates[].disclosure_control.method", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/method/items", + "key_path": "datasets[].aggregates[].disclosure_control.method[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/method/items", + "key_path": "datasets[].entities[].aggregates[].disclosure_control.method[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/method/items", + "key_path": "datasets[].tables[].aggregates[].disclosure_control.method[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/min_cell_size", + "key_path": "datasets[].aggregates[].disclosure_control.min_cell_size", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/min_cell_size", + "key_path": "datasets[].entities[].aggregates[].disclosure_control.min_cell_size", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/min_cell_size", + "key_path": "datasets[].tables[].aggregates[].disclosure_control.min_cell_size", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/min_group_size", + "key_path": "datasets[].aggregates[].disclosure_control.min_group_size", + "path_kind": "property" + }, + "purpose": "Optionally overrides the effective disclosure threshold for grouped results; when omitted, Relay uses the configured cell threshold.", + "purpose_source": "reviewed_override", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer", + "null" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": [ + "integer", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/min_group_size", + "key_path": "datasets[].entities[].aggregates[].disclosure_control.min_group_size", + "path_kind": "property" + }, + "purpose": "Optionally overrides the effective disclosure threshold for grouped results; when omitted, Relay uses the configured cell threshold.", + "purpose_source": "reviewed_override", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer", + "null" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": [ + "integer", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/min_group_size", + "key_path": "datasets[].tables[].aggregates[].disclosure_control.min_group_size", + "path_kind": "property" + }, + "purpose": "Optionally overrides the effective disclosure threshold for grouped results; when omitted, Relay uses the configured cell threshold.", + "purpose_source": "reviewed_override", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer", + "null" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": [ + "integer", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/report_suppressed_rows", + "key_path": "datasets[].aggregates[].disclosure_control.report_suppressed_rows", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/report_suppressed_rows", + "key_path": "datasets[].entities[].aggregates[].disclosure_control.report_suppressed_rows", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/report_suppressed_rows", + "key_path": "datasets[].tables[].aggregates[].disclosure_control.report_suppressed_rows", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/suppression", + "key_path": "datasets[].aggregates[].disclosure_control.suppression", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/Suppression", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "const", + "value": [ + "mask", + "null", + "omit" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/Suppression" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/suppression", + "key_path": "datasets[].entities[].aggregates[].disclosure_control.suppression", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/Suppression", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "const", + "value": [ + "mask", + "null", + "omit" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/Suppression" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/suppression", + "key_path": "datasets[].tables[].aggregates[].disclosure_control.suppression", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/Suppression", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "const", + "value": [ + "mask", + "null", + "omit" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/Suppression" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EcosystemBindingSelectorConfig/properties/id", + "key_path": "metadata.ecosystem_binding.id", + "path_kind": "property" + }, + "purpose": "Controls Relay metadata publication and registry-description behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_metadata_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EcosystemBindingSelectorConfig/properties/version", + "key_path": "metadata.ecosystem_binding.version", + "path_kind": "property" + }, + "purpose": "Controls Relay metadata publication and registry-description behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_metadata_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityAccessConfig/properties/aggregate_scope", + "key_path": "datasets[].entities[].access.aggregate_scope", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityAccessConfig/properties/evidence_verification_scope", + "key_path": "datasets[].entities[].access.evidence_verification_scope", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityAccessConfig/properties/metadata_scope", + "key_path": "datasets[].entities[].access.metadata_scope", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityAccessConfig/properties/read_scope", + "key_path": "datasets[].entities[].access.read_scope", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityApiConfig/properties/allowed_expansions", + "key_path": "datasets[].entities[].api.allowed_expansions", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityApiConfig/properties/allowed_expansions/items", + "key_path": "datasets[].entities[].api.allowed_expansions[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityApiConfig/properties/allowed_filters", + "key_path": "datasets[].entities[].api.allowed_filters", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityApiConfig/properties/allowed_filters/items", + "key_path": "datasets[].entities[].api.allowed_filters[]", + "path_kind": "array_item" + }, + "purpose": "A single allowed filter: field name + permitted operators.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AllowedFilter", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "field", + "ops" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AllowedFilter" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityApiConfig/properties/default_limit", + "key_path": "datasets[].entities[].api.default_limit", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityApiConfig/properties/governed_policy", + "key_path": "datasets[].entities[].api.governed_policy", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityApiConfig/properties/max_limit", + "key_path": "datasets[].entities[].api.max_limit", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityApiConfig/properties/require_purpose_header", + "key_path": "datasets[].entities[].api.require_purpose_header", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityApiConfig/properties/required_filter_bindings", + "key_path": "datasets[].entities[].api.required_filter_bindings", + "path_kind": "property" + }, + "purpose": "Principal-derived bindings that both satisfy the required filter gate\nand are applied to the query.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityApiConfig/properties/required_filter_bindings/items", + "key_path": "datasets[].entities[].api.required_filter_bindings[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/RequiredFilterBindingConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "field" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/RequiredFilterBindingConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityApiConfig/properties/required_filters", + "key_path": "datasets[].entities[].api.required_filters", + "path_kind": "property" + }, + "purpose": "Alternative fields that can satisfy the row-scope gate. A\nprincipal-bound equality filter on any listed field is sufficient, so\nlist multiple fields only when each is an acceptable boundary.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityApiConfig/properties/required_filters/items", + "key_path": "datasets[].entities[].api.required_filters[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/access", + "key_path": "datasets[].entities[].access", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/EntityAccessConfig", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "metadata_scope", + "aggregate_scope", + "read_scope" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/EntityAccessConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/aggregates", + "key_path": "datasets[].entities[].aggregates", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/aggregates/items", + "key_path": "datasets[].entities[].aggregates[]", + "path_kind": "array_item" + }, + "purpose": "Aggregate declaration: group-by columns, measures, disclosure\ncontrol.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AggregateConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id", + "description", + "disclosure_control" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/api", + "key_path": "datasets[].entities[].api", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/EntityApiConfig", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "default_limit", + "max_limit" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/EntityApiConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/attribute_release_profiles", + "key_path": "datasets[].entities[].attribute_release_profiles", + "path_kind": "property" + }, + "purpose": "Governed identity attribute-release profiles attached to this entity.\nEach profile resolves exactly one subject and returns only the\nconfigured, minimised claims. Empty by default (feature opt-in).", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/attribute_release_profiles/items", + "key_path": "datasets[].entities[].attribute_release_profiles[]", + "path_kind": "array_item" + }, + "purpose": "A governed identity attribute-release profile. A profile is a\nprojection-limited, exactly-one-subject lookup that maps a configured set of\nsource fields (or CEL-computed expressions) into a minimised\nOIDC/UserInfo-style claim bundle. Every profile is purpose-bound and requires\na matching `data-purpose` at resolve time. Identified globally by the\n`(id, version)` pair; both are required path segments at resolve time.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AttributeReleaseProfile", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id", + "version", + "purpose", + "release_scope", + "subject", + "claims" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AttributeReleaseProfile" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/concept_uri", + "key_path": "datasets[].entities[].concept_uri", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/description", + "key_path": "datasets[].entities[].description", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/fields", + "key_path": "datasets[].entities[].fields", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/fields/items", + "key_path": "datasets[].entities[].fields[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/EntityFieldConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "name" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/EntityFieldConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/name", + "key_path": "datasets[].entities[].name", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/relationships", + "key_path": "datasets[].entities[].relationships", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/relationships/items", + "key_path": "datasets[].entities[].relationships[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/EntityRelationshipConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "name", + "kind", + "target", + "foreign_key" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/EntityRelationshipConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/spatial", + "key_path": "datasets[].entities[].spatial", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "geometry" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/table", + "key_path": "datasets[].entities[].table", + "path_kind": "property" + }, + "purpose": "Resource identifier within a dataset.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/ResourceId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9_]*$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ResourceId" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/title", + "key_path": "datasets[].entities[].title", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityFieldConfig/properties/codelist", + "key_path": "datasets[].entities[].fields[].codelist", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityFieldConfig/properties/concept_uri", + "key_path": "datasets[].entities[].fields[].concept_uri", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityFieldConfig/properties/from", + "key_path": "datasets[].entities[].fields[].from", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityFieldConfig/properties/language", + "key_path": "datasets[].entities[].fields[].language", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityFieldConfig/properties/name", + "key_path": "datasets[].entities[].fields[].name", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityFieldConfig/properties/sensitive", + "key_path": "datasets[].entities[].fields[].sensitive", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityFieldConfig/properties/unit", + "key_path": "datasets[].entities[].fields[].unit", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityRelationshipConfig/properties/concept_uri", + "key_path": "datasets[].entities[].relationships[].concept_uri", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityRelationshipConfig/properties/foreign_key", + "key_path": "datasets[].entities[].relationships[].foreign_key", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityRelationshipConfig/properties/kind", + "key_path": "datasets[].entities[].relationships[].kind", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/RelationshipKind", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "belongs_to", + "has_many", + "has_one" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/RelationshipKind" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityRelationshipConfig/properties/name", + "key_path": "datasets[].entities[].relationships[].name", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityRelationshipConfig/properties/target", + "key_path": "datasets[].entities[].relationships[].target", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntitySpatialConfig/properties/bbox_fields", + "key_path": "datasets[].entities[].spatial.bbox_fields", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "min_x", + "min_y", + "max_x", + "max_y" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntitySpatialConfig/properties/collection_id", + "key_path": "datasets[].entities[].spatial.collection_id", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntitySpatialConfig/properties/datetime_field", + "key_path": "datasets[].entities[].spatial.datetime_field", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntitySpatialConfig/properties/description", + "key_path": "datasets[].entities[].spatial.description", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntitySpatialConfig/properties/geometry", + "key_path": "datasets[].entities[].spatial.geometry", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/SpatialGeometryConfig", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + [ + "kind", + "field", + "crs" + ], + [ + "kind", + "longitude_field", + "latitude_field", + "crs" + ] + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/SpatialGeometryConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntitySpatialConfig/properties/max_bbox_degrees", + "key_path": "datasets[].entities[].spatial.max_bbox_degrees", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "number" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "double" + }, + { + "keyword": "type", + "value": "number" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntitySpatialConfig/properties/max_geometry_vertices", + "key_path": "datasets[].entities[].spatial.max_geometry_vertices", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntitySpatialConfig/properties/title", + "key_path": "datasets[].entities[].spatial.title", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/FieldConfig/properties/codelist", + "key_path": "datasets[].tables[].schema.fields[].codelist", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/FieldConfig/properties/concept_uri", + "key_path": "datasets[].tables[].schema.fields[].concept_uri", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/FieldConfig/properties/language", + "key_path": "datasets[].tables[].schema.fields[].language", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/FieldConfig/properties/name", + "key_path": "datasets[].tables[].schema.fields[].name", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/FieldConfig/properties/nullable", + "key_path": "datasets[].tables[].schema.fields[].nullable", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/FieldConfig/properties/sensitive", + "key_path": "datasets[].tables[].schema.fields[].sensitive", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/FieldConfig/properties/type", + "key_path": "datasets[].tables[].schema.fields[].type", + "path_kind": "property" + }, + "purpose": "Physical type of a column. The set is fixed in V1; semantic types\nare carried via `concept_uri`.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/FieldType", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "string", + "number", + "integer", + "boolean", + "date", + "timestamp" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/FieldType" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/FieldConfig/properties/unit", + "key_path": "datasets[].tables[].schema.fields[].unit", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/GovernedPolicyConfig/properties/allowed_assurance", + "key_path": "datasets[].entities[].api.governed_policy.allowed_assurance", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/GovernedPolicyConfig/properties/allowed_assurance/items", + "key_path": "datasets[].entities[].api.governed_policy.allowed_assurance[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/GovernedPolicyConfig/properties/max_source_age_seconds", + "key_path": "datasets[].entities[].api.governed_policy.max_source_age_seconds", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer", + "null" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "maximum", + "value": 18446744073709551615 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": [ + "integer", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/GovernedPolicyConfig/properties/minimum_assurance", + "key_path": "datasets[].entities[].api.governed_policy.minimum_assurance", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/GovernedPolicyConfig/properties/permitted_jurisdictions", + "key_path": "datasets[].entities[].api.governed_policy.permitted_jurisdictions", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/GovernedPolicyConfig/properties/permitted_jurisdictions/items", + "key_path": "datasets[].entities[].api.governed_policy.permitted_jurisdictions[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/GovernedPolicyConfig/properties/permitted_purposes", + "key_path": "datasets[].entities[].api.governed_policy.permitted_purposes", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/GovernedPolicyConfig/properties/permitted_purposes/items", + "key_path": "datasets[].entities[].api.governed_policy.permitted_purposes[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/GovernedPolicyConfig/properties/redaction_fields", + "key_path": "datasets[].entities[].api.governed_policy.redaction_fields", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/GovernedPolicyConfig/properties/redaction_fields/items", + "key_path": "datasets[].entities[].api.governed_policy.redaction_fields[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/GovernedPolicyConfig/properties/require_consent", + "key_path": "datasets[].entities[].api.governed_policy.require_consent", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/GovernedPolicyConfig/properties/require_legal_basis", + "key_path": "datasets[].entities[].api.governed_policy.require_legal_basis", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/GovernedPolicyConfig/properties/trusted_context", + "key_path": "datasets[].entities[].api.governed_policy.trusted_context", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/GovernedTrustedContextConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/GovernedTrustedContextConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/GovernedTrustedContextConfig/properties/asserted_assurance", + "key_path": "datasets[].entities[].api.governed_policy.trusted_context.asserted_assurance", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/GovernedTrustedContextConfig/properties/consent_ref", + "key_path": "datasets[].entities[].api.governed_policy.trusted_context.consent_ref", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/GovernedTrustedContextConfig/properties/jurisdiction", + "key_path": "datasets[].entities[].api.governed_policy.trusted_context.jurisdiction", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/GovernedTrustedContextConfig/properties/legal_basis_ref", + "key_path": "datasets[].entities[].api.governed_policy.trusted_context.legal_basis_ref", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/GovernedTrustedContextConfig/properties/source_observed_age_seconds", + "key_path": "datasets[].entities[].api.governed_policy.trusted_context.source_observed_age_seconds", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer", + "null" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "maximum", + "value": 18446744073709551615 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": [ + "integer", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/InstanceConfig/properties/environment", + "key_path": "instance.environment", + "path_kind": "property" + }, + "purpose": "Identifies the public Relay instance labels surfaced by posture and operations tooling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_instance_public", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "Public instance labels surfaced by Relay posture and operations tooling; this intent catalog records their contract without loading deployment values.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "public", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic public labels; never copy a country deployment identity into generated reference documentation.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate changes to public instance identity with the Relay deployment and its operational inventory.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/InstanceConfig/properties/id", + "key_path": "instance.id", + "path_kind": "property" + }, + "purpose": "Identifies the public Relay instance labels surfaced by posture and operations tooling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_instance_public", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "Public instance labels surfaced by Relay posture and operations tooling; this intent catalog records their contract without loading deployment values.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "public", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic public labels; never copy a country deployment identity into generated reference documentation.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate changes to public instance identity with the Relay deployment and its operational inventory.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/InstanceConfig/properties/jurisdiction", + "key_path": "instance.jurisdiction", + "path_kind": "property" + }, + "purpose": "Identifies the public Relay instance labels surfaced by posture and operations tooling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_instance_public", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "Public instance labels surfaced by Relay posture and operations tooling; this intent catalog records their contract without loading deployment values.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "public", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic public labels; never copy a country deployment identity into generated reference documentation.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate changes to public instance identity with the Relay deployment and its operational inventory.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/InstanceConfig/properties/owner", + "key_path": "instance.owner", + "path_kind": "property" + }, + "purpose": "Identifies the public Relay instance labels surfaced by posture and operations tooling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_instance_public", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "Public instance labels surfaced by Relay posture and operations tooling; this intent catalog records their contract without loading deployment values.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "public", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic public labels; never copy a country deployment identity into generated reference documentation.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate changes to public instance identity with the Relay deployment and its operational inventory.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/MetadataConfig/properties/ecosystem_binding", + "key_path": "metadata.ecosystem_binding", + "path_kind": "property" + }, + "purpose": "Controls Relay metadata publication and registry-description behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_metadata_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/MetadataConfig/properties/source", + "key_path": "metadata.source", + "path_kind": "property" + }, + "purpose": "Controls Relay metadata publication and registry-description behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_metadata_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/MetadataSourceConfig", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "path" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/MetadataSourceConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/MetadataSourceConfig/properties/digest", + "key_path": "metadata.source.digest", + "path_kind": "property" + }, + "purpose": "Controls Relay metadata publication and registry-description behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_metadata_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/MetadataSourceConfig/properties/path", + "key_path": "metadata.source.path", + "path_kind": "property" + }, + "purpose": "Controls Relay metadata publication and registry-description behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_metadata_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/allow_dev_insecure_fetch_urls", + "key_path": "auth.oidc.allow_dev_insecure_fetch_urls", + "path_kind": "property" + }, + "purpose": "Development-only escape hatch that permits loopback HTTP issuer,\ndiscovery, and JWKS URLs. Private non-loopback networks and cloud\nmetadata endpoints remain denied by the platform fetch policy.", + "purpose_source": "schema_description", + "intent_profile": "relay_auth_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/allowed_algorithms", + "key_path": "auth.oidc.allowed_algorithms", + "path_kind": "property" + }, + "purpose": "Signature algorithms accepted by the verifier. Defaults to\nRS256, ES256, EdDSA. HS\\* and `none` are intentionally absent\nfrom [`OidcAlgorithm`].", + "purpose_source": "schema_description", + "intent_profile": "relay_auth_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/allowed_algorithms/items", + "key_path": "auth.oidc.allowed_algorithms[]", + "path_kind": "array_item" + }, + "purpose": "JWS signature algorithms accepted by the OIDC verifier. Symmetric\nalgorithms (`HS*`) and `none` are intentionally absent: shared-secret\nJWTs are unsafe between a resource server and an IdP, and `none`\ndisables verification entirely.\n\nYAML values are the canonical JWA `alg` strings (`RS256`, `ES256`,\n`EdDSA`), case-sensitive.", + "purpose_source": "schema_description", + "intent_profile": "relay_auth_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/OidcAlgorithm", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "RS256", + "ES256", + "EdDSA" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/OidcAlgorithm" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/allowed_clients", + "key_path": "auth.oidc.allowed_clients", + "path_kind": "property" + }, + "purpose": "Optional allowlist of client identifiers, matched against the\ntoken's `azp` (preferred) or `client_id` claim. Empty list\nmeans any client is accepted.", + "purpose_source": "schema_description", + "intent_profile": "relay_auth_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/allowed_clients/items", + "key_path": "auth.oidc.allowed_clients[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_auth_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/allowed_token_types", + "key_path": "auth.oidc.allowed_token_types", + "path_kind": "property" + }, + "purpose": "Accepted `typ` JOSE header values. Defaults to `JWT` and\n`at+jwt` (RFC 9068). ID tokens (`id+jwt`) are not access tokens\nand are rejected by default. Tokens without `typ` are rejected by\nthe shared verifier.", + "purpose_source": "schema_description", + "intent_profile": "relay_auth_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/allowed_token_types/items", + "key_path": "auth.oidc.allowed_token_types[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_auth_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/audiences", + "key_path": "auth.oidc.audiences", + "path_kind": "property" + }, + "purpose": "One or more accepted `aud` values. Tokens with no `aud`, or\nwhose `aud` does not intersect this list, are rejected.", + "purpose_source": "schema_description", + "intent_profile": "relay_auth_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/audiences/items", + "key_path": "auth.oidc.audiences[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_auth_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/discovery_url", + "key_path": "auth.oidc.discovery_url", + "path_kind": "property" + }, + "purpose": "OIDC discovery document URL\n(`.well-known/openid-configuration`). The JWKS URL is resolved\nfrom `jwks_uri` in the discovered document.", + "purpose_source": "schema_description", + "intent_profile": "relay_auth_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/issuer", + "key_path": "auth.oidc.issuer", + "path_kind": "property" + }, + "purpose": "Issuer URL. Compared verbatim against the JWT `iss` claim.", + "purpose_source": "schema_description", + "intent_profile": "relay_auth_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/jwks_cache_ttl", + "key_path": "auth.oidc.jwks_cache_ttl", + "path_kind": "property" + }, + "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_auth_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/HumantimeDuration", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 255 + }, + { + "keyword": "pattern", + "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/HumantimeDuration" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/jwks_url", + "key_path": "auth.oidc.jwks_url", + "path_kind": "property" + }, + "purpose": "JWKS endpoint. Either this or `discovery_url` must be set.\n`discovery_url` takes precedence: when both are configured the\nvalidator rejects the document.", + "purpose_source": "schema_description", + "intent_profile": "relay_auth_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/leeway", + "key_path": "auth.oidc.leeway", + "path_kind": "property" + }, + "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_auth_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/HumantimeDuration", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 255 + }, + { + "keyword": "pattern", + "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/HumantimeDuration" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/scope_claim", + "key_path": "auth.oidc.scope_claim", + "path_kind": "property" + }, + "purpose": "JWT claim whose value carries scopes. Defaults to `scope`, the\nRFC 8693 / RFC 9068 space-separated form. Some IdPs use `scp`\nor `permissions`; the value may be a string, an array of strings,\nor an object keyed by scope name.", + "purpose_source": "schema_description", + "intent_profile": "relay_auth_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/scope_map", + "key_path": "auth.oidc.scope_map", + "path_kind": "property" + }, + "purpose": "Optional rename map: `external_scope -> internal_scope`. Applied\nafter parsing the scope claim, before scope-based access checks\nrun. Useful for adapting IdP role names (`role:foo`) to the\nrelay's `:` shape.", + "purpose_source": "schema_description", + "intent_profile": "relay_auth_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/scope_map/additionalProperties", + "key_path": "auth.oidc.scope_map.*", + "path_kind": "map_value" + }, + "purpose": "Each reviewed key is an external token scope and each value is the bounded Relay scope mapping granted for that exact token scope.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_auth_oidc_scope_map_open_map", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "structural", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/scope_object_required_keys", + "key_path": "auth.oidc.scope_object_required_keys", + "path_kind": "property" + }, + "purpose": "Keys that must be present inside object-valued role claim values\nbefore the role key is treated as an active scope. Object-valued\nclaims grant no scopes when this list is empty.\nThis is useful for IdPs such as Zitadel where role values are\nkeyed by organization id.", + "purpose_source": "schema_description", + "intent_profile": "relay_auth_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/scope_object_required_keys/items", + "key_path": "auth.oidc.scope_object_required_keys[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_auth_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/PostgresTableConfig/properties/name", + "key_path": "datasets[].tables[].source.table.name", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/PostgresTableConfig/properties/schema", + "key_path": "datasets[].tables[].source.table.schema", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/PublicServiceConfig/properties/description", + "key_path": "datasets[].public_services[].description", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/PublicServiceConfig/properties/id", + "key_path": "datasets[].public_services[].id", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/PublicServiceConfig/properties/title", + "key_path": "datasets[].public_services[].title", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/RefreshConfig/oneOf/0/properties/interval", + "key_path": "datasets[].defaults.refresh.interval", + "path_kind": "property" + }, + "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/HumantimeDuration", + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 255 + }, + { + "keyword": "pattern", + "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/HumantimeDuration" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/RefreshConfig/oneOf/0/properties/interval", + "key_path": "datasets[].tables[].refresh.interval", + "path_kind": "property" + }, + "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/HumantimeDuration", + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 255 + }, + { + "keyword": "pattern", + "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/HumantimeDuration" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/RefreshConfig/oneOf/0/properties/mode", + "key_path": "datasets[].defaults.refresh.mode", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "const", + "value": [ + "interval", + "manual", + "mtime" + ] + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/RefreshConfig/oneOf/0/properties/mode", + "key_path": "datasets[].tables[].refresh.mode", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "const", + "value": [ + "interval", + "manual", + "mtime" + ] + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ReleaseClaimConfig/properties/expression", + "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].expression", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "cel" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ReleaseClaimConfig/properties/format", + "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].format", + "path_kind": "property" + }, + "purpose": "Optional value format hint.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ReleaseClaimConfig/properties/locale", + "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].locale", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ReleaseClaimConfig/properties/name", + "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].name", + "path_kind": "property" + }, + "purpose": "Released claim name (lower-snake).", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ReleaseClaimConfig/properties/required", + "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].required", + "path_kind": "property" + }, + "purpose": "Whether the claim must be present; a missing required claim denies.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ReleaseClaimConfig/properties/sensitivity", + "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].sensitivity", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "direct_identifier", + "personal", + "public", + "pseudonymous" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "string" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ReleaseClaimConfig/properties/source_field", + "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].source_field", + "path_kind": "property" + }, + "purpose": "Source field projected into the claim. XOR with `expression`.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ReleaseConditionsConfig/properties/expression", + "key_path": "datasets[].entities[].attribute_release_profiles[].release_conditions.expression", + "path_kind": "property" + }, + "purpose": "A single CEL expression evaluated over the subject's source projection.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/ReleaseExpressionConfig", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "cel" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ReleaseExpressionConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ReleaseExpressionConfig/properties/cel", + "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].expression.cel", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ReleaseExpressionConfig/properties/cel", + "key_path": "datasets[].entities[].attribute_release_profiles[].release_conditions.expression.cel", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ReleaseResponseConfig/properties/include_source_metadata", + "key_path": "datasets[].entities[].attribute_release_profiles[].response.include_source_metadata", + "path_kind": "property" + }, + "purpose": "Whether to include profile-sourced metadata in the response body.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ReleaseSubjectConfig/properties/id_type", + "key_path": "datasets[].entities[].attribute_release_profiles[].subject.id_type", + "path_kind": "property" + }, + "purpose": "Accepted identifier type label.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ReleaseSubjectConfig/properties/source_field", + "key_path": "datasets[].entities[].attribute_release_profiles[].subject.source_field", + "path_kind": "property" + }, + "purpose": "Source field used to match the subject. Must be an exposed entity field.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/RequiredFilterBindingConfig/properties/field", + "key_path": "datasets[].aggregates[].required_filter_bindings[].field", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/RequiredFilterBindingConfig/properties/field", + "key_path": "datasets[].entities[].aggregates[].required_filter_bindings[].field", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/RequiredFilterBindingConfig/properties/field", + "key_path": "datasets[].entities[].api.required_filter_bindings[].field", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/RequiredFilterBindingConfig/properties/field", + "key_path": "datasets[].tables[].aggregates[].required_filter_bindings[].field", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/RequiredFilterBindingConfig/properties/source", + "key_path": "datasets[].aggregates[].required_filter_bindings[].source", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/RequiredFilterBindingSource", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "principal_id" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/RequiredFilterBindingSource" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/RequiredFilterBindingConfig/properties/source", + "key_path": "datasets[].entities[].aggregates[].required_filter_bindings[].source", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/RequiredFilterBindingSource", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "principal_id" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/RequiredFilterBindingSource" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/RequiredFilterBindingConfig/properties/source", + "key_path": "datasets[].entities[].api.required_filter_bindings[].source", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/RequiredFilterBindingSource", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "principal_id" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/RequiredFilterBindingSource" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/RequiredFilterBindingConfig/properties/source", + "key_path": "datasets[].tables[].aggregates[].required_filter_bindings[].source", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/RequiredFilterBindingSource", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "principal_id" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/RequiredFilterBindingSource" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ResourceAccessConfig/properties/aggregate_scope", + "key_path": "datasets[].tables[].access.aggregate_scope", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ResourceAccessConfig/properties/metadata_scope", + "key_path": "datasets[].tables[].access.metadata_scope", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ResourceApiConfig/properties/allowed_filters", + "key_path": "datasets[].tables[].api.allowed_filters", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ResourceApiConfig/properties/allowed_filters/items", + "key_path": "datasets[].tables[].api.allowed_filters[]", + "path_kind": "array_item" + }, + "purpose": "A single allowed filter: field name + permitted operators.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AllowedFilter", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "field", + "ops" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AllowedFilter" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ResourceApiConfig/properties/default_limit", + "key_path": "datasets[].tables[].api.default_limit", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ResourceApiConfig/properties/max_limit", + "key_path": "datasets[].tables[].api.max_limit", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ResourceApiConfig/properties/require_purpose_header", + "key_path": "datasets[].tables[].api.require_purpose_header", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ResourceConfig/properties/access", + "key_path": "datasets[].tables[].access", + "path_kind": "property" + }, + "purpose": "Resource-level scope assignments. Private tables are not exposed as row\nresources in beta; row access is configured on public entities.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/ResourceAccessConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "metadata_scope", + "aggregate_scope" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ResourceAccessConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ResourceConfig/properties/aggregates", + "key_path": "datasets[].tables[].aggregates", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ResourceConfig/properties/aggregates/items", + "key_path": "datasets[].tables[].aggregates[]", + "path_kind": "array_item" + }, + "purpose": "Aggregate declaration: group-by columns, measures, disclosure\ncontrol.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AggregateConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id", + "description", + "disclosure_control" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ResourceConfig/properties/api", + "key_path": "datasets[].tables[].api", + "path_kind": "property" + }, + "purpose": "Resource-level API knobs: per-field filter allowlist, limit caps,\nand the `Data-Purpose` requirement.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/ResourceApiConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "default_limit", + "max_limit" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ResourceApiConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ResourceConfig/properties/id", + "key_path": "datasets[].tables[].id", + "path_kind": "property" + }, + "purpose": "Resource identifier within a dataset.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/ResourceId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9_]*$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ResourceId" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ResourceConfig/properties/materialization", + "key_path": "datasets[].tables[].materialization", + "path_kind": "property" + }, + "purpose": "How a configured private table is registered for query planning.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "snapshot" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "string" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ResourceConfig/properties/primary_key", + "key_path": "datasets[].tables[].primary_key", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ResourceConfig/properties/refresh", + "key_path": "datasets[].tables[].refresh", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + [ + "mode", + "interval" + ], + [ + "mode" + ] + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ResourceConfig/properties/schema", + "key_path": "datasets[].tables[].schema", + "path_kind": "property" + }, + "purpose": "Declared resource schema. `strict` is the spec's `strict_schema`\nflag; on mismatch ingestion refuses to register the resource.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/SchemaConfig", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "fields" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/SchemaConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ResourceConfig/properties/source", + "key_path": "datasets[].tables[].source", + "path_kind": "property" + }, + "purpose": "Source plugin selection. Tagged on `type:` so HTTP, S3, or additional\ndatabase variants can land additively later.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/SourceConfig", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + [ + "type", + "connection_env" + ], + [ + "type", + "path" + ] + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/SourceConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ResourceFormatConfig/properties/csv", + "key_path": "datasets[].tables[].source.format.csv", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ResourceFormatConfig/properties/parquet", + "key_path": "datasets[].tables[].source.format.parquet", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ResourceFormatConfig/properties/xlsx", + "key_path": "datasets[].tables[].source.format.xlsx", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/RotateConfig/properties/max_files", + "key_path": "audit.rotate.max_files", + "path_kind": "property" + }, + "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_audit_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/RotateConfig/properties/max_size_mb", + "key_path": "audit.rotate.max_size_mb", + "path_kind": "property" + }, + "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_audit_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "maximum", + "value": 18446744073709551615 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SchemaConfig/properties/fields", + "key_path": "datasets[].tables[].schema.fields", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SchemaConfig/properties/fields/items", + "key_path": "datasets[].tables[].schema.fields[]", + "path_kind": "array_item" + }, + "purpose": "One column in a resource schema. Physical type and optional\nsemantic annotations used by catalog and schema metadata.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/FieldConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "name", + "type" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/FieldConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SchemaConfig/properties/strict", + "key_path": "datasets[].tables[].schema.strict", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ServerConfig/properties/admin_bind", + "key_path": "server.admin_bind", + "path_kind": "property" + }, + "purpose": "Canonical dotted-decimal IPv4 or bracketed IPv6 plus a decimal port from 0 through 65535", + "purpose_source": "schema_description", + "intent_profile": "relay_server_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "pattern", + "value": [ + "^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9]):(?:0|[1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$", + "^\\[(?:(?:[0-9A-Fa-f]{1,4}:){7}[0-9A-Fa-f]{1,4}|(?:[0-9A-Fa-f]{1,4}:){1,7}:|(?:[0-9A-Fa-f]{1,4}:){1,6}:[0-9A-Fa-f]{1,4}|(?:[0-9A-Fa-f]{1,4}:){1,5}(?::[0-9A-Fa-f]{1,4}){1,2}|(?:[0-9A-Fa-f]{1,4}:){1,4}(?::[0-9A-Fa-f]{1,4}){1,3}|(?:[0-9A-Fa-f]{1,4}:){1,3}(?::[0-9A-Fa-f]{1,4}){1,4}|(?:[0-9A-Fa-f]{1,4}:){1,2}(?::[0-9A-Fa-f]{1,4}){1,5}|[0-9A-Fa-f]{1,4}:(?:(?::[0-9A-Fa-f]{1,4}){1,6})|:(?:(?::[0-9A-Fa-f]{1,4}){1,7}|:))\\]:(?:0|[1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "string" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ServerConfig/properties/bind", + "key_path": "server.bind", + "path_kind": "property" + }, + "purpose": "Canonical dotted-decimal IPv4 or bracketed IPv6 plus a decimal port from 0 through 65535", + "purpose_source": "schema_description", + "intent_profile": "relay_server_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/SocketAddr", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": [ + "^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9]):(?:0|[1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$", + "^\\[(?:(?:[0-9A-Fa-f]{1,4}:){7}[0-9A-Fa-f]{1,4}|(?:[0-9A-Fa-f]{1,4}:){1,7}:|(?:[0-9A-Fa-f]{1,4}:){1,6}:[0-9A-Fa-f]{1,4}|(?:[0-9A-Fa-f]{1,4}:){1,5}(?::[0-9A-Fa-f]{1,4}){1,2}|(?:[0-9A-Fa-f]{1,4}:){1,4}(?::[0-9A-Fa-f]{1,4}){1,3}|(?:[0-9A-Fa-f]{1,4}:){1,3}(?::[0-9A-Fa-f]{1,4}){1,4}|(?:[0-9A-Fa-f]{1,4}:){1,2}(?::[0-9A-Fa-f]{1,4}){1,5}|[0-9A-Fa-f]{1,4}:(?:(?::[0-9A-Fa-f]{1,4}){1,6})|:(?:(?::[0-9A-Fa-f]{1,4}){1,7}|:))\\]:(?:0|[1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/SocketAddr" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ServerConfig/properties/cache_dir", + "key_path": "server.cache_dir", + "path_kind": "property" + }, + "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_server_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ServerConfig/properties/cors", + "key_path": "server.cors", + "path_kind": "property" + }, + "purpose": "CORS allowlist; default-deny per Section 17 item 7.", + "purpose_source": "schema_description", + "intent_profile": "relay_server_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/CorsConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/CorsConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ServerConfig/properties/http1_header_read_timeout", + "key_path": "server.http1_header_read_timeout", + "path_kind": "property" + }, + "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w", + "purpose_source": "schema_description", + "intent_profile": "relay_server_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/HumantimeDuration", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 255 + }, + { + "keyword": "pattern", + "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/HumantimeDuration" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ServerConfig/properties/max_connections", + "key_path": "server.max_connections", + "path_kind": "property" + }, + "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_server_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint" + }, + { + "keyword": "maximum", + "value": 18446744073709551615 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ServerConfig/properties/max_source_file_bytes", + "key_path": "server.max_source_file_bytes", + "path_kind": "property" + }, + "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_server_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "maximum", + "value": 18446744073709551615 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ServerConfig/properties/openapi_requires_auth", + "key_path": "server.openapi_requires_auth", + "path_kind": "property" + }, + "purpose": "Keeps the configured OpenAPI document behind Relay authentication unless an operator explicitly accepts unauthenticated contract discovery.", + "purpose_source": "reviewed_override", + "intent_profile": "relay_server_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ServerConfig/properties/request_body_timeout", + "key_path": "server.request_body_timeout", + "path_kind": "property" + }, + "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w", + "purpose_source": "schema_description", + "intent_profile": "relay_server_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/HumantimeDuration", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 255 + }, + { + "keyword": "pattern", + "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/HumantimeDuration" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ServerConfig/properties/request_timeout", + "key_path": "server.request_timeout", + "path_kind": "property" + }, + "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w", + "purpose_source": "schema_description", + "intent_profile": "relay_server_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/HumantimeDuration", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 255 + }, + { + "keyword": "pattern", + "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/HumantimeDuration" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ServerConfig/properties/trust_proxy", + "key_path": "server.trust_proxy", + "path_kind": "property" + }, + "purpose": "`X-Forwarded-For` policy. Until the `ipnet` crate lands in deps we\nkeep CIDR specs as strings and validate format in\n[`validate::run`].", + "purpose_source": "schema_description", + "intent_profile": "relay_server_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/TrustProxyConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/TrustProxyConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ServerConfig/properties/xlsx_max_file_bytes", + "key_path": "server.xlsx_max_file_bytes", + "path_kind": "property" + }, + "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_server_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "maximum", + "value": 18446744073709551615 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SourceConfig/oneOf/0/properties/format", + "key_path": "datasets[].tables[].source.format", + "path_kind": "property" + }, + "purpose": "Storage table format override. If omitted, ingest infers the format\nfrom the source file extension.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SourceConfig/oneOf/0/properties/path", + "key_path": "datasets[].tables[].source.path", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SourceConfig/oneOf/0/properties/type", + "key_path": "datasets[].tables[].source.type", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "const", + "value": [ + "file", + "postgres" + ] + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SourceConfig/oneOf/1/properties/change_token_sql", + "key_path": "datasets[].tables[].source.change_token_sql", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SourceConfig/oneOf/1/properties/connect_timeout", + "key_path": "datasets[].tables[].source.connect_timeout", + "path_kind": "property" + }, + "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/HumantimeDuration", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 255 + }, + { + "keyword": "pattern", + "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/HumantimeDuration" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SourceConfig/oneOf/1/properties/connection_env", + "key_path": "datasets[].tables[].source.connection_env", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_secret_reference", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/PostgresEnvironmentNameSchema", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[A-Za-z_][A-Za-z0-9_]*$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/PostgresEnvironmentNameSchema" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SourceConfig/oneOf/1/properties/query", + "key_path": "datasets[].tables[].source.query", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SourceConfig/oneOf/1/properties/query_timeout", + "key_path": "datasets[].tables[].source.query_timeout", + "path_kind": "property" + }, + "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/HumantimeDuration", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 255 + }, + { + "keyword": "pattern", + "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/HumantimeDuration" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SourceConfig/oneOf/1/properties/table", + "key_path": "datasets[].tables[].source.table", + "path_kind": "property" + }, + "purpose": "Structured database table reference. Keeping schema/name separate\navoids parsing dotted identifiers and leaves quoting to connectors.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "schema", + "name" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_x", + "key_path": "datasets[].aggregates[].spatial.bbox_fields.max_x", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_x", + "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields.max_x", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_x", + "key_path": "datasets[].entities[].spatial.bbox_fields.max_x", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_x", + "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields.max_x", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_y", + "key_path": "datasets[].aggregates[].spatial.bbox_fields.max_y", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_y", + "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields.max_y", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_y", + "key_path": "datasets[].entities[].spatial.bbox_fields.max_y", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_y", + "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields.max_y", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_x", + "key_path": "datasets[].aggregates[].spatial.bbox_fields.min_x", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_x", + "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields.min_x", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_x", + "key_path": "datasets[].entities[].spatial.bbox_fields.min_x", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_x", + "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields.min_x", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_y", + "key_path": "datasets[].aggregates[].spatial.bbox_fields.min_y", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_y", + "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields.min_y", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_y", + "key_path": "datasets[].entities[].spatial.bbox_fields.min_y", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_y", + "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields.min_y", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpatialGeometryConfig/oneOf/0/properties/crs", + "key_path": "datasets[].entities[].spatial.geometry.crs", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpatialGeometryConfig/oneOf/0/properties/kind", + "key_path": "datasets[].entities[].spatial.geometry.kind", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "const", + "value": [ + "geojson", + "point", + "wkb", + "wkt" + ] + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpatialGeometryConfig/oneOf/0/properties/latitude_field", + "key_path": "datasets[].entities[].spatial.geometry.latitude_field", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpatialGeometryConfig/oneOf/0/properties/longitude_field", + "key_path": "datasets[].entities[].spatial.geometry.longitude_field", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpatialGeometryConfig/oneOf/1/properties/field", + "key_path": "datasets[].entities[].spatial.geometry.field", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/dataset", + "key_path": "standards.spdci.disability_registry.dataset", + "path_kind": "property" + }, + "purpose": "Dataset identifier. Lower-snake, starts with a letter.", + "purpose_source": "schema_description", + "intent_profile": "relay_standards_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/DatasetId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9_]*$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/DatasetId" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/disabled_positive_values", + "key_path": "standards.spdci.disability_registry.disabled_positive_values", + "path_kind": "property" + }, + "purpose": "Case-insensitive values interpreted as disabled.", + "purpose_source": "schema_description", + "intent_profile": "relay_standards_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/disabled_positive_values/items", + "key_path": "standards.spdci.disability_registry.disabled_positive_values[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_standards_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/disabled_status_field", + "key_path": "standards.spdci.disability_registry.disabled_status_field", + "path_kind": "property" + }, + "purpose": "Entity field whose value determines the SP DCI disabled response.", + "purpose_source": "schema_description", + "intent_profile": "relay_standards_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/entity", + "key_path": "standards.spdci.disability_registry.entity", + "path_kind": "property" + }, + "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_standards_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/query_field", + "key_path": "standards.spdci.disability_registry.query_field", + "path_kind": "property" + }, + "purpose": "Entity field filtered when the SP DCI query key is present.", + "purpose_source": "schema_description", + "intent_profile": "relay_standards_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/query_key", + "key_path": "standards.spdci.disability_registry.query_key", + "path_kind": "property" + }, + "purpose": "Query key accepted from SP DCI `disabled_criteria.query`.", + "purpose_source": "schema_description", + "intent_profile": "relay_standards_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpdciRegistryConfig/properties/dataset", + "key_path": "standards.spdci.registries.*.dataset", + "path_kind": "property" + }, + "purpose": "Dataset identifier. Lower-snake, starts with a letter.", + "purpose_source": "schema_description", + "intent_profile": "relay_standards_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/DatasetId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9_]*$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/DatasetId" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpdciRegistryConfig/properties/default_limit", + "key_path": "standards.spdci.registries.*.default_limit", + "path_kind": "property" + }, + "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_standards_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpdciRegistryConfig/properties/entity", + "key_path": "standards.spdci.registries.*.entity", + "path_kind": "property" + }, + "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_standards_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpdciRegistryConfig/properties/expression_fields", + "key_path": "standards.spdci.registries.*.expression_fields", + "path_kind": "property" + }, + "purpose": "DCI expression or predicate attribute to entity field mappings.", + "purpose_source": "schema_description", + "intent_profile": "relay_standards_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpdciRegistryConfig/properties/expression_fields/additionalProperties", + "key_path": "standards.spdci.registries.*.expression_fields.*", + "path_kind": "map_value" + }, + "purpose": "Each reviewed key names an expression-visible field and each value defines the bounded source expression exposed under that name.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_standards_spdci_registries_expression_fields_open_map", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "structural", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpdciRegistryConfig/properties/identifiers", + "key_path": "standards.spdci.registries.*.identifiers", + "path_kind": "property" + }, + "purpose": "DCI identifier type to entity field mappings for `idtype-value`.", + "purpose_source": "schema_description", + "intent_profile": "relay_standards_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpdciRegistryConfig/properties/identifiers/additionalProperties", + "key_path": "standards.spdci.registries.*.identifiers.*", + "path_kind": "map_value" + }, + "purpose": "Each reviewed key names an identifier role and each value defines the exact request identifier binding for that role.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_standards_spdci_registries_identifiers_open_map", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "structural", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpdciRegistryConfig/properties/record_type", + "key_path": "standards.spdci.registries.*.record_type", + "path_kind": "property" + }, + "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_standards_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpdciRegistryConfig/properties/registry_type", + "key_path": "standards.spdci.registries.*.registry_type", + "path_kind": "property" + }, + "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_standards_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpdciRegistryConfig/properties/response_fields", + "key_path": "standards.spdci.registries.*.response_fields", + "path_kind": "property" + }, + "purpose": "SP DCI output path to entity field mappings for direct response\nprojection. A CEL mapping takes precedence when both are set.", + "purpose_source": "schema_description", + "intent_profile": "relay_standards_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpdciRegistryConfig/properties/response_fields/additionalProperties", + "key_path": "standards.spdci.registries.*.response_fields.*", + "path_kind": "map_value" + }, + "purpose": "Each reviewed key names a response field and each value defines the exact bounded response projection for that field.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_standards_spdci_registries_response_fields_open_map", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "structural", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpdciRegistryConfig/properties/response_mapping_path", + "key_path": "standards.spdci.registries.*.response_mapping_path", + "path_kind": "property" + }, + "purpose": "Optional local CEL mapping document used to shape response records.", + "purpose_source": "schema_description", + "intent_profile": "relay_standards_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpdciRegistryConfig/properties/response_schema_path", + "key_path": "standards.spdci.registries.*.response_schema_path", + "path_kind": "property" + }, + "purpose": "Optional local JSON Schema used to validate shaped response records.", + "purpose_source": "schema_description", + "intent_profile": "relay_standards_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpdciStandardsConfig/properties/disability_registry", + "key_path": "standards.spdci.disability_registry", + "path_kind": "property" + }, + "purpose": "Runtime binding from SP DCI Disability Registry sync APIs to one\nconfigured Registry Relay entity.", + "purpose_source": "schema_description", + "intent_profile": "relay_standards_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "dataset", + "entity" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpdciStandardsConfig/properties/registries", + "key_path": "standards.spdci.registries", + "path_kind": "property" + }, + "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_standards_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpdciStandardsConfig/properties/registries/additionalProperties", + "key_path": "standards.spdci.registries.*", + "path_kind": "map_value" + }, + "purpose": "Runtime binding from a DCI registry sync search API to one configured\nRegistry Relay entity.", + "purpose_source": "schema_description", + "intent_profile": "relay_standards_spdci_registries_open_map", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/SpdciRegistryConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "structural", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "dataset", + "entity" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/SpdciRegistryConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/StandardsConfig/properties/spdci", + "key_path": "standards.spdci", + "path_kind": "property" + }, + "purpose": "Social Protection Digital Convergence Initiative (SP DCI) adapter\nconfiguration.", + "purpose_source": "schema_description", + "intent_profile": "relay_standards_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/TrustProxyConfig/properties/enabled", + "key_path": "server.trust_proxy.enabled", + "path_kind": "property" + }, + "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_server_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/TrustProxyConfig/properties/trusted_proxies", + "key_path": "server.trust_proxy.trusted_proxies", + "path_kind": "property" + }, + "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_server_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/TrustProxyConfig/properties/trusted_proxies/items", + "key_path": "server.trust_proxy.trusted_proxies[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_server_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/XlsxFormatConfig/properties/data_range", + "key_path": "datasets[].tables[].source.format.xlsx.data_range", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/XlsxFormatConfig/properties/header_row", + "key_path": "datasets[].tables[].source.format.xlsx.header_row", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer", + "null" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": [ + "integer", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/XlsxFormatConfig/properties/sheet", + "key_path": "datasets[].tables[].source.format.xlsx.sheet", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/properties/audit", + "key_path": "audit", + "path_kind": "property" + }, + "purpose": "Audit configuration. Sink choice gates further fields via the\ntagged `AuditSinkConfig` enum. The enum is flattened onto the\ncontaining struct so that the YAML `sink:` key acts as the\ndiscriminator, matching the public example configuration.\n\n`deny_unknown_fields` is deliberately omitted here: `serde` does\nnot support combining it with `#[serde(flatten)]` on an internally\ntagged enum (unknown keys in `audit` are caught by the enum's own\n`deny_unknown_fields`).", + "purpose_source": "schema_description", + "intent_profile": "relay_audit_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AuditConfig", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + [ + "sink", + "path" + ], + [ + "sink" + ] + ] + }, + { + "keyword": "type", + "value": "object" + }, + { + "keyword": "unevaluatedProperties", + "value": false + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AuditConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/properties/auth", + "key_path": "auth", + "path_kind": "property" + }, + "purpose": "Authentication configuration. Exactly one of `api_keys` and `oidc`\nis consumed at startup, gated by `mode`; cross-field validation in\n[`validate`] enforces that only the active block is populated.", + "purpose_source": "schema_description", + "intent_profile": "relay_auth_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AuthConfig", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "mode" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AuthConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/properties/catalog", + "key_path": "catalog", + "path_kind": "property" + }, + "purpose": "Catalog-level metadata surfaced by `/metadata/*` and DCAT outputs.", + "purpose_source": "schema_description", + "intent_profile": "relay_catalog_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/CatalogConfig", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "title", + "base_url", + "publisher" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/CatalogConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/properties/config_trust", + "key_path": "config_trust", + "path_kind": "property" + }, + "purpose": "Optional signed configuration bundle trust state.\n\nSimple local deployments omit this block. Bundle-aware deployments pin the\nlocal trust anchor, bundle, and anti-rollback state paths explicitly.", + "purpose_source": "schema_description", + "intent_profile": "relay_config_trust_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "trust_anchor_path", + "bundle_path", + "antirollback_state_path" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/properties/consultation", + "key_path": "consultation", + "path_kind": "property" + }, + "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_consultation_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "authorized_workload", + "state_plane", + "audit_pseudonym_materials" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/properties/datasets", + "key_path": "datasets", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/properties/datasets/items", + "key_path": "datasets[]", + "path_kind": "array_item" + }, + "purpose": "A single dataset declaration.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/DatasetConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id", + "title", + "description", + "owner", + "sensitivity", + "access_rights", + "update_frequency" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/DatasetConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/properties/deployment", + "key_path": "deployment", + "path_kind": "property" + }, + "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_deployment_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/DeploymentConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/DeploymentConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/properties/instance", + "key_path": "instance", + "path_kind": "property" + }, + "purpose": "Stable deployment identity surfaced in redacted operations posture.", + "purpose_source": "schema_description", + "intent_profile": "relay_instance_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/InstanceConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/InstanceConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/properties/metadata", + "key_path": "metadata", + "path_kind": "property" + }, + "purpose": "Optional split metadata manifest loaded alongside the runtime config.", + "purpose_source": "schema_description", + "intent_profile": "relay_metadata_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "source" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/properties/server", + "key_path": "server", + "path_kind": "property" + }, + "purpose": "HTTP listener and adjacent server-wide knobs.", + "purpose_source": "schema_description", + "intent_profile": "relay_server_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/ServerConfig", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "bind" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ServerConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/properties/standards", + "key_path": "standards", + "path_kind": "property" + }, + "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_standards_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/StandardsConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/StandardsConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/properties/vocabularies", + "key_path": "vocabularies", + "path_kind": "property" + }, + "purpose": "Controls the reviewed vocabulary bindings Relay uses to interpret namespaced terms.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_vocabularies_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/properties/vocabularies/additionalProperties", + "key_path": "vocabularies.*", + "path_kind": "map_value" + }, + "purpose": "Each reviewed key is a vocabulary prefix and each value binds that prefix to its operator-approved vocabulary identifier.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_vocabularies_open_map", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "structural", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "", + "key_path": "", + "path_kind": "root" + }, + "purpose": "Defines the complete Notary runtime configuration boundary consumed when a Notary instance starts.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_root_structural", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "structural", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "evidence", + "auth" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/AccessTokenSigningConfig/properties/access_token_ttl_seconds", + "key_path": "auth.access_token_signing.access_token_ttl_seconds", + "path_kind": "property" + }, + "purpose": "Access-token lifetime in seconds.", + "purpose_source": "schema_description", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/AccessTokenSigningConfig/properties/allowed_algorithms", + "key_path": "auth.access_token_signing.allowed_algorithms", + "path_kind": "property" + }, + "purpose": "Allowed signing algorithms. Only EdDSA is supported.", + "purpose_source": "schema_description", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/AccessTokenSigningConfig/properties/allowed_algorithms/items", + "key_path": "auth.access_token_signing.allowed_algorithms[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/AccessTokenSigningConfig/properties/audiences", + "key_path": "auth.access_token_signing.audiences", + "path_kind": "property" + }, + "purpose": "Audiences (`aud`) accepted for Notary-minted access tokens.", + "purpose_source": "schema_description", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/AccessTokenSigningConfig/properties/audiences/items", + "key_path": "auth.access_token_signing.audiences[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/AccessTokenSigningConfig/properties/enabled", + "key_path": "auth.access_token_signing.enabled", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/AccessTokenSigningConfig/properties/issuer", + "key_path": "auth.access_token_signing.issuer", + "path_kind": "property" + }, + "purpose": "Issuer (`iss`) the Notary stamps into its own access tokens.", + "purpose_source": "schema_description", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/AccessTokenSigningConfig/properties/signing_key_id", + "key_path": "auth.access_token_signing.signing_key_id", + "path_kind": "property" + }, + "purpose": "`evidence.signing_keys` entry used to sign access tokens. Must be a\ndedicated key, never a credential-signing key.", + "purpose_source": "schema_description", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/AccessTokenSigningConfig/properties/token_typ", + "key_path": "auth.access_token_signing.token_typ", + "path_kind": "property" + }, + "purpose": "Header `typ` stamped into Notary access tokens, distinct from the\ncredential `typ` so a token cannot be replayed as another class.", + "purpose_source": "schema_description", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/AccessTokenSigningConfig/properties/verification_key_ids", + "key_path": "auth.access_token_signing.verification_key_ids", + "path_kind": "property" + }, + "purpose": "Additional publish-only `evidence.signing_keys` entries accepted for\nverifying previously minted Notary access tokens and pre-authorized\ncodes during a governed key rotation.", + "purpose_source": "schema_description", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/AccessTokenSigningConfig/properties/verification_key_ids/items", + "key_path": "auth.access_token_signing.verification_key_ids[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/BatchOperationConfig/properties/enabled", + "key_path": "evidence.claims[].operations.batch_evaluate.enabled", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/BatchOperationConfig/properties/max_subjects", + "key_path": "evidence.claims[].operations.batch_evaluate.max_subjects", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint" + }, + { + "keyword": "maximum", + "value": 100 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/CccevConfig/properties/evidence_type", + "key_path": "evidence.claims[].cccev.evidence_type", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/CccevConfig/properties/evidence_type_iri", + "key_path": "evidence.claims[].cccev.evidence_type_iri", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/CccevConfig/properties/requirement_type", + "key_path": "evidence.claims[].cccev.requirement_type", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/CelBindingsConfig/properties/claims", + "key_path": "evidence.claims[].rule.bindings.claims", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/CelBindingsConfig/properties/claims/additionalProperties", + "key_path": "evidence.claims[].rule.bindings.claims.*", + "path_kind": "map_value" + }, + "purpose": "Each reviewed key names a CEL claim binding and each value selects the approved evidence claim exposed to that binding.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_claims_rule_bindings_claims_open_map", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/ClaimBindingConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "structural", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "claim" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/ClaimBindingConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/CelBindingsConfig/properties/vars", + "key_path": "evidence.claims[].rule.bindings.vars", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimBindingConfig/properties/binding_type", + "key_path": "evidence.claims[].rule.bindings.claims.*.binding_type", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimBindingConfig/properties/claim", + "key_path": "evidence.claims[].rule.bindings.claims.*.claim", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/cccev", + "key_path": "evidence.claims[].cccev", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/credential_profiles", + "key_path": "evidence.claims[].credential_profiles", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/credential_profiles/items", + "key_path": "evidence.claims[].credential_profiles[]", + "path_kind": "array_item" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/depends_on", + "key_path": "evidence.claims[].depends_on", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/depends_on/items", + "key_path": "evidence.claims[].depends_on[]", + "path_kind": "array_item" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/disclosure", + "key_path": "evidence.claims[].disclosure", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/DisclosureConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/DisclosureConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/evidence_mode", + "key_path": "evidence.claims[].evidence_mode", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/ClaimEvidenceMode", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + [ + "type", + "consultations" + ], + [ + "type" + ] + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/ClaimEvidenceMode" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/formats", + "key_path": "evidence.claims[].formats", + "path_kind": "property" + }, + "purpose": "Omitting this field keeps existing authored claims renderable using the\ncanonical claim-result representation. An explicitly empty list is\nrejected during configuration validation.", + "purpose_source": "schema_description", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/formats/items", + "key_path": "evidence.claims[].formats[]", + "path_kind": "array_item" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/id", + "key_path": "evidence.claims[].id", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/inputs", + "key_path": "evidence.claims[].inputs", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/inputs/items", + "key_path": "evidence.claims[].inputs[]", + "path_kind": "array_item" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/ClaimInputConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "name", + "type" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/ClaimInputConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/oots", + "key_path": "evidence.claims[].oots", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/operations", + "key_path": "evidence.claims[].operations", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/ClaimOperationsConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/ClaimOperationsConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/purpose", + "key_path": "evidence.claims[].purpose", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/required_scopes", + "key_path": "evidence.claims[].required_scopes", + "path_kind": "property" + }, + "purpose": "Caller scopes checked before any registry consultation is dispatched.", + "purpose_source": "schema_description", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/required_scopes/items", + "key_path": "evidence.claims[].required_scopes[]", + "path_kind": "array_item" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/rule", + "key_path": "evidence.claims[].rule", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/RuleConfig", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + [ + "type", + "consultation", + "output" + ], + [ + "type", + "consultation" + ], + [ + "type", + "expression" + ] + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/RuleConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/semantics", + "key_path": "evidence.claims[].semantics", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/subject_type", + "key_path": "evidence.claims[].subject_type", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/title", + "key_path": "evidence.claims[].title", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/value", + "key_path": "evidence.claims[].value", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/ClaimValueConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/ClaimValueConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/version", + "key_path": "evidence.claims[].version", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimInputConfig/properties/name", + "key_path": "evidence.claims[].inputs[].name", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimInputConfig/properties/type", + "key_path": "evidence.claims[].inputs[].type", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimOperationsConfig/properties/batch_evaluate", + "key_path": "evidence.claims[].operations.batch_evaluate", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/BatchOperationConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/BatchOperationConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimOperationsConfig/properties/evaluate", + "key_path": "evidence.claims[].operations.evaluate", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/OperationConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/OperationConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimRefObject/properties/id", + "key_path": "auth.api_keys[].authorization_details.claims[].id", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimRefObject/properties/id", + "key_path": "auth.bearer_tokens[].authorization_details.claims[].id", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimRefObject/properties/version", + "key_path": "auth.api_keys[].authorization_details.claims[].version", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimRefObject/properties/version", + "key_path": "auth.bearer_tokens[].authorization_details.claims[].version", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimSemanticConfig/properties/concept", + "key_path": "evidence.claims[].semantics.concept", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimSemanticConfig/properties/derived_from", + "key_path": "evidence.claims[].semantics.derived_from", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimSemanticConfig/properties/derived_from/items", + "key_path": "evidence.claims[].semantics.derived_from[]", + "path_kind": "array_item" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimSemanticConfig/properties/predicate", + "key_path": "evidence.claims[].semantics.predicate", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimSemanticConfig/properties/property", + "key_path": "evidence.claims[].semantics.property", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimSemanticConfig/properties/value_mapping", + "key_path": "evidence.claims[].semantics.value_mapping", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimSemanticConfig/properties/vocabulary", + "key_path": "evidence.claims[].semantics.vocabulary", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimValueConfig/properties/nullable", + "key_path": "evidence.claims[].value.nullable", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimValueConfig/properties/type", + "key_path": "evidence.claims[].value.type", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimValueConfig/properties/unit", + "key_path": "evidence.claims[].value.unit", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ConcurrencyConfig/properties/subjects", + "key_path": "evidence.concurrency.subjects", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ConfigTrustConfig/properties/antirollback_state_path", + "key_path": "config_trust.antirollback_state_path", + "path_kind": "property" + }, + "purpose": "Controls Notary verification of signed configuration bundles, trust anchors, and rollback protection.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_config_trust_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ConfigTrustConfig/properties/break_glass_override_path", + "key_path": "config_trust.break_glass_override_path", + "path_kind": "property" + }, + "purpose": "Controls Notary verification of signed configuration bundles, trust anchors, and rollback protection.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_config_trust_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ConfigTrustConfig/properties/bundle_path", + "key_path": "config_trust.bundle_path", + "path_kind": "property" + }, + "purpose": "Controls Notary verification of signed configuration bundles, trust anchors, and rollback protection.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_config_trust_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ConfigTrustConfig/properties/trust_anchor_path", + "key_path": "config_trust.trust_anchor_path", + "path_kind": "property" + }, + "purpose": "Controls Notary verification of signed configuration bundles, trust anchors, and rollback protection.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_config_trust_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/CredentialDisclosureConfig/properties/allowed", + "key_path": "evidence.credential_profiles.*.disclosure.allowed", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/CredentialDisclosureConfig/properties/allowed/items", + "key_path": "evidence.credential_profiles.*.disclosure.allowed[]", + "path_kind": "array_item" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/CredentialFingerprintRef/properties/name", + "key_path": "auth.api_keys[].fingerprint.name", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_secret_reference", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/CredentialFingerprintRef/properties/name", + "key_path": "auth.bearer_tokens[].fingerprint.name", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_secret_reference", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/CredentialFingerprintRef/properties/path", + "key_path": "auth.api_keys[].fingerprint.path", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_secret_reference", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/CredentialFingerprintRef/properties/path", + "key_path": "auth.bearer_tokens[].fingerprint.path", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_secret_reference", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/CredentialFingerprintRef/properties/provider", + "key_path": "auth.api_keys[].fingerprint.provider", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "env", + "file" + ] + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/CredentialFingerprintRef/properties/provider", + "key_path": "auth.bearer_tokens[].fingerprint.provider", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "env", + "file" + ] + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/CredentialProfileConfig/properties/allowed_claims", + "key_path": "evidence.credential_profiles.*.allowed_claims", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/CredentialProfileConfig/properties/allowed_claims/items", + "key_path": "evidence.credential_profiles.*.allowed_claims[]", + "path_kind": "array_item" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/CredentialProfileConfig/properties/disclosure", + "key_path": "evidence.credential_profiles.*.disclosure", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/CredentialDisclosureConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/CredentialDisclosureConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/CredentialProfileConfig/properties/format", + "key_path": "evidence.credential_profiles.*.format", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/CredentialProfileConfig/properties/holder_binding", + "key_path": "evidence.credential_profiles.*.holder_binding", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/HolderBindingConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/HolderBindingConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/CredentialProfileConfig/properties/issuer", + "key_path": "evidence.credential_profiles.*.issuer", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/CredentialProfileConfig/properties/signing_key", + "key_path": "evidence.credential_profiles.*.signing_key", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/CredentialProfileConfig/properties/validity_seconds", + "key_path": "evidence.credential_profiles.*.validity_seconds", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "int64" + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/CredentialProfileConfig/properties/vct", + "key_path": "evidence.credential_profiles.*.vct", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/CredentialStatusConfig/properties/base_url", + "key_path": "credential_status.base_url", + "path_kind": "property" + }, + "purpose": "Controls Notary credential-status publication and retention behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_credential_status_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/CredentialStatusConfig/properties/enabled", + "key_path": "credential_status.enabled", + "path_kind": "property" + }, + "purpose": "Controls Notary credential-status publication and retention behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_credential_status_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/CredentialStatusConfig/properties/retention_seconds", + "key_path": "credential_status.retention_seconds", + "path_kind": "property" + }, + "purpose": "Controls Notary credential-status publication and retention behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_credential_status_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/DeploymentConfig/properties/evidence", + "key_path": "deployment.evidence", + "path_kind": "property" + }, + "purpose": "Declares Notary deployment posture and reviewed waiver metadata used by operator checks.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_deployment_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/DeploymentEvidenceConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/DeploymentEvidenceConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/DeploymentConfig/properties/multi_instance", + "key_path": "deployment.multi_instance", + "path_kind": "property" + }, + "purpose": "Declares Notary deployment posture and reviewed waiver metadata used by operator checks.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_deployment_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/DeploymentConfig/properties/profile", + "key_path": "deployment.profile", + "path_kind": "property" + }, + "purpose": "The set of deployment profiles an operator can declare.\n\nFrozen at introduction; new profiles may be added but existing ones never\nchange meaning. Deserialization is strict: an unknown profile string fails,\nwhich surfaces as a startup error.", + "purpose_source": "schema_description", + "intent_profile": "notary_deployment_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "local", + "hosted_lab", + "production", + "evidence_grade" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "string" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/DeploymentConfig/properties/waivers", + "key_path": "deployment.waivers", + "path_kind": "property" + }, + "purpose": "Declares Notary deployment posture and reviewed waiver metadata used by operator checks.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_deployment_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/DeploymentConfig/properties/waivers/items", + "key_path": "deployment.waivers[]", + "path_kind": "array_item" + }, + "purpose": "One operator-configured waiver.\n\nA waiver names exactly one finding id, a required operator reference, an\noptional summary, and a mandatory expiry date (`YYYY-MM-DD`). The shared\noperations contract validates metadata before it can reach posture or logs.", + "purpose_source": "schema_description", + "intent_profile": "notary_deployment_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/DeploymentWaiverConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "finding", + "reference", + "expires" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/DeploymentWaiverConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_ack_cursor_path", + "key_path": "deployment.evidence.audit_ack_cursor_path", + "path_kind": "property" + }, + "purpose": "Optional path to a `registry.audit.ack_cursor.v1` file maintained by\nwhatever ships audit events off-host. Runtime health requires both a\nfresh timestamp and a watermark equal to the live keyed audit-chain tail.", + "purpose_source": "schema_description", + "intent_profile": "notary_deployment_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_ack_max_age_secs", + "key_path": "deployment.evidence.audit_ack_max_age_secs", + "path_kind": "property" + }, + "purpose": "Optional freshness window, in seconds, for the off-host ack cursor.\nUnset defaults to [`DEFAULT_AUDIT_ACK_MAX_AGE`] (900s). Meaningless\nwithout `audit_ack_cursor_path`; config load rejects that combination.\n\n[`DEFAULT_AUDIT_ACK_MAX_AGE`]: registry_platform_ops::DEFAULT_AUDIT_ACK_MAX_AGE", + "purpose_source": "schema_description", + "intent_profile": "notary_deployment_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer", + "null" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": [ + "integer", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_offhost_shipping", + "key_path": "deployment.evidence.audit_offhost_shipping", + "path_kind": "property" + }, + "purpose": "Operator asserts audit log events are shipped off-host (for example to\na log aggregator or SIEM) so a local file sink does not cap retention.", + "purpose_source": "schema_description", + "intent_profile": "notary_deployment_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/DeploymentEvidenceConfig/properties/signer_custody_approved", + "key_path": "deployment.evidence.signer_custody_approved", + "path_kind": "property" + }, + "purpose": "Operator asserts a production review has approved signer custody for\nthis deployment. Provider kind is not proof of custody: PKCS#11 modules\ncan be backed by either hardware or software tokens.", + "purpose_source": "schema_description", + "intent_profile": "notary_deployment_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/DeploymentWaiverConfig/properties/expires", + "key_path": "deployment.waivers[].expires", + "path_kind": "property" + }, + "purpose": "Declares Notary deployment posture and reviewed waiver metadata used by operator checks.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_deployment_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/DeploymentWaiverConfig/properties/finding", + "key_path": "deployment.waivers[].finding", + "path_kind": "property" + }, + "purpose": "Declares Notary deployment posture and reviewed waiver metadata used by operator checks.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_deployment_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/DeploymentWaiverConfig/properties/reference", + "key_path": "deployment.waivers[].reference", + "path_kind": "property" + }, + "purpose": "Declares Notary deployment posture and reviewed waiver metadata used by operator checks.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_deployment_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/DeploymentWaiverReference", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 128 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^(?!.*\\.\\.)[A-Za-z0-9._:-]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/DeploymentWaiverReference" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/DeploymentWaiverConfig/properties/summary", + "key_path": "deployment.waivers[].summary", + "path_kind": "property" + }, + "purpose": "Structurally valid deployment-waiver summary. Contextual authorization-value and private-key marker exclusions require semantic producer validation.", + "purpose_source": "schema_description", + "intent_profile": "notary_deployment_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/DeploymentWaiverSummary", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/DeploymentWaiverSummary" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/DisclosureConfig/properties/allowed", + "key_path": "evidence.claims[].disclosure.allowed", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/DisclosureConfig/properties/allowed/items", + "key_path": "evidence.claims[].disclosure.allowed[]", + "path_kind": "array_item" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/DisclosureConfig/properties/default", + "key_path": "evidence.claims[].disclosure.default", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/DisclosureConfig/properties/downgrade", + "key_path": "evidence.claims[].disclosure.downgrade", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAssistedAccessContext/properties/channel", + "key_path": "auth.api_keys[].authorization_details.assisted_access_context.channel", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAssistedAccessContext/properties/channel", + "key_path": "auth.bearer_tokens[].authorization_details.assisted_access_context.channel", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuditConfig/properties/hash_secret_env", + "key_path": "audit.hash_secret_env", + "path_kind": "property" + }, + "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_audit_secret_reference", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuditConfig/properties/max_files", + "key_path": "audit.max_files", + "path_kind": "property" + }, + "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_audit_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer", + "null" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": [ + "integer", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuditConfig/properties/max_size_mb", + "key_path": "audit.max_size_mb", + "path_kind": "property" + }, + "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_audit_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer", + "null" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": [ + "integer", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuditConfig/properties/path", + "key_path": "audit.path", + "path_kind": "property" + }, + "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_audit_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuditConfig/properties/sink", + "key_path": "audit.sink", + "path_kind": "property" + }, + "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_audit_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuditConfig/properties/syslog_socket_path", + "key_path": "audit.syslog_socket_path", + "path_kind": "property" + }, + "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_audit_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthConfig/properties/access_token_signing", + "key_path": "auth.access_token_signing", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AccessTokenSigningConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/AccessTokenSigningConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthConfig/properties/api_keys", + "key_path": "auth.api_keys", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthConfig/properties/api_keys/items", + "key_path": "auth.api_keys[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/EvidenceCredentialConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id", + "fingerprint" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/EvidenceCredentialConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthConfig/properties/bearer_tokens", + "key_path": "auth.bearer_tokens", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthConfig/properties/bearer_tokens/items", + "key_path": "auth.bearer_tokens[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/EvidenceCredentialConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id", + "fingerprint" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/EvidenceCredentialConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthConfig/properties/oidc", + "key_path": "auth.oidc", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "issuer", + "jwks_url" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/access_mode", + "key_path": "auth.api_keys[].authorization_details.access_mode", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "unknown", + "machine_client", + "subject_bound", + "delegated_attestation" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "string" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/access_mode", + "key_path": "auth.bearer_tokens[].authorization_details.access_mode", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "unknown", + "machine_client", + "subject_bound", + "delegated_attestation" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "string" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/actions", + "key_path": "auth.api_keys[].authorization_details.actions", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/actions", + "key_path": "auth.bearer_tokens[].authorization_details.actions", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/actions/items", + "key_path": "auth.api_keys[].authorization_details.actions[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/actions/items", + "key_path": "auth.bearer_tokens[].authorization_details.actions[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/assisted_access_context", + "key_path": "auth.api_keys[].authorization_details.assisted_access_context", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "channel" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/assisted_access_context", + "key_path": "auth.bearer_tokens[].authorization_details.assisted_access_context", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "channel" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/assurance_level", + "key_path": "auth.api_keys[].authorization_details.assurance_level", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/assurance_level", + "key_path": "auth.bearer_tokens[].authorization_details.assurance_level", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/claims", + "key_path": "auth.api_keys[].authorization_details.claims", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/claims", + "key_path": "auth.bearer_tokens[].authorization_details.claims", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/claims/items", + "key_path": "auth.api_keys[].authorization_details.claims[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object", + "string" + ], + "local_reference": "#/$defs/ClaimRef", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id" + ] + }, + { + "keyword": "type", + "value": [ + "object", + "string" + ] + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/ClaimRef" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/claims/items", + "key_path": "auth.bearer_tokens[].authorization_details.claims[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object", + "string" + ], + "local_reference": "#/$defs/ClaimRef", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id" + ] + }, + { + "keyword": "type", + "value": [ + "object", + "string" + ] + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/ClaimRef" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/consent_ref", + "key_path": "auth.api_keys[].authorization_details.consent_ref", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/consent_ref", + "key_path": "auth.bearer_tokens[].authorization_details.consent_ref", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/disclosure", + "key_path": "auth.api_keys[].authorization_details.disclosure", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/disclosure", + "key_path": "auth.bearer_tokens[].authorization_details.disclosure", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/format", + "key_path": "auth.api_keys[].authorization_details.format", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/format", + "key_path": "auth.bearer_tokens[].authorization_details.format", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/jurisdiction", + "key_path": "auth.api_keys[].authorization_details.jurisdiction", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/jurisdiction", + "key_path": "auth.bearer_tokens[].authorization_details.jurisdiction", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/legal_basis_ref", + "key_path": "auth.api_keys[].authorization_details.legal_basis_ref", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/legal_basis_ref", + "key_path": "auth.bearer_tokens[].authorization_details.legal_basis_ref", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/locations", + "key_path": "auth.api_keys[].authorization_details.locations", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/locations", + "key_path": "auth.bearer_tokens[].authorization_details.locations", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/locations/items", + "key_path": "auth.api_keys[].authorization_details.locations[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/locations/items", + "key_path": "auth.bearer_tokens[].authorization_details.locations[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/purpose", + "key_path": "auth.api_keys[].authorization_details.purpose", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/purpose", + "key_path": "auth.bearer_tokens[].authorization_details.purpose", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/relationship", + "key_path": "auth.api_keys[].authorization_details.relationship", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "relationship_type", + "proof_claim" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/relationship", + "key_path": "auth.bearer_tokens[].authorization_details.relationship", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "relationship_type", + "proof_claim" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/schema_version", + "key_path": "auth.api_keys[].authorization_details.schema_version", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/schema_version", + "key_path": "auth.bearer_tokens[].authorization_details.schema_version", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/subject", + "key_path": "auth.api_keys[].authorization_details.subject", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "binding_claim", + "id_type" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/subject", + "key_path": "auth.bearer_tokens[].authorization_details.subject", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "binding_claim", + "id_type" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/target", + "key_path": "auth.api_keys[].authorization_details.target", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id_type", + "id" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/target", + "key_path": "auth.bearer_tokens[].authorization_details.target", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id_type", + "id" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/type", + "key_path": "auth.api_keys[].authorization_details.type", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/type", + "key_path": "auth.bearer_tokens[].authorization_details.type", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationRelationship/properties/proof_claim", + "key_path": "auth.api_keys[].authorization_details.relationship.proof_claim", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationRelationship/properties/proof_claim", + "key_path": "auth.bearer_tokens[].authorization_details.relationship.proof_claim", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationRelationship/properties/relationship_type", + "key_path": "auth.api_keys[].authorization_details.relationship.relationship_type", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationRelationship/properties/relationship_type", + "key_path": "auth.bearer_tokens[].authorization_details.relationship.relationship_type", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationSubject/properties/binding_claim", + "key_path": "auth.api_keys[].authorization_details.subject.binding_claim", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationSubject/properties/binding_claim", + "key_path": "auth.bearer_tokens[].authorization_details.subject.binding_claim", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationSubject/properties/id_type", + "key_path": "auth.api_keys[].authorization_details.subject.id_type", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationSubject/properties/id_type", + "key_path": "auth.bearer_tokens[].authorization_details.subject.id_type", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationTarget/properties/id", + "key_path": "auth.api_keys[].authorization_details.target.id", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationTarget/properties/id", + "key_path": "auth.bearer_tokens[].authorization_details.target.id", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationTarget/properties/id_type", + "key_path": "auth.api_keys[].authorization_details.target.id_type", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationTarget/properties/id_type", + "key_path": "auth.bearer_tokens[].authorization_details.target.id_type", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/allowed_purposes", + "key_path": "evidence.allowed_purposes", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/allowed_purposes/items", + "key_path": "evidence.allowed_purposes[]", + "path_kind": "array_item" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/api_base_url", + "key_path": "evidence.api_base_url", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/api_version", + "key_path": "evidence.api_version", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/claims", + "key_path": "evidence.claims", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/claims/items", + "key_path": "evidence.claims[]", + "path_kind": "array_item" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/ClaimDefinition", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id", + "title", + "version", + "subject_type", + "evidence_mode", + "rule" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/claims_url", + "key_path": "evidence.claims_url", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/concurrency", + "key_path": "evidence.concurrency", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/ConcurrencyConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/ConcurrencyConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/credential_profiles", + "key_path": "evidence.credential_profiles", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/credential_profiles/additionalProperties", + "key_path": "evidence.credential_profiles.*", + "path_kind": "map_value" + }, + "purpose": "Each reviewed key names a credential profile and each value defines its exact claims, format, and issuance contract.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_credential_profiles_open_map", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/CredentialProfileConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "format", + "issuer", + "signing_key", + "vct" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/CredentialProfileConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/enabled", + "key_path": "evidence.enabled", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/formats_url", + "key_path": "evidence.formats_url", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/inline_batch_limit", + "key_path": "evidence.inline_batch_limit", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint" + }, + { + "keyword": "maximum", + "value": 100 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/machine_quota", + "key_path": "evidence.machine_quota", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/MachineQuotaConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/MachineQuotaConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/max_credential_validity_seconds", + "key_path": "evidence.max_credential_validity_seconds", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/relay", + "key_path": "evidence.relay", + "path_kind": "property" + }, + "purpose": "The one Registry Relay connection available to registry-backed claims.\nAuthentication remains a reloadable local file reference; core never\nloads the bearer token value.", + "purpose_source": "schema_description", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "base_url", + "workload_client_id", + "token_file" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/service_id", + "key_path": "evidence.service_id", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/signing_keys", + "key_path": "evidence.signing_keys", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/signing_keys/additionalProperties", + "key_path": "evidence.signing_keys.*", + "path_kind": "map_value" + }, + "purpose": "Each reviewed key names a signing-key binding and each value references the operator-managed signing material and lifecycle metadata.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_signing_keys_open_map", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/SigningKeyConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "provider", + "alg", + "kid", + "status" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/SigningKeyConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/variables", + "key_path": "evidence.variables", + "path_kind": "property" + }, + "purpose": "Closed union of request variables declared by authored services.", + "purpose_source": "schema_description", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/variables/additionalProperties", + "key_path": "evidence.variables.*", + "path_kind": "map_value" + }, + "purpose": "Each reviewed key names a Notary evidence variable and each value defines its bounded source and evaluation contract.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_variables_open_map", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/RequestVariableConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "structural", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "from", + "type" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/RequestVariableConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceCredentialConfig/properties/authorization_details", + "key_path": "auth.api_keys[].authorization_details", + "path_kind": "property" + }, + "purpose": "Versioned authorization fields shared by static configuration and token/OIDC JSON.\n\nUnknown metadata is intentionally ignored for forward-compatible interoperability.\nAuthorization decisions consume only the modeled fields and must never infer authority\nfrom an unrecognized extension.", + "purpose_source": "schema_description", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "type", + "schema_version" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceCredentialConfig/properties/authorization_details", + "key_path": "auth.bearer_tokens[].authorization_details", + "path_kind": "property" + }, + "purpose": "Versioned authorization fields shared by static configuration and token/OIDC JSON.\n\nUnknown metadata is intentionally ignored for forward-compatible interoperability.\nAuthorization decisions consume only the modeled fields and must never infer authority\nfrom an unrecognized extension.", + "purpose_source": "schema_description", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "type", + "schema_version" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceCredentialConfig/properties/fingerprint", + "key_path": "auth.api_keys[].fingerprint", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/CredentialFingerprintRef", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "provider" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/CredentialFingerprintRef" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceCredentialConfig/properties/fingerprint", + "key_path": "auth.bearer_tokens[].fingerprint", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/CredentialFingerprintRef", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "provider" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/CredentialFingerprintRef" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceCredentialConfig/properties/id", + "key_path": "auth.api_keys[].id", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceCredentialConfig/properties/id", + "key_path": "auth.bearer_tokens[].id", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceCredentialConfig/properties/scopes", + "key_path": "auth.api_keys[].scopes", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceCredentialConfig/properties/scopes", + "key_path": "auth.bearer_tokens[].scopes", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceCredentialConfig/properties/scopes/items", + "key_path": "auth.api_keys[].scopes[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceCredentialConfig/properties/scopes/items", + "key_path": "auth.bearer_tokens[].scopes[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allow_insecure_localhost", + "key_path": "auth.oidc.allow_insecure_localhost", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_algorithms", + "key_path": "auth.oidc.allowed_algorithms", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_algorithms/items", + "key_path": "auth.oidc.allowed_algorithms[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_clients", + "key_path": "auth.oidc.allowed_clients", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_clients/items", + "key_path": "auth.oidc.allowed_clients[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_token_types", + "key_path": "auth.oidc.allowed_token_types", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_token_types/items", + "key_path": "auth.oidc.allowed_token_types[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/audiences", + "key_path": "auth.oidc.audiences", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/audiences/items", + "key_path": "auth.oidc.audiences[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/issuer", + "key_path": "auth.oidc.issuer", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/jwks_url", + "key_path": "auth.oidc.jwks_url", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/leeway", + "key_path": "auth.oidc.leeway", + "path_kind": "property" + }, + "purpose": "A humantime duration string. The runtime parser remains authoritative for its complete grammar.", + "purpose_source": "schema_description", + "intent_profile": "notary_auth_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/HumantimeDuration", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/HumantimeDuration" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/principal_claim", + "key_path": "auth.oidc.principal_claim", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/scope_claim", + "key_path": "auth.oidc.scope_claim", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/scope_map", + "key_path": "auth.oidc.scope_map", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/scope_map/additionalProperties", + "key_path": "auth.oidc.scope_map.*", + "path_kind": "map_value" + }, + "purpose": "Each reviewed key is an external token scope and each value is the bounded Notary scope mapping granted for that exact token scope.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_oidc_scope_map_open_map", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "structural", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/scope_map/additionalProperties/items", + "key_path": "auth.oidc.scope_map.*[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/scope_separator", + "key_path": "auth.oidc.scope_separator", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/userinfo_endpoint", + "key_path": "auth.oidc.userinfo_endpoint", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/userinfo_issuers", + "key_path": "auth.oidc.userinfo_issuers", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/userinfo_issuers/items", + "key_path": "auth.oidc.userinfo_issuers[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/clock_leeway_seconds", + "key_path": "federation.clock_leeway_seconds", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/emergency_denylist", + "key_path": "federation.emergency_denylist", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/FederationEmergencyDenylistConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/FederationEmergencyDenylistConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/enabled", + "key_path": "federation.enabled", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/evaluation_profiles", + "key_path": "federation.evaluation_profiles", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/evaluation_profiles/items", + "key_path": "federation.evaluation_profiles[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/FederationEvaluationProfileConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id", + "ruleset", + "claim_id", + "subject_id_type" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/FederationEvaluationProfileConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/federation_api", + "key_path": "federation.federation_api", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/inbound_body_limit_bytes", + "key_path": "federation.inbound_body_limit_bytes", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/issuer", + "key_path": "federation.issuer", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/jwks_uri", + "key_path": "federation.jwks_uri", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/max_request_lifetime_seconds", + "key_path": "federation.max_request_lifetime_seconds", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/node_id", + "key_path": "federation.node_id", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/pairwise_subject_hash", + "key_path": "federation.pairwise_subject_hash", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/FederationPairwiseSubjectHashConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/FederationPairwiseSubjectHashConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/peers", + "key_path": "federation.peers", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/peers/items", + "key_path": "federation.peers[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/FederationPeerConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "node_id", + "issuer", + "jwks_uri" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/FederationPeerConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/response_shaping", + "key_path": "federation.response_shaping", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/FederationResponseShapingConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/FederationResponseShapingConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/signing", + "key_path": "federation.signing", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/FederationSigningConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "signing_key" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/FederationSigningConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/supported_protocol_versions", + "key_path": "federation.supported_protocol_versions", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/supported_protocol_versions/items", + "key_path": "federation.supported_protocol_versions[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationEmergencyDenylistConfig/properties/kids", + "key_path": "federation.emergency_denylist.kids", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationEmergencyDenylistConfig/properties/kids/items", + "key_path": "federation.emergency_denylist.kids[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationEmergencyDenylistConfig/properties/node_ids", + "key_path": "federation.emergency_denylist.node_ids", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationEmergencyDenylistConfig/properties/node_ids/items", + "key_path": "federation.emergency_denylist.node_ids[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationEvaluationProfileConfig/properties/assurance_level", + "key_path": "federation.evaluation_profiles[].assurance_level", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationEvaluationProfileConfig/properties/claim_id", + "key_path": "federation.evaluation_profiles[].claim_id", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationEvaluationProfileConfig/properties/consent_ref", + "key_path": "federation.evaluation_profiles[].consent_ref", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationEvaluationProfileConfig/properties/disclosure", + "key_path": "federation.evaluation_profiles[].disclosure", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationEvaluationProfileConfig/properties/id", + "key_path": "federation.evaluation_profiles[].id", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationEvaluationProfileConfig/properties/jurisdiction", + "key_path": "federation.evaluation_profiles[].jurisdiction", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationEvaluationProfileConfig/properties/legal_basis_ref", + "key_path": "federation.evaluation_profiles[].legal_basis_ref", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationEvaluationProfileConfig/properties/max_claim_result_age_seconds", + "key_path": "federation.evaluation_profiles[].max_claim_result_age_seconds", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer", + "null" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": [ + "integer", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationEvaluationProfileConfig/properties/ruleset", + "key_path": "federation.evaluation_profiles[].ruleset", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationEvaluationProfileConfig/properties/subject_id_type", + "key_path": "federation.evaluation_profiles[].subject_id_type", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationPairwiseSubjectHashConfig/properties/secret_env", + "key_path": "federation.pairwise_subject_hash.secret_env", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_secret_reference", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationPeerConfig/properties/allow_insecure_localhost", + "key_path": "federation.peers[].allow_insecure_localhost", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationPeerConfig/properties/allow_insecure_private_network", + "key_path": "federation.peers[].allow_insecure_private_network", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationPeerConfig/properties/allowed_profiles", + "key_path": "federation.peers[].allowed_profiles", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationPeerConfig/properties/allowed_profiles/items", + "key_path": "federation.peers[].allowed_profiles[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationPeerConfig/properties/allowed_protocol_versions", + "key_path": "federation.peers[].allowed_protocol_versions", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationPeerConfig/properties/allowed_protocol_versions/items", + "key_path": "federation.peers[].allowed_protocol_versions[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationPeerConfig/properties/allowed_purposes", + "key_path": "federation.peers[].allowed_purposes", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationPeerConfig/properties/allowed_purposes/items", + "key_path": "federation.peers[].allowed_purposes[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationPeerConfig/properties/evaluation_scopes", + "key_path": "federation.peers[].evaluation_scopes", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationPeerConfig/properties/evaluation_scopes/items", + "key_path": "federation.peers[].evaluation_scopes[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationPeerConfig/properties/issuer", + "key_path": "federation.peers[].issuer", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationPeerConfig/properties/jwks_uri", + "key_path": "federation.peers[].jwks_uri", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationPeerConfig/properties/node_id", + "key_path": "federation.peers[].node_id", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationResponseShapingConfig/properties/minimum_denial_latency_ms", + "key_path": "federation.response_shaping.minimum_denial_latency_ms", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationSigningConfig/properties/signing_key", + "key_path": "federation.signing.signing_key", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/HolderBindingConfig/properties/allowed_did_methods", + "key_path": "evidence.credential_profiles.*.holder_binding.allowed_did_methods", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/HolderBindingConfig/properties/allowed_did_methods/items", + "key_path": "evidence.credential_profiles.*.holder_binding.allowed_did_methods[]", + "path_kind": "array_item" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/HolderBindingConfig/properties/mode", + "key_path": "evidence.credential_profiles.*.holder_binding.mode", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/HolderBindingConfig/properties/proof_of_possession", + "key_path": "evidence.credential_profiles.*.holder_binding.proof_of_possession", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/MachineQuotaConfig/properties/enabled", + "key_path": "evidence.machine_quota.enabled", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/MachineQuotaConfig/properties/subjects_per_minute", + "key_path": "evidence.machine_quota.subjects_per_minute", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/NotaryInstanceConfig/properties/environment", + "key_path": "instance.environment", + "path_kind": "property" + }, + "purpose": "Identifies the Notary instance and its deployment environment for operational correlation.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_instance_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/NotaryInstanceConfig/properties/id", + "key_path": "instance.id", + "path_kind": "property" + }, + "purpose": "Identifies the Notary instance and its deployment environment for operational correlation.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_instance_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/NotaryInstanceConfig/properties/jurisdiction", + "key_path": "instance.jurisdiction", + "path_kind": "property" + }, + "purpose": "Identifies the Notary instance and its deployment environment for operational correlation.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_instance_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/NotaryInstanceConfig/properties/owner", + "key_path": "instance.owner", + "path_kind": "property" + }, + "purpose": "Identifies the Notary instance and its deployment environment for operational correlation.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_instance_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/NotaryInstanceConfig/properties/public_base_url", + "key_path": "instance.public_base_url", + "path_kind": "property" + }, + "purpose": "Identifies the Notary instance and its deployment environment for operational correlation.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_instance_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciAuthorizationConfig/properties/require_pkce_method", + "key_path": "oid4vci.authorization.require_pkce_method", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig/properties/accepted_token_audiences", + "key_path": "oid4vci.accepted_token_audiences", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig/properties/accepted_token_audiences/items", + "key_path": "oid4vci.accepted_token_audiences[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig/properties/authorization", + "key_path": "oid4vci.authorization", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/Oid4vciAuthorizationConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/Oid4vciAuthorizationConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig/properties/authorization_servers", + "key_path": "oid4vci.authorization_servers", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig/properties/authorization_servers/items", + "key_path": "oid4vci.authorization_servers[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig/properties/credential_configurations", + "key_path": "oid4vci.credential_configurations", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig/properties/credential_configurations/additionalProperties", + "key_path": "oid4vci.credential_configurations.*", + "path_kind": "map_value" + }, + "purpose": "Each reviewed key names an OpenID4VCI credential configuration and each value defines the advertised and issued credential contract.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_credential_configurations_open_map", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/Oid4vciCredentialConfigurationConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "credential_profile", + "format", + "scope", + "vct", + "display_name" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialConfigurationConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig/properties/credential_endpoint", + "key_path": "oid4vci.credential_endpoint", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig/properties/credential_issuer", + "key_path": "oid4vci.credential_issuer", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig/properties/display", + "key_path": "oid4vci.display", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig/properties/display/items", + "key_path": "oid4vci.display[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/Oid4vciIssuerDisplayConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "name" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/Oid4vciIssuerDisplayConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig/properties/enabled", + "key_path": "oid4vci.enabled", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig/properties/nonce", + "key_path": "oid4vci.nonce", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/Oid4vciNonceConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/Oid4vciNonceConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig/properties/nonce_endpoint", + "key_path": "oid4vci.nonce_endpoint", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig/properties/offer_endpoint", + "key_path": "oid4vci.offer_endpoint", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig/properties/pre_authorized_code", + "key_path": "oid4vci.pre_authorized_code", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/Oid4vciPreAuthorizedCodeConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/Oid4vciPreAuthorizedCodeConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig/properties/proof", + "key_path": "oid4vci.proof", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/Oid4vciProofConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/Oid4vciProofConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialClaimConfig/properties/display_name", + "key_path": "oid4vci.credential_configurations.*.claims[].display_name", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialClaimConfig/properties/id", + "key_path": "oid4vci.credential_configurations.*.claims[].id", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialClaimConfig/properties/output_path", + "key_path": "oid4vci.credential_configurations.*.claims[].output_path", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialClaimConfig/properties/output_path/items", + "key_path": "oid4vci.credential_configurations.*.claims[].output_path[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialClaimConfig/properties/sd", + "key_path": "oid4vci.credential_configurations.*.claims[].sd", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/claim_id", + "key_path": "oid4vci.credential_configurations.*.claim_id", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/claims", + "key_path": "oid4vci.credential_configurations.*.claims", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/claims/items", + "key_path": "oid4vci.credential_configurations.*.claims[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/Oid4vciCredentialClaimConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id", + "output_path", + "display_name", + "sd" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialClaimConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/credential_profile", + "key_path": "oid4vci.credential_configurations.*.credential_profile", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/cryptographic_binding_methods_supported", + "key_path": "oid4vci.credential_configurations.*.cryptographic_binding_methods_supported", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/cryptographic_binding_methods_supported/items", + "key_path": "oid4vci.credential_configurations.*.cryptographic_binding_methods_supported[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/display", + "key_path": "oid4vci.credential_configurations.*.display", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/Oid4vciCredentialDisplayConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialDisplayConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/display_name", + "key_path": "oid4vci.credential_configurations.*.display_name", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/format", + "key_path": "oid4vci.credential_configurations.*.format", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/proof_signing_alg_values_supported", + "key_path": "oid4vci.credential_configurations.*.proof_signing_alg_values_supported", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/proof_signing_alg_values_supported/items", + "key_path": "oid4vci.credential_configurations.*.proof_signing_alg_values_supported[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/scope", + "key_path": "oid4vci.credential_configurations.*.scope", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/vct", + "key_path": "oid4vci.credential_configurations.*.vct", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/background_color", + "key_path": "oid4vci.credential_configurations.*.display.background_color", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/background_image", + "key_path": "oid4vci.credential_configurations.*.display.background_image", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/description", + "key_path": "oid4vci.credential_configurations.*.display.description", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/locale", + "key_path": "oid4vci.credential_configurations.*.display.locale", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/logo", + "key_path": "oid4vci.credential_configurations.*.display.logo", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/secondary_image", + "key_path": "oid4vci.credential_configurations.*.display.secondary_image", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/text_color", + "key_path": "oid4vci.credential_configurations.*.display.text_color", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/alt_text", + "key_path": "oid4vci.credential_configurations.*.display.background_image.alt_text", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/alt_text", + "key_path": "oid4vci.credential_configurations.*.display.logo.alt_text", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/alt_text", + "key_path": "oid4vci.credential_configurations.*.display.secondary_image.alt_text", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/alt_text", + "key_path": "oid4vci.display[].logo.alt_text", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/uri", + "key_path": "oid4vci.credential_configurations.*.display.background_image.uri", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/uri", + "key_path": "oid4vci.credential_configurations.*.display.logo.uri", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/uri", + "key_path": "oid4vci.credential_configurations.*.display.secondary_image.uri", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/uri", + "key_path": "oid4vci.display[].logo.uri", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/url", + "key_path": "oid4vci.credential_configurations.*.display.background_image.url", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/url", + "key_path": "oid4vci.credential_configurations.*.display.logo.url", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/url", + "key_path": "oid4vci.credential_configurations.*.display.secondary_image.url", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/url", + "key_path": "oid4vci.display[].logo.url", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/allow_insecure_localhost", + "key_path": "oid4vci.pre_authorized_code.esignet.allow_insecure_localhost", + "path_kind": "property" + }, + "purpose": "Allow `http` loopback URLs for the eSignet endpoints and JWKS transport.\nFor local development and tests only.", + "purpose_source": "schema_description", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/authorize_url", + "key_path": "oid4vci.pre_authorized_code.esignet.authorize_url", + "path_kind": "property" + }, + "purpose": "eSignet authorize endpoint.", + "purpose_source": "schema_description", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/client_id", + "key_path": "oid4vci.pre_authorized_code.esignet.client_id", + "path_kind": "property" + }, + "purpose": "Confidential client id the Notary presents to eSignet.", + "purpose_source": "schema_description", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/client_signing_key_id", + "key_path": "oid4vci.pre_authorized_code.esignet.client_signing_key_id", + "path_kind": "property" + }, + "purpose": "`evidence.signing_keys` entry used to sign the eSignet\n`private_key_jwt` client assertion.", + "purpose_source": "schema_description", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/issuer", + "key_path": "oid4vci.pre_authorized_code.esignet.issuer", + "path_kind": "property" + }, + "purpose": "eSignet OIDC issuer, pinned when validating the returned `id_token`.", + "purpose_source": "schema_description", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/jwks_uri", + "key_path": "oid4vci.pre_authorized_code.esignet.jwks_uri", + "path_kind": "property" + }, + "purpose": "eSignet JWKS URI, used to resolve the `id_token` signing key by `kid`.", + "purpose_source": "schema_description", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/login_state_ttl_seconds", + "key_path": "oid4vci.pre_authorized_code.esignet.login_state_ttl_seconds", + "path_kind": "property" + }, + "purpose": "Lifetime of the short-lived login state (PKCE verifier + nonce +\nselection) reserved between `offer/start` and `offer/callback`.", + "purpose_source": "schema_description", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/redirect_uri", + "key_path": "oid4vci.pre_authorized_code.esignet.redirect_uri", + "path_kind": "property" + }, + "purpose": "Notary callback the citizen browser is redirected back to.", + "purpose_source": "schema_description", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/scopes", + "key_path": "oid4vci.pre_authorized_code.esignet.scopes", + "path_kind": "property" + }, + "purpose": "OAuth scopes requested at eSignet.", + "purpose_source": "schema_description", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/scopes/items", + "key_path": "oid4vci.pre_authorized_code.esignet.scopes[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/token_url", + "key_path": "oid4vci.pre_authorized_code.esignet.token_url", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/userinfo_url", + "key_path": "oid4vci.pre_authorized_code.esignet.userinfo_url", + "path_kind": "property" + }, + "purpose": "eSignet userinfo endpoint. Required when the subject-binding claim is\nsourced from userinfo rather than the `id_token`; the callback fetches\nthe userinfo JWS with the eSignet access token and reads the binding\nclaim from it.", + "purpose_source": "schema_description", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciIssuerDisplayConfig/properties/locale", + "key_path": "oid4vci.display[].locale", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciIssuerDisplayConfig/properties/logo", + "key_path": "oid4vci.display[].logo", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciIssuerDisplayConfig/properties/name", + "key_path": "oid4vci.display[].name", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciNonceConfig/properties/enabled", + "key_path": "oid4vci.nonce.enabled", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciNonceConfig/properties/ttl_seconds", + "key_path": "oid4vci.nonce.ttl_seconds", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciPreAuthorizedCodeConfig/properties/enabled", + "key_path": "oid4vci.pre_authorized_code.enabled", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciPreAuthorizedCodeConfig/properties/esignet", + "key_path": "oid4vci.pre_authorized_code.esignet", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/Oid4vciEsignetRpConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/Oid4vciEsignetRpConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciPreAuthorizedCodeConfig/properties/pre_authorized_code_ttl_seconds", + "key_path": "oid4vci.pre_authorized_code.pre_authorized_code_ttl_seconds", + "path_kind": "property" + }, + "purpose": "Pre-authorized-code lifetime in seconds.", + "purpose_source": "schema_description", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciPreAuthorizedCodeConfig/properties/tx_code", + "key_path": "oid4vci.pre_authorized_code.tx_code", + "path_kind": "property" + }, + "purpose": "`tx_code` (PIN) policy for the pre-authorized-code grant. A `tx_code` is\nrequired by default because a code without a PIN is a bearer credential.", + "purpose_source": "schema_description", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/Oid4vciTxCodeConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/Oid4vciTxCodeConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciProofConfig/properties/max_age_seconds", + "key_path": "oid4vci.proof.max_age_seconds", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciProofConfig/properties/max_clock_skew_seconds", + "key_path": "oid4vci.proof.max_clock_skew_seconds", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciTxCodeConfig/properties/input_mode", + "key_path": "oid4vci.pre_authorized_code.tx_code.input_mode", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciTxCodeConfig/properties/length", + "key_path": "oid4vci.pre_authorized_code.tx_code.length", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciTxCodeConfig/properties/required", + "key_path": "oid4vci.pre_authorized_code.tx_code.required", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/OotsConfig/properties/authentication_level_of_assurance", + "key_path": "evidence.claims[].oots.authentication_level_of_assurance", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/OotsConfig/properties/enabled", + "key_path": "evidence.claims[].oots.enabled", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/OotsConfig/properties/evidence_type_classification", + "key_path": "evidence.claims[].oots.evidence_type_classification", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/OotsConfig/properties/evidence_type_list", + "key_path": "evidence.claims[].oots.evidence_type_list", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/OotsConfig/properties/languages", + "key_path": "evidence.claims[].oots.languages", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/OotsConfig/properties/languages/items", + "key_path": "evidence.claims[].oots.languages[]", + "path_kind": "array_item" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/OotsConfig/properties/reference_framework", + "key_path": "evidence.claims[].oots.reference_framework", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/OotsConfig/properties/requirement", + "key_path": "evidence.claims[].oots.requirement", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/OperationConfig/properties/enabled", + "key_path": "evidence.claims[].operations.evaluate.enabled", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryAdminListenerConfig/properties/bind", + "key_path": "server.admin_listener.bind", + "path_kind": "property" + }, + "purpose": "A Rust SocketAddr string. The runtime parser remains authoritative for address and port validity.", + "purpose_source": "schema_description", + "intent_profile": "notary_server_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/SocketAddr", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/SocketAddr" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryAdminListenerConfig/properties/mode", + "key_path": "server.admin_listener.mode", + "path_kind": "property" + }, + "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_server_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/RegistryNotaryAdminListenerMode", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "shared_with_public", + "dedicated", + "disabled" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryAdminListenerMode" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryCelConfig/properties/allow_regex", + "key_path": "cel.allow_regex", + "path_kind": "property" + }, + "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_cel_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryCelConfig/properties/eval_timeout_ms", + "key_path": "cel.eval_timeout_ms", + "path_kind": "property" + }, + "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_cel_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_binding_json_bytes", + "key_path": "cel.max_binding_json_bytes", + "path_kind": "property" + }, + "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_cel_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_expression_bytes", + "key_path": "cel.max_expression_bytes", + "path_kind": "property" + }, + "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_cel_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_list_items", + "key_path": "cel.max_list_items", + "path_kind": "property" + }, + "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_cel_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_object_depth", + "key_path": "cel.max_object_depth", + "path_kind": "property" + }, + "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_cel_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_object_keys", + "key_path": "cel.max_object_keys", + "path_kind": "property" + }, + "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_cel_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_result_json_bytes", + "key_path": "cel.max_result_json_bytes", + "path_kind": "property" + }, + "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_cel_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_string_bytes", + "key_path": "cel.max_string_bytes", + "path_kind": "property" + }, + "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_cel_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryCelConfig/properties/mode", + "key_path": "cel.mode", + "path_kind": "property" + }, + "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_cel_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryCelConfig/properties/worker_count", + "key_path": "cel.worker_count", + "path_kind": "property" + }, + "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_cel_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryCelConfig/properties/worker_memory_bytes", + "key_path": "cel.worker_memory_bytes", + "path_kind": "property" + }, + "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_cel_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryCelConfig/properties/worker_stderr_bytes", + "key_path": "cel.worker_stderr_bytes", + "path_kind": "property" + }, + "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_cel_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryCorsConfig/properties/allowed_origins", + "key_path": "server.cors.allowed_origins", + "path_kind": "property" + }, + "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_server_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryCorsConfig/properties/allowed_origins/items", + "key_path": "server.cors.allowed_origins[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_server_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryHttpConfig/properties/admin_listener", + "key_path": "server.admin_listener", + "path_kind": "property" + }, + "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_server_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/RegistryNotaryAdminListenerConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryAdminListenerConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryHttpConfig/properties/bind", + "key_path": "server.bind", + "path_kind": "property" + }, + "purpose": "A Rust SocketAddr string. The runtime parser remains authoritative for address and port validity.", + "purpose_source": "schema_description", + "intent_profile": "notary_server_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/SocketAddr", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/SocketAddr" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryHttpConfig/properties/cors", + "key_path": "server.cors", + "path_kind": "property" + }, + "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_server_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/RegistryNotaryCorsConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryCorsConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryHttpConfig/properties/http1_header_read_timeout", + "key_path": "server.http1_header_read_timeout", + "path_kind": "property" + }, + "purpose": "A humantime duration string. The runtime parser remains authoritative for its complete grammar.", + "purpose_source": "schema_description", + "intent_profile": "notary_server_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/HumantimeDuration", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/HumantimeDuration" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryHttpConfig/properties/max_connections", + "key_path": "server.max_connections", + "path_kind": "property" + }, + "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_server_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryHttpConfig/properties/openapi_requires_auth", + "key_path": "server.openapi_requires_auth", + "path_kind": "property" + }, + "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_server_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryHttpConfig/properties/request_body_timeout", + "key_path": "server.request_body_timeout", + "path_kind": "property" + }, + "purpose": "A humantime duration string. The runtime parser remains authoritative for its complete grammar.", + "purpose_source": "schema_description", + "intent_profile": "notary_server_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/HumantimeDuration", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/HumantimeDuration" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryHttpConfig/properties/request_timeout", + "key_path": "server.request_timeout", + "path_kind": "property" + }, + "purpose": "A humantime duration string. The runtime parser remains authoritative for its complete grammar.", + "purpose_source": "schema_description", + "intent_profile": "notary_server_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/HumantimeDuration", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/HumantimeDuration" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryHttpConfig/properties/trusted_proxy_ips", + "key_path": "server.trusted_proxy_ips", + "path_kind": "property" + }, + "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_server_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryHttpConfig/properties/trusted_proxy_ips/items", + "key_path": "server.trusted_proxy_ips[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_server_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "ip" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RelayConnectionConfig/properties/allow_insecure_localhost", + "key_path": "evidence.relay.allow_insecure_localhost", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RelayConnectionConfig/properties/allowed_private_cidrs", + "key_path": "evidence.relay.allowed_private_cidrs", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RelayConnectionConfig/properties/allowed_private_cidrs/items", + "key_path": "evidence.relay.allowed_private_cidrs[]", + "path_kind": "array_item" + }, + "purpose": "An IP network CIDR string. The runtime parser remains authoritative for address and prefix validity.", + "purpose_source": "schema_description", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/IpNet", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/IpNet" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RelayConnectionConfig/properties/base_url", + "key_path": "evidence.relay.base_url", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RelayConnectionConfig/properties/max_in_flight", + "key_path": "evidence.relay.max_in_flight", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RelayConnectionConfig/properties/token_file", + "key_path": "evidence.relay.token_file", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_secret_reference", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RelayConnectionConfig/properties/workload_client_id", + "key_path": "evidence.relay.workload_client_id", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RelayConsultationConfig/properties/inputs", + "key_path": "evidence.claims[].evidence_mode.consultations.*.inputs", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RelayConsultationConfig/properties/inputs/additionalProperties", + "key_path": "evidence.claims[].evidence_mode.consultations.*.inputs.*", + "path_kind": "map_value" + }, + "purpose": "A supported consultation input path. The runtime parser remains authoritative for exact stable-name bounds.", + "purpose_source": "schema_description", + "intent_profile": "notary_evidence_claims_evidence_mode_consultations_inputs_open_map", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/RelayConsultationInput", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "structural", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/RelayConsultationInput" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RelayConsultationConfig/properties/outputs", + "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs", + "path_kind": "property" + }, + "purpose": "Complete closed public output schema expected from the pinned profile.", + "purpose_source": "schema_description", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RelayConsultationConfig/properties/outputs/additionalProperties", + "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*", + "path_kind": "map_value" + }, + "purpose": "Each reviewed key names a consultation output and each value defines its bounded evidence-result interpretation.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_claims_evidence_mode_consultations_outputs_open_map", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/RelayOutputContract", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "structural", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + [ + "type", + "max_bytes" + ], + [ + "type", + "minimum", + "maximum" + ], + [ + "type" + ] + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/RelayOutputContract" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RelayConsultationConfig/properties/profile", + "key_path": "evidence.claims[].evidence_mode.consultations.*.profile", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/RelayConsultationProfileRef", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id", + "contract_hash" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/RelayConsultationProfileRef" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RelayConsultationProfileRef/properties/contract_hash", + "key_path": "evidence.claims[].evidence_mode.consultations.*.profile.contract_hash", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RelayConsultationProfileRef/properties/id", + "key_path": "evidence.claims[].evidence_mode.consultations.*.profile.id", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RelayOutputContract/oneOf/0/properties/nullable", + "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.nullable", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RelayOutputContract/oneOf/0/properties/type", + "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.type", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "const", + "value": [ + "boolean", + "date", + "integer", + "string" + ] + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RelayOutputContract/oneOf/1/properties/maximum", + "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.maximum", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "int64" + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RelayOutputContract/oneOf/1/properties/minimum", + "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.minimum", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "int64" + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RelayOutputContract/oneOf/2/properties/max_bytes", + "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.max_bytes", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RequestVariableConfig/properties/from", + "key_path": "evidence.variables.*.from", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RequestVariableConfig/properties/type", + "key_path": "evidence.variables.*.type", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/RequestVariableType", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "date" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/RequestVariableType" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RuleConfig/oneOf/0/properties/consultation", + "key_path": "evidence.claims[].rule.consultation", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RuleConfig/oneOf/0/properties/output", + "key_path": "evidence.claims[].rule.output", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RuleConfig/oneOf/0/properties/type", + "key_path": "evidence.claims[].rule.type", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "const", + "value": [ + "cel", + "consultation_matched", + "consultation_output" + ] + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RuleConfig/oneOf/2/properties/bindings", + "key_path": "evidence.claims[].rule.bindings", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/CelBindingsConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/CelBindingsConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RuleConfig/oneOf/2/properties/expression", + "key_path": "evidence.claims[].rule.expression", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SealedClaimEvidenceMode/oneOf/0/properties/consultations", + "key_path": "evidence.claims[].evidence_mode.consultations", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SealedClaimEvidenceMode/oneOf/0/properties/consultations/additionalProperties", + "key_path": "evidence.claims[].evidence_mode.consultations.*", + "path_kind": "map_value" + }, + "purpose": "Each reviewed key names a Relay consultation and each value defines the bounded consultation contract used to support this evidence claim.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_claims_evidence_mode_consultations_open_map", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/RelayConsultationConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "structural", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "profile", + "inputs" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/RelayConsultationConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SealedClaimEvidenceMode/oneOf/0/properties/type", + "key_path": "evidence.claims[].evidence_mode.type", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "const", + "value": [ + "registry_backed", + "self_attested" + ] + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SigningKeyConfig/properties/alg", + "key_path": "evidence.signing_keys.*.alg", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SigningKeyConfig/properties/key_id_hex", + "key_path": "evidence.signing_keys.*.key_id_hex", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SigningKeyConfig/properties/key_label", + "key_path": "evidence.signing_keys.*.key_label", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SigningKeyConfig/properties/kid", + "key_path": "evidence.signing_keys.*.kid", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SigningKeyConfig/properties/module_path", + "key_path": "evidence.signing_keys.*.module_path", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SigningKeyConfig/properties/password_env", + "key_path": "evidence.signing_keys.*.password_env", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_secret_reference", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SigningKeyConfig/properties/path", + "key_path": "evidence.signing_keys.*.path", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_secret_reference", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SigningKeyConfig/properties/pin_env", + "key_path": "evidence.signing_keys.*.pin_env", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_secret_reference", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SigningKeyConfig/properties/private_jwk_env", + "key_path": "evidence.signing_keys.*.private_jwk_env", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_secret_reference", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SigningKeyConfig/properties/provider", + "key_path": "evidence.signing_keys.*.provider", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/SigningKeyProviderSchema", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "local_jwk_env", + "file_watch", + "pkcs11", + "local_pkcs12_file", + "kms", + "workload_identity" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/SigningKeyProviderSchema" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SigningKeyConfig/properties/public_jwk_env", + "key_path": "evidence.signing_keys.*.public_jwk_env", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SigningKeyConfig/properties/publish_until_unix_seconds", + "key_path": "evidence.signing_keys.*.publish_until_unix_seconds", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer", + "null" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": [ + "integer", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SigningKeyConfig/properties/status", + "key_path": "evidence.signing_keys.*.status", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/SigningKeyStatusSchema", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "active", + "publish_only", + "disabled" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/SigningKeyStatusSchema" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SigningKeyConfig/properties/token_label", + "key_path": "evidence.signing_keys.*.token_label", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/StateConfig/properties/postgresql", + "key_path": "state.postgresql", + "path_kind": "property" + }, + "purpose": "Controls Notary durable state storage, database trust, timeouts, connection limits, and sensitive-state protection.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_state_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/StatePostgresqlConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/StatePostgresqlConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/StateConfig/properties/storage", + "key_path": "state.storage", + "path_kind": "property" + }, + "purpose": "Controls Notary durable state storage, database trust, timeouts, connection limits, and sensitive-state protection.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_state_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/StatePostgresqlConfig/properties/connect_timeout_ms", + "key_path": "state.postgresql.connect_timeout_ms", + "path_kind": "property" + }, + "purpose": "Controls Notary durable state storage, database trust, timeouts, connection limits, and sensitive-state protection.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_state_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/StatePostgresqlConfig/properties/max_connections", + "key_path": "state.postgresql.max_connections", + "path_kind": "property" + }, + "purpose": "Controls Notary durable state storage, database trust, timeouts, connection limits, and sensitive-state protection.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_state_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/StatePostgresqlConfig/properties/operation_timeout_ms", + "key_path": "state.postgresql.operation_timeout_ms", + "path_kind": "property" + }, + "purpose": "Controls Notary durable state storage, database trust, timeouts, connection limits, and sensitive-state protection.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_state_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/StatePostgresqlConfig/properties/root_certificate_path", + "key_path": "state.postgresql.root_certificate_path", + "path_kind": "property" + }, + "purpose": "Controls Notary durable state storage, database trust, timeouts, connection limits, and sensitive-state protection.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_state_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/StatePostgresqlConfig/properties/sensitive_state_key_env", + "key_path": "state.postgresql.sensitive_state_key_env", + "path_kind": "property" + }, + "purpose": "Controls Notary durable state storage, database trust, timeouts, connection limits, and sensitive-state protection.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_state_secret_reference", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/StatePostgresqlConfig/properties/url_env", + "key_path": "state.postgresql.url_env", + "path_kind": "property" + }, + "purpose": "Controls Notary durable state storage, database trust, timeouts, connection limits, and sensitive-state protection.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_state_secret_reference", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessCitizenClientsConfig/properties/allowed_audiences", + "key_path": "subject_access.citizen_clients.allowed_audiences", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessCitizenClientsConfig/properties/allowed_audiences/items", + "key_path": "subject_access.citizen_clients.allowed_audiences[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessCitizenClientsConfig/properties/allowed_client_ids", + "key_path": "subject_access.citizen_clients.allowed_client_ids", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessCitizenClientsConfig/properties/allowed_client_ids/items", + "key_path": "subject_access.citizen_clients.allowed_client_ids[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/allowed_claims", + "key_path": "subject_access.allowed_claims", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/allowed_claims/items", + "key_path": "subject_access.allowed_claims[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/allowed_disclosures", + "key_path": "subject_access.allowed_disclosures", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/allowed_disclosures/items", + "key_path": "subject_access.allowed_disclosures[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/allowed_formats", + "key_path": "subject_access.allowed_formats", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/allowed_formats/items", + "key_path": "subject_access.allowed_formats[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/allowed_operations", + "key_path": "subject_access.allowed_operations", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/SubjectAccessOperationsConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessOperationsConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/allowed_purposes", + "key_path": "subject_access.allowed_purposes", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/allowed_purposes/items", + "key_path": "subject_access.allowed_purposes[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/allowed_wallet_origins", + "key_path": "subject_access.allowed_wallet_origins", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/allowed_wallet_origins/items", + "key_path": "subject_access.allowed_wallet_origins[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/citizen_clients", + "key_path": "subject_access.citizen_clients", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/SubjectAccessCitizenClientsConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessCitizenClientsConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/credential_profiles", + "key_path": "subject_access.credential_profiles", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/credential_profiles/items", + "key_path": "subject_access.credential_profiles[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/delegation", + "key_path": "subject_access.delegation", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/SubjectAccessDelegationConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessDelegationConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/enabled", + "key_path": "subject_access.enabled", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/rate_limits", + "key_path": "subject_access.rate_limits", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/SubjectAccessRateLimitsConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessRateLimitsConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/required_scopes", + "key_path": "subject_access.required_scopes", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/required_scopes/items", + "key_path": "subject_access.required_scopes[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/scope_policy", + "key_path": "subject_access.scope_policy", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/SubjectAccessScopePolicy", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "required", + "optional", + "disabled" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessScopePolicy" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/subject_binding", + "key_path": "subject_access.subject_binding", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/SubjectAccessSubjectBindingConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessSubjectBindingConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/token_policy", + "key_path": "subject_access.token_policy", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/SubjectAccessTokenPolicyConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessTokenPolicyConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/allowed_claims", + "key_path": "subject_access.delegation.allowed_relationships[].allowed_claims", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/allowed_claims/items", + "key_path": "subject_access.delegation.allowed_relationships[].allowed_claims[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/allowed_disclosures", + "key_path": "subject_access.delegation.allowed_relationships[].allowed_disclosures", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/allowed_disclosures/items", + "key_path": "subject_access.delegation.allowed_relationships[].allowed_disclosures[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/allowed_formats", + "key_path": "subject_access.delegation.allowed_relationships[].allowed_formats", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/allowed_formats/items", + "key_path": "subject_access.delegation.allowed_relationships[].allowed_formats[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/allowed_purposes", + "key_path": "subject_access.delegation.allowed_relationships[].allowed_purposes", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/allowed_purposes/items", + "key_path": "subject_access.delegation.allowed_relationships[].allowed_purposes[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/credential_profiles", + "key_path": "subject_access.delegation.allowed_relationships[].credential_profiles", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/credential_profiles/items", + "key_path": "subject_access.delegation.allowed_relationships[].credential_profiles[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/proof_claim", + "key_path": "subject_access.delegation.allowed_relationships[].proof_claim", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/relationship_type", + "key_path": "subject_access.delegation.allowed_relationships[].relationship_type", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/target_id_type", + "key_path": "subject_access.delegation.allowed_relationships[].target_id_type", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessDelegationConfig/properties/allowed_relationships", + "key_path": "subject_access.delegation.allowed_relationships", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessDelegationConfig/properties/allowed_relationships/items", + "key_path": "subject_access.delegation.allowed_relationships[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/SubjectAccessDelegatedRelationshipConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "relationship_type", + "proof_claim" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessDelegationConfig/properties/enabled", + "key_path": "subject_access.delegation.enabled", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessOperationsConfig/properties/batch_evaluate", + "key_path": "subject_access.allowed_operations.batch_evaluate", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessOperationsConfig/properties/evaluate", + "key_path": "subject_access.allowed_operations.evaluate", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessOperationsConfig/properties/issue_credential", + "key_path": "subject_access.allowed_operations.issue_credential", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessOperationsConfig/properties/render", + "key_path": "subject_access.allowed_operations.render", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessRateLimitsConfig/properties/credential_issuance_per_principal_per_hour", + "key_path": "subject_access.rate_limits.credential_issuance_per_principal_per_hour", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessRateLimitsConfig/properties/invalid_token_per_client_address_per_minute", + "key_path": "subject_access.rate_limits.invalid_token_per_client_address_per_minute", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessRateLimitsConfig/properties/per_holder_per_hour", + "key_path": "subject_access.rate_limits.per_holder_per_hour", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessRateLimitsConfig/properties/per_principal_per_minute", + "key_path": "subject_access.rate_limits.per_principal_per_minute", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessRateLimitsConfig/properties/subject_mismatch_per_principal_per_hour", + "key_path": "subject_access.rate_limits.subject_mismatch_per_principal_per_hour", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessRateLimitsConfig/properties/tx_code_attempts_per_code_per_minute", + "key_path": "subject_access.rate_limits.tx_code_attempts_per_code_per_minute", + "path_kind": "property" + }, + "purpose": "Per-minute cap on `tx_code` attempts against a single\n`pre-authorized_code`. Bounds brute force of the numeric PIN at the\npre-authorized-code token endpoint. Defaults to zero so existing\nconfigs that do not enable pre-auth still validate; it must be greater\nthan zero only when the pre-authorized-code flow is enabled.", + "purpose_source": "schema_description", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessSubjectBindingConfig/properties/allow_sub_as_civil_id", + "key_path": "subject_access.subject_binding.allow_sub_as_civil_id", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessSubjectBindingConfig/properties/claim_source", + "key_path": "subject_access.subject_binding.claim_source", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/SubjectAccessClaimSource", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "access_token", + "userinfo" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessClaimSource" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessSubjectBindingConfig/properties/id_type", + "key_path": "subject_access.subject_binding.id_type", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessSubjectBindingConfig/properties/normalize", + "key_path": "subject_access.subject_binding.normalize", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/SubjectBindingNormalize", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "exact" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/SubjectBindingNormalize" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessSubjectBindingConfig/properties/request_field", + "key_path": "subject_access.subject_binding.request_field", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/SubjectId", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "SubjectId" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/SubjectId" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessSubjectBindingConfig/properties/token_claim", + "key_path": "subject_access.subject_binding.token_claim", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessTokenPolicyConfig/properties/assurance_claim_source", + "key_path": "subject_access.token_policy.assurance_claim_source", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/SubjectAccessAssuranceClaimSource", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "access_token", + "id_token" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessAssuranceClaimSource" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessTokenPolicyConfig/properties/max_access_token_lifetime_seconds", + "key_path": "subject_access.token_policy.max_access_token_lifetime_seconds", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessTokenPolicyConfig/properties/max_auth_age_seconds", + "key_path": "subject_access.token_policy.max_auth_age_seconds", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessTokenPolicyConfig/properties/max_clock_leeway_seconds", + "key_path": "subject_access.token_policy.max_clock_leeway_seconds", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessTokenPolicyConfig/properties/max_credential_validity_seconds", + "key_path": "subject_access.token_policy.max_credential_validity_seconds", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessTokenPolicyConfig/properties/max_evaluation_age_seconds", + "key_path": "subject_access.token_policy.max_evaluation_age_seconds", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessTokenPolicyConfig/properties/required_acr_values", + "key_path": "subject_access.token_policy.required_acr_values", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessTokenPolicyConfig/properties/required_acr_values/items", + "key_path": "subject_access.token_policy.required_acr_values[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/properties/audit", + "key_path": "audit", + "path_kind": "property" + }, + "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_audit_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/EvidenceAuditConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuditConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/properties/auth", + "key_path": "auth", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/EvidenceAuthConfig", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/properties/cel", + "key_path": "cel", + "path_kind": "property" + }, + "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_cel_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/RegistryNotaryCelConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryCelConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/properties/config_trust", + "key_path": "config_trust", + "path_kind": "property" + }, + "purpose": "Optional governed-configuration local trust state.\n\nSimple local deployments omit this block. Signed/governed apply requires it\nso anti-rollback state lives in an explicit durable location.", + "purpose_source": "schema_description", + "intent_profile": "notary_config_trust_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "trust_anchor_path", + "bundle_path", + "antirollback_state_path" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/properties/credential_status", + "key_path": "credential_status", + "path_kind": "property" + }, + "purpose": "Controls Notary credential-status publication and retention behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_credential_status_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/CredentialStatusConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/CredentialStatusConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/properties/deployment", + "key_path": "deployment", + "path_kind": "property" + }, + "purpose": "The operator-declared `deployment` config block.\n\nAn absent profile means an undeclared deployment, which refuses startup. The\n`multi_instance` flag is an operator declaration that the instance is one of\nseveral sharing the same workload; it is never inferred.", + "purpose_source": "schema_description", + "intent_profile": "notary_deployment_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/DeploymentConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/DeploymentConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/properties/evidence", + "key_path": "evidence", + "path_kind": "property" + }, + "purpose": "Registry Notary configuration. Disabled by default so existing\nRegistry Relay deployments load unchanged.", + "purpose_source": "schema_description", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/EvidenceConfig", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/properties/federation", + "key_path": "federation", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/FederationConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/FederationConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/properties/instance", + "key_path": "instance", + "path_kind": "property" + }, + "purpose": "Identifies the Notary instance and its deployment environment for operational correlation.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_instance_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/NotaryInstanceConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/NotaryInstanceConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/properties/oid4vci", + "key_path": "oid4vci", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/Oid4vciConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/properties/server", + "key_path": "server", + "path_kind": "property" + }, + "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_server_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/RegistryNotaryHttpConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryHttpConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/properties/state", + "key_path": "state", + "path_kind": "property" + }, + "purpose": "Controls Notary durable state storage, database trust, timeouts, connection limits, and sensitive-state protection.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_state_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/StateConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/StateConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/properties/subject_access", + "key_path": "subject_access", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/SubjectAccessConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig" + } + } + ] +} diff --git a/docs/site/public/generated/diagnostics/authoring.v1.json b/docs/site/public/generated/diagnostics/authoring.v1.json new file mode 100644 index 000000000..bc216f055 --- /dev/null +++ b/docs/site/public/generated/diagnostics/authoring.v1.json @@ -0,0 +1,311 @@ +{ + "schema_version": "registryctl.authoring_error_reference.v1", + "entries": [ + { + "family": "authoring_validation", + "code": "registryctl.authoring.diagnostics.truncated", + "owner": "registryctl", + "product": "registryctl", + "phase": "aggregation", + "safe_meaning": "At most 64 diagnostics are returned in deterministic order.", + "rule": "diagnostic_limit", + "safe_remediation": "Fix the reported diagnostics and run the check again.", + "field_address_pattern": null, + "evidence_scope": "offline authored project files selected for registryctl check", + "secret_sensitive_value_policy": "no_received_value", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.diagnostics.truncated", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "family": "authoring_validation", + "code": "registryctl.authoring.entity.invalid", + "owner": "registryctl", + "product": "registryctl", + "phase": "semantic_validation", + "safe_meaning": "A declared entity id and shape must match the project contract.", + "rule": "entity_contract", + "safe_remediation": "Correct the entity declaration with the entity schema and its project alias.", + "field_address_pattern": "#", + "evidence_scope": "offline authored project files selected for registryctl check", + "secret_sensitive_value_policy": "no_received_value", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.entity.invalid", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "family": "authoring_validation", + "code": "registryctl.authoring.environment.invalid", + "owner": "registryctl", + "product": "registryctl", + "phase": "semantic_validation", + "safe_meaning": "Environment bindings must match declared products, integrations, identities, origins, and bounded generations.", + "rule": "environment_binding", + "safe_remediation": "Align the selected environment with the declared project contract.", + "field_address_pattern": "environments/.yaml#", + "evidence_scope": "offline authored project files selected for registryctl check", + "secret_sensitive_value_policy": "no_received_value", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.environment.invalid", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "family": "authoring_validation", + "code": "registryctl.authoring.file.too_large", + "owner": "registryctl", + "product": "registryctl", + "phase": "safe_input", + "safe_meaning": "Authored files must remain below their documented fixed byte bound.", + "rule": "authored_file_size", + "safe_remediation": "Reduce the file below its documented maximum size.", + "field_address_pattern": "#", + "evidence_scope": "offline authored project files selected for registryctl check", + "secret_sensitive_value_policy": "no_received_value", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.file.too_large", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "family": "authoring_validation", + "code": "registryctl.authoring.file.unreadable", + "owner": "registryctl", + "product": "registryctl", + "phase": "safe_input", + "safe_meaning": "A regular file inside the project root must be readable.", + "rule": "authored_file_readability", + "safe_remediation": "Restore a readable regular project-relative file.", + "field_address_pattern": "#", + "evidence_scope": "offline authored project files selected for registryctl check", + "secret_sensitive_value_policy": "no_received_value", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.file.unreadable", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "family": "authoring_validation", + "code": "registryctl.authoring.fixture.invalid", + "owner": "registryctl", + "product": "registryctl", + "phase": "semantic_validation", + "safe_meaning": "Fixtures must be deterministic, bounded, and satisfy the integration contract without live values.", + "rule": "fixture_contract", + "safe_remediation": "Correct the fixture declaration and its closed interaction contract.", + "field_address_pattern": "integrations//fixtures/.yaml#", + "evidence_scope": "offline authored project files selected for registryctl check", + "secret_sensitive_value_policy": "no_received_value", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.fixture.invalid", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "family": "authoring_validation", + "code": "registryctl.authoring.fixture.reserved_body_field", + "owner": "registryctl", + "product": "registryctl", + "phase": "syntax", + "safe_meaning": "A fixture body object may use `file` only as the closed body-file reference shape.", + "rule": "fixture_body_file_reference", + "safe_remediation": "Use the documented body-file reference shape or an inline JSON body.", + "field_address_pattern": "integrations//fixtures/.yaml#", + "evidence_scope": "offline authored project files selected for registryctl check", + "secret_sensitive_value_policy": "received_type_only", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.fixture.reserved_body_field", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "family": "authoring_validation", + "code": "registryctl.authoring.integration.invalid", + "owner": "registryctl", + "product": "registryctl", + "phase": "semantic_validation", + "safe_meaning": "An integration alias, capability, and declared contract must be internally consistent.", + "rule": "integration_contract", + "safe_remediation": "Correct the integration declaration with the integration schema.", + "field_address_pattern": "integrations//integration.yaml#", + "evidence_scope": "offline authored project files selected for registryctl check", + "secret_sensitive_value_policy": "no_received_value", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.integration.invalid", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "family": "authoring_validation", + "code": "registryctl.authoring.path.unsafe", + "owner": "registryctl", + "product": "registryctl", + "phase": "safe_input", + "safe_meaning": "Paths must be normalized project-relative paths to regular non-symlink entries.", + "rule": "project_relative_path", + "safe_remediation": "Use a normalized project-relative regular file path.", + "field_address_pattern": "#", + "evidence_scope": "offline authored project files selected for registryctl check", + "secret_sensitive_value_policy": "no_received_value", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.path.unsafe", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "family": "authoring_validation", + "code": "registryctl.authoring.project.invalid", + "owner": "registryctl", + "product": "registryctl", + "phase": "semantic_validation", + "safe_meaning": "Project services, entities, integrations, and references must form a closed valid graph.", + "rule": "project_contract", + "safe_remediation": "Align the project declaration and referenced contracts.", + "field_address_pattern": "registry-stack.yaml#", + "evidence_scope": "offline authored project files selected for registryctl check", + "secret_sensitive_value_policy": "no_received_value", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.project.invalid", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "family": "authoring_validation", + "code": "registryctl.authoring.project.scope_collision", + "owner": "registryctl", + "product": "registryctl", + "phase": "semantic_validation", + "safe_meaning": "Effective authorization scopes must be distinct across records API and attribute-release access.", + "rule": "authorization_scope_uniqueness", + "safe_remediation": "Assign distinct scopes to each authorization purpose.", + "field_address_pattern": "registry-stack.yaml#", + "evidence_scope": "offline authored project files selected for registryctl check", + "secret_sensitive_value_policy": "no_received_value", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.project.scope_collision", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "family": "authoring_validation", + "code": "registryctl.authoring.script.closed_contract_violation", + "owner": "registryctl", + "product": "registryctl", + "phase": "script_validation", + "safe_meaning": "Scripts must use the released bounded Script contract and module rules.", + "rule": "released_script_contract", + "safe_remediation": "Use only the released bounded Script contract.", + "field_address_pattern": "#", + "evidence_scope": "offline authored project files selected for registryctl check", + "secret_sensitive_value_policy": "no_received_value", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.script.closed_contract_violation", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "family": "authoring_validation", + "code": "registryctl.authoring.script.invalid_signature", + "owner": "registryctl", + "product": "registryctl", + "phase": "script_validation", + "safe_meaning": "The Script entrypoint must be exactly `consult(context)`.", + "rule": "script_entrypoint_signature", + "safe_remediation": "Define the exact released entrypoint signature.", + "field_address_pattern": "#", + "evidence_scope": "offline authored project files selected for registryctl check", + "secret_sensitive_value_policy": "no_received_value", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.script.invalid_signature", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "family": "authoring_validation", + "code": "registryctl.authoring.script.syntax_error", + "owner": "registryctl", + "product": "registryctl", + "phase": "script_validation", + "safe_meaning": "The Script source must parse under the released runtime.", + "rule": "script_syntax", + "safe_remediation": "Correct the Script syntax at the reported location.", + "field_address_pattern": "#", + "evidence_scope": "offline authored project files selected for registryctl check", + "secret_sensitive_value_policy": "no_received_value", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.script.syntax_error", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "family": "authoring_validation", + "code": "registryctl.authoring.script.unknown_function", + "owner": "registryctl", + "product": "registryctl", + "phase": "script_validation", + "safe_meaning": "The Script must define the released `consult(context)` entrypoint.", + "rule": "script_entrypoint", + "safe_remediation": "Define consult(context) as the Script entrypoint.", + "field_address_pattern": "#", + "evidence_scope": "offline authored project files selected for registryctl check", + "secret_sensitive_value_policy": "no_received_value", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.script.unknown_function", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "family": "authoring_validation", + "code": "registryctl.authoring.yaml.invalid_syntax", + "owner": "registryctl", + "product": "registryctl", + "phase": "syntax", + "safe_meaning": "YAML must parse as the selected closed authoring document shape.", + "rule": "closed_yaml_document", + "safe_remediation": "Correct the YAML with the matching authoring schema.", + "field_address_pattern": "#", + "evidence_scope": "offline authored project files selected for registryctl check", + "secret_sensitive_value_policy": "received_type_only", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.yaml.invalid_syntax", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "family": "authoring_validation", + "code": "registryctl.authoring.yaml.unknown_field", + "owner": "registryctl", + "product": "registryctl", + "phase": "syntax", + "safe_meaning": "Only documented fields in the closed authoring schema are accepted.", + "rule": "closed_yaml_unknown_field", + "safe_remediation": "Remove the unsupported field or replace it with its documented field.", + "field_address_pattern": "#", + "evidence_scope": "offline authored project files selected for registryctl check", + "secret_sensitive_value_policy": "received_type_only", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.yaml.unknown_field", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + } + ] +} diff --git a/docs/site/public/generated/diagnostics/fixture.v1.json b/docs/site/public/generated/diagnostics/fixture.v1.json new file mode 100644 index 000000000..8b1349174 --- /dev/null +++ b/docs/site/public/generated/diagnostics/fixture.v1.json @@ -0,0 +1,293 @@ +{ + "schema_version": "registryctl.fixture_error_reference.v1", + "entries": [ + { + "family": "fixture_execution", + "code": "authorization.denied", + "owner": "registryctl", + "product": "registryctl_relay_offline_harness", + "phase": "offline_execution", + "safe_meaning": "Authorization denied fixture execution before source access.", + "rule": "authorization_before_source", + "safe_remediation": "Align the fixture identity and authorization expectation with the compiled policy.", + "field_address_pattern": null, + "evidence_scope": "offline synthetic fixture execution", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--authorization.denied", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "family": "fixture_execution", + "code": "failure.subject_mismatch", + "owner": "registryctl", + "product": "registryctl_relay_offline_harness", + "phase": "offline_execution", + "safe_meaning": "The source observation did not preserve the requested subject binding.", + "rule": "subject_binding", + "safe_remediation": "Correct the synthetic subject evidence or the reviewed subject comparison.", + "field_address_pattern": null, + "evidence_scope": "offline synthetic fixture execution", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--failure.subject_mismatch", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "family": "fixture_execution", + "code": "fixture.execution_contract_invalid", + "owner": "registryctl", + "product": "registryctl_relay_offline_harness", + "phase": "offline_execution", + "safe_meaning": "Fixture execution violated the compiled offline plan contract.", + "rule": "compiled_execution_contract", + "safe_remediation": "Align the fixture with the exact compiled integration plan.", + "field_address_pattern": null, + "evidence_scope": "offline synthetic fixture execution", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--fixture.execution_contract_invalid", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "family": "fixture_execution", + "code": "fixture.profile_not_found", + "owner": "registryctl", + "product": "registryctl_relay_offline_harness", + "phase": "offline_execution", + "safe_meaning": "The fixture profile pin did not select one exact compiled plan.", + "rule": "profile_pin", + "safe_remediation": "Select one compiled integration profile.", + "field_address_pattern": null, + "evidence_scope": "offline synthetic fixture execution", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--fixture.profile_not_found", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "family": "fixture_execution", + "code": "fixture.request_mismatch", + "owner": "registryctl", + "product": "registryctl_relay_offline_harness", + "phase": "offline_execution", + "safe_meaning": "The rendered request or call order did not match the fixture expectation.", + "rule": "request_authority_and_order", + "safe_remediation": "Align the fixture request expectation with the compiled plan.", + "field_address_pattern": null, + "evidence_scope": "offline synthetic fixture execution", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--fixture.request_mismatch", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "family": "fixture_execution", + "code": "fixture.source_operation_unknown", + "owner": "registryctl", + "product": "registryctl_relay_offline_harness", + "phase": "offline_execution", + "safe_meaning": "The fixture named a source operation outside the compiled plan.", + "rule": "source_operation_closure", + "safe_remediation": "Use only source operations declared by the compiled plan.", + "field_address_pattern": null, + "evidence_scope": "offline synthetic fixture execution", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--fixture.source_operation_unknown", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "family": "fixture_execution", + "code": "input.pattern_mismatch", + "owner": "registryctl", + "product": "registryctl_relay_offline_harness", + "phase": "offline_execution", + "safe_meaning": "A synthetic fixture input did not satisfy its compiled contract.", + "rule": "compiled_input_contract", + "safe_remediation": "Correct the synthetic input shape.", + "field_address_pattern": null, + "evidence_scope": "offline synthetic fixture execution", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--input.pattern_mismatch", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "family": "fixture_execution", + "code": "redacted_unclassified_error", + "owner": "registryctl", + "product": "registryctl_relay_offline_harness", + "phase": "offline_execution", + "safe_meaning": "An error outside the reviewed safe allow-list was redacted.", + "rule": "safe_error_allow_list", + "safe_remediation": "Use classified fixture evidence or inspect private local logs without publishing values.", + "field_address_pattern": null, + "evidence_scope": "offline synthetic fixture execution", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--redacted_unclassified_error", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "family": "fixture_execution", + "code": "source.call_budget_exceeded", + "owner": "registryctl", + "product": "registryctl_relay_offline_harness", + "phase": "offline_execution", + "safe_meaning": "Fixture execution exceeded the compiled source-call budget.", + "rule": "source_call_budget", + "safe_remediation": "Reduce source calls or revise the reviewed bounded plan.", + "field_address_pattern": null, + "evidence_scope": "offline synthetic fixture execution", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--source.call_budget_exceeded", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "family": "fixture_execution", + "code": "source.cardinality_violation", + "owner": "registryctl", + "product": "registryctl_relay_offline_harness", + "phase": "offline_execution", + "safe_meaning": "The synthetic source response violated the compiled cardinality contract.", + "rule": "source_cardinality", + "safe_remediation": "Correct the synthetic response cardinality.", + "field_address_pattern": null, + "evidence_scope": "offline synthetic fixture execution", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--source.cardinality_violation", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "family": "fixture_execution", + "code": "source.deadline_exceeded", + "owner": "registryctl", + "product": "registryctl_relay_offline_harness", + "phase": "offline_execution", + "safe_meaning": "The synthetic source interaction exceeded its deadline.", + "rule": "source_deadline", + "safe_remediation": "Align the timeout fixture with the compiled deadline behavior.", + "field_address_pattern": null, + "evidence_scope": "offline synthetic fixture execution", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--source.deadline_exceeded", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "family": "fixture_execution", + "code": "source.response_malformed", + "owner": "registryctl", + "product": "registryctl_relay_offline_harness", + "phase": "offline_execution", + "safe_meaning": "The synthetic source response violated its closed response contract.", + "rule": "source_response_contract", + "safe_remediation": "Correct the synthetic response shape.", + "field_address_pattern": null, + "evidence_scope": "offline synthetic fixture execution", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--source.response_malformed", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "family": "fixture_execution", + "code": "source.response_too_large", + "owner": "registryctl", + "product": "registryctl_relay_offline_harness", + "phase": "offline_execution", + "safe_meaning": "The synthetic source response exceeded its compiled byte bound.", + "rule": "source_response_byte_bound", + "safe_remediation": "Reduce the synthetic response below the compiled bound.", + "field_address_pattern": null, + "evidence_scope": "offline synthetic fixture execution", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--source.response_too_large", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "family": "fixture_execution", + "code": "source.status_rejected", + "owner": "registryctl", + "product": "registryctl_relay_offline_harness", + "phase": "offline_execution", + "safe_meaning": "The synthetic source returned a status outside the accepted mapping.", + "rule": "source_status_mapping", + "safe_remediation": "Use a reviewed status mapping or correct the fixture status.", + "field_address_pattern": null, + "evidence_scope": "offline synthetic fixture execution", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--source.status_rejected", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "family": "fixture_execution", + "code": "source.unavailable", + "owner": "registryctl", + "product": "registryctl_relay_offline_harness", + "phase": "offline_execution", + "safe_meaning": "The synthetic source was unavailable.", + "rule": "source_availability", + "safe_remediation": "Correct the offline source observation for the intended availability case.", + "field_address_pattern": null, + "evidence_scope": "offline synthetic fixture execution", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--source.unavailable", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "family": "fixture_execution", + "code": "source_unavailable", + "owner": "registryctl", + "product": "registryctl_relay_offline_harness", + "phase": "offline_execution", + "safe_meaning": "The synthetic source was unavailable under the retained legacy code.", + "rule": "legacy_source_availability", + "safe_remediation": "Prefer source.unavailable for new fixtures while retaining compatible evidence.", + "field_address_pattern": null, + "evidence_scope": "offline synthetic fixture execution", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--source_unavailable", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + } + ] +} diff --git a/docs/site/public/generated/diagnostics/operator.v1.json b/docs/site/public/generated/diagnostics/operator.v1.json new file mode 100644 index 000000000..2dfd91627 --- /dev/null +++ b/docs/site/public/generated/diagnostics/operator.v1.json @@ -0,0 +1,1068 @@ +{ + "schema_version": "registryctl.operator_error_reference.v1", + "entries": [ + { + "family": "bundle_verification", + "code": "rejected_binding", + "owner": "registry_platform_ops", + "product": "registry_platform_ops", + "phase": "bundle_verification", + "safe_meaning": "The bundle binding does not match the intended runtime target.", + "rule": "registry.platform.bundle_verification.binding_matches_target", + "safe_remediation": "Use a bundle issued for the intended runtime binding.", + "field_address_pattern": null, + "evidence_scope": "signed bundle and configured runtime binding", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_platform_ops--rejected-binding", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose received or configured binding values." + }, + { + "family": "bundle_verification", + "code": "rejected_rollback", + "owner": "registry_platform_ops", + "product": "registry_platform_ops", + "phase": "bundle_activation", + "safe_meaning": "The bundle or override does not satisfy local anti-rollback requirements.", + "rule": "registry.platform.bundle_verification.rollback_constraints_satisfied", + "safe_remediation": "Use a monotonic bundle or an authorized break-glass selection.", + "field_address_pattern": null, + "evidence_scope": "local anti-rollback state and bundle or override metadata", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_platform_ops--rejected-rollback", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose stored sequences, content digests, paths, or approval values." + }, + { + "family": "bundle_verification", + "code": "rejected_signature", + "owner": "registry_platform_ops", + "product": "registry_platform_ops", + "phase": "bundle_verification", + "safe_meaning": "Bundle authenticity or declared content integrity verification failed.", + "rule": "registry.platform.bundle_verification.signature_and_integrity_accepted", + "safe_remediation": "Rebuild and sign the complete bundle with an accepted trust configuration.", + "field_address_pattern": null, + "evidence_scope": "bundle trust metadata, signature envelope, file closure, and content digests", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_platform_ops--rejected-signature", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose signer identifiers, file names, or content digests." + }, + { + "family": "bundle_verification", + "code": "rejected_validation", + "owner": "registry_platform_ops", + "product": "registry_platform_ops", + "phase": "bundle_verification", + "safe_meaning": "The bundle or acceptance metadata is missing, unreadable, malformed, or unsupported.", + "rule": "registry.platform.bundle_verification.input_is_valid", + "safe_remediation": "Regenerate the bundle and acceptance metadata using supported formats.", + "field_address_pattern": null, + "evidence_scope": "bundle encoding, manifest, acceptance metadata, and required local inputs", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_platform_ops--rejected-validation", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose parser messages, local paths, or supplied values." + }, + { + "family": "notary_activation", + "code": "notary.configuration.invalid", + "owner": "registry_notary", + "product": "registry_notary", + "phase": "configuration_activation", + "safe_meaning": "Registry Notary runtime configuration is invalid", + "rule": "Runtime activation requires valid product configuration, supported features, and resolvable secret and provider bindings", + "safe_remediation": "run registry-notary doctor, correct the reviewed configuration or binding, and retry activation", + "field_address_pattern": null, + "evidence_scope": "Notary configuration, provider bindings, and compiled feature support", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--configuration-invalid", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + }, + { + "family": "notary_activation", + "code": "notary.deployment.gate_failed", + "owner": "registry_notary", + "product": "registry_notary", + "phase": "deployment_activation", + "safe_meaning": "Registry Notary deployment gates refused startup", + "rule": "Every startup-failing deployment gate must pass before activation", + "safe_remediation": "run registry-notary doctor for the selected deployment profile and resolve its startup-failing findings", + "field_address_pattern": null, + "evidence_scope": "selected deployment profile and startup-failing gate results", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--deployment-gate-failed", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + }, + { + "family": "notary_activation", + "code": "notary.relay.activation_failed", + "owner": "registry_notary", + "product": "registry_notary", + "phase": "relay_activation", + "safe_meaning": "Relay consultation activation failed", + "rule": "Registry-backed claims require the reviewed Relay consultation client to activate before Notary serves", + "safe_remediation": "check the Notary configuration and startup environment", + "field_address_pattern": null, + "evidence_scope": "Notary Relay consultation client activation lifecycle", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--relay-activation-failed", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + }, + { + "family": "notary_activation", + "code": "notary.relay.configuration_invalid", + "owner": "registry_notary", + "product": "registry_notary", + "phase": "relay_activation", + "safe_meaning": "Relay consultation configuration is invalid", + "rule": "The Relay destination, activation plan, and activation lifecycle must form one valid reviewed configuration", + "safe_remediation": "check the evidence.relay connection and Registry-backed consultation configuration", + "field_address_pattern": null, + "evidence_scope": "Relay destination, activation plan, and consultation configuration", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--relay-configuration-invalid", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + }, + { + "family": "notary_activation", + "code": "notary.relay.credential_unavailable", + "owner": "registry_notary", + "product": "registry_notary", + "phase": "relay_activation", + "safe_meaning": "Relay workload credential is unavailable", + "rule": "A current non-empty workload credential must be available before a live Relay consultation", + "safe_remediation": "mount a current readable workload JWT at evidence.relay.token_file", + "field_address_pattern": null, + "evidence_scope": "configured Relay workload credential availability", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--relay-credential-unavailable", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + }, + { + "family": "notary_activation", + "code": "notary.relay.credentials_rejected", + "owner": "registry_notary", + "product": "registry_notary", + "phase": "relay_activation", + "safe_meaning": "Relay rejected the configured workload credential", + "rule": "Relay must accept the configured Notary workload binding, scope, and validity window", + "safe_remediation": "rotate the workload JWT and verify that Relay recognizes its workload binding, required scope, and validity window", + "field_address_pattern": null, + "evidence_scope": "Relay workload binding, scope, and validity acceptance", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--relay-credentials-rejected", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + }, + { + "family": "notary_activation", + "code": "notary.relay.profile_mismatch", + "owner": "registry_notary", + "product": "registry_notary", + "phase": "relay_activation", + "safe_meaning": "Relay consultation profile does not match the configured contract pin", + "rule": "The active Relay profile must match the reviewed Notary consultation contract pin", + "safe_remediation": "reconcile the Notary profile id and contract hash with the reviewed Relay consultation contract", + "field_address_pattern": null, + "evidence_scope": "reviewed Notary profile pin and active Relay consultation contract", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--relay-profile-mismatch", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + }, + { + "family": "notary_activation", + "code": "notary.relay.profile_not_found", + "owner": "registry_notary", + "product": "registry_notary", + "phase": "relay_activation", + "safe_meaning": "Relay consultation profile was not found", + "rule": "Every Registry-backed Notary consultation must resolve to an active Relay profile", + "safe_remediation": "deploy the configured Relay profile id, then retry the live check", + "field_address_pattern": null, + "evidence_scope": "configured consultation profile resolution in Relay", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--relay-profile-not-found", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + }, + { + "family": "notary_activation", + "code": "notary.relay.unavailable", + "owner": "registry_notary", + "product": "registry_notary", + "phase": "relay_activation", + "safe_meaning": "Relay consultation service is unavailable", + "rule": "The reviewed Relay destination must be reachable through the configured transport policy", + "safe_remediation": "check Relay reachability, TLS, destination policy, and service health", + "field_address_pattern": null, + "evidence_scope": "reviewed Relay destination, transport policy, and service availability", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--relay-unavailable", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + }, + { + "family": "notary_activation", + "code": "notary.runtime.activation_failed", + "owner": "registry_notary", + "product": "registry_notary", + "phase": "runtime_activation", + "safe_meaning": "Registry Notary runtime activation failed", + "rule": "Audit, state, sensitive-state, and other runtime dependencies must activate successfully before listeners serve", + "safe_remediation": "restore the governed runtime dependency or integrity condition, then retry activation", + "field_address_pattern": null, + "evidence_scope": "governed audit, state, sensitive-state, and runtime dependencies", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--runtime-activation-failed", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + }, + { + "family": "notary_activation", + "code": "notary.runtime.activation_required", + "owner": "registry_notary", + "product": "registry_notary", + "phase": "runtime_activation", + "safe_meaning": "Registry Notary runtime activation is required before serving", + "rule": "Routers may be built only after the governed audit and state activation lifecycle completes", + "safe_remediation": "run the compiled Registry Notary runtime activation step before building or serving routers", + "field_address_pattern": null, + "evidence_scope": "router assembly and governed audit and state activation lifecycle", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--runtime-activation-required", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + }, + { + "family": "notary_activation", + "code": "notary.state.postgresql.database_read_only", + "owner": "registry_notary", + "product": "registry_notary", + "phase": "runtime_activation", + "safe_meaning": "Registry Notary PostgreSQL state database is read-only or recovering", + "rule": "Serving requires a writable PostgreSQL primary for correctness-state transactions", + "safe_remediation": "restore a writable PostgreSQL primary, run registry-notary state doctor, and retry activation", + "field_address_pattern": null, + "evidence_scope": "PostgreSQL writeability and recovery posture", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--postgresql-database-read-only", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + }, + { + "family": "notary_activation", + "code": "notary.state.postgresql.database_unavailable", + "owner": "registry_notary", + "product": "registry_notary", + "phase": "runtime_activation", + "safe_meaning": "Registry Notary PostgreSQL state database is unavailable", + "rule": "Serving requires a reachable PostgreSQL service with an accepted TLS trust chain", + "safe_remediation": "check PostgreSQL reachability, TLS trust, and service health, then run registry-notary state doctor", + "field_address_pattern": null, + "evidence_scope": "PostgreSQL transport, TLS trust, and service availability", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--postgresql-database-unavailable", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + }, + { + "family": "notary_activation", + "code": "notary.state.postgresql.database_unsupported", + "owner": "registry_notary", + "product": "registry_notary", + "phase": "runtime_activation", + "safe_meaning": "Registry Notary PostgreSQL server major is unsupported", + "rule": "Serving requires a PostgreSQL major covered by the Registry Notary compatibility contract", + "safe_remediation": "move the state database to a supported PostgreSQL major, run registry-notary state doctor, and retry activation", + "field_address_pattern": null, + "evidence_scope": "PostgreSQL server-major compatibility", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--postgresql-database-unsupported", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + }, + { + "family": "notary_activation", + "code": "notary.state.postgresql.durability_unsafe", + "owner": "registry_notary", + "product": "registry_notary", + "phase": "runtime_activation", + "safe_meaning": "Registry Notary PostgreSQL durability settings are unsafe", + "rule": "Serving requires the documented PostgreSQL durability settings for correctness state", + "safe_remediation": "restore the required PostgreSQL durability settings, run registry-notary state doctor, and retry activation", + "field_address_pattern": null, + "evidence_scope": "PostgreSQL durability posture", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--postgresql-durability-unsafe", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + }, + { + "family": "notary_activation", + "code": "notary.state.postgresql.role_incompatible", + "owner": "registry_notary", + "product": "registry_notary", + "phase": "runtime_activation", + "safe_meaning": "Registry Notary PostgreSQL runtime role contract is incompatible", + "rule": "Serving requires the documented restricted runtime role and its attested schema binding", + "safe_remediation": "restore the documented runtime grants and role binding, run registry-notary state doctor, and retry activation", + "field_address_pattern": null, + "evidence_scope": "PostgreSQL runtime-role attributes, grants, and schema binding", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--postgresql-role-incompatible", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + }, + { + "family": "notary_activation", + "code": "notary.state.postgresql.schema_incompatible", + "owner": "registry_notary", + "product": "registry_notary", + "phase": "runtime_activation", + "safe_meaning": "Registry Notary PostgreSQL state schema contract is incompatible", + "rule": "Serving requires the exact product-owned schema, catalog, fingerprint, and privilege contract", + "safe_remediation": "restore or install the matching Registry Notary state schema, run registry-notary state doctor, and retry activation", + "field_address_pattern": null, + "evidence_scope": "PostgreSQL state schema, catalog, fingerprint, and privilege contract", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--postgresql-schema-incompatible", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + }, + { + "family": "operator_preflight", + "code": "registryctl.preflight.product_validator_not_checked", + "owner": "registryctl", + "product": "registryctl", + "phase": "product_capability", + "safe_meaning": "A required linked product validator was not checked locally.", + "rule": "registryctl.preflight.product_validator_locally_available", + "safe_remediation": "Enable the linked product validator.", + "field_address_pattern": null, + "evidence_scope": "offline local operator preflight", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registryctl--registryctl.preflight.product_validator_not_checked", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Preflight does not contact live sources or prove remote availability." + }, + { + "family": "operator_preflight", + "code": "registryctl.preflight.report_capacity_exceeded", + "owner": "registryctl", + "product": "registryctl", + "phase": "report_boundary", + "safe_meaning": "The preflight report reached its deterministic safety cap.", + "rule": "registryctl.preflight.report_capacity", + "safe_remediation": "Reduce declared preflight inputs.", + "field_address_pattern": null, + "evidence_scope": "offline local operator preflight", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registryctl--registryctl.preflight.report_capacity_exceeded", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Preflight does not contact live sources or prove remote availability." + }, + { + "family": "operator_preflight", + "code": "registryctl.preflight.runtime_file_empty", + "owner": "registryctl", + "product": "registryctl", + "phase": "runtime_file_posture", + "safe_meaning": "A declared runtime file is empty.", + "rule": "registryctl.preflight.runtime_file_bounded_regular", + "safe_remediation": "Replace the runtime file.", + "field_address_pattern": "", + "evidence_scope": "offline local operator preflight", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registryctl--registryctl.preflight.runtime_file_empty", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Preflight does not contact live sources or prove remote availability." + }, + { + "family": "operator_preflight", + "code": "registryctl.preflight.runtime_file_missing", + "owner": "registryctl", + "product": "registryctl", + "phase": "runtime_file_posture", + "safe_meaning": "A declared runtime file is missing.", + "rule": "registryctl.preflight.runtime_file_bounded_regular", + "safe_remediation": "Replace the runtime file.", + "field_address_pattern": "", + "evidence_scope": "offline local operator preflight", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registryctl--registryctl.preflight.runtime_file_missing", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Preflight does not contact live sources or prove remote availability." + }, + { + "family": "operator_preflight", + "code": "registryctl.preflight.runtime_file_not_checked", + "owner": "registryctl", + "product": "registryctl", + "phase": "runtime_file_posture", + "safe_meaning": "Runtime file posture could not be checked with the required local invariant.", + "rule": "registryctl.preflight.runtime_file_posture_supported", + "safe_remediation": "Run preflight on a supported Unix platform.", + "field_address_pattern": "", + "evidence_scope": "offline local operator preflight", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registryctl--registryctl.preflight.runtime_file_not_checked", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Preflight does not contact live sources or prove remote availability." + }, + { + "family": "operator_preflight", + "code": "registryctl.preflight.runtime_file_not_regular", + "owner": "registryctl", + "product": "registryctl", + "phase": "runtime_file_posture", + "safe_meaning": "A declared runtime file is not an acceptable bounded regular file.", + "rule": "registryctl.preflight.runtime_file_bounded_regular", + "safe_remediation": "Replace the runtime file.", + "field_address_pattern": "", + "evidence_scope": "offline local operator preflight", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registryctl--registryctl.preflight.runtime_file_not_regular", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Preflight does not contact live sources or prove remote availability." + }, + { + "family": "operator_preflight", + "code": "registryctl.preflight.runtime_file_unsafe_mode", + "owner": "registryctl", + "product": "registryctl", + "phase": "runtime_file_posture", + "safe_meaning": "A declared runtime file has unsafe local access permissions.", + "rule": "registryctl.preflight.runtime_file_safe_mode", + "safe_remediation": "Tighten runtime file permissions.", + "field_address_pattern": "", + "evidence_scope": "offline local operator preflight", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registryctl--registryctl.preflight.runtime_file_unsafe_mode", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Preflight does not contact live sources or prove remote availability." + }, + { + "family": "operator_preflight", + "code": "registryctl.preflight.runtime_file_unsafe_owner", + "owner": "registryctl", + "product": "registryctl", + "phase": "runtime_file_posture", + "safe_meaning": "A declared runtime file has an unsafe owner.", + "rule": "registryctl.preflight.runtime_file_safe_owner", + "safe_remediation": "Set the runtime file owner.", + "field_address_pattern": "", + "evidence_scope": "offline local operator preflight", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registryctl--registryctl.preflight.runtime_file_unsafe_owner", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Preflight does not contact live sources or prove remote availability." + }, + { + "family": "operator_preflight", + "code": "registryctl.preflight.secret_empty", + "owner": "registryctl", + "product": "registryctl", + "phase": "secret_availability", + "safe_meaning": "A required secret reference contains only whitespace.", + "rule": "registryctl.preflight.secret_reference_available", + "safe_remediation": "Provide a non-empty secret to the process environment.", + "field_address_pattern": "", + "evidence_scope": "offline local operator preflight", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registryctl--registryctl.preflight.secret_empty", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Preflight does not contact live sources or prove remote availability." + }, + { + "family": "operator_preflight", + "code": "registryctl.preflight.secret_missing", + "owner": "registryctl", + "product": "registryctl", + "phase": "secret_availability", + "safe_meaning": "A required secret reference is unavailable to this process.", + "rule": "registryctl.preflight.secret_reference_available", + "safe_remediation": "Provide the secret to the process environment.", + "field_address_pattern": "", + "evidence_scope": "offline local operator preflight", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registryctl--registryctl.preflight.secret_missing", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Preflight does not contact live sources or prove remote availability." + }, + { + "family": "operator_preflight", + "code": "registryctl.preflight.static_validation_not_checked", + "owner": "registryctl", + "product": "registryctl", + "phase": "static_validation", + "safe_meaning": "Required authoritative static validation was not completed.", + "rule": "registryctl.preflight.authoritative_static_validation", + "safe_remediation": "Complete authoritative static validation.", + "field_address_pattern": "", + "evidence_scope": "offline local operator preflight", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registryctl--registryctl.preflight.static_validation_not_checked", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Preflight does not contact live sources or prove remote availability." + }, + { + "family": "relay_activation", + "code": "relay.consultation.activation.artifact_registry_invalid", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "consultation_activation", + "safe_meaning": "Relay could not compile the verified consultation artifact registry.", + "rule": "The verified artifact closure must compile into one closed registry without conflicting public profiles.", + "safe_remediation": "Rebuild and verify the exact consultation artifact closure before restarting Relay.", + "field_address_pattern": null, + "evidence_scope": "verified consultation artifact closure and compiled public profiles", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--artifact-registry-invalid", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose paths, URLs, parser excerpts, hashes, credentials, identifiers, or authored values." + }, + { + "family": "relay_activation", + "code": "relay.consultation.activation.configuration_missing", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "consultation_activation", + "safe_meaning": "Relay consultation activation requires configuration that is not present.", + "rule": "The closed consultation configuration must exist before Relay compiles serving authority.", + "safe_remediation": "Provide a validated Relay consultation configuration and restart Relay.", + "field_address_pattern": null, + "evidence_scope": "Relay consultation configuration and serving authority", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--configuration-missing", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose paths, URLs, parser excerpts, hashes, credentials, identifiers, or authored values." + }, + { + "family": "relay_activation", + "code": "relay.consultation.activation.protected_metadata_invalid", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "consultation_activation", + "safe_meaning": "Relay could not construct bounded protected consultation metadata.", + "rule": "Protected metadata must contain one strict bounded public contract and its reviewed binding.", + "safe_remediation": "Regenerate and verify the consultation artifact closure, then restart Relay.", + "field_address_pattern": null, + "evidence_scope": "protected consultation metadata, public contract, and reviewed binding", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--protected-metadata-invalid", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose paths, URLs, parser excerpts, hashes, credentials, identifiers, or authored values." + }, + { + "family": "relay_activation", + "code": "relay.consultation.activation.pseudonym_material_unavailable", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "consultation_activation", + "safe_meaning": "Relay could not activate the pseudonym material required for consultation audit evidence.", + "rule": "The configured pseudonym material must be valid and bind to the current write authority.", + "safe_remediation": "Restore the reviewed pseudonym material and write authority, then restart Relay.", + "field_address_pattern": null, + "evidence_scope": "consultation pseudonym material and current write authority", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--pseudonym-material-unavailable", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose paths, URLs, parser excerpts, hashes, credentials, identifiers, or authored values." + }, + { + "family": "relay_activation", + "code": "relay.consultation.activation.quota_limits_invalid", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "consultation_activation", + "safe_meaning": "Relay could not activate the bounded consultation quota contract.", + "rule": "Public and effective quota limits must remain representable, positive, and non-widening.", + "safe_remediation": "Correct the reviewed quota limits and rebuild the consultation artifacts.", + "field_address_pattern": null, + "evidence_scope": "public and effective consultation quota limits", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--quota-limits-invalid", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose paths, URLs, parser excerpts, hashes, credentials, identifiers, or authored values." + }, + { + "family": "relay_activation", + "code": "relay.consultation.activation.source_credentials_unavailable", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "consultation_activation", + "safe_meaning": "Relay could not activate the source-credential capability required by the consultation registry.", + "rule": "Every compiled source plan must have exactly the credential capability it declares.", + "safe_remediation": "Restore the reviewed source-credential references and restart Relay.", + "field_address_pattern": null, + "evidence_scope": "compiled consultation source plans and credential capabilities", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--source-credentials-unavailable", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose paths, URLs, parser excerpts, hashes, credentials, identifiers, or authored values." + }, + { + "family": "relay_activation", + "code": "relay.consultation.activation.state_plane_unavailable", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "consultation_activation", + "safe_meaning": "Relay could not activate the consultation state plane and its current authority.", + "rule": "The state plane, durable audit boundary, quota state, and current write authority must activate together.", + "safe_remediation": "Restore the reviewed Relay state-plane dependencies and restart Relay.", + "field_address_pattern": null, + "evidence_scope": "consultation state plane, audit boundary, quota state, and write authority", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--state-plane-unavailable", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose paths, URLs, parser excerpts, hashes, credentials, identifiers, or authored values." + }, + { + "family": "relay_activation", + "code": "relay.consultation.activation.unsupported_plan", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "consultation_activation", + "safe_meaning": "A compiled consultation plan requires a capability this Relay runtime cannot activate.", + "rule": "Every plan, worker, transport, snapshot binding, and dispatch budget must use a compiled supported capability.", + "safe_remediation": "Use a Relay release that supports the reviewed plan or rebuild the plan with supported capabilities.", + "field_address_pattern": null, + "evidence_scope": "compiled consultation plan and Relay runtime capabilities", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--unsupported-plan", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose paths, URLs, parser excerpts, hashes, credentials, identifiers, or authored values." + }, + { + "family": "relay_activation", + "code": "relay.consultation.activation.workload_binding_invalid", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "consultation_activation", + "safe_meaning": "The configured consultation workload binding is incompatible with Relay authentication.", + "rule": "Issuer, audience, client binding, principal, and selector must satisfy the closed Relay workload contract.", + "safe_remediation": "Align the reviewed consultation workload binding with Relay authentication and restart Relay.", + "field_address_pattern": null, + "evidence_scope": "consultation workload binding and Relay authentication contract", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--workload-binding-invalid", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose paths, URLs, parser excerpts, hashes, credentials, identifiers, or authored values." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.admin_listener_address_in_use", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "listener_binding", + "safe_meaning": "Relay could not open the administration listener because its binding is already in use.", + "rule": "registry.relay.startup.admin_listener_binding_is_unused", + "safe_remediation": "Resolve the listener conflict for server.admin_bind in its owning deployment input; if generated, update the authored project and regenerate the Relay input, then retry.", + "field_address_pattern": null, + "evidence_scope": "configured Relay administration listener and closed bind-failure category", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--admin-listener-address-in-use", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category names server.admin_bind and address-in-use status but does not disclose its address, port, or operating-system error." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.admin_listener_permission_denied", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "listener_binding", + "safe_meaning": "Relay lacks permission to open the configured administration listener.", + "rule": "registry.relay.startup.admin_listener_binding_is_permitted", + "safe_remediation": "Choose a permitted server.admin_bind and correct the service account or network policy in its owning deployment input; regenerate generated Relay input, then retry.", + "field_address_pattern": null, + "evidence_scope": "configured Relay administration listener and closed bind-failure category", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--admin-listener-permission-denied", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category names server.admin_bind and permission-denied status but does not disclose its address, port, account identity, or operating-system error." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.admin_listener_unavailable", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "listener_binding", + "safe_meaning": "Relay could not open the configured administration listener.", + "rule": "registry.relay.startup.admin_listener_is_available", + "safe_remediation": "Check interface availability, address-family support, and deployment networking for server.admin_bind in its owning input; regenerate generated Relay input, then retry.", + "field_address_pattern": null, + "evidence_scope": "configured Relay administration listener and closed bind-failure category", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--admin-listener-unavailable", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The fallback category names server.admin_bind but does not disclose its address, port, or operating-system error." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.bundle_binding_rejected", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "bundle_verification", + "safe_meaning": "The governed bundle does not match this Relay runtime target.", + "rule": "registry.relay.startup.bundle_binding_matches_runtime", + "safe_remediation": "Use a governed bundle issued for this Relay runtime target.", + "field_address_pattern": null, + "evidence_scope": "governed bundle and Relay runtime binding", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--bundle-binding-rejected", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose configured or received binding values." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.bundle_rollback_rejected", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "bundle_activation", + "safe_meaning": "The governed bundle or override failed Relay anti-rollback checks.", + "rule": "registry.relay.startup.bundle_antirollback_satisfied", + "safe_remediation": "Use a monotonic governed bundle or an authorized break-glass selection.", + "field_address_pattern": null, + "evidence_scope": "local anti-rollback state and governed bundle or override metadata", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--bundle-rollback-rejected", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose sequences, hashes, paths, operators, or approval values." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.bundle_signature_rejected", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "bundle_verification", + "safe_meaning": "The governed bundle failed authenticity or content-integrity verification.", + "rule": "registry.relay.startup.bundle_authenticity_and_integrity_accepted", + "safe_remediation": "Rebuild and sign the complete bundle with an accepted trust configuration.", + "field_address_pattern": null, + "evidence_scope": "bundle trust metadata, signature envelope, file closure, and content digests", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--bundle-signature-rejected", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose signer identifiers, file names, hashes, or trust-anchor values." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.bundle_validation_rejected", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "bundle_verification", + "safe_meaning": "The governed bundle or local acceptance metadata is invalid.", + "rule": "registry.relay.startup.bundle_inputs_are_valid", + "safe_remediation": "Regenerate the bundle and acceptance metadata using supported formats.", + "field_address_pattern": null, + "evidence_scope": "bundle encoding, manifest, acceptance metadata, and required local inputs", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--bundle-validation-rejected", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose parser excerpts, local paths, hashes, identities, or supplied values." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.config_deprecated_field_rejected", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "config_document_validation", + "safe_meaning": "A Relay configuration document uses a field that the current runtime no longer accepts.", + "rule": "registry.relay.startup.config_uses_current_fields", + "safe_remediation": "Compare the authored input with the current Relay schema and migration guidance, replace deprecated fields, regenerate generated Relay input, then retry.", + "field_address_pattern": null, + "evidence_scope": "Relay configuration field names and the product-owned deprecated-field registry", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--config-deprecated-field-rejected", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose the configured field path, replacement, source path, or supplied values. Run authored-project validation for field-addressed guidance." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.config_document_invalid", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "config_document_validation", + "safe_meaning": "A Relay configuration or metadata document does not match its required syntax or typed schema.", + "rule": "registry.relay.startup.config_document_is_typed", + "safe_remediation": "Compare the authored input with the current Relay schema, run authored-project validation when generated, correct the document, regenerate generated Relay input, then retry.", + "field_address_pattern": null, + "evidence_scope": "Relay configuration and metadata document encoding, syntax, field grammar, and types", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--config-document-invalid", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose parser excerpts, field paths, local paths, or supplied values. It does not claim field-level diagnostics were emitted." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.config_environment_binding_rejected", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "config_environment_expansion", + "safe_meaning": "A required Relay configuration environment binding could not be expanded safely.", + "rule": "registry.relay.startup.config_environment_bindings_expand", + "safe_remediation": "Check the authored environment expressions and required deployment bindings, then run Relay doctor against the same configuration before retrying.", + "field_address_pattern": null, + "evidence_scope": "Relay configuration environment expressions and deployment-provided bindings", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--config-environment-binding-rejected", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose environment names, expansion errors, source paths, or supplied values. It does not claim field-level diagnostics were emitted." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.config_source_unavailable", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "config_loading", + "safe_meaning": "A required Relay configuration or metadata source could not be read.", + "rule": "registry.relay.startup.config_source_is_readable", + "safe_remediation": "Check the --config source and any configured metadata.source.path, restore readable input from its owner, regenerate generated Relay input instead of editing it in place, then retry.", + "field_address_pattern": null, + "evidence_scope": "Relay configuration and metadata sources", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--config-source-unavailable", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose local paths, operating-system errors, or source contents." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.config_validation_rejected", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "config_validation", + "safe_meaning": "The parsed Relay configuration failed product validation.", + "rule": "registry.relay.startup.config_product_invariants_hold", + "safe_remediation": "Run the authored-project validator, correct its field-addressed issues and governed bindings, regenerate the Relay input, then retry.", + "field_address_pattern": null, + "evidence_scope": "parsed Relay configuration and governed runtime bindings", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--config-validation-rejected", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose configured identifiers, URLs, environment names, hashes, or source values." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.consultation_artifacts_rejected", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "consultation_activation", + "safe_meaning": "The governed consultation artifact closure failed startup validation.", + "rule": "registry.relay.startup.consultation_artifact_closure_is_valid", + "safe_remediation": "Rebuild the complete hash-covered consultation artifact closure and retry.", + "field_address_pattern": null, + "evidence_scope": "governed consultation artifact closure and runtime bindings", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--consultation-artifacts-rejected", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose artifact paths, hashes, selectors, identities, or parser excerpts." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.data_listener_address_in_use", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "listener_binding", + "safe_meaning": "Relay could not open the data-plane listener because its binding is already in use.", + "rule": "registry.relay.startup.data_listener_binding_is_unused", + "safe_remediation": "Resolve the listener conflict for server.bind in its owning deployment input; if generated, update the authored project and regenerate the Relay input, then retry.", + "field_address_pattern": null, + "evidence_scope": "configured Relay data-plane listener and closed bind-failure category", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--data-listener-address-in-use", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category names server.bind and address-in-use status but does not disclose its address, port, or operating-system error." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.data_listener_permission_denied", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "listener_binding", + "safe_meaning": "Relay lacks permission to open the configured data-plane listener.", + "rule": "registry.relay.startup.data_listener_binding_is_permitted", + "safe_remediation": "Choose a permitted server.bind and correct the service account or network policy in its owning deployment input; regenerate generated Relay input, then retry.", + "field_address_pattern": null, + "evidence_scope": "configured Relay data-plane listener and closed bind-failure category", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--data-listener-permission-denied", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category names server.bind and permission-denied status but does not disclose its address, port, account identity, or operating-system error." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.data_listener_unavailable", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "listener_binding", + "safe_meaning": "Relay could not open the configured data-plane listener.", + "rule": "registry.relay.startup.data_listener_is_available", + "safe_remediation": "Check interface availability, address-family support, and deployment networking for server.bind in its owning input; regenerate generated Relay input, then retry.", + "field_address_pattern": null, + "evidence_scope": "configured Relay data-plane listener and closed bind-failure category", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--data-listener-unavailable", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The fallback category names server.bind but does not disclose its address, port, or operating-system error." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.doctor_failed", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "operator_diagnostics", + "safe_meaning": "Relay doctor found one or more blocking diagnostics.", + "rule": "registry.relay.startup.doctor_has_no_blocking_diagnostics", + "safe_remediation": "Use the static diagnostic codes and actions in the doctor report.", + "field_address_pattern": null, + "evidence_scope": "offline Relay readiness and deployment diagnostics", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--doctor-failed", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The process failure does not repeat diagnostic source values or report internals." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.runtime_initialization_failed", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "runtime_initialization", + "safe_meaning": "Relay runtime initialization failed.", + "rule": "registry.relay.startup.runtime_initializes", + "safe_remediation": "Review preceding static diagnostic codes, correct the runtime inputs, and retry.", + "field_address_pattern": null, + "evidence_scope": "Relay runtime dependencies and protected startup capabilities", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--runtime-initialization-failed", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose inner errors, paths, URLs, identities, hashes, or supplied values." + } + ], + "omissions": [] +} diff --git a/docs/site/public/generated/standard-journeys.json b/docs/site/public/generated/standard-journeys.json new file mode 100644 index 000000000..f353c9a99 --- /dev/null +++ b/docs/site/public/generated/standard-journeys.json @@ -0,0 +1,2712 @@ +[ + { + "id": "spreadsheet-protected-api", + "slug": "journeys/spreadsheet-protected-api", + "title": "Publish a spreadsheet through a protected API", + "description": "Generate the maintained local spreadsheet scaffold, verify its protected Relay surface, and identify which files become human-owned after generation.", + "outcome": "A synthetic spreadsheet is available through a purpose-limited Relay API, with anonymous and under-scoped requests denied.", + "level": "Beginner, local runtime", + "prerequisites": [ + "A Main-source registryctl binary and image lock built from one recorded commit", + "A Docker Compose provider", + "curl" + ], + "expected_time": "15 to 25 minutes", + "evidence_class": "source_and_generated_contract", + "evidence_lifecycle": "main_unreleased", + "availability": { + "status": "current_unreleased", + "proof": "source_tree", + "release": null + }, + "canonical_sources": [ + "crates/registryctl/src/lib.rs", + "crates/registryctl/src/sample.rs", + "crates/registryctl/src/templates/relay_config.yaml.tmpl", + "crates/registryctl/src/templates/compose.yaml", + "crates/registryctl/tests/init_output.rs" + ], + "canonical_workspace": { + "id": "registry-relay", + "path": "crates/registryctl" + }, + "catalog_references": [ + { + "catalog": "projects", + "id": "registry-relay" + } + ], + "minimal_configuration": { + "files": [ + { + "source": "crates/registryctl/src/templates/relay_config.yaml.tmpl", + "destination": "my-first-api/relay/config.yaml", + "format": "scaffolded", + "public_boundary": "generated_template" + } + ], + "note": "The exact init step emits the complete disposable sample. The template is linked as its canonical source but is not rendered with unresolved generation tokens; review the emitted relay/config.yaml before runtime use." + }, + "artifacts": [ + { + "path": "my-first-api/registryctl.yaml", + "classification": "scaffolded_human_owned", + "owner": "country_author", + "human_edit": true, + "version_control": true, + "note": "Registryctl creates this project manifest, but later edits are human-authored intent. It is not registryctl build output." + }, + { + "path": "my-first-api/relay/config.yaml", + "classification": "scaffolded_human_owned", + "owner": "operator", + "human_edit": true, + "version_control": true, + "note": "Registryctl creates the first Relay runtime configuration. The operator owns subsequent policy, caller, and data-binding review." + }, + { + "path": "my-first-api/data/benefits_casework.xlsx", + "classification": "synthetic_fixture", + "owner": "country_author", + "human_edit": true, + "version_control": true, + "note": "The generated workbook contains synthetic tutorial records only." + }, + { + "path": "my-first-api/secrets/local.env", + "classification": "environment_binding", + "owner": "operator", + "human_edit": true, + "version_control": false, + "note": "Registryctl generates local-only credentials. This file must not be reused or committed." + }, + { + "path": "my-first-api/output/smoke-results.json", + "classification": "runtime_observed", + "owner": "registryctl", + "human_edit": false, + "version_control": false, + "note": "The report records one local runtime observation and is not authored configuration." + } + ], + "fixture": { + "source": "crates/registryctl/src/sample.rs", + "format": "generated_sample", + "expected_trace": [ + "Registryctl generates the synthetic benefits workbook and local-only credentials.", + "Relay starts only after strict configuration and deployment gates pass.", + "Anonymous access is denied, purpose and scope are enforced, and the row reader receives only allowed fields.", + "The smoke report records local statuses without exposing credential values." + ] + }, + "contract": { + "proves": [ + "The source-under-test scaffold can start one local Relay over synthetic tabular data.", + "Protected metadata and record operations enforce configured caller, scope, purpose, and field-release boundaries.", + "Scaffolded runtime files and runtime-observed reports have distinct ownership." + ], + "does_not_prove": [ + "Compatibility with a country spreadsheet, database, identity provider, or network.", + "Production key custody, policy approval, legal approval, or operational resilience.", + "That generated local credentials are suitable outside this disposable journey." + ] + }, + "command_recipe": { + "kind": "spreadsheet_runtime" + }, + "review": [ + "Inspect registryctl.yaml and relay/config.yaml before first start; treat both as human-owned after scaffolding.", + "Confirm secrets/local.env is excluded from version control and contains no real credential.", + "Inspect output/smoke-results.json as runtime evidence, not as configuration or production acceptance." + ], + "gates": [ + { + "name": "Registryctl doctor", + "proves": "The local scaffold, runtime files, and selected local posture pass the product checks reached by doctor.", + "does_not_prove": "Source accuracy, production readiness, or approval of generated credentials." + }, + { + "name": "Relay startup validation", + "proves": "Relay accepted the strict configuration and reached the configured local listener.", + "does_not_prove": "The configuration is authorized for a production environment." + }, + { + "name": "Registryctl smoke", + "proves": "Maintained synthetic allowed and denied requests behaved as expected against the local runtime.", + "does_not_prove": "Live-source interoperability, load behavior, disaster recovery, or external acceptance." + } + ], + "production_delta": { + "environment": "Bind the reviewed candidate to the intended production environment and product instance.", + "secrets": "Provision credentials and trust material through operator-managed references.", + "approval": "Record country-author, product-owner, and operator approval for the reviewed candidate.", + "signing": "Sign each immutable product input with the authorized product-specific identity.", + "activation": "Verify, activate, observe, and retain rollback evidence independently for each product." + }, + "troubleshooting": [ + { + "code": "relay.startup.config_document_invalid", + "family": "relay_process_startup", + "product": "registry_relay", + "meaning": "A Relay configuration or metadata document does not match its required syntax or typed schema.", + "remediation": "Compare the authored input with the current Relay schema, run authored-project validation when generated, correct the document, regenerate generated Relay input, then retry.", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--config-document-invalid", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "The category does not disclose parser excerpts, field paths, local paths, or supplied values. It does not claim field-level diagnostics were emitted." + }, + { + "code": "relay.startup.config_validation_rejected", + "family": "relay_process_startup", + "product": "registry_relay", + "meaning": "The parsed Relay configuration failed product validation.", + "remediation": "Run the authored-project validator, correct its field-addressed issues and governed bindings, regenerate the Relay input, then retry.", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--config-validation-rejected", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "The category does not disclose configured identifiers, URLs, environment names, hashes, or source values." + }, + { + "code": "relay.startup.data_listener_unavailable", + "family": "relay_process_startup", + "product": "registry_relay", + "meaning": "Relay could not open the configured data-plane listener.", + "remediation": "Check interface availability, address-family support, and deployment networking for server.bind in its owning input; regenerate generated Relay input, then retry.", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--data-listener-unavailable", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "The fallback category names server.bind but does not disclose its address, port, or operating-system error." + }, + { + "code": "relay.startup.doctor_failed", + "family": "relay_process_startup", + "product": "registry_relay", + "meaning": "Relay doctor found one or more blocking diagnostics.", + "remediation": "Use the static diagnostic codes and actions in the doctor report.", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--doctor-failed", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "The process failure does not repeat diagnostic source values or report internals." + } + ], + "next_task": { + "label": "Inspect the instance OpenAPI", + "href": "/journeys/instance-openapi/" + }, + "evidence": { + "extraction": { + "status": "verified", + "source_path": "docs/site/scripts/generate-standard-journeys.test.mjs", + "test_id": "extracts every declared complete configuration file from its canonical source", + "command": "node --test scripts/generate-standard-journeys.test.mjs", + "workflow": ".github/workflows/ci.yml#docs", + "revision": "main", + "lifecycle": "current_unreleased" + }, + "execution": { + "status": "verified", + "source_path": "docs/site/scripts/check-registryctl-tutorials.sh", + "test_id": "run_relay_tutorial()", + "command": "npm run check:tutorial:registryctl", + "workflow": ".github/workflows/ci.yml#registryctl-tutorials", + "revision": "main", + "lifecycle": "current_unreleased" + }, + "runtime": { + "status": "verified", + "source_path": "docs/site/scripts/check-registryctl-tutorials.sh", + "test_id": "run_relay_tutorial()", + "command": "npm run check:tutorial:registryctl", + "workflow": ".github/workflows/ci.yml#registryctl-tutorials", + "revision": "main", + "lifecycle": "current_unreleased" + } + }, + "source_label": "Main source (unreleased)", + "section_headings": [ + "Outcome and prerequisites", + "Smallest complete configuration", + "Project tree and artifact ownership", + "Synthetic fixture and expected trace", + "Contract this journey proves", + "Test, explain, compare, and build", + "Review authored and generated artifacts", + "What each gate proves", + "Production delta", + "Troubleshooting and next task" + ], + "configuration_files": [ + { + "source": "crates/registryctl/src/templates/relay_config.yaml.tmpl", + "destination": "my-first-api/relay/config.yaml", + "format": "scaffolded", + "public_boundary": "generated_template", + "language": null, + "content": null + } + ], + "fixture_excerpt": { + "language": "text", + "content": "Generated synthetic sample: crates/registryctl/src/sample.rs\n" + }, + "steps": [ + { + "id": "spreadsheet-init", + "kind": "command", + "label": "Create the disposable spreadsheet scaffold", + "cwd": ".", + "argv": [ + "registryctl", + "init", + "relay", + "my-first-api", + "--sample", + "benefits" + ] + }, + { + "id": "spreadsheet-doctor", + "kind": "alternative", + "label": "Product doctor", + "cwd": "my-first-api", + "argv": [ + "registryctl", + "doctor", + "--profile", + "local" + ], + "note": "Run after the source-built product commands and Docker provider are available." + }, + { + "id": "spreadsheet-start", + "kind": "long_running", + "label": "Start the disposable local runtime", + "cwd": "my-first-api", + "argv": [ + "registryctl", + "start" + ], + "note": "This is a long-running runtime boundary and is exercised by the source tutorial gate, not the clean-temp authoring sequence." + }, + { + "id": "spreadsheet-smoke", + "kind": "alternative", + "label": "Runtime smoke after readiness", + "cwd": "my-first-api", + "argv": [ + "registryctl", + "smoke" + ], + "note": "Run only after the local runtime reports ready." + } + ] + }, + { + "id": "instance-openapi", + "slug": "journeys/instance-openapi", + "title": "Inspect one running instance OpenAPI contract", + "description": "Compare the reviewed Relay API source contract with the document exposed by one configured instance.", + "outcome": "An operator verifies the exact API contract selected by one Relay instance.", + "level": "Beginner", + "prerequisites": [ + "A Main-source registryctl binary and image lock built from one recorded commit", + "A Docker Compose provider for the optional local runtime step", + "An HTTP client that can preserve response bytes at an exact output path" + ], + "expected_time": "10 minutes", + "evidence_class": "source_and_generated_contract", + "evidence_lifecycle": "main_unreleased", + "availability": { + "status": "current_unreleased", + "proof": "source_tree", + "release": null + }, + "canonical_sources": [ + "crates/registry-relay/openapi/registry-relay.openapi.json", + "crates/registry-relay/tests/api_docs.rs", + "crates/registryctl/src/templates/relay_config.yaml.tmpl" + ], + "canonical_workspace": { + "id": "registry-relay", + "path": "crates/registry-relay" + }, + "catalog_references": [ + { + "catalog": "projects", + "id": "registry-relay" + }, + { + "catalog": "contracts", + "id": "registry-relay.openapi" + } + ], + "minimal_configuration": { + "files": [ + { + "source": "crates/registryctl/src/templates/relay_config.yaml.tmpl", + "destination": "openapi-inspection/relay/config.yaml", + "format": "scaffolded", + "public_boundary": "generated_template" + } + ], + "note": "The exact init step emits the complete disposable local configuration. That sample explicitly sets server.openapi_requires_auth to false; the product default remains true." + }, + "artifacts": [ + { + "path": "openapi-inspection/relay/config.yaml", + "classification": "scaffolded_human_owned", + "owner": "operator", + "human_edit": true, + "version_control": true, + "note": "Exact configuration emitted by the disposable init step. It explicitly selects the local public OpenAPI opt-out and becomes operator-owned after scaffolding." + }, + { + "path": "crates/registry-relay/openapi/registry-relay.openapi.json", + "classification": "generated_unsigned", + "owner": "registry_relay", + "human_edit": false, + "version_control": true, + "note": "Committed product-owned source contract used for drift and consumer review." + }, + { + "path": "openapi-inspection/output/instance.openapi.json", + "classification": "runtime_observed", + "owner": "operator", + "human_edit": false, + "version_control": false, + "note": "Exact user-selected capture path for the typed runtime GET interface." + } + ], + "fixture": { + "source": "crates/registry-relay/tests/api_docs.rs", + "format": "source_reference", + "expected_trace": [ + "Registryctl creates a disposable local scaffold whose generated config explicitly sets server.openapi_requires_auth to false.", + "The separately started local instance exposes an unauthenticated GET /openapi.json only because that explicit opt-out is selected.", + "The captured OpenAPI document declares version 3.1.0 and is written to openapi-inspection/output/instance.openapi.json." + ] + }, + "contract": { + "proves": [ + "The cited product source test proves that the explicit local opt-out exposes an OpenAPI 3.1.0 document without authentication.", + "Performing the separate runtime interface captures the generated contract selected by that disposable instance." + ], + "does_not_prove": [ + "Downstream consumers remain compatible with every changed operation.", + "OpenAPI-assisted upstream source authoring; that compiler contract remains deferred.", + "That the product default is public, or that any operation described by the captured document is authorized without its configured credentials." + ] + }, + "command_recipe": { + "kind": "instance_openapi" + }, + "review": [ + "Review the server and catalog configuration selecting the API surface.", + "Confirm the generated disposable config is the intended local-only openapi_requires_auth false opt-out before starting it.", + "Inspect the exact instance document returned through the unauthenticated local route.", + "Record the source revision, instance binding, capture time, and document digest; no credential is required or recorded for this explicit local opt-out." + ], + "gates": [ + { + "name": "source test", + "proves": "The explicit local public opt-out returns an OpenAPI 3.1.0 document in the product source test.", + "does_not_prove": "A particular deployed instance is reachable." + }, + { + "name": "instance inspection", + "proves": "When the operator performs the separate runtime step, the selected disposable instance exposes one concrete generated contract at the exact capture path.", + "does_not_prove": "Every client accepts the selected contract." + }, + { + "name": "consumer comparison", + "proves": "Reviewed consumers accept the candidate contract.", + "does_not_prove": "Runtime health or production data correctness." + } + ], + "production_delta": { + "environment": "Bind the reviewed candidate to the intended production environment and product instance.", + "secrets": "Provision credentials and trust material through operator-managed references.", + "approval": "Record country-author, product-owner, and operator approval for the reviewed candidate.", + "signing": "Sign each immutable product input with the authorized product-specific identity.", + "activation": "Verify, activate, observe, and retain rollback evidence independently for each product." + }, + "troubleshooting": [ + { + "code": "relay.startup.data_listener_unavailable", + "family": "relay_process_startup", + "product": "registry_relay", + "meaning": "Relay could not open the configured data-plane listener.", + "remediation": "Check interface availability, address-family support, and deployment networking for server.bind in its owning input; regenerate generated Relay input, then retry.", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--data-listener-unavailable", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "The fallback category names server.bind but does not disclose its address, port, or operating-system error." + }, + { + "code": "relay.startup.config_validation_rejected", + "family": "relay_process_startup", + "product": "registry_relay", + "meaning": "The parsed Relay configuration failed product validation.", + "remediation": "Run the authored-project validator, correct its field-addressed issues and governed bindings, regenerate the Relay input, then retry.", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--config-validation-rejected", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "The category does not disclose configured identifiers, URLs, environment names, hashes, or source values." + }, + { + "code": "rejected_binding", + "family": "bundle_verification", + "product": "registry_platform_ops", + "meaning": "The bundle binding does not match the intended runtime target.", + "remediation": "Use a bundle issued for the intended runtime binding.", + "docs_anchor": "/reference/diagnostics/operator/#registry_platform_ops--rejected-binding", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "The category does not disclose received or configured binding values." + } + ], + "next_task": { + "label": "Author a bounded HTTP integration", + "href": "/journeys/bounded-http/" + }, + "evidence": { + "extraction": { + "status": "verified", + "source_path": "docs/site/scripts/generate-standard-journeys.test.mjs", + "test_id": "extracts every declared complete configuration file from its canonical source", + "command": "node --test scripts/generate-standard-journeys.test.mjs", + "workflow": ".github/workflows/ci.yml#docs", + "revision": "main", + "lifecycle": "current_unreleased" + }, + "execution": { + "status": "verified", + "source_path": "crates/registry-relay/tests/api_docs.rs", + "test_id": "openapi_json_can_be_moved_to_public_router_for_local_testing", + "command": "cargo test --locked -p registry-relay --test api_docs openapi_json_can_be_moved_to_public_router_for_local_testing -- --exact", + "workflow": ".github/workflows/ci.yml#relay-contracts", + "revision": "main", + "lifecycle": "current_unreleased" + }, + "runtime": { + "status": "not_claimed", + "source_path": "docs/site/scripts/generate-standard-journeys.test.mjs", + "test_id": "keeps runtime and product activation claims bounded to traceable evidence", + "command": "node --test scripts/generate-standard-journeys.test.mjs", + "workflow": ".github/workflows/ci.yml#docs", + "revision": "main", + "lifecycle": "current_unreleased" + } + }, + "source_label": "Main source (unreleased)", + "section_headings": [ + "Outcome and prerequisites", + "Smallest complete configuration", + "Project tree and artifact ownership", + "Synthetic fixture and expected trace", + "Contract this journey proves", + "Test, explain, compare, and build", + "Review authored and generated artifacts", + "What each gate proves", + "Production delta", + "Troubleshooting and next task" + ], + "configuration_files": [ + { + "source": "crates/registryctl/src/templates/relay_config.yaml.tmpl", + "destination": "openapi-inspection/relay/config.yaml", + "format": "scaffolded", + "public_boundary": "generated_template", + "language": null, + "content": null + } + ], + "fixture_excerpt": { + "language": "text", + "content": "Source-backed proof: crates/registry-relay/tests/api_docs.rs\n" + }, + "steps": [ + { + "id": "openapi-init", + "kind": "command", + "label": "Create the disposable local instance", + "cwd": ".", + "argv": [ + "registryctl", + "init", + "relay", + "openapi-inspection", + "--sample", + "benefits" + ] + }, + { + "id": "openapi-start", + "kind": "long_running", + "label": "Start the disposable local instance", + "cwd": "openapi-inspection", + "argv": [ + "registryctl", + "start" + ], + "note": "The generated local sample explicitly opts out of OpenAPI authentication. Product defaults remain authentication-gated." + }, + { + "id": "openapi-capture", + "kind": "runtime_interface", + "label": "Capture the disposable instance contract", + "method": "GET", + "url": "http://127.0.0.1:4242/openapi.json", + "authentication": "none_disposable_local_opt_out", + "output_path": "openapi-inspection/output/instance.openapi.json", + "note": "Use an HTTP client that preserves the response bytes. This interface is public only because the generated disposable local configuration sets server.openapi_requires_auth to false." + }, + { + "id": "openapi-consumer-review", + "kind": "operator_interface", + "label": "Consumer contract comparison", + "inputs": [ + "Captured openapi-inspection/output/instance.openapi.json", + "Consumer-owned reviewed baseline and compatibility policy" + ], + "outputs": [ + "Consumer-owned compatibility decision" + ], + "procedure": "Compare the captured bytes using the consumer's reviewed compatibility tool. Registry Stack does not turn an external baseline into an executable shell placeholder." + } + ] + }, + { + "id": "bounded-http", + "slug": "journeys/bounded-http", + "title": "Author and test a bounded HTTP integration", + "description": "Normalize one fixed HTTP request into a closed evidence projection with offline fixture proof.", + "outcome": "A bounded HTTP request produces reviewed evidence through deterministic offline fixtures.", + "level": "Intermediate", + "prerequisites": [ + "registryctl built from the current source revision", + "A bounded source API contract", + "Synthetic match and non-match examples" + ], + "expected_time": "30 minutes", + "evidence_class": "maintained_offline_fixture", + "evidence_lifecycle": "main_unreleased", + "availability": { + "status": "current_unreleased", + "proof": "source_tree", + "release": null + }, + "canonical_sources": [ + "crates/registryctl/assets/project-starters/bounded-http/registry-stack.yaml", + "crates/registryctl/assets/project-starters/bounded-http/environments/local.yaml", + "crates/registryctl/assets/project-starters/bounded-http/integrations/person-record/integration.yaml", + "crates/registryctl/assets/project-starters/bounded-http/integrations/person-record/fixtures/active.yaml" + ], + "canonical_workspace": { + "id": "http", + "path": "crates/registryctl/assets/project-starters/bounded-http" + }, + "catalog_references": [ + { + "catalog": "project_authoring", + "id": "http" + }, + { + "catalog": "projects", + "id": "registry-relay" + }, + { + "catalog": "projects", + "id": "registry-notary" + } + ], + "minimal_configuration": { + "files": [ + { + "source": "crates/registryctl/assets/project-starters/bounded-http/registry-stack.yaml", + "destination": "registry-project/registry-stack.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic" + }, + { + "source": "crates/registryctl/assets/project-starters/bounded-http/environments/local.yaml", + "destination": "registry-project/environments/local.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic" + }, + { + "source": "crates/registryctl/assets/project-starters/bounded-http/integrations/person-record/integration.yaml", + "destination": "registry-project/integrations/person-record/integration.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic" + } + ], + "note": "These complete maintained starter files define project topology, synthetic local bindings, and the bounded HTTP integration. No field-range excerpt is presented as a complete configuration." + }, + "artifacts": [ + { + "path": "registry-project/registry-stack.yaml", + "classification": "authored", + "owner": "country_author", + "human_edit": true, + "version_control": true, + "note": "Human-owned registry intent, service policy, consultation, claims, and disclosure." + }, + { + "path": "registry-project/integrations/person-record/integration.yaml", + "classification": "authored", + "owner": "country_author", + "human_edit": true, + "version_control": true, + "note": "Human-owned source and projection contract." + }, + { + "path": "registry-project/integrations/person-record/fixtures/active.yaml", + "classification": "synthetic_fixture", + "owner": "country_author", + "human_edit": true, + "version_control": true, + "note": "Maintained offline match evidence." + }, + { + "path": "registry-project/.registry-stack/build/local/reviewable", + "classification": "generated_unsigned", + "owner": "registryctl", + "human_edit": false, + "version_control": false, + "note": "Exact emitted human-review directory within the local build output." + }, + { + "path": "registry-project/.registry-stack/build/local/private/relay", + "classification": "generated_unsigned", + "owner": "registryctl", + "human_edit": false, + "version_control": false, + "note": "Exact emitted unsigned Relay product input." + }, + { + "path": "registry-project/.registry-stack/build/local/private/notary", + "classification": "generated_unsigned", + "owner": "registryctl", + "human_edit": false, + "version_control": false, + "note": "Exact emitted unsigned Notary product input." + } + ], + "fixture": { + "source": "crates/registryctl/assets/project-starters/bounded-http/integrations/person-record/fixtures/active.yaml", + "format": "yaml", + "expected_trace": [ + "The harness expects one GET request at the templated person path.", + "The synthetic response projects only the declared active output.", + "Expected claims are evaluated without contacting a live source." + ] + }, + "contract": { + "proves": [ + "The bounded request and response projection produce the expected offline result.", + "Authored configuration can pass static check and deterministic build.", + "Service policy, Relay consultation, Notary claims, and separate product inputs remain visible through the canonical workspace and generated reports." + ], + "does_not_prove": [ + "Live authentication, source availability, or production response compatibility." + ] + }, + "command_recipe": { + "kind": "matrix", + "matrix_id": "http" + }, + "review": [ + "Review paths, statuses, output types, and every fixture interaction.", + "Keep credentials as references and out of fixtures.", + "Review explanations and product inputs without editing generated files." + ], + "gates": [ + { + "name": "fixture", + "proves": "The bounded request and projection produce the maintained offline result.", + "does_not_prove": "Live source compatibility or authentication." + }, + { + "name": "check", + "proves": "Authored configuration satisfies current static contracts.", + "does_not_prove": "Runtime files and references are available." + }, + { + "name": "build", + "proves": "Deterministic per-product inputs can be generated.", + "does_not_prove": "Inputs are signed, trusted, or active." + } + ], + "production_delta": { + "environment": "Bind the reviewed candidate to the intended production environment and product instance.", + "secrets": "Provision credentials and trust material through operator-managed references.", + "approval": "Record country-author, product-owner, and operator approval for the reviewed candidate.", + "signing": "Sign each immutable product input with the authorized product-specific identity.", + "activation": "Verify, activate, observe, and retain rollback evidence independently for each product." + }, + "troubleshooting": [ + { + "code": "registryctl.authoring.yaml.unknown_field", + "family": "authoring_validation", + "product": "registryctl", + "meaning": "Only documented fields in the closed authoring schema are accepted.", + "remediation": "Remove the unsupported field or replace it with its documented field.", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.yaml.unknown_field", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "code": "fixture.request_mismatch", + "family": "fixture_execution", + "product": "registryctl_relay_offline_harness", + "meaning": "The rendered request or call order did not match the fixture expectation.", + "remediation": "Align the fixture request expectation with the compiled plan.", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--fixture.request_mismatch", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "code": "source.status_rejected", + "family": "fixture_execution", + "product": "registryctl_relay_offline_harness", + "meaning": "The synthetic source returned a status outside the accepted mapping.", + "remediation": "Use a reviewed status mapping or correct the fixture status.", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--source.status_rejected", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "code": "authorization.denied", + "family": "fixture_execution", + "product": "registryctl_relay_offline_harness", + "meaning": "Authorization denied fixture execution before source access.", + "remediation": "Align the fixture identity and authorization expectation with the compiled policy.", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--authorization.denied", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + } + ], + "next_task": { + "label": "Extend the adapter with bounded FHIR scripting", + "href": "/journeys/bounded-multi-call-script/" + }, + "evidence": { + "extraction": { + "status": "verified", + "source_path": "docs/site/scripts/generate-standard-journeys.test.mjs", + "test_id": "extracts every declared complete configuration file from its canonical source", + "command": "node --test scripts/generate-standard-journeys.test.mjs", + "workflow": ".github/workflows/ci.yml#docs", + "revision": "main", + "lifecycle": "current_unreleased" + }, + "execution": { + "status": "verified", + "source_path": "crates/registryctl/tests/project_authoring.rs", + "test_id": "every_cataloged_supported_project_authoring_command_is_automated", + "command": "cargo build --locked -p registryctl --bin registryctl && cargo test --locked -p registryctl --test project_authoring every_cataloged_supported_project_authoring_command_is_automated -- --exact", + "workflow": ".github/workflows/ci.yml#project-authoring-determinism", + "revision": "main", + "lifecycle": "current_unreleased" + }, + "runtime": { + "status": "not_claimed", + "source_path": "docs/site/scripts/generate-standard-journeys.test.mjs", + "test_id": "keeps runtime and product activation claims bounded to traceable evidence", + "command": "node --test scripts/generate-standard-journeys.test.mjs", + "workflow": ".github/workflows/ci.yml#docs", + "revision": "main", + "lifecycle": "current_unreleased" + } + }, + "source_label": "Main source (unreleased)", + "section_headings": [ + "Outcome and prerequisites", + "Smallest complete configuration", + "Project tree and artifact ownership", + "Synthetic fixture and expected trace", + "Contract this journey proves", + "Test, explain, compare, and build", + "Review authored and generated artifacts", + "What each gate proves", + "Production delta", + "Troubleshooting and next task" + ], + "configuration_files": [ + { + "source": "crates/registryctl/assets/project-starters/bounded-http/registry-stack.yaml", + "destination": "registry-project/registry-stack.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic", + "language": "yaml", + "content": "integrations:\n person-record:\n file: integrations/person-record/integration.yaml\nregistry:\n id: fictional-citizen-registry\nservices:\n person-verification:\n access:\n scopes:\n - evidence:person:read\n claims:\n person-active:\n disclosure: value\n output: person_record.active\n person-record-exists:\n cel: person_record.matched\n disclosure: predicate\n consent: not_required\n consultations:\n person_record:\n input:\n person_id: request.target.identifiers.registry_person_id\n integration: person-record\n credential_profiles:\n person-status:\n claims:\n - person-record-exists\n - person-active\n format: dc+sd-jwt\n type: https://credentials.invalid/person-status/v1\n validity: 10m\n kind: evidence\n legal_basis: public-service-delivery\n purpose: public-service-person-verification\n version: 1\nstarter:\n content_digest: sha256:a4e0263957f3dd7756ef1a270483f4aa5f856102f070c6e0325e8cc9b1413b76\n id: http\n release: 0.13.0\nversion: 1\n" + }, + { + "source": "crates/registryctl/assets/project-starters/bounded-http/environments/local.yaml", + "destination": "registry-project/environments/local.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic", + "language": "yaml", + "content": "callers:\n evidence-client:\n api_key_fingerprint:\n secret: EVIDENCE_CLIENT_TOKEN_HASH\n scopes:\n - evidence:person:read\ndeployment:\n notary:\n service: fictional-registry-notary\n profile: local\n relay:\n service: fictional-registry-relay\nintegrations:\n person-record:\n source:\n credential:\n generation: 1\n token:\n secret: FICTIONAL_REGISTRY_TOKEN\n origin: https://citizen-registry.invalid\nissuance:\n generation: 1\n issuer: did:web:notary.invalid\n signing_key:\n secret: REGISTRY_NOTARY_ISSUER_JWK\n signing_kid: project-issuer-key\nnotary_relay:\n base_url: http://127.0.0.1:8080\n token_file: /run/secrets/relay-workload-token\n workload_client_id: fictional-registry-notary\nrelay:\n allowed_clients:\n - fictional-relay-client\n audience: registry-relay\n issuer: https://workload-issuer.internal.invalid\n jwks_url: https://workload-issuer.internal.invalid/.well-known/jwks.json\n origin: https://relay.internal.invalid\nversion: 1\n" + }, + { + "source": "crates/registryctl/assets/project-starters/bounded-http/integrations/person-record/integration.yaml", + "destination": "registry-project/integrations/person-record/integration.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic", + "language": "yaml", + "content": "capability:\n http:\n request:\n method: GET\n path: /people/{input.person_id}\n query:\n fields: active\n response:\n ambiguous:\n - 409\n no_match:\n - 404\nid: person-record\ninput:\n person_id:\n maxLength: 64\n role: selector\n type: string\nnot_applicable:\n subject_mismatch:\n rationale: The selected response projection contains no identifier that can be compared with the requested person identifier.\n request_fixture: active-person\noutputs:\n active:\n type: boolean\n x-registry-source: /active\nrevision: 1\nsource:\n auth:\n type: static_bearer\n product: replace-with-source-product\n versions:\n unverified:\n - replace-with-source-version\nversion: 1\n" + } + ], + "fixture_excerpt": { + "language": "yaml", + "content": "classification: synthetic\nexpect:\n claims:\n person-active: true\n person-record-exists: true\n outcome: match\n outputs:\n active: true\ninput:\n person_id: AB-123456\ninteractions:\n - expect:\n method: GET\n path: /people/AB-123456\n query:\n fields: active\n respond:\n body:\n active: true\n status: 200\nname: active-person\nrequest:\n claims:\n - person-record-exists\n disclosure: predicate\n format: application/vnd.registry-notary.claim-result+json\n purpose: public-service-person-verification\n target:\n identifiers:\n - scheme: registry_person_id\n value: AB-123456\n type: Person\n" + }, + "steps": [ + { + "id": "bounded-http-init-0", + "kind": "command", + "label": "Required init step", + "cwd": ".", + "argv": [ + "registryctl", + "init", + "--from", + "http", + "--project-dir", + "registry-project" + ] + }, + { + "id": "bounded-http-authoring-editor-1", + "kind": "command", + "label": "Required authoring editor step", + "cwd": ".", + "argv": [ + "registryctl", + "authoring", + "editor", + "--project-dir", + "registry-project" + ] + }, + { + "id": "bounded-http-test-2", + "kind": "command", + "label": "Required test step", + "cwd": ".", + "argv": [ + "registryctl", + "test", + "--project-dir", + "registry-project", + "--integration", + "person-record", + "--fixture", + "active-person", + "--trace" + ] + }, + { + "id": "bounded-http-test", + "kind": "long_running", + "label": "Optional watch loop", + "cwd": ".", + "argv": [ + "registryctl", + "test", + "--project-dir", + "registry-project", + "--integration", + "person-record", + "--fixture", + "active-person", + "--watch" + ], + "note": "This long-running alternative reruns the focused synthetic fixture after authored files change. It is not part of the required noninteractive sequence." + }, + { + "id": "bounded-http-test-3", + "kind": "command", + "label": "Required test step", + "cwd": ".", + "argv": [ + "registryctl", + "test", + "--project-dir", + "registry-project" + ] + }, + { + "id": "bounded-http-check-4", + "kind": "command", + "label": "Required check step", + "cwd": ".", + "argv": [ + "registryctl", + "check", + "--project-dir", + "registry-project", + "--environment", + "local", + "--explain" + ] + }, + { + "id": "bounded-http-semantic-comparison", + "kind": "command", + "label": "Compare authored semantics with the embedded starter", + "cwd": ".", + "argv": [ + "registryctl", + "compare", + "--project-dir", + "registry-project", + "--environment", + "local", + "--from-starter" + ] + }, + { + "id": "bounded-http-build-5", + "kind": "command", + "label": "Required build step", + "cwd": ".", + "argv": [ + "registryctl", + "build", + "--project-dir", + "registry-project", + "--environment", + "local" + ] + } + ] + }, + { + "id": "bounded-multi-call-script", + "slug": "journeys/bounded-multi-call-script", + "title": "Author and test a bounded FHIR R4 multi-call script", + "description": "Review the complete Rhai adapter that bounds Patient, Coverage, and Organization requests.", + "outcome": "A bounded Rhai adapter produces normalized FHIR evidence with maintained offline fixtures.", + "level": "Advanced", + "prerequisites": [ + "Familiarity with FHIR R4 search bundles", + "registryctl built from the current source revision", + "Synthetic Patient, Coverage, and Organization examples" + ], + "expected_time": "45 minutes", + "evidence_class": "maintained_offline_fixture", + "evidence_lifecycle": "main_unreleased", + "availability": { + "status": "current_unreleased", + "proof": "source_tree", + "release": null + }, + "canonical_sources": [ + "crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/registry-stack.yaml", + "crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/environments/local.yaml", + "crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/integration.yaml", + "crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/adapter.rhai", + "crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/fixtures/match.yaml" + ], + "canonical_workspace": { + "id": "fhir-r4-coverage-active", + "path": "crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active" + }, + "catalog_references": [ + { + "catalog": "project_authoring", + "id": "fhir-r4-coverage-active" + }, + { + "catalog": "projects", + "id": "registry-relay" + }, + { + "catalog": "projects", + "id": "registry-notary" + } + ], + "minimal_configuration": { + "files": [ + { + "source": "crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/registry-stack.yaml", + "destination": "fhir-project/registry-stack.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic" + }, + { + "source": "crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/environments/local.yaml", + "destination": "fhir-project/environments/local.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic" + }, + { + "source": "crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/integration.yaml", + "destination": "fhir-project/integrations/coverage/integration.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic" + }, + { + "source": "crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/adapter.rhai", + "destination": "fhir-project/integrations/coverage/adapter.rhai", + "format": "rhai", + "public_boundary": "maintained_synthetic" + } + ], + "note": "The complete maintained set includes project topology, synthetic local bindings, the canonical request limits, and the entire reviewed Rhai adapter without line-range extraction." + }, + "artifacts": [ + { + "path": "fhir-project/integrations/coverage/integration.yaml", + "classification": "authored", + "owner": "country_author", + "human_edit": true, + "version_control": true, + "note": "Human-owned request bounds, selectors, outputs, and limits." + }, + { + "path": "fhir-project/integrations/coverage/adapter.rhai", + "classification": "authored", + "owner": "country_author", + "human_edit": true, + "version_control": true, + "note": "Hash-covered reviewed country implementation code." + }, + { + "path": "fhir-project/integrations/coverage/fixtures/match.yaml", + "classification": "synthetic_fixture", + "owner": "country_author", + "human_edit": true, + "version_control": true, + "note": "Maintained offline FHIR conversation." + }, + { + "path": "fhir-project/.registry-stack/build/local/reviewable", + "classification": "generated_unsigned", + "owner": "registryctl", + "human_edit": false, + "version_control": false, + "note": "Exact emitted human-review directory containing the reviewed integration closure." + }, + { + "path": "fhir-project/.registry-stack/build/local/private/relay", + "classification": "generated_unsigned", + "owner": "registryctl", + "human_edit": false, + "version_control": false, + "note": "Exact emitted unsigned Relay input containing the complete Rhai adapter." + }, + { + "path": "fhir-project/.registry-stack/build/local/private/notary", + "classification": "generated_unsigned", + "owner": "registryctl", + "human_edit": false, + "version_control": false, + "note": "Exact emitted unsigned Notary input for the combined project." + } + ], + "fixture": { + "source": "crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/fixtures/match.yaml", + "format": "yaml", + "expected_trace": [ + "The adapter performs bounded Patient and Coverage searches.", + "The matched payor selects one Organization request.", + "Coverage status and insurer name produce the expected claims." + ] + }, + "contract": { + "proves": [ + "The complete Rhai file parses and satisfies the maintained synthetic FHIR conversation.", + "Host-declared four-call, 512KiB source-byte, 8KiB request-byte, and 12-second deadline limits bound adapter execution." + ], + "does_not_prove": [ + "A live FHIR server conforms to the tested profile." + ] + }, + "command_recipe": { + "kind": "matrix", + "matrix_id": "fhir-r4-coverage-active" + }, + "review": [ + "Review every allowed request, selector, ambiguity branch, and output projection.", + "Confirm fixture ordering and bounded pagination.", + "Confirm the generated closure includes the full reviewed Rhai file." + ], + "gates": [ + { + "name": "script syntax", + "proves": "The complete Rhai file parses under the current authoring contract.", + "does_not_prove": "Every source response yields intended evidence." + }, + { + "name": "fixture", + "proves": "The synthetic FHIR conversation produces expected normalized evidence.", + "does_not_prove": "A live FHIR server conforms to the tested profile." + }, + { + "name": "build", + "proves": "The reviewed script enters deterministic product inputs.", + "does_not_prove": "Product bundles are trusted or active." + } + ], + "production_delta": { + "environment": "Bind the reviewed candidate to the intended production environment and product instance.", + "secrets": "Provision credentials and trust material through operator-managed references.", + "approval": "Record country-author, product-owner, and operator approval for the reviewed candidate.", + "signing": "Sign each immutable product input with the authorized product-specific identity.", + "activation": "Verify, activate, observe, and retain rollback evidence independently for each product." + }, + "troubleshooting": [ + { + "code": "registryctl.authoring.script.syntax_error", + "family": "authoring_validation", + "product": "registryctl", + "meaning": "The Script source must parse under the released runtime.", + "remediation": "Correct the Script syntax at the reported location.", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.script.syntax_error", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "code": "registryctl.authoring.script.unknown_function", + "family": "authoring_validation", + "product": "registryctl", + "meaning": "The Script must define the released `consult(context)` entrypoint.", + "remediation": "Define consult(context) as the Script entrypoint.", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.script.unknown_function", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "code": "source.call_budget_exceeded", + "family": "fixture_execution", + "product": "registryctl_relay_offline_harness", + "meaning": "Fixture execution exceeded the compiled source-call budget.", + "remediation": "Reduce source calls or revise the reviewed bounded plan.", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--source.call_budget_exceeded", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "code": "source.deadline_exceeded", + "family": "fixture_execution", + "product": "registryctl_relay_offline_harness", + "meaning": "The synthetic source interaction exceeded its deadline.", + "remediation": "Align the timeout fixture with the compiled deadline behavior.", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--source.deadline_exceeded", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "code": "source.response_malformed", + "family": "fixture_execution", + "product": "registryctl_relay_offline_harness", + "meaning": "The synthetic source response violated its closed response contract.", + "remediation": "Correct the synthetic response shape.", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--source.response_malformed", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + } + ], + "next_task": { + "label": "Compare with an exact snapshot", + "href": "/journeys/exact-snapshot/" + }, + "evidence": { + "extraction": { + "status": "verified", + "source_path": "docs/site/scripts/generate-standard-journeys.test.mjs", + "test_id": "extracts every declared complete configuration file from its canonical source", + "command": "node --test scripts/generate-standard-journeys.test.mjs", + "workflow": ".github/workflows/ci.yml#docs", + "revision": "main", + "lifecycle": "current_unreleased" + }, + "execution": { + "status": "verified", + "source_path": "crates/registryctl/tests/project_authoring.rs", + "test_id": "every_cataloged_supported_project_authoring_command_is_automated", + "command": "cargo build --locked -p registryctl --bin registryctl && cargo test --locked -p registryctl --test project_authoring every_cataloged_supported_project_authoring_command_is_automated -- --exact", + "workflow": ".github/workflows/ci.yml#project-authoring-determinism", + "revision": "main", + "lifecycle": "current_unreleased" + }, + "runtime": { + "status": "not_claimed", + "source_path": "docs/site/scripts/generate-standard-journeys.test.mjs", + "test_id": "keeps runtime and product activation claims bounded to traceable evidence", + "command": "node --test scripts/generate-standard-journeys.test.mjs", + "workflow": ".github/workflows/ci.yml#docs", + "revision": "main", + "lifecycle": "current_unreleased" + } + }, + "source_label": "Main source (unreleased)", + "section_headings": [ + "Outcome and prerequisites", + "Smallest complete configuration", + "Project tree and artifact ownership", + "Synthetic fixture and expected trace", + "Contract this journey proves", + "Test, explain, compare, and build", + "Review authored and generated artifacts", + "What each gate proves", + "Production delta", + "Troubleshooting and next task" + ], + "configuration_files": [ + { + "source": "crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/registry-stack.yaml", + "destination": "fhir-project/registry-stack.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic", + "language": "yaml", + "content": "integrations:\n coverage:\n file: integrations/coverage/integration.yaml\nregistry:\n id: fictional-fhir-registry\nservices:\n coverage-verification:\n access:\n scopes:\n - evidence:coverage:read\n claims:\n coverage-active:\n cel: |-\n coverage.coverage_status != null\n ? coverage.matched && coverage.coverage_status == \"active\"\n : false\n disclosure: predicate\n insurer-name:\n disclosure: value\n output: coverage.insurer_name\n patient-record-exists:\n cel: coverage.matched\n disclosure: predicate\n consent: not_required\n consultations:\n coverage:\n input:\n birthdate: request.target.identifiers.birthdate\n family: request.target.identifiers.family\n given: request.target.identifiers.given\n integration: coverage\n credential_profiles:\n coverage-status:\n claims:\n - patient-record-exists\n - coverage-active\n - insurer-name\n format: dc+sd-jwt\n type: https://credentials.invalid/coverage-status/v1\n validity: 5m\n kind: evidence\n legal_basis: public-service-delivery\n purpose: coverage-verification\n version: 1\nstarter:\n content_digest: sha256:b99bff37a59c34d90ee6d212b61fd5f50e0ec6995310f574c5020535ebbd4f8d\n id: fhir-r4\n release: 0.13.0\nversion: 1\n" + }, + { + "source": "crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/environments/local.yaml", + "destination": "fhir-project/environments/local.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic", + "language": "yaml", + "content": "callers:\n coverage-service:\n api_key_fingerprint:\n secret: COVERAGE_SERVICE_TOKEN_HASH\n scopes:\n - evidence:coverage:read\ndeployment:\n notary:\n service: fhir-notary\n profile: local\n relay:\n service: fhir-relay\nintegrations:\n coverage:\n source:\n credential:\n generation: 1\n token:\n secret: FHIR_ACCESS_TOKEN\n origin: https://coverage.fixture.invalid\nissuance:\n generation: 1\n issuer: did:web:fhir-notary.invalid\n signing_key:\n secret: REGISTRY_NOTARY_ISSUER_JWK\n signing_kid: project-issuer-key\nnotary_relay:\n base_url: http://127.0.0.1:8080\n token_file: /run/secrets/relay-workload-token\n workload_client_id: fhir-notary\nrelay:\n allowed_clients:\n - fhir-relay-client\n audience: registry-relay\n issuer: https://workload-issuer.internal.invalid\n jwks_url: https://workload-issuer.internal.invalid/.well-known/jwks.json\n origin: https://fhir-relay.internal.invalid\nversion: 1\n" + }, + { + "source": "crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/integration.yaml", + "destination": "fhir-project/integrations/coverage/integration.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic", + "language": "yaml", + "content": "capability:\n script:\n file: adapter.rhai\nid: fhir-r4-coverage-active\ninput:\n birthdate:\n format: date\n maxLength: 10\n role: selector\n type: string\n family:\n maxLength: 80\n role: selector\n type: string\n given:\n maxLength: 80\n role: selector\n type: string\nlimits:\n calls: 4\n deadline: 12s\n request_bytes: 8KiB\n source_bytes: 512KiB\noutputs:\n coverage_status:\n maxLength: 16\n type:\n - string\n - \"null\"\n insurer_name:\n maxLength: 120\n type:\n - string\n - \"null\"\nrevision: 1\nsource:\n allow:\n - method: GET\n path: /fhir/Patient\n - method: GET\n path: /fhir/Coverage\n - method: GET\n path: /fhir/Organization/*\n auth:\n type: static_bearer\n product: project-fhir-server\n response:\n format: json\n max_bytes: 128KiB\n versions:\n unverified:\n - r4-fixture-v1\nversion: 1\n" + }, + { + "source": "crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/adapter.rhai", + "destination": "fhir-project/integrations/coverage/adapter.rhai", + "format": "rhai", + "public_boundary": "maintained_synthetic", + "language": "rhai", + "content": "fn patient_matches_selectors(patient, input) {\n if patient.birthDate != input.birthdate {\n return false;\n }\n for name in patient.name {\n if name.family == input.family {\n for given in name.given {\n if given == input.given {\n return true;\n }\n }\n }\n }\n false\n}\n\nfn consult(ctx) {\n let patient_response = source.get(\"/fhir/Patient\", #{\n query: #{\n _count: 2,\n birthdate: ctx.input.birthdate,\n family: ctx.input.family,\n given: ctx.input.given\n }\n });\n if patient_response.status != 200 {\n return result.fail(failure.source_rejected);\n }\n let page = protocol.fhir.parse_searchset(patient_response, \"Patient\");\n let patients = page.matches;\n if patients.len < 2 && page.next != () {\n let continuation_response = source.get(page.next);\n if continuation_response.status != 200 {\n return result.fail(failure.source_rejected);\n }\n let continuation = protocol.fhir.parse_searchset(continuation_response, \"Patient\");\n for patient in continuation.matches {\n patients.push(patient);\n }\n if continuation.next != () {\n return result.ambiguous();\n }\n }\n if patients.len == 0 {\n return result.no_match();\n }\n if patients.len > 1 {\n return result.ambiguous();\n }\n let patient = patients[0];\n if !patient_matches_selectors(patient, ctx.input) {\n return result.fail(failure.subject_mismatch);\n }\n\n let coverage_response = source.get(\"/fhir/Coverage\", #{\n query: #{ _count: 2, beneficiary: \"Patient/\" + patient.id }\n });\n if coverage_response.status != 200 {\n return result.fail(failure.source_rejected);\n }\n let coverage_search = protocol.fhir.parse_searchset(coverage_response, \"Coverage\");\n if coverage_search.matches.len == 0 {\n return result.no_match();\n }\n if coverage_search.matches.len > 1 || coverage_search.next != () {\n return result.ambiguous();\n }\n let coverage = coverage_search.matches[0];\n let payor_reference = coverage.payor[0].reference;\n let reference_parts = payor_reference.split(\"/\");\n if reference_parts.len != 2 || reference_parts[0] != \"Organization\" {\n return result.fail(failure.source_rejected);\n }\n\n let organization_target = source.path(\n \"/fhir/Organization/{organization_id}\",\n #{ organization_id: reference_parts[1] }\n );\n let organization_response = source.get(organization_target);\n if organization_response.status != 200 || organization_response.body.resourceType != \"Organization\" {\n return result.fail(failure.source_rejected);\n }\n result.match(#{\n coverage_status: coverage.status,\n insurer_name: organization_response.body.name\n })\n}\n" + } + ], + "fixture_excerpt": { + "language": "yaml", + "content": "classification: synthetic\nexpect:\n claims:\n coverage-active: true\n insurer-name: Synthetic Health Fund\n patient-record-exists: true\n outcome: match\n outputs:\n coverage_status: active\n insurer_name: Synthetic Health Fund\ninput:\n birthdate: 2018-05-12\n family: Example\n given: Ada\ninteractions:\n - expect:\n method: GET\n path: /fhir/Patient\n query:\n _count: 2\n birthdate: 2018-05-12\n family: Example\n given: Ada\n respond:\n body:\n entry:\n - resource:\n birthDate: 2018-05-12\n extension:\n - url: https://example.invalid/ignored\n valueString: synthetic-extra\n id: patient-1\n managingOrganization:\n reference: Organization/org-1\n name:\n - family: Example\n given:\n - Ada\n - Synthetic\n use: official\n resourceType: Patient\n search:\n mode: match\n resourceType: Bundle\n total: 1\n type: searchset\n status: 200\n - expect:\n method: GET\n path: /fhir/Coverage\n query:\n _count: 2\n beneficiary: Patient/patient-1\n respond:\n body:\n entry:\n - resource:\n beneficiary:\n reference: Patient/patient-1\n id: coverage-1\n payor:\n - reference: Organization/org-1\n period:\n start: 2026-01-01\n resourceType: Coverage\n status: active\n search:\n mode: match\n resourceType: Bundle\n total: 1\n type: searchset\n status: 200\n - expect:\n method: GET\n path: /fhir/Organization/org-1\n respond:\n body:\n active: true\n id: org-1\n name: Synthetic Health Fund\n resourceType: Organization\n status: 200\nname: coverage-active\nrequest:\n claims:\n - coverage-active\n disclosure: predicate\n format: application/vnd.registry-notary.claim-result+json\n purpose: coverage-verification\n target:\n identifiers:\n - scheme: birthdate\n value: 2018-05-12\n - scheme: family\n value: Example\n - scheme: given\n value: Ada\n type: Person\n" + }, + "steps": [ + { + "id": "bounded-multi-call-script-init-0", + "kind": "command", + "label": "Required init step", + "cwd": ".", + "argv": [ + "registryctl", + "init", + "--from", + "fhir-r4", + "--project-dir", + "fhir-project" + ] + }, + { + "id": "bounded-multi-call-script-authoring-editor-1", + "kind": "command", + "label": "Required authoring editor step", + "cwd": ".", + "argv": [ + "registryctl", + "authoring", + "editor", + "--project-dir", + "fhir-project" + ] + }, + { + "id": "bounded-multi-call-script-test-2", + "kind": "command", + "label": "Required test step", + "cwd": ".", + "argv": [ + "registryctl", + "test", + "--project-dir", + "fhir-project", + "--integration", + "coverage", + "--fixture", + "coverage-active", + "--trace" + ] + }, + { + "id": "bounded-multi-call-script-test", + "kind": "long_running", + "label": "Optional watch loop", + "cwd": ".", + "argv": [ + "registryctl", + "test", + "--project-dir", + "fhir-project", + "--integration", + "coverage", + "--fixture", + "coverage-active", + "--watch" + ], + "note": "This long-running alternative reruns the focused synthetic fixture after authored files change. It is not part of the required noninteractive sequence." + }, + { + "id": "bounded-multi-call-script-test-3", + "kind": "command", + "label": "Required test step", + "cwd": ".", + "argv": [ + "registryctl", + "test", + "--project-dir", + "fhir-project" + ] + }, + { + "id": "bounded-multi-call-script-check-4", + "kind": "command", + "label": "Required check step", + "cwd": ".", + "argv": [ + "registryctl", + "check", + "--project-dir", + "fhir-project", + "--environment", + "local", + "--explain" + ] + }, + { + "id": "bounded-multi-call-script-semantic-comparison", + "kind": "command", + "label": "Compare authored semantics with the embedded starter", + "cwd": ".", + "argv": [ + "registryctl", + "compare", + "--project-dir", + "fhir-project", + "--environment", + "local", + "--from-starter" + ] + }, + { + "id": "bounded-multi-call-script-build-5", + "kind": "command", + "label": "Required build step", + "cwd": ".", + "argv": [ + "registryctl", + "build", + "--project-dir", + "fhir-project", + "--environment", + "local" + ] + } + ] + }, + { + "id": "exact-snapshot", + "slug": "journeys/exact-snapshot", + "title": "Build an exact immutable snapshot lookup", + "description": "Select at most one materialized record by unique key and project only declared evidence.", + "outcome": "An exact selector reads one snapshot record and emits closed evidence.", + "level": "Intermediate", + "prerequisites": [ + "registryctl built from the current source revision", + "An immutable snapshot schema with a unique primary key", + "Synthetic match and non-match records" + ], + "expected_time": "30 minutes", + "evidence_class": "maintained_offline_fixture", + "evidence_lifecycle": "main_unreleased", + "availability": { + "status": "current_unreleased", + "proof": "source_tree", + "release": null + }, + "canonical_sources": [ + "crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/registry-stack.yaml", + "crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/environments/local.yaml", + "crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/entities/people.yaml", + "crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/integrations/person-snapshot/integration.yaml", + "crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/integrations/person-snapshot/fixtures/match.yaml" + ], + "canonical_workspace": { + "id": "snapshot", + "path": "crates/registryctl/tests/fixtures/project-authoring/snapshot-exact" + }, + "catalog_references": [ + { + "catalog": "project_authoring", + "id": "snapshot" + }, + { + "catalog": "projects", + "id": "registry-relay" + }, + { + "catalog": "projects", + "id": "registry-notary" + } + ], + "minimal_configuration": { + "files": [ + { + "source": "crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/registry-stack.yaml", + "destination": "snapshot-project/registry-stack.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic" + }, + { + "source": "crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/environments/local.yaml", + "destination": "snapshot-project/environments/local.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic" + }, + { + "source": "crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/entities/people.yaml", + "destination": "snapshot-project/entities/people.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic" + }, + { + "source": "crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/integrations/person-snapshot/integration.yaml", + "destination": "snapshot-project/integrations/person-snapshot/integration.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic" + } + ], + "note": "The complete maintained set includes the entity and unique-key materialization contract as well as the exact lookup. Ambiguity is structurally not applicable only while that primary-key invariant holds." + }, + "artifacts": [ + { + "path": "snapshot-project/entities/people.yaml", + "classification": "authored", + "owner": "country_author", + "human_edit": true, + "version_control": true, + "note": "Human-owned entity schema and materialization bounds." + }, + { + "path": "snapshot-project/integrations/person-snapshot/integration.yaml", + "classification": "authored", + "owner": "country_author", + "human_edit": true, + "version_control": true, + "note": "Exact selector and evidence projection." + }, + { + "path": "snapshot-project/integrations/person-snapshot/fixtures/match.yaml", + "classification": "synthetic_fixture", + "owner": "country_author", + "human_edit": true, + "version_control": true, + "note": "Maintained offline match evidence." + }, + { + "path": "snapshot-project/.registry-stack/build/local/reviewable", + "classification": "generated_unsigned", + "owner": "registryctl", + "human_edit": false, + "version_control": false, + "note": "Exact emitted human-review directory for snapshot semantics." + }, + { + "path": "snapshot-project/.registry-stack/build/local/private/relay", + "classification": "generated_unsigned", + "owner": "registryctl", + "human_edit": false, + "version_control": false, + "note": "Exact emitted unsigned Relay input containing snapshot materialization requirements." + }, + { + "path": "snapshot-project/.registry-stack/build/local/private/notary", + "classification": "generated_unsigned", + "owner": "registryctl", + "human_edit": false, + "version_control": false, + "note": "Exact emitted unsigned Notary input for the combined project." + } + ], + "fixture": { + "source": "crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/integrations/person-snapshot/fixtures/match.yaml", + "format": "yaml", + "expected_trace": [ + "The unique selector addresses at most one record.", + "The selected record projects only declared outputs.", + "Expected claims are evaluated from normalized snapshot evidence." + ] + }, + "contract": { + "proves": [ + "Exact selection and projection match the maintained synthetic fixture.", + "Authored snapshot and evidence contracts are statically coherent.", + "Ambiguity is not applicable because the exact selector is the materialized unique primary key." + ], + "does_not_prove": [ + "Production snapshot freshness, completeness, or unique-key enforcement." + ] + }, + "command_recipe": { + "kind": "matrix", + "matrix_id": "snapshot" + }, + "review": [ + "Review primary key, materialization bounds, freshness, and output projection.", + "Confirm fixtures contain synthetic data only.", + "Keep ambiguity not applicable only while the unique-key constraint remains enforced.", + "Keep runtime snapshot generations outside version control." + ], + "gates": [ + { + "name": "fixture", + "proves": "Exact selection and projection match the synthetic conversation.", + "does_not_prove": "Production freshness or completeness." + }, + { + "name": "check", + "proves": "Static snapshot and evidence contracts are coherent.", + "does_not_prove": "Runtime snapshot files are available." + }, + { + "name": "build", + "proves": "Unsigned Relay input contains the reviewed snapshot materialization requirements.", + "does_not_prove": "A runtime loaded a concrete snapshot generation or the upstream collection is complete." + } + ], + "production_delta": { + "environment": "Bind the reviewed candidate to the intended production environment and product instance.", + "secrets": "Provision credentials and trust material through operator-managed references.", + "approval": "Record country-author, product-owner, and operator approval for the reviewed candidate.", + "signing": "Sign each immutable product input with the authorized product-specific identity.", + "activation": "Verify, activate, observe, and retain rollback evidence independently for each product." + }, + "troubleshooting": [ + { + "code": "registryctl.authoring.project.invalid", + "family": "authoring_validation", + "product": "registryctl", + "meaning": "Project services, entities, integrations, and references must form a closed valid graph.", + "remediation": "Align the project declaration and referenced contracts.", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.project.invalid", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "code": "fixture.request_mismatch", + "family": "fixture_execution", + "product": "registryctl_relay_offline_harness", + "meaning": "The rendered request or call order did not match the fixture expectation.", + "remediation": "Align the fixture request expectation with the compiled plan.", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--fixture.request_mismatch", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "code": "registryctl.preflight.runtime_file_missing", + "family": "operator_preflight", + "product": "registryctl", + "meaning": "A declared runtime file is missing.", + "remediation": "Replace the runtime file.", + "docs_anchor": "/reference/diagnostics/operator/#registryctl--registryctl.preflight.runtime_file_missing", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "Preflight does not contact live sources or prove remote availability." + } + ], + "next_task": { + "label": "Consume registry-backed evidence in Notary", + "href": "/journeys/registry-backed-notary-claim/" + }, + "evidence": { + "extraction": { + "status": "verified", + "source_path": "docs/site/scripts/generate-standard-journeys.test.mjs", + "test_id": "extracts every declared complete configuration file from its canonical source", + "command": "node --test scripts/generate-standard-journeys.test.mjs", + "workflow": ".github/workflows/ci.yml#docs", + "revision": "main", + "lifecycle": "current_unreleased" + }, + "execution": { + "status": "verified", + "source_path": "crates/registryctl/tests/project_authoring.rs", + "test_id": "every_cataloged_supported_project_authoring_command_is_automated", + "command": "cargo build --locked -p registryctl --bin registryctl && cargo test --locked -p registryctl --test project_authoring every_cataloged_supported_project_authoring_command_is_automated -- --exact", + "workflow": ".github/workflows/ci.yml#project-authoring-determinism", + "revision": "main", + "lifecycle": "current_unreleased" + }, + "runtime": { + "status": "not_claimed", + "source_path": "docs/site/scripts/generate-standard-journeys.test.mjs", + "test_id": "keeps runtime and product activation claims bounded to traceable evidence", + "command": "node --test scripts/generate-standard-journeys.test.mjs", + "workflow": ".github/workflows/ci.yml#docs", + "revision": "main", + "lifecycle": "current_unreleased" + } + }, + "source_label": "Main source (unreleased)", + "section_headings": [ + "Outcome and prerequisites", + "Smallest complete configuration", + "Project tree and artifact ownership", + "Synthetic fixture and expected trace", + "Contract this journey proves", + "Test, explain, compare, and build", + "Review authored and generated artifacts", + "What each gate proves", + "Production delta", + "Troubleshooting and next task" + ], + "configuration_files": [ + { + "source": "crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/registry-stack.yaml", + "destination": "snapshot-project/registry-stack.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic", + "language": "yaml", + "content": "entities:\n people:\n file: entities/people.yaml\nintegrations:\n person-snapshot:\n file: integrations/person-snapshot/integration.yaml\nregistry:\n id: fictional-population-registry\nservices:\n benefits-eligibility:\n access:\n scopes:\n - evidence:population:read\n claims:\n population-record-exists:\n cel: person.matched\n disclosure: predicate\n population-registration-status:\n disclosure: value\n output: person.registration_status\n residency-confirmed:\n disclosure: predicate\n output: person.residency_confirmed\n consent: not_required\n consultations:\n person:\n input:\n person_id: request.target.identifiers.population_person_id\n integration: person-snapshot\n credential_profiles:\n population-evidence:\n claims:\n - population-record-exists\n - population-registration-status\n - residency-confirmed\n format: dc+sd-jwt\n type: https://credentials.invalid/population-evidence/v1\n validity: 10m\n kind: evidence\n legal_basis: public-service-delivery\n purpose: benefits-eligibility\n version: 1\n emergency-assistance:\n access:\n scopes:\n - evidence:population:emergency\n claims:\n emergency-record-exists:\n cel: person.matched\n disclosure: predicate\n emergency-status:\n disclosure: redacted\n output: person.registration_status\n consent: not_required\n consultations:\n person:\n input:\n person_id: request.target.identifiers.population_person_id\n integration: person-snapshot\n credential_profiles:\n emergency-status:\n claims:\n - emergency-record-exists\n - emergency-status\n format: dc+sd-jwt\n type: https://credentials.invalid/emergency-status/v1\n validity: 5m\n kind: evidence\n legal_basis: vital-interests\n purpose: emergency-assistance\n version: 1\nstarter:\n content_digest: sha256:8fb0772e01333fd084974550f76829e829bc43f6e6941ac50d2e92522baadede\n id: snapshot\n release: 0.13.0\nversion: 1\n" + }, + { + "source": "crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/environments/local.yaml", + "destination": "snapshot-project/environments/local.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic", + "language": "yaml", + "content": "callers:\n benefits-service:\n api_key_fingerprint:\n secret: BENEFITS_SERVICE_TOKEN_HASH\n scopes:\n - evidence:population:read\n emergency-service:\n api_key_fingerprint:\n secret: EMERGENCY_SERVICE_TOKEN_HASH\n scopes:\n - evidence:population:emergency\ndeployment:\n notary:\n service: population-notary\n profile: local\n relay:\n service: population-relay\nentities:\n people:\n columns:\n guardian_id: guardian_key\n person_id: subject_key\n registration_status: status_code\n residency_confirmed: residency_flag\n generation: 2026-07-12\n provider:\n header_row: 1\n path: /var/lib/registry/population.csv\n type: csv\n source_revision: population-export-v1\nissuance:\n generation: 1\n issuer: did:web:population-notary.invalid\n signing_key:\n secret: REGISTRY_NOTARY_ISSUER_JWK\n signing_kid: project-issuer-key\nnotary_relay:\n base_url: http://127.0.0.1:8080\n token_file: /run/secrets/relay-workload-token\n workload_client_id: population-notary\nrelay:\n allowed_clients:\n - population-relay-client\n audience: registry-relay\n issuer: https://workload-issuer.internal.invalid\n jwks_url: https://workload-issuer.internal.invalid/.well-known/jwks.json\n origin: https://population-relay.internal.invalid\nversion: 1\n" + }, + { + "source": "crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/entities/people.yaml", + "destination": "snapshot-project/entities/people.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic", + "language": "yaml", + "content": "id: people\nmaterialization:\n max_bytes: 256MiB\n max_records: 1000000\n refresh: manual\n retain_generations: 2\nprimary_key: person_id\nrevision: 1\nschema:\n additionalProperties: false\n properties:\n guardian_id:\n maxLength: 64\n type:\n - string\n - \"null\"\n person_id:\n maxLength: 64\n type: string\n registration_status:\n maxLength: 32\n type:\n - string\n - \"null\"\n residency_confirmed:\n type:\n - boolean\n - \"null\"\n required:\n - person_id\n - registration_status\n - residency_confirmed\n - guardian_id\n type: object\nversion: 1\n" + }, + { + "source": "crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/integrations/person-snapshot/integration.yaml", + "destination": "snapshot-project/integrations/person-snapshot/integration.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic", + "language": "yaml", + "content": "capability:\n snapshot:\n entity: people\n exact:\n person_id:\n input: person_id\n freshness: 24h\nid: population-person-snapshot\ninput:\n person_id:\n maxLength: 12\n pattern: ^PER-[0-9]{8}$\n role: selector\n type: string\nnot_applicable:\n ambiguity:\n rationale: The exact snapshot selector is the entity primary key, whose materialized unique-key constraint permits at most one record.\n request_fixture: snapshot-match\n subject_mismatch:\n rationale: The selected snapshot output projection omits the primary key, so it contains no identifier comparable with the requested person identifier.\n request_fixture: snapshot-match\noutputs:\n - registration_status\n - residency_confirmed\nrevision: 1\nversion: 1\n" + } + ], + "fixture_excerpt": { + "language": "yaml", + "content": "classification: synthetic\nexpect:\n claims:\n emergency-record-exists: true\n emergency-status: redacted\n population-record-exists: true\n population-registration-status: active\n residency-confirmed: true\n outcome: match\n outputs:\n registration_status: active\n residency_confirmed: true\ninput:\n person_id: PER-00000001\ninteractions:\n - expect:\n method: GET\n path: /snapshot\n respond:\n body:\n registration_status: active\n residency_confirmed: true\n status: 200\nname: snapshot-match\nrequest:\n claims:\n - population-record-exists\n disclosure: predicate\n format: application/vnd.registry-notary.claim-result+json\n purpose: benefits-eligibility\n target:\n identifiers:\n - scheme: population_person_id\n value: PER-00000001\n type: Person\n" + }, + "steps": [ + { + "id": "exact-snapshot-init-0", + "kind": "command", + "label": "Required init step", + "cwd": ".", + "argv": [ + "registryctl", + "init", + "--from", + "snapshot", + "--project-dir", + "snapshot-project" + ] + }, + { + "id": "exact-snapshot-authoring-editor-1", + "kind": "command", + "label": "Required authoring editor step", + "cwd": ".", + "argv": [ + "registryctl", + "authoring", + "editor", + "--project-dir", + "snapshot-project" + ] + }, + { + "id": "exact-snapshot-test-2", + "kind": "command", + "label": "Required test step", + "cwd": ".", + "argv": [ + "registryctl", + "test", + "--project-dir", + "snapshot-project", + "--integration", + "person-snapshot", + "--fixture", + "snapshot-match", + "--trace" + ] + }, + { + "id": "exact-snapshot-test", + "kind": "long_running", + "label": "Optional watch loop", + "cwd": ".", + "argv": [ + "registryctl", + "test", + "--project-dir", + "snapshot-project", + "--integration", + "person-snapshot", + "--fixture", + "snapshot-match", + "--watch" + ], + "note": "This long-running alternative reruns the focused synthetic fixture after authored files change. It is not part of the required noninteractive sequence." + }, + { + "id": "exact-snapshot-test-3", + "kind": "command", + "label": "Required test step", + "cwd": ".", + "argv": [ + "registryctl", + "test", + "--project-dir", + "snapshot-project" + ] + }, + { + "id": "exact-snapshot-check-4", + "kind": "command", + "label": "Required check step", + "cwd": ".", + "argv": [ + "registryctl", + "check", + "--project-dir", + "snapshot-project", + "--environment", + "local", + "--explain" + ] + }, + { + "id": "exact-snapshot-semantic-comparison", + "kind": "command", + "label": "Compare authored semantics with the embedded starter", + "cwd": ".", + "argv": [ + "registryctl", + "compare", + "--project-dir", + "snapshot-project", + "--environment", + "local", + "--from-starter" + ] + }, + { + "id": "exact-snapshot-build-5", + "kind": "command", + "label": "Required build step", + "cwd": ".", + "argv": [ + "registryctl", + "build", + "--project-dir", + "snapshot-project", + "--environment", + "local" + ] + } + ] + }, + { + "id": "registry-backed-notary-claim", + "slug": "journeys/registry-backed-notary-claim", + "title": "Evaluate a registry-backed Notary predicate", + "description": "Evaluate one disclosure-minimizing Notary claim from normalized Relay evidence.", + "outcome": "Notary returns the explicit active-registration-exists predicate from registry-backed evidence.", + "level": "Intermediate", + "prerequisites": [ + "A Relay person-demographics integration", + "registryctl and images built from one exact source revision", + "Synthetic match, pending, non-match, and ambiguity fixtures" + ], + "expected_time": "25 minutes", + "evidence_class": "source_and_generated_contract", + "evidence_lifecycle": "main_unreleased", + "availability": { + "status": "current_unreleased", + "proof": "source_tree", + "release": null + }, + "canonical_sources": [ + "crates/registryctl/src/templates/notary_addon/registry-stack.yaml", + "crates/registryctl/src/templates/notary_addon/environments/local.yaml", + "crates/registryctl/src/templates/notary_addon/integrations/person-demographics/integration.yaml", + "crates/registryctl/src/templates/notary_addon/integrations/person-demographics/fixtures/match.yaml" + ], + "canonical_workspace": { + "id": "registry-notary", + "path": "crates/registryctl/src/templates/notary_addon" + }, + "catalog_references": [ + { + "catalog": "projects", + "id": "registry-relay" + }, + { + "catalog": "projects", + "id": "registry-notary" + }, + { + "catalog": "contracts", + "id": "registry-notary.openapi" + } + ], + "minimal_configuration": { + "files": [ + { + "source": "crates/registryctl/src/templates/notary_addon/registry-stack.yaml", + "destination": "my-first-api/notary/project/registry-stack.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic" + }, + { + "source": "crates/registryctl/src/templates/notary_addon/environments/local.yaml", + "destination": "my-first-api/notary/project/environments/local.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic" + }, + { + "source": "crates/registryctl/src/templates/notary_addon/integrations/person-demographics/integration.yaml", + "destination": "my-first-api/notary/project/integrations/person-demographics/integration.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic" + } + ], + "note": "The add-on step emits this complete authored Notary project set. The explicit active-registration-exists predicate remains in the full project file and is checked against the maintained fixture." + }, + "artifacts": [ + { + "path": "my-first-api/notary/project/registry-stack.yaml", + "classification": "authored", + "owner": "country_author", + "human_edit": true, + "version_control": true, + "note": "Human-owned consultation and claim rule." + }, + { + "path": "my-first-api/notary/project/integrations/person-demographics/fixtures/match.yaml", + "classification": "synthetic_fixture", + "owner": "country_author", + "human_edit": true, + "version_control": true, + "note": "Maintained predicate expectation." + }, + { + "path": "my-first-api/notary/project/.registry-stack/build/local/reviewable", + "classification": "generated_unsigned", + "owner": "registryctl", + "human_edit": false, + "version_control": false, + "note": "Exact emitted human-review directory for the Notary project build." + }, + { + "path": "my-first-api/notary/project/.registry-stack/build/local/private/relay", + "classification": "generated_unsigned", + "owner": "registryctl", + "human_edit": false, + "version_control": false, + "note": "Exact emitted unsigned Relay consultation input." + }, + { + "path": "my-first-api/notary/project/.registry-stack/build/local/private/notary", + "classification": "generated_unsigned", + "owner": "registryctl", + "human_edit": false, + "version_control": false, + "note": "Exact emitted unsigned Notary product input." + } + ], + "fixture": { + "source": "crates/registryctl/src/templates/notary_addon/integrations/person-demographics/fixtures/match.yaml", + "format": "yaml", + "expected_trace": [ + "Relay-backed enrollment evidence matches with active status.", + "Notary evaluates active-registration-exists.", + "The response discloses the predicate rather than the source record." + ] + }, + "contract": { + "proves": [ + "The maintained fixture expects active-registration-exists to be true.", + "Relay evidence and the Notary predicate agree in current source.", + "True means the bounded selected source returned exactly one matching active registration." + ], + "does_not_prove": [ + "Live registry data, workload identity, or production policy approval.", + "False does not prove global nonexistence, identity fraud, ineligibility, or a legal negative.", + "The result does not prove that the caller is the matched person." + ] + }, + "command_recipe": { + "kind": "notary_claim" + }, + "review": [ + "Review the consultation mapping, claim identifier, CEL rule, and all fixture claim keys.", + "Confirm the rule discloses no unnecessary attributes.", + "Keep false bounded to no active matching record found by this consultation in the selected source.", + "Review Relay and Notary generated inputs independently." + ], + "gates": [ + { + "name": "fixture", + "proves": "The maintained match produces the explicit predicate.", + "does_not_prove": "Live registry data produces the same result." + }, + { + "name": "cross-product check", + "proves": "Relay outputs and Notary dependencies are statically compatible.", + "does_not_prove": "Runtime trust and network configuration are valid." + }, + { + "name": "smoke", + "proves": "The local combined runtime satisfies its packaged smoke contract.", + "does_not_prove": "Production legal, disclosure, or availability requirements." + } + ], + "production_delta": { + "environment": "Bind the reviewed candidate to the intended production environment and product instance.", + "secrets": "Provision credentials and trust material through operator-managed references.", + "approval": "Record country-author, product-owner, and operator approval for the reviewed candidate.", + "signing": "Sign each immutable product input with the authorized product-specific identity.", + "activation": "Verify, activate, observe, and retain rollback evidence independently for each product." + }, + "troubleshooting": [ + { + "code": "registryctl.authoring.project.invalid", + "family": "authoring_validation", + "product": "registryctl", + "meaning": "Project services, entities, integrations, and references must form a closed valid graph.", + "remediation": "Align the project declaration and referenced contracts.", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.project.invalid", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "code": "fixture.request_mismatch", + "family": "fixture_execution", + "product": "registryctl_relay_offline_harness", + "meaning": "The rendered request or call order did not match the fixture expectation.", + "remediation": "Align the fixture request expectation with the compiled plan.", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--fixture.request_mismatch", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "code": "notary.relay.profile_mismatch", + "family": "notary_activation", + "product": "registry_notary", + "meaning": "Relay consultation profile does not match the configured contract pin", + "remediation": "reconcile the Notary profile id and contract hash with the reviewed Relay consultation contract", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--relay-profile-mismatch", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + } + ], + "next_task": { + "label": "Promote generated product inputs", + "href": "/journeys/product-input-lifecycle/" + }, + "evidence": { + "extraction": { + "status": "verified", + "source_path": "docs/site/scripts/generate-standard-journeys.test.mjs", + "test_id": "extracts every declared complete configuration file from its canonical source", + "command": "node --test scripts/generate-standard-journeys.test.mjs", + "workflow": ".github/workflows/ci.yml#docs", + "revision": "main", + "lifecycle": "current_unreleased" + }, + "execution": { + "status": "verified", + "source_path": "docs/site/scripts/check-registryctl-tutorials.sh", + "test_id": "run_notary_tutorial()", + "command": "npm run check:tutorial:registryctl", + "workflow": ".github/workflows/ci.yml#registryctl-tutorials", + "revision": "main", + "lifecycle": "current_unreleased" + }, + "runtime": { + "status": "verified", + "source_path": "docs/site/scripts/check-registryctl-tutorials.sh", + "test_id": "run_notary_tutorial()", + "command": "npm run check:tutorial:registryctl", + "workflow": ".github/workflows/ci.yml#registryctl-tutorials", + "revision": "main", + "lifecycle": "current_unreleased" + } + }, + "source_label": "Main source (unreleased)", + "section_headings": [ + "Outcome and prerequisites", + "Smallest complete configuration", + "Project tree and artifact ownership", + "Synthetic fixture and expected trace", + "Contract this journey proves", + "Test, explain, compare, and build", + "Review authored and generated artifacts", + "What each gate proves", + "Production delta", + "Troubleshooting and next task" + ], + "configuration_files": [ + { + "source": "crates/registryctl/src/templates/notary_addon/registry-stack.yaml", + "destination": "my-first-api/notary/project/registry-stack.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic", + "language": "yaml", + "content": "entities:\n person:\n file: entities/person.yaml\nintegrations:\n person-demographics:\n file: integrations/person-demographics/integration.yaml\nregistry:\n id: tutorial-benefits-registry\nservices:\n registration-verification:\n access:\n scopes:\n - benefits_casework:evidence\n claims:\n active-registration-exists:\n cel: enrollment.matched && enrollment.registration_status == \"active\"\n disclosure: predicate\n consent: not_required\n consultations:\n enrollment:\n input:\n date_of_birth: request.target.attributes.date_of_birth\n family_name: request.target.attributes.family_name\n given_name: request.target.attributes.given_name\n integration: person-demographics\n kind: evidence\n legal_basis: public-service-delivery\n purpose: https://example.local/purpose/tutorial\n version: 1\nversion: 1\n" + }, + { + "source": "crates/registryctl/src/templates/notary_addon/environments/local.yaml", + "destination": "my-first-api/notary/project/environments/local.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic", + "language": "yaml", + "content": "callers:\n tutorial-evaluator:\n api_key_fingerprint:\n secret: TUTORIAL_EVALUATOR_HASH\n scopes:\n - benefits_casework:evidence\ndeployment:\n notary:\n service: registry-notary\n profile: local\n relay:\n service: registry-relay-consultation\nentities:\n person:\n columns:\n date_of_birth: date_of_birth\n family_name: family_name\n given_name: given_name\n household_id: household_id\n national_id: national_id\n person_id: person_id\n registration_status: registration_status\n relationship_to_head: relationship_to_head\n generation: tutorial-local-v1\n provider:\n header_row: 1\n path: /var/lib/registry/benefits_casework.xlsx\n sheet: Persons\n type: xlsx\n source_revision: tutorial-benefits-workbook-v1\nnotary_cel:\n worker_memory_bytes: 1073741824\nnotary_relay:\n base_url: http://127.0.0.1:8082\n token_file: /run/secrets/notary-relay.jwt\n workload_client_id: registry-notary\nrelay:\n allowed_clients:\n - registry-notary\n audience: registry-relay\n issuer: http://127.0.0.1:8081\n jwks_url: http://127.0.0.1:8083/jwks.json\n origin: http://127.0.0.1:8082\nversion: 1\n" + }, + { + "source": "crates/registryctl/src/templates/notary_addon/integrations/person-demographics/integration.yaml", + "destination": "my-first-api/notary/project/integrations/person-demographics/integration.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic", + "language": "yaml", + "content": "capability:\n snapshot:\n entity: person\n exact:\n date_of_birth:\n input: date_of_birth\n family_name:\n input: family_name\n given_name:\n input: given_name\n freshness: 24h\nid: tutorial-person-demographics\ninput:\n date_of_birth:\n format: date\n maxLength: 10\n role: selector\n type: string\n family_name:\n maxLength: 80\n role: selector\n type: string\n given_name:\n maxLength: 80\n role: selector\n type: string\nnot_applicable:\n subject_mismatch:\n rationale: The exact snapshot selector applies name and date of birth before returning registration status; the minimized projection contains no selector-comparable identifier.\n request_fixture: jo-elm-match\noutputs:\n - registration_status\nrevision: 1\nversion: 1\n" + } + ], + "fixture_excerpt": { + "language": "yaml", + "content": "classification: synthetic\nexpect:\n claims:\n active-registration-exists: true\n outcome: match\n outputs:\n registration_status: active\ninput:\n date_of_birth: 2019-02-03\n family_name: Elm\n given_name: Jo\ninteractions:\n - expect:\n method: GET\n path: /snapshot\n respond:\n body:\n registration_status: active\n status: 200\nname: jo-elm-match\n" + }, + "steps": [ + { + "id": "notary-init", + "kind": "command", + "label": "Create the disposable Relay scaffold", + "cwd": ".", + "argv": [ + "registryctl", + "init", + "relay", + "my-first-api", + "--sample", + "benefits" + ] + }, + { + "id": "notary-add", + "kind": "command", + "label": "Add the maintained Notary project", + "cwd": "my-first-api", + "argv": [ + "registryctl", + "add", + "notary" + ] + }, + { + "id": "notary-test", + "kind": "command", + "label": "Execute every Notary project fixture offline", + "cwd": ".", + "argv": [ + "registryctl", + "test", + "--project-dir", + "my-first-api/notary/project" + ] + }, + { + "id": "notary-check", + "kind": "command", + "label": "Check and explain the combined project", + "cwd": ".", + "argv": [ + "registryctl", + "check", + "--project-dir", + "my-first-api/notary/project", + "--environment", + "local", + "--explain" + ] + }, + { + "id": "notary-build", + "kind": "command", + "label": "Build separate unsigned product inputs", + "cwd": ".", + "argv": [ + "registryctl", + "build", + "--project-dir", + "my-first-api/notary/project", + "--environment", + "local" + ] + }, + { + "id": "notary-start", + "kind": "long_running", + "label": "Start the combined disposable runtime", + "cwd": "my-first-api", + "argv": [ + "registryctl", + "start" + ], + "note": "This runtime step is exercised by the source tutorial gate and remains separate from the required clean-temp sequence." + } + ] + }, + { + "id": "product-input-lifecycle", + "slug": "journeys/product-input-lifecycle", + "title": "Review and promote generated product inputs", + "description": "Keep authoring, generation, signing, verification, and activation as separate trust-boundary steps.", + "outcome": "Reviewed authored configuration becomes independently activatable Relay and Notary product inputs.", + "level": "Advanced", + "prerequisites": [ + "A fixture-complete project that passes registryctl check", + "Operator-managed signing identities and product trust anchors", + "Separate Relay and Notary activation authority" + ], + "expected_time": "40 minutes", + "evidence_class": "generated_contract", + "evidence_lifecycle": "main_unreleased", + "availability": { + "status": "current_unreleased", + "proof": "source_tree", + "release": null + }, + "canonical_sources": [ + "docs/site/src/content/docs/reference/registryctl.mdx", + "crates/registryctl/assets/project-starters/bounded-http/registry-stack.yaml", + "crates/registryctl/assets/project-starters/bounded-http/environments/local.yaml", + "crates/registryctl/assets/project-starters/bounded-http/integrations/person-record/integration.yaml", + "crates/registryctl/assets/project-starters/bounded-http/integrations/person-record/fixtures/active.yaml" + ], + "canonical_workspace": { + "id": "http", + "path": "crates/registryctl/assets/project-starters/bounded-http" + }, + "catalog_references": [ + { + "catalog": "project_authoring", + "id": "http" + }, + { + "catalog": "projects", + "id": "registry-relay" + }, + { + "catalog": "projects", + "id": "registry-notary" + } + ], + "minimal_configuration": { + "files": [ + { + "source": "crates/registryctl/assets/project-starters/bounded-http/registry-stack.yaml", + "destination": "registry-project/registry-stack.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic" + }, + { + "source": "crates/registryctl/assets/project-starters/bounded-http/environments/local.yaml", + "destination": "registry-project/environments/local.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic" + }, + { + "source": "crates/registryctl/assets/project-starters/bounded-http/integrations/person-record/integration.yaml", + "destination": "registry-project/integrations/person-record/integration.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic" + } + ], + "note": "The complete maintained source set contains authored intent and synthetic local bindings only. Unsigned product inputs, user-selected bundle outputs, trust anchors, and activation state remain separate." + }, + "artifacts": [ + { + "path": "registry-project/registry-stack.yaml", + "classification": "authored", + "owner": "country_author", + "human_edit": true, + "version_control": true, + "note": "Reviewed authored source of truth." + }, + { + "path": "registry-project/.registry-stack/build/local/reviewable", + "classification": "generated_unsigned", + "owner": "registryctl", + "human_edit": false, + "version_control": false, + "note": "Exact emitted reviewable directory from the deterministic build." + }, + { + "path": "registry-project/.registry-stack/build/local/private/relay", + "classification": "generated_unsigned", + "owner": "registryctl", + "human_edit": false, + "version_control": false, + "note": "Exact emitted unsigned Relay product input." + }, + { + "path": "registry-project/.registry-stack/build/local/private/notary", + "classification": "generated_unsigned", + "owner": "registryctl", + "human_edit": false, + "version_control": false, + "note": "Exact emitted unsigned Notary product input." + }, + { + "path": "journey-output/registry-relay-bundle", + "classification": "generated_signed", + "owner": "operator", + "human_edit": false, + "version_control": false, + "note": "Exact user-selected --out path for the independently signed and verified Relay bundle." + }, + { + "path": "journey-output/registry-notary-bundle", + "classification": "generated_signed", + "owner": "operator", + "human_edit": false, + "version_control": false, + "note": "Exact user-selected --out path for the independently signed and verified Notary bundle." + } + ], + "fixture": { + "source": "crates/registryctl/assets/project-starters/bounded-http/integrations/person-record/fixtures/active.yaml", + "format": "yaml", + "expected_trace": [ + "Fixtures establish authored behavior before build.", + "Check and preflight emit separate value-free reports.", + "Product inputs remain independent through signing, verification, and the product-owned activation handoff." + ] + }, + "contract": { + "proves": [ + "Deterministic unsigned product inputs can be generated from reviewed source.", + "Independently signed Relay and Notary bundles can be verified and made eligible for separate product-owned activation.", + "Relay and Notary inputs, signatures, trust anchors, and anti-rollback sequences remain product-owned and separate." + ], + "does_not_prove": [ + "An unsigned build is trusted, active, healthy, or release-proven.", + "Separate valid product signatures create an atomic project-root activation." + ] + }, + "command_recipe": { + "kind": "product_input_lifecycle", + "matrix_id": "http" + }, + "review": [ + "Review authored semantics and the candidate source commit.", + "Use the build report to locate each product closure.", + "Sign and verify Relay and Notary inputs independently before handing either bundle to its product-owned activation procedure." + ], + "gates": [ + { + "name": "fixture and check", + "proves": "Maintained behavior and static contracts are coherent.", + "does_not_prove": "Runtime readiness or live source compatibility." + }, + { + "name": "preflight diagnostic", + "proves": "A clean workspace reports missing operator files and secret references through the value-free offline contract.", + "does_not_prove": "Operator inputs are provisioned, preflight passes, or the runtime is healthy." + }, + { + "name": "bundle verification", + "proves": "One immutable product closure has accepted signature and target binding.", + "does_not_prove": "The other product is valid or activation succeeds." + }, + { + "name": "activation handoff", + "proves": "Each verified bundle and trust decision is separately identifiable for its product-owned activation procedure.", + "does_not_prove": "Either product activated the bundle, reached readiness, or exercised rollback." + } + ], + "production_delta": { + "environment": "Bind each reviewed product candidate to the intended environment and instance.", + "secrets": "Keep signing keys and trust anchors in operator-managed systems.", + "approval": "Preserve separate author, product-owner, signer, and activator approvals.", + "signing": "Apply product-specific identity, stream, sequence, and bundle bindings.", + "activation": "Exercise readiness, activation, rollback, and last-known-good behavior per product. Relay and Notary activate independently; Registry Stack does not claim atomic project-root activation." + }, + "troubleshooting": [ + { + "code": "registryctl.authoring.project.invalid", + "family": "authoring_validation", + "product": "registryctl", + "meaning": "Project services, entities, integrations, and references must form a closed valid graph.", + "remediation": "Align the project declaration and referenced contracts.", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.project.invalid", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "code": "registryctl.preflight.secret_missing", + "family": "operator_preflight", + "product": "registryctl", + "meaning": "A required secret reference is unavailable to this process.", + "remediation": "Provide the secret to the process environment.", + "docs_anchor": "/reference/diagnostics/operator/#registryctl--registryctl.preflight.secret_missing", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "Preflight does not contact live sources or prove remote availability." + }, + { + "code": "rejected_signature", + "family": "bundle_verification", + "product": "registry_platform_ops", + "meaning": "Bundle authenticity or declared content integrity verification failed.", + "remediation": "Rebuild and sign the complete bundle with an accepted trust configuration.", + "docs_anchor": "/reference/diagnostics/operator/#registry_platform_ops--rejected-signature", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "The category does not disclose signer identifiers, file names, or content digests." + }, + { + "code": "rejected_binding", + "family": "bundle_verification", + "product": "registry_platform_ops", + "meaning": "The bundle binding does not match the intended runtime target.", + "remediation": "Use a bundle issued for the intended runtime binding.", + "docs_anchor": "/reference/diagnostics/operator/#registry_platform_ops--rejected-binding", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "The category does not disclose received or configured binding values." + }, + { + "code": "rejected_rollback", + "family": "bundle_verification", + "product": "registry_platform_ops", + "meaning": "The bundle or override does not satisfy local anti-rollback requirements.", + "remediation": "Use a monotonic bundle or an authorized break-glass selection.", + "docs_anchor": "/reference/diagnostics/operator/#registry_platform_ops--rejected-rollback", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "The category does not disclose stored sequences, content digests, paths, or approval values." + }, + { + "code": "notary.runtime.activation_required", + "family": "notary_activation", + "product": "registry_notary", + "meaning": "Registry Notary runtime activation is required before serving", + "remediation": "run the compiled Registry Notary runtime activation step before building or serving routers", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--runtime-activation-required", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + } + ], + "next_task": { + "label": "Review operator diagnostics", + "href": "/reference/diagnostics/operator/" + }, + "evidence": { + "extraction": { + "status": "verified", + "source_path": "docs/site/scripts/generate-standard-journeys.test.mjs", + "test_id": "extracts every declared complete configuration file from its canonical source", + "command": "node --test scripts/generate-standard-journeys.test.mjs", + "workflow": ".github/workflows/ci.yml#docs", + "revision": "main", + "lifecycle": "current_unreleased" + }, + "execution": { + "status": "verified", + "source_path": "crates/registryctl/tests/project_authoring.rs", + "test_id": "every_cataloged_supported_project_authoring_command_is_automated", + "command": "cargo build --locked -p registryctl --bin registryctl && cargo test --locked -p registryctl --test project_authoring every_cataloged_supported_project_authoring_command_is_automated -- --exact", + "workflow": ".github/workflows/ci.yml#project-authoring-determinism", + "revision": "main", + "lifecycle": "current_unreleased" + }, + "runtime": { + "status": "not_claimed", + "source_path": "docs/site/scripts/generate-standard-journeys.test.mjs", + "test_id": "keeps runtime and product activation claims bounded to traceable evidence", + "command": "node --test scripts/generate-standard-journeys.test.mjs", + "workflow": ".github/workflows/ci.yml#docs", + "revision": "main", + "lifecycle": "current_unreleased" + } + }, + "source_label": "Main source (unreleased)", + "section_headings": [ + "Outcome and prerequisites", + "Smallest complete configuration", + "Project tree and artifact ownership", + "Synthetic fixture and expected trace", + "Contract this journey proves", + "Test, explain, compare, and build", + "Review authored and generated artifacts", + "What each gate proves", + "Production delta", + "Troubleshooting and next task" + ], + "configuration_files": [ + { + "source": "crates/registryctl/assets/project-starters/bounded-http/registry-stack.yaml", + "destination": "registry-project/registry-stack.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic", + "language": "yaml", + "content": "integrations:\n person-record:\n file: integrations/person-record/integration.yaml\nregistry:\n id: fictional-citizen-registry\nservices:\n person-verification:\n access:\n scopes:\n - evidence:person:read\n claims:\n person-active:\n disclosure: value\n output: person_record.active\n person-record-exists:\n cel: person_record.matched\n disclosure: predicate\n consent: not_required\n consultations:\n person_record:\n input:\n person_id: request.target.identifiers.registry_person_id\n integration: person-record\n credential_profiles:\n person-status:\n claims:\n - person-record-exists\n - person-active\n format: dc+sd-jwt\n type: https://credentials.invalid/person-status/v1\n validity: 10m\n kind: evidence\n legal_basis: public-service-delivery\n purpose: public-service-person-verification\n version: 1\nstarter:\n content_digest: sha256:a4e0263957f3dd7756ef1a270483f4aa5f856102f070c6e0325e8cc9b1413b76\n id: http\n release: 0.13.0\nversion: 1\n" + }, + { + "source": "crates/registryctl/assets/project-starters/bounded-http/environments/local.yaml", + "destination": "registry-project/environments/local.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic", + "language": "yaml", + "content": "callers:\n evidence-client:\n api_key_fingerprint:\n secret: EVIDENCE_CLIENT_TOKEN_HASH\n scopes:\n - evidence:person:read\ndeployment:\n notary:\n service: fictional-registry-notary\n profile: local\n relay:\n service: fictional-registry-relay\nintegrations:\n person-record:\n source:\n credential:\n generation: 1\n token:\n secret: FICTIONAL_REGISTRY_TOKEN\n origin: https://citizen-registry.invalid\nissuance:\n generation: 1\n issuer: did:web:notary.invalid\n signing_key:\n secret: REGISTRY_NOTARY_ISSUER_JWK\n signing_kid: project-issuer-key\nnotary_relay:\n base_url: http://127.0.0.1:8080\n token_file: /run/secrets/relay-workload-token\n workload_client_id: fictional-registry-notary\nrelay:\n allowed_clients:\n - fictional-relay-client\n audience: registry-relay\n issuer: https://workload-issuer.internal.invalid\n jwks_url: https://workload-issuer.internal.invalid/.well-known/jwks.json\n origin: https://relay.internal.invalid\nversion: 1\n" + }, + { + "source": "crates/registryctl/assets/project-starters/bounded-http/integrations/person-record/integration.yaml", + "destination": "registry-project/integrations/person-record/integration.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic", + "language": "yaml", + "content": "capability:\n http:\n request:\n method: GET\n path: /people/{input.person_id}\n query:\n fields: active\n response:\n ambiguous:\n - 409\n no_match:\n - 404\nid: person-record\ninput:\n person_id:\n maxLength: 64\n role: selector\n type: string\nnot_applicable:\n subject_mismatch:\n rationale: The selected response projection contains no identifier that can be compared with the requested person identifier.\n request_fixture: active-person\noutputs:\n active:\n type: boolean\n x-registry-source: /active\nrevision: 1\nsource:\n auth:\n type: static_bearer\n product: replace-with-source-product\n versions:\n unverified:\n - replace-with-source-version\nversion: 1\n" + } + ], + "fixture_excerpt": { + "language": "yaml", + "content": "classification: synthetic\nexpect:\n claims:\n person-active: true\n person-record-exists: true\n outcome: match\n outputs:\n active: true\ninput:\n person_id: AB-123456\ninteractions:\n - expect:\n method: GET\n path: /people/AB-123456\n query:\n fields: active\n respond:\n body:\n active: true\n status: 200\nname: active-person\nrequest:\n claims:\n - person-record-exists\n disclosure: predicate\n format: application/vnd.registry-notary.claim-result+json\n purpose: public-service-person-verification\n target:\n identifiers:\n - scheme: registry_person_id\n value: AB-123456\n type: Person\n" + }, + "steps": [ + { + "id": "product-input-lifecycle-init-0", + "kind": "command", + "label": "Required init step", + "cwd": ".", + "argv": [ + "registryctl", + "init", + "--from", + "http", + "--project-dir", + "registry-project" + ] + }, + { + "id": "product-input-lifecycle-authoring-editor-1", + "kind": "command", + "label": "Required authoring editor step", + "cwd": ".", + "argv": [ + "registryctl", + "authoring", + "editor", + "--project-dir", + "registry-project" + ] + }, + { + "id": "product-input-lifecycle-test-2", + "kind": "command", + "label": "Required test step", + "cwd": ".", + "argv": [ + "registryctl", + "test", + "--project-dir", + "registry-project", + "--integration", + "person-record", + "--fixture", + "active-person", + "--trace" + ] + }, + { + "id": "product-input-lifecycle-test", + "kind": "long_running", + "label": "Optional watch loop", + "cwd": ".", + "argv": [ + "registryctl", + "test", + "--project-dir", + "registry-project", + "--integration", + "person-record", + "--fixture", + "active-person", + "--watch" + ], + "note": "This long-running alternative reruns the focused synthetic fixture after authored files change. It is not part of the required noninteractive sequence." + }, + { + "id": "product-input-lifecycle-test-3", + "kind": "command", + "label": "Required test step", + "cwd": ".", + "argv": [ + "registryctl", + "test", + "--project-dir", + "registry-project" + ] + }, + { + "id": "product-input-lifecycle-check-4", + "kind": "command", + "label": "Required check step", + "cwd": ".", + "argv": [ + "registryctl", + "check", + "--project-dir", + "registry-project", + "--environment", + "local", + "--explain" + ] + }, + { + "id": "product-input-lifecycle-semantic-comparison", + "kind": "command", + "label": "Compare authored semantics with the embedded starter", + "cwd": ".", + "argv": [ + "registryctl", + "compare", + "--project-dir", + "registry-project", + "--environment", + "local", + "--from-starter" + ] + }, + { + "id": "lifecycle-preflight", + "kind": "readiness_gate", + "label": "Inspect missing offline requirements before operator handoff", + "cwd": ".", + "argv": [ + "registryctl", + "preflight", + "--project-dir", + "registry-project", + "--environment", + "local", + "--format", + "json" + ], + "note": "This clean-workspace step is expected to exit 1 with a value-free not_ready report because operator-provisioned runtime files and secret references are absent. It proves the diagnostic boundary, not readiness. Provision the reviewed environment bindings, rerun this command, and require a passing report before signing, verification, promotion, or activation handoff." + }, + { + "id": "lifecycle-capabilities", + "kind": "command", + "label": "Inspect declared and available capabilities", + "cwd": ".", + "argv": [ + "registryctl", + "capabilities", + "--project-dir", + "registry-project", + "--environment", + "local" + ] + }, + { + "id": "product-input-lifecycle-build-5", + "kind": "command", + "label": "Required build step", + "cwd": ".", + "argv": [ + "registryctl", + "build", + "--project-dir", + "registry-project", + "--environment", + "local" + ] + }, + { + "id": "lifecycle-governed-promotion-review", + "kind": "operator_interface", + "label": "Review against governed product baselines", + "inputs": [ + "Separately verified Relay baseline bundle and Relay trust anchor", + "Separately verified Notary baseline bundle and Notary trust anchor" + ], + "outputs": [ + "Value-safe promotion report and required-action review" + ], + "procedure": "Only after operators supply both product-owned baseline paths and trust anchors, use the registryctl promote lifecycle interface for the fixed project directory and local environment. This governed review is separate from the first-time starter comparison and does not authorize activation." + }, + { + "id": "lifecycle-relay-bundle", + "kind": "operator_interface", + "label": "Sign and verify the Relay product input", + "inputs": [ + "registry-project/.registry-stack/build/local/private/relay", + "Operator-selected Relay signing key", + "Operator-selected Relay trust anchor and anti-rollback sequence" + ], + "outputs": [ + "journey-output/registry-relay-bundle" + ], + "procedure": "Use registryctl bundle sign with --out journey-output/registry-relay-bundle, then verify that directory with the product-owned Relay trust anchor. Signing material is never rendered into a shell block." + }, + { + "id": "lifecycle-notary-bundle", + "kind": "operator_interface", + "label": "Sign and verify the Notary product input", + "inputs": [ + "registry-project/.registry-stack/build/local/private/notary", + "Operator-selected Notary signing key", + "Operator-selected Notary trust anchor and anti-rollback sequence" + ], + "outputs": [ + "journey-output/registry-notary-bundle" + ], + "procedure": "Use registryctl bundle sign with --out journey-output/registry-notary-bundle, then verify that directory with the product-owned Notary trust anchor. This does not claim product activation." + } + ] + } +] diff --git a/docs/site/scripts/advanced-operations-docs.test.mjs b/docs/site/scripts/advanced-operations-docs.test.mjs new file mode 100644 index 000000000..c55008abc --- /dev/null +++ b/docs/site/scripts/advanced-operations-docs.test.mjs @@ -0,0 +1,268 @@ +import assert from 'node:assert/strict'; +import { readFile } from 'node:fs/promises'; +import { resolve } from 'node:path'; +import { test } from 'node:test'; + +const siteRoot = resolve(import.meta.dirname, '..'); +const advancedRoot = resolve( + siteRoot, + 'src/content/docs/operate/advanced', +); + +const taskPages = [ + 'rotate-credentials-and-trust.mdx', + 'compare-and-reapprove-source-change.mdx', + 'refresh-and-recover-materialization.mdx', + 'recover-upgrade-migrate-and-rollback.mdx', + 'inspect-and-diagnose.mdx', + 'operate-script-workers.mdx', +]; + +async function readPage(name) { + return readFile(resolve(advancedRoot, name), 'utf8'); +} + +async function readSitePage(path) { + return readFile(resolve(siteRoot, 'src/content/docs', path), 'utf8'); +} + +test('advanced operator pages are goal-oriented and include recovery evidence', async () => { + const requiredSections = [ + '## Prerequisites', + '## Ownership and trust boundary', + '## Expected evidence', + '## What this proves', + '## Roll back or recover', + '## Escalate', + '## Next', + ]; + + for (const pageName of taskPages) { + const source = await readPage(pageName); + assert.match(source, /^status: current$/m, pageName); + assert.match(source, /^doc_type: how-to$/m, pageName); + for (const section of requiredSections) { + assert.ok(source.includes(section), `${pageName} is missing ${section}`); + } + assert.match(source, /does not prove|do not prove/i, pageName); + } +}); + +test('advanced operations cover every FC3-E recoverable operator task', async () => { + const source = ( + await Promise.all(['index.mdx', ...taskPages].map(readPage)) + ).join('\n'); + + for (const expected of [ + /source credential/i, + /caller key/i, + /signing key/i, + /certificate/i, + /trust anchor/i, + /verified baseline/i, + /reapprove/i, + /source product or version label/i, + /without widening/i, + /refresh/i, + /serving_last_good/, + /retention/i, + /back up/i, + /restore/i, + /restart/i, + /upgrade/i, + /registryctl migrate/, + /roll back/i, + /redacted posture/i, + /audit/i, + /healthz/, + /ready/, + /openapi\.json/i, + /source denial/i, + /policy denial/i, + /ambiguity/i, + /stale materialization/i, + /bundle rejection/i, + /capability.*mismatch/i, + /bounded Script worker/i, + /protocol\.fhir\.parse_searchset/, + /protocol\.dci\.search/, + ]) { + assert.match(source, expected); + } +}); + +test('diagnosis uses generated references and stable code vocabulary', async () => { + const source = await readPage('inspect-and-diagnose.mdx'); + + for (const link of [ + '../../../reference/diagnostics/operator/', + '../../../reference/diagnostics/fixture/', + '../../../reference/diagnostics/authoring/', + '../../../reference/errors/', + ]) { + assert.ok(source.includes(`](${link})`), `missing stable link ${link}`); + } + + for (const code of [ + 'relay.consultation.activation.source_credentials_unavailable', + 'notary.relay.credentials_rejected', + 'pdp.purpose_not_permitted', + 'pdp.evidence_stale', + 'source.cardinality_violation', + 'rejected_signature', + 'rejected_binding', + 'rejected_validation', + 'rejected_rollback', + 'relay.consultation.activation.unsupported_plan', + 'notary.relay.profile_mismatch', + 'registry.admin.capability.not_supported', + ]) { + assert.ok(source.includes(`\`${code}\``), `missing stable code ${code}`); + } + + assert.match( + source, + /registryctl project diagnostics --catalog operator --format json/, + ); + assert.match( + source, + /registryctl project diagnostics --catalog fixture --format json/, + ); + assert.match( + source, + /registryctl project diagnostics --catalog authoring --format json/, + ); +}); + +test('advanced operations preserve product activation and confidentiality boundaries', async () => { + const source = ( + await Promise.all(['index.mdx', ...taskPages].map(readPage)) + ).join('\n'); + + assert.match(source, /separate (?:product )?bundles/i); + assert.match(source, /not atomic project activation/i); + assert.match(source, /admit (?:caller )?traffic only after both product/i); + assert.match(source, /do not use personal data|with synthetic identifiers/i); + + for (const superseded of [ + /activate Relay and Notary as one/i, + /root manifest binds compatible Relay and Notary/i, + /atomic project activation coordinator/i, + /live country (?:proof|success|interoperability)/i, + ]) { + assert.doesNotMatch(source, superseded); + } +}); + +test('bundle verification separates stateless closure from product rollback eligibility', async () => { + const source = await readPage('rotate-credentials-and-trust.mdx'); + + assert.match( + source, + /SIGNED_PRODUCT_BUNDLE=operator-inputs\/signed-relay-bundle[\s\S]*?PRODUCT_TRUST_ANCHOR=operator-inputs\/relay-trust-anchor\.json[\s\S]*?registryctl bundle verify[\s\S]*?--bundle-dir "\$SIGNED_PRODUCT_BUNDLE"[\s\S]*?--anchor-path "\$PRODUCT_TRUST_ANCHOR"/, + ); + assert.match( + source, + /does not read product anti-rollback state or establish local rollback eligibility/, + ); + for (const [product, bundleVariable, anchorVariable, stateVariable] of [ + ['registry-relay', 'SIGNED_RELAY_BUNDLE', 'RELAY_TRUST_ANCHOR', 'RELAY_ROLLBACK_STATE'], + ['registry-notary', 'SIGNED_NOTARY_BUNDLE', 'NOTARY_TRUST_ANCHOR', 'NOTARY_ROLLBACK_STATE'], + ]) { + assert.match( + source, + new RegExp( + `${product} config verify-bundle[\\s\\S]*?` + + `--bundle-dir "\\$${bundleVariable}"[\\s\\S]*?` + + `--anchor-path "\\$${anchorVariable}"[\\s\\S]*?` + + `--state-path "\\$${stateVariable}"`, + ), + ); + } + assert.match(source, /require accepted state to exist/); + assert.match(source, /Neither command persists bundle acceptance/); + assert.doesNotMatch( + source, + /(?:registryctl )?[Bb]undle verification proves[\s\S]{0,100}anti-rollback eligibility/, + ); +}); + +test('materialization refresh uses one supported table path and rejects reload-all', async () => { + const source = await readPage('refresh-and-recover-materialization.mdx'); + + assert.match( + source, + /\/admin\/v1\/datasets\/\/tables\/\/reload/, + ); + assert.match( + source, + /Do not use `\/admin\/v1\/reload` for a deployment that contains any audited SnapshotExact plan/, + ); + assert.match( + source, + /rejects the complete reload-all request with `ingest\.materialization_failed`/, + ); + assert.match(source, /refreshes no resource/); + assert.match(source, /There is no atomic multi-materialization admin refresh/); + assert.doesNotMatch( + source, + /http:\/\/127\.0\.0\.1:8081\/admin\/v1\/reload(?:\s|$)/, + ); + assert.doesNotMatch( + source, + /Reload-all prepares every resource before publishing any resource/, + ); +}); + +test('advanced operations contain no secret material or unsafe copy-paste values', async () => { + const source = ( + await Promise.all(['index.mdx', ...taskPages].map(readPage)) + ).join('\n'); + + for (const secretMaterial of [ + /BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY/, + /\beyJ[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}/, + /\b(?:api[_-]?key|token|password|secret)\s*[:=]\s*["']?(?!<)[A-Za-z0-9/+_-]{16,}/i, + /REGISTRY_[A-Z0-9_]*(?:SECRET|TOKEN|PASSWORD|KEY)=/, + ]) { + assert.doesNotMatch(source, secretMaterial); + } + + assert.doesNotMatch(source, /curl[^\n]*\s-[^-]*d\s+.*(?:secret|token|password)/i); +}); + +test('materialization recovery documents the exact fail-closed and recovery boundaries', async () => { + const refresh = await readPage('refresh-and-recover-materialization.mdx'); + const backup = await readSitePage('operate/backup-and-restore.mdx'); + const retention = await readSitePage( + 'operate/retention-and-persistent-state.mdx', + ); + const tutorial = await readSitePage( + 'tutorials/configure-project-snapshot-materialization.mdx', + ); + const source = [refresh, backup, retention, tutorial].join('\n'); + + assert.match(refresh, /any audited SnapshotExact plan/i); + assert.match(refresh, /rejects the complete reload-all request/i); + assert.match(refresh, /table-specific endpoint/i); + assert.match(refresh, /ordinary reads retain their previous ready table/i); + assert.match(refresh, /global `\/ready` can remain `200`/i); + assert.match(refresh, /execution-time SnapshotExact freshness/i); + + assert.match(source, /`retain_generations`[^.]*from `1` through `16`/i); + assert.match( + source, + /not an admin-selectable list of\s+arbitrary rollback targets/i, + ); + assert.match(backup, /one coordinated recovery point/i); + assert.match( + backup, + /source inputs, the Relay ingest cache, and the Relay\s+consultation database/i, + ); + assert.match(source, /database active pointer and\s+history/i); + assert.match( + source, + /exact active generation and restricted content\s+digest/i, + ); + assert.match(backup, /A list of unrelated artifact hashes is not evidence/i); +}); diff --git a/docs/site/scripts/authoring-reference-docs.test.mjs b/docs/site/scripts/authoring-reference-docs.test.mjs new file mode 100644 index 000000000..108c6ea8e --- /dev/null +++ b/docs/site/scripts/authoring-reference-docs.test.mjs @@ -0,0 +1,161 @@ +import assert from 'node:assert/strict'; +import { execFile } from 'node:child_process'; +import { readFile } from 'node:fs/promises'; +import { resolve } from 'node:path'; +import { test } from 'node:test'; +import { promisify } from 'node:util'; + +import { validateAuthoringReference } from './generate-authoring-reference.mjs'; + +const siteRoot = resolve(import.meta.dirname, '..'); +const repoRoot = resolve(siteRoot, '../..'); +const execFileAsync = promisify(execFile); + +async function readJson(relative) { + return JSON.parse(await readFile(resolve(siteRoot, relative), 'utf8')); +} + +test('committed internal and public reference artifacts are exact and complete', async () => { + const [reference, coverage, publicReference, publicCoverage] = await Promise.all([ + readJson('src/data/generated/configuration-reference.json'), + readJson('src/data/generated/configuration-reference-coverage.json'), + readJson('public/generated/configuration-reference.v1.json'), + readJson('public/generated/configuration-reference-coverage.v1.json'), + ]); + + validateAuthoringReference(reference, coverage); + assert.deepEqual(publicReference, reference); + assert.deepEqual(publicCoverage, coverage); + assert.equal(reference.fields.length, 1758); + assert.equal(coverage.reviewed_intent_assignment_required_count, 1758); + assert.equal(coverage.reviewed_intent_assignment_covered_count, 1758); + assert.equal(coverage.distinct_reviewed_intent_count, 588); + assert.equal(coverage.distinct_reviewed_intents_reused_count, 83); + assert.equal(coverage.reviewed_intent_assignments_using_reused_intent_count, 1253); + assert.deepEqual(reference.reference_baseline, { + generator_lifecycle: 'unreleased', + published_release: null, + field_history_status: 'not_verified', + history_verification_method: null, + compared_releases: [], + }); + assert.ok( + reference.fields.every( + (field) => + field.history_status === 'not_verified' && + field.introduced_in === null && + field.version_history.length === 0 && + !Object.hasOwn(field.default, 'source_version'), + ), + 'unverified release history must remain explicit and cannot contain a fabricated version', + ); + assert.deepEqual(reference.coverage.by_schema, { + project: 219, + environment: 191, + integration: 138, + fixture: 62, + entity: 35, + relay: 584, + notary: 529, + }); + assert.deepEqual(reference.coverage.by_path_kind, { + root: 7, + property: 1406, + map_key: 25, + map_value: 47, + array_item: 177, + branch: 96, + }); + assert.equal( + Object.values(reference.coverage.by_intent_profile).reduce( + (total, count) => total + count, + 0, + ), + 1113, + ); +}); + +test('published reference page identifies generated sources and the no-country-value boundary', async () => { + const [page, component, packageJson] = await Promise.all([ + readFile(resolve(siteRoot, 'src/content/docs/reference/project-configuration.mdx'), 'utf8'), + readFile(resolve(siteRoot, 'src/components/AuthoringConfigurationReference.astro'), 'utf8'), + readJson('package.json'), + ]); + + assert.match(page, /Generator: `registryctl authoring reference`/); + assert.match(page, /Coverage gate: `registryctl authoring reference --coverage`/); + assert.match(page, /Country workspace or runtime configuration reads: none/); + assert.match(page, /Relay and Notary runtime schemas/); + assert.match(page, /does not inspect a project, live runtime configuration, environment variables/); + assert.match(page, /five project-authoring sections describe configuration people commit/); + assert.match(page, /intent sidecars are documentation knowledge\s+only/); + assert.match(page, /Field release history: not verified/); + assert.match(page, /Assignment coverage does not claim that every path has unique prose/); + assert.match(component, /configuration-reference-coverage\.json/); + assert.match(component, /generated\/configuration-reference\.v1\.json/); + assert.match(component, /Reviewed intent profile/); + assert.match(component, /JSON Schema pointer/); + assert.match(component, /human-authored country\s+files/); + assert.match(component, /not runtime configuration/); + assert.match(component, /Reviewed intent assignments/); + assert.match(component, /Distinct reviewed intents/); + assert.match(component, /Release history/); + assert.match(component, /Not verified/); + assert.match(packageJson.scripts.generate, /generate-authoring-reference\.mjs/); +}); + +test('committed reference and coverage are byte-exact to the CLI', async () => { + const [ + { stdout: referenceStdout }, + { stdout: coverageStdout }, + committedReference, + publicReference, + committedCoverage, + publicCoverage, + ] = await Promise.all([ + execFileAsync( + 'cargo', + ['run', '--locked', '--quiet', '-p', 'registryctl', '--', 'authoring', 'reference'], + { + cwd: repoRoot, + encoding: 'utf8', + maxBuffer: 16 * 1024 * 1024, + }, + ), + execFileAsync( + 'cargo', + [ + 'run', + '--locked', + '--quiet', + '-p', + 'registryctl', + '--', + 'authoring', + 'reference', + '--coverage', + ], + { + cwd: repoRoot, + encoding: 'utf8', + maxBuffer: 16 * 1024 * 1024, + }, + ), + readFile(resolve(siteRoot, 'src/data/generated/configuration-reference.json'), 'utf8'), + readFile(resolve(siteRoot, 'public/generated/configuration-reference.v1.json'), 'utf8'), + readFile( + resolve(siteRoot, 'src/data/generated/configuration-reference-coverage.json'), + 'utf8', + ), + readFile( + resolve(siteRoot, 'public/generated/configuration-reference-coverage.v1.json'), + 'utf8', + ), + ]); + + assert.equal(committedReference, referenceStdout); + assert.equal(publicReference, referenceStdout); + assert.equal(committedCoverage, coverageStdout); + assert.equal(publicCoverage, coverageStdout); + assert.match(committedReference, /"value": 18446744073709551615/); +}); diff --git a/docs/site/scripts/authoring-reference-sources.json b/docs/site/scripts/authoring-reference-sources.json new file mode 100644 index 000000000..e1d0dcd47 --- /dev/null +++ b/docs/site/scripts/authoring-reference-sources.json @@ -0,0 +1,76 @@ +{ + "schema_order": [ + "project", + "environment", + "integration", + "fixture", + "entity", + "relay", + "notary" + ], + "schema_sources": [ + "project.schema.json", + "environment.schema.json", + "integration.schema.json", + "fixture.schema.json", + "entity.schema.json", + "registry-relay.config.schema.json", + "registry-notary.config.schema.json" + ], + "field_knowledge": "schemas/project-authoring/parity-coverage.json#field_knowledge", + "human_intent": "schemas/project-authoring/documentation-intent.json", + "runtime_intent": [ + "crates/registry-relay/config/documentation-intent.json", + "crates/registry-notary-core/config/documentation-intent.json" + ], + "ci_inputs": [ + { + "pattern": "crates/registryctl/schemas/project-authoring/**", + "sample": "crates/registryctl/schemas/project-authoring/project.schema.json" + }, + { + "pattern": "crates/registryctl/schemas/project-documentation/**", + "sample": "crates/registryctl/schemas/project-documentation/registry.project.configuration_reference.v1.schema.json" + }, + { + "pattern": "crates/registryctl/src/project_authoring/documentation.rs", + "sample": "crates/registryctl/src/project_authoring/documentation.rs" + }, + { + "pattern": "crates/registryctl/src/project_authoring/knowledge.rs", + "sample": "crates/registryctl/src/project_authoring/knowledge.rs" + }, + { + "pattern": "crates/registry-relay/config/documentation-intent.json", + "sample": "crates/registry-relay/config/documentation-intent.json" + }, + { + "pattern": "crates/registry-relay/src/config/**", + "sample": "crates/registry-relay/src/config/mod.rs" + }, + { + "pattern": "crates/registry-notary-core/config/documentation-intent.json", + "sample": "crates/registry-notary-core/config/documentation-intent.json" + }, + { + "pattern": "crates/registry-notary-core/src/config.rs", + "sample": "crates/registry-notary-core/src/config.rs" + }, + { + "pattern": "crates/registry-notary-core/src/config/**", + "sample": "crates/registry-notary-core/src/config/root.rs" + }, + { + "pattern": "crates/registry-notary-core/src/deployment.rs", + "sample": "crates/registry-notary-core/src/deployment.rs" + }, + { + "pattern": "schemas/registry-relay.config.schema.json", + "sample": "schemas/registry-relay.config.schema.json" + }, + { + "pattern": "schemas/registry-notary.config.schema.json", + "sample": "schemas/registry-notary.config.schema.json" + } + ] +} diff --git a/docs/site/scripts/build-archives.mjs b/docs/site/scripts/build-archives.mjs index ca323bab3..e834626b8 100644 --- a/docs/site/scripts/build-archives.mjs +++ b/docs/site/scripts/build-archives.mjs @@ -1,7 +1,8 @@ -import { spawn } from 'node:child_process'; -import { rm } from 'node:fs/promises'; -import { resolve } from 'node:path'; +import { execFile, spawn } from 'node:child_process'; +import { lstat, mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises'; +import { dirname, relative, resolve } from 'node:path'; import { fileURLToPath } from 'node:url'; +import { promisify } from 'node:util'; import { applyArchiveSeo } from './apply-archive-seo.mjs'; import { archiveOutputDirectory, @@ -9,6 +10,24 @@ import { } from './archive-bundle.mjs'; import { loadDocsets } from './docsets.mjs'; +const execFileAsync = promisify(execFile); +export const currentSourceGeneratedArtifacts = Object.freeze([ + 'docs/site/src/data/generated/project-authoring-journeys.json', + 'docs/site/src/data/generated/project-starters.json', + 'docs/site/src/data/generated/configuration-reference.json', + 'docs/site/src/data/generated/configuration-reference-coverage.json', + 'docs/site/public/generated/configuration-reference.v1.json', + 'docs/site/public/generated/configuration-reference-coverage.v1.json', + 'docs/site/src/data/generated/diagnostics/authoring.json', + 'docs/site/src/data/generated/diagnostics/fixture.json', + 'docs/site/src/data/generated/diagnostics/operator.json', + 'docs/site/public/generated/diagnostics/authoring.v1.json', + 'docs/site/public/generated/diagnostics/fixture.v1.json', + 'docs/site/public/generated/diagnostics/operator.v1.json', + 'docs/site/src/data/generated/standard-journeys.json', + 'docs/site/public/generated/standard-journeys.json', +]); + async function run(command, args, env) { await new Promise((resolveRun, rejectRun) => { const child = spawn(command, args, { @@ -24,8 +43,108 @@ async function run(command, args, env) { }); } +async function readOptionalRegularFile(path) { + try { + const info = await lstat(path); + if (!info.isFile()) { + throw new Error(`generated archive input must be a regular file: ${path}`); + } + return await readFile(path); + } catch (error) { + if (error?.code === 'ENOENT') return null; + throw error; + } +} + +async function replaceFile(path, contents) { + await mkdir(dirname(path), { recursive: true }); + const temporary = `${path}.${process.pid}.archive.tmp`; + try { + await writeFile(temporary, contents, { flag: 'wx' }); + await rename(temporary, path); + } catch (error) { + await rm(temporary, { force: true }).catch(() => {}); + throw error; + } +} + +async function git(command, args, cwd) { + try { + return await execFileAsync(command, args, { + cwd, + encoding: 'buffer', + maxBuffer: 16 * 1024 * 1024, + }); + } catch (error) { + const stderr = Buffer.isBuffer(error?.stderr) + ? error.stderr.toString('utf8').trim() + : String(error?.stderr ?? '').trim(); + throw new Error(`${command} ${args.join(' ')} failed: ${stderr || error.message}`); + } +} + +export async function stagePinnedGeneratedArtifacts(docset, { + docsRoot = process.cwd(), + executeGit = git, +} = {}) { + const sourceRef = docset.products?.['registry-stack']?.ref; + if (typeof sourceRef !== 'string' || !/^[0-9a-f]{40}$/.test(sourceRef)) { + throw new Error( + `Archived docset "${docset.id}" must pin products.registry-stack.ref to a full commit`, + ); + } + const repoRoot = resolve(docsRoot, '../..'); + const { stdout: listed } = await executeGit( + 'git', + ['ls-tree', '-rz', '--name-only', sourceRef, '--', ...currentSourceGeneratedArtifacts], + repoRoot, + ); + const pinnedPaths = new Set( + listed + .toString('utf8') + .split('\0') + .filter(Boolean), + ); + const pinnedContents = new Map(); + for (const path of pinnedPaths) { + const { stdout } = await executeGit('git', ['show', `${sourceRef}:${path}`], repoRoot); + pinnedContents.set(path, stdout); + } + + const snapshots = new Map(); + for (const repoRelative of currentSourceGeneratedArtifacts) { + const local = resolve(repoRoot, repoRelative); + if (relative(docsRoot, local).startsWith('..')) { + throw new Error(`generated archive input resolves outside docs root: ${repoRelative}`); + } + snapshots.set(local, await readOptionalRegularFile(local)); + } + + const restore = async () => { + for (const [local, contents] of snapshots) { + if (contents === null) await rm(local, { force: true }); + else await replaceFile(local, contents); + } + }; + try { + for (const repoRelative of currentSourceGeneratedArtifacts) { + const local = resolve(repoRoot, repoRelative); + const contents = pinnedContents.get(repoRelative); + if (contents === undefined) await rm(local, { force: true }); + else await replaceFile(local, contents); + } + } catch (error) { + await restore(); + throw error; + } + return restore; +} + export async function buildDocsetArchive(docset, { docsRoot = process.cwd(), + runCommand = run, + applySeo = applyArchiveSeo, + stageGeneratedArtifacts = stagePinnedGeneratedArtifacts, } = {}) { if (docset.status !== 'archived') { throw new Error(`Docset "${docset.id}" is not archived`); @@ -44,10 +163,23 @@ export async function buildDocsetArchive(docset, { }; const outDir = await validateArchiveOutputLocation(docsRoot, docset); await rm(outDir, { recursive: true, force: true }); - await run('npm', ['run', 'generate'], env); - await run('npx', ['astro', 'check'], env); - await run('npx', ['astro', 'build', '--outDir', archiveOutputDirectory(docsRoot, docset)], env); - await applyArchiveSeo(outDir); + // Current-source generators consume the checked-out registryctl contracts + // and label their output as unreleased. Release archives instead stage those + // generated artifacts from the docset's pinned source ref and refresh only + // inputs whose generators honor DOCS_DOCSET. + const restoreGeneratedArtifacts = await stageGeneratedArtifacts(docset, { docsRoot }); + try { + await runCommand('npm', ['run', 'generate:archive'], env); + await runCommand('npx', ['astro', 'check'], env); + await runCommand( + 'npx', + ['astro', 'build', '--outDir', archiveOutputDirectory(docsRoot, docset)], + env, + ); + await applySeo(outDir); + } finally { + await restoreGeneratedArtifacts(); + } console.log(`Built archived docset ${docset.id} at ${outDir}.`); } diff --git a/docs/site/scripts/build-archives.test.mjs b/docs/site/scripts/build-archives.test.mjs new file mode 100644 index 000000000..502ab821a --- /dev/null +++ b/docs/site/scripts/build-archives.test.mjs @@ -0,0 +1,155 @@ +import assert from 'node:assert/strict'; +import { execFile } from 'node:child_process'; +import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'; +import { tmpdir } from 'node:os'; +import { dirname, resolve } from 'node:path'; +import test from 'node:test'; +import { fileURLToPath } from 'node:url'; +import { promisify } from 'node:util'; + +import { + buildDocsetArchive, + currentSourceGeneratedArtifacts, +} from './build-archives.mjs'; + +const execFileAsync = promisify(execFile); +const scriptsDir = dirname(fileURLToPath(import.meta.url)); +const docsRoot = resolve(scriptsDir, '..'); +const archivedDocset = { + id: 'v1.2.3', + path: '/v/1.2.3/', + status: 'archived', + products: { + 'registry-stack': { + ref: 'a'.repeat(40), + }, + }, +}; + +test('archive generation excludes current-source generators', async () => { + const packageJson = JSON.parse( + await readFile(resolve(docsRoot, 'package.json'), 'utf8'), + ); + const archiveGeneration = packageJson.scripts['generate:archive']; + + for (const script of [ + 'generate-data.mjs', + 'fetch-openapi.mjs', + 'sync-repo-docs.mjs', + 'generate-sidebar.mjs', + ]) { + assert.match(archiveGeneration, new RegExp(`scripts/${script.replace('.', '\\.')}`)); + } + for (const script of [ + 'generate-project-starters.mjs', + 'generate-authoring-reference.mjs', + 'generate-diagnostic-references.mjs', + 'generate-standard-journeys.mjs', + ]) { + assert.doesNotMatch( + archiveGeneration, + new RegExp(`scripts/${script.replace('.', '\\.')}`), + ); + assert.match( + packageJson.scripts.generate, + new RegExp(`scripts/${script.replace('.', '\\.')}`), + ); + } +}); + +test('archived docset builds use isolated generation with release-bound environment', async (t) => { + const root = await mkdtemp(resolve(tmpdir(), 'registry-docs-archive-build-')); + t.after(() => rm(root, { recursive: true, force: true })); + const calls = []; + let seoPath; + + await buildDocsetArchive(archivedDocset, { + docsRoot: root, + stageGeneratedArtifacts: async () => async () => {}, + runCommand: async (command, args, env) => { + calls.push({ command, args, env }); + }, + applySeo: async (path) => { + seoPath = path; + }, + }); + + assert.deepEqual( + calls.map(({ command, args }) => [command, args]), + [ + ['npm', ['run', 'generate:archive']], + ['npx', ['astro', 'check']], + ['npx', ['astro', 'build', '--outDir', resolve(root, 'dist/v/1.2.3')]], + ], + ); + for (const { env } of calls) { + assert.equal(env.DOCS_DOCSET, 'v1.2.3'); + assert.equal(env.DOCS_BASE, '/v/1.2.3/'); + assert.equal(env.TZ, 'UTC'); + assert.equal(env.PUBLIC_UMAMI_WEBSITE_ID, ''); + assert.equal(env.PUBLIC_UMAMI_SCRIPT_SRC, ''); + assert.equal(env.PUBLIC_UMAMI_DOMAINS, ''); + } + assert.equal(seoPath, resolve(root, 'dist/v/1.2.3')); +}); + +test('archive output uses pinned generated artifacts and restores current files', async (t) => { + const repoRoot = await mkdtemp(resolve(tmpdir(), 'registry-docs-archive-ref-')); + t.after(() => rm(repoRoot, { recursive: true, force: true })); + const siteRoot = resolve(repoRoot, 'docs/site'); + const pinnedPath = currentSourceGeneratedArtifacts[2]; + const absentAtReleasePath = currentSourceGeneratedArtifacts.at(-1); + const pinnedLocal = resolve(repoRoot, pinnedPath); + const absentAtReleaseLocal = resolve(repoRoot, absentAtReleasePath); + + await mkdir(dirname(pinnedLocal), { recursive: true }); + await writeFile(pinnedLocal, '{"source_label":"v1.2.3"}\n'); + await execFileAsync('git', ['init', '--quiet'], { cwd: repoRoot }); + await execFileAsync('git', ['config', 'user.name', 'Archive Test'], { cwd: repoRoot }); + await execFileAsync('git', ['config', 'user.email', 'archive@example.invalid'], { + cwd: repoRoot, + }); + await execFileAsync('git', ['add', pinnedPath], { cwd: repoRoot }); + await execFileAsync('git', ['commit', '--quiet', '-m', 'release'], { cwd: repoRoot }); + const { stdout: sourceRefOutput } = await execFileAsync( + 'git', + ['rev-parse', 'HEAD'], + { cwd: repoRoot }, + ); + const sourceRef = sourceRefOutput.trim(); + + await writeFile(pinnedLocal, '{"source_label":"Main source (unreleased)"}\n'); + await mkdir(dirname(absentAtReleaseLocal), { recursive: true }); + await writeFile(absentAtReleaseLocal, '{"source_label":"Main source (unreleased)"}\n'); + + const outputCapture = resolve(repoRoot, 'archive-captured.json'); + await buildDocsetArchive( + { + ...archivedDocset, + products: { 'registry-stack': { ref: sourceRef } }, + }, + { + docsRoot: siteRoot, + runCommand: async (_command, args) => { + if (args.includes('build')) { + await writeFile(outputCapture, await readFile(pinnedLocal)); + await assert.rejects(readFile(absentAtReleaseLocal), { code: 'ENOENT' }); + } + }, + applySeo: async () => {}, + }, + ); + + assert.equal( + await readFile(outputCapture, 'utf8'), + '{"source_label":"v1.2.3"}\n', + ); + assert.equal( + await readFile(pinnedLocal, 'utf8'), + '{"source_label":"Main source (unreleased)"}\n', + ); + assert.equal( + await readFile(absentAtReleaseLocal, 'utf8'), + '{"source_label":"Main source (unreleased)"}\n', + ); +}); diff --git a/docs/site/scripts/check-registryctl-tutorials.sh b/docs/site/scripts/check-registryctl-tutorials.sh index 85ba73b4f..e8a660d3e 100644 --- a/docs/site/scripts/check-registryctl-tutorials.sh +++ b/docs/site/scripts/check-registryctl-tutorials.sh @@ -304,7 +304,7 @@ run_relay_tutorial() { mkdir -p "$tutorial_root" node "$HELPER" assert-layout "$RELAY_TUTORIAL" \ - '["Install registryctl","Create the sample project","Start the local stack","Run the smoke check","Load local demo keys","Make one denied request","Make one allowed request","Read one protected record","Read one protected record","Read restricted identity fields","Read restricted identity fields","Inspect the generated contract","Inspect the generated contract","Run an aggregate","Change the disclosure rule","Change the disclosure rule","Change the disclosure rule","Change the disclosure rule","Change the disclosure rule","Stop the stack"]' + '["Install registryctl","Create the sample project","Start the local stack","Run the smoke check","Load local demo keys","Make one denied request","Make one allowed request","Read one protected record","Read one protected record","Read restricted identity fields","Read restricted identity fields","Inspect the editable local scaffold","Inspect the editable local scaffold","Run an aggregate","Change the disclosure rule","Change the disclosure rule","Change the disclosure rule","Change the disclosure rule","Change the disclosure rule","Stop the stack"]' node "$HELPER" extract-shell "$RELAY_TUTORIAL" "$blocks" expected_install=$'curl -fsSL https://raw.githubusercontent.com/registrystack/registry-stack/refs/tags/v0.13.0/crates/registryctl/install.sh | REGISTRYCTL_VERSION=v0.13.0 bash\nregistryctl --version' @@ -354,9 +354,9 @@ run_relay_tutorial() { assert_http "$LAST_OUTPUT" 200 assert_contains "$LAST_OUTPUT" Fae Elm FAKE-856648 '595 River Rd, Southvale' assert_json_fence_subset "$LAST_OUTPUT" "$RELAY_TUTORIAL" 'Read restricted identity fields' 2 - run_block 'Relay 12: Inspect the generated contract' "$blocks/12.sh" success + run_block 'Relay 12: Inspect the editable local scaffold' "$blocks/12.sh" success run_block 'Relay 13: Open the runtime API reference' "$blocks/13.sh" success - assert_fence_lines "$LAST_OUTPUT" "$RELAY_TUTORIAL" 'Inspect the generated contract' text 1 + assert_fence_lines "$LAST_OUTPUT" "$RELAY_TUTORIAL" 'Inspect the editable local scaffold' text 1 run_block 'Relay 14: Run an aggregate' "$blocks/14.sh" success assert_http "$LAST_OUTPUT" 200 assert_json_fence_subset "$LAST_OUTPUT" "$RELAY_TUTORIAL" 'Run an aggregate' 1 @@ -371,7 +371,8 @@ run_relay_tutorial() { run_block 'Relay 17: Reject a disclosure floor below the invariant' "$blocks/17.sh" failure assert_contains "$LAST_OUTPUT" 'Relay did not become healthy and ready before timeout' run_block 'Relay 18: Explain the rejected configuration' "$blocks/18.sh" success - assert_contains "$LAST_OUTPUT" config.validation_error 'min_cell_size >= 2' + assert_contains "$LAST_OUTPUT" relay.startup.config_validation_rejected + assert_not_contains "$LAST_OUTPUT" config.validation_error 'min_cell_size >= 2' node "$HELPER" set-relay-min-group-size relay/config.yaml benefits_casework by_district 2 run_block 'Relay 19: Restore the valid disclosure floor' "$blocks/19.sh" success @@ -388,10 +389,10 @@ run_notary_tutorial() { local tutorial_root="$WORK_ROOT/relay-reader" local project_dir="$tutorial_root/my-first-api" local project_name="registryctl-notary-$RUN_ID" - local edited_claim="$WORK_ROOT/registry-stack-accept-pending.yaml" + local edited_claim="$WORK_ROOT/registry-stack-active-or-pending-exists.yaml" node "$HELPER" assert-layout "$NOTARY_TUTORIAL" \ - '["Add Notary to the project","Inspect the claim","Start Relay and Notary","Load the evaluator key","Evaluate an accepted active registration","Reject a pending registration","Try a non-matching date of birth","Edit the claim rule","Evaluate the edited rule","Stop the stack"]' + '["Add Notary to the project","Inspect the claim","Start Relay and Notary","Load the evaluator key","Evaluate an active registration","Evaluate a pending registration","Try a non-matching date of birth","Edit the claim rule","Evaluate the edited rule","Stop the stack"]' node "$HELPER" extract-shell "$NOTARY_TUTORIAL" "$blocks" export COMPOSE_PROJECT_NAME="$project_name" @@ -405,7 +406,8 @@ run_notary_tutorial() { assert_contains "$LAST_OUTPUT" http://127.0.0.1:4255 notary/project/registry-stack.yaml run_block 'Notary 2: Inspect the claim' "$blocks/02.sh" success assert_fence_lines "$LAST_OUTPUT" "$NOTARY_TUTORIAL" 'Inspect the claim' yaml 1 - assert_contains "$LAST_OUTPUT" request.target.attributes.given_name request.target.attributes.date_of_birth person-registration-accepted + assert_contains "$LAST_OUTPUT" request.target.attributes.given_name request.target.attributes.date_of_birth active-registration-exists + assert_not_contains "$LAST_OUTPUT" person-registration-accepted run_block 'Notary 3: Start Relay and Notary' "$blocks/03.sh" success assert_fence_lines "$LAST_OUTPUT" "$NOTARY_TUTORIAL" 'Start Relay and Notary' text 1 run_block 'Notary 4: Load the evaluator key' "$blocks/04.sh" success @@ -413,31 +415,55 @@ run_notary_tutorial() { printf 'Notary tutorial evaluator credential was not loaded\n' >&2 exit 1 } - run_block 'Notary 5: Evaluate an accepted active registration' "$blocks/05.sh" success + run_block 'Notary 5: Evaluate an active registration' "$blocks/05.sh" success assert_http "$LAST_OUTPUT" 200 - assert_json_fence_subset "$LAST_OUTPUT" "$NOTARY_TUTORIAL" 'Evaluate an accepted active registration' 1 + assert_json_fence_subset "$LAST_OUTPUT" "$NOTARY_TUTORIAL" 'Evaluate an active registration' 1 assert_not_contains "$LAST_OUTPUT" Jo Elm 2019-02-03 '"active"' - run_block 'Notary 6: Reject a pending registration' "$blocks/06.sh" success + run_block 'Notary 6: Evaluate a pending registration' "$blocks/06.sh" success assert_http "$LAST_OUTPUT" 200 - assert_json_fence_subset "$LAST_OUTPUT" "$NOTARY_TUTORIAL" 'Reject a pending registration' 1 + assert_json_fence_subset "$LAST_OUTPUT" "$NOTARY_TUTORIAL" 'Evaluate a pending registration' 1 assert_not_contains "$LAST_OUTPUT" Nia Stone 1998-03-05 '"pending"' run_block 'Notary 7: Try a non-matching date of birth' "$blocks/07.sh" success assert_http "$LAST_OUTPUT" 200 assert_json_fence_subset "$LAST_OUTPUT" "$NOTARY_TUTORIAL" 'Try a non-matching date of birth' 1 assert_not_contains "$LAST_OUTPUT" Jo Elm 2019-02-04 '"active"' + node "$HELPER" replace-once \ + notary/project/registry-stack.yaml \ + 'active-registration-exists' \ + 'active-or-pending-registration-exists' \ + "$edited_claim" + mv "$edited_claim" notary/project/registry-stack.yaml node "$HELPER" replace-once \ notary/project/registry-stack.yaml \ 'enrollment.registration_status == "active"' \ '(enrollment.registration_status == "active" || enrollment.registration_status == "pending")' \ "$edited_claim" mv "$edited_claim" notary/project/registry-stack.yaml + node "$HELPER" replace-once \ + notary/project/integrations/person-demographics/fixtures/match.yaml \ + 'claims: { active-registration-exists: true }' \ + 'claims: { active-or-pending-registration-exists: true }' \ + "$edited_claim" + mv "$edited_claim" notary/project/integrations/person-demographics/fixtures/match.yaml node "$HELPER" replace-once \ notary/project/integrations/person-demographics/fixtures/pending.yaml \ - 'claims: { person-registration-accepted: false }' \ - 'claims: { person-registration-accepted: true }' \ + 'claims: { active-registration-exists: false }' \ + 'claims: { active-or-pending-registration-exists: true }' \ "$edited_claim" mv "$edited_claim" notary/project/integrations/person-demographics/fixtures/pending.yaml + node "$HELPER" replace-once \ + notary/project/integrations/person-demographics/fixtures/no-match.yaml \ + 'claims: { active-registration-exists: false }' \ + 'claims: { active-or-pending-registration-exists: false }' \ + "$edited_claim" + mv "$edited_claim" notary/project/integrations/person-demographics/fixtures/no-match.yaml + node "$HELPER" replace-once \ + notary/pending-registration-request.json \ + '"claims": ["active-registration-exists"]' \ + '"claims": ["active-or-pending-registration-exists"]' \ + "$edited_claim" + mv "$edited_claim" notary/pending-registration-request.json run_block 'Notary 8: Restart with the edited claim rule' "$blocks/08.sh" success assert_contains "$LAST_OUTPUT" 'Relay API:' 'Notary API:' run_block 'Notary 9: Evaluate the edited rule' "$blocks/09.sh" success diff --git a/docs/site/scripts/check-tutorial.sh b/docs/site/scripts/check-tutorial.sh index 0fc13448d..97284ca73 100755 --- a/docs/site/scripts/check-tutorial.sh +++ b/docs/site/scripts/check-tutorial.sh @@ -164,7 +164,7 @@ done # inside `sh` fences. Bump the expected count when you intentionally add or # remove a documented command. REGISTRYCTL_TUTORIALS=( - "author-registry-project:23" + "author-registry-project:32" "publish-spreadsheet-secured-registry-api:49" "verify-claim-registry-api:79" ) diff --git a/docs/site/scripts/deployment-documentation-truth.test.mjs b/docs/site/scripts/deployment-documentation-truth.test.mjs new file mode 100644 index 000000000..9c3d3b0ad --- /dev/null +++ b/docs/site/scripts/deployment-documentation-truth.test.mjs @@ -0,0 +1,126 @@ +import assert from 'node:assert/strict'; +import { readFile } from 'node:fs/promises'; +import { resolve } from 'node:path'; +import { test } from 'node:test'; + +import YAML from 'yaml'; + +const siteRoot = resolve(import.meta.dirname, '..'); +const repoRoot = resolve(siteRoot, '../..'); + +async function readRepo(relative) { + return readFile(resolve(repoRoot, relative), 'utf8'); +} + +async function readYaml(relative) { + return YAML.parse(await readRepo(relative)); +} + +const currentActivationPages = [ + 'products/notary/docs/configuration-trust-and-integrity.md', + 'products/notary/docs/operator-config-reference.md', + 'products/notary/docs/deployment-hardening-runbook.md', +]; + +test('current docs are explicit unreleased main source while v0.13.0 stays pinned release evidence', async () => { + const [docsets, repoDocs, generatedDocsets] = await Promise.all([ + readYaml('docs/site/src/data/docsets.yaml'), + readYaml('docs/site/src/data/repo-docs.yaml'), + readRepo('docs/site/src/data/generated/docsets.json').then(JSON.parse), + ]); + assert.deepEqual(generatedDocsets, docsets, 'generated docset metadata must match its source'); + const current = docsets.docsets.find((docset) => docset.id === docsets.current); + const released = docsets.docsets.find((docset) => docset.id === 'v0.13.0'); + + assert.equal(current.id, 'latest'); + assert.equal(current.label, 'Main source (unreleased)'); + assert.equal(current.status, 'current'); + assert.equal(current.availability, 'unreleased'); + assert.equal(current.source, 'registry-stack-main'); + assert.match(current.description, /\bunreleased\b.*\bmain\b.*not v0\.13\.0 release proof/i); + for (const product of Object.values(current.products)) { + assert.equal(product.ref, 'HEAD'); + assert.equal(product.version, 'main source (unreleased)'); + assert.doesNotMatch(product.version, /^v0\.13\.0$/); + } + + for (const [repoId, repo] of Object.entries(repoDocs.repos)) { + if (!Array.isArray(repo.docs) || repo.docs.length === 0) continue; + assert.equal(repo.ref, 'HEAD', `${repoId} current docs must read main source`); + assert.equal( + repo.version, + 'main source (unreleased)', + `${repoId} current docs must not inherit a crate release version`, + ); + } + + assert.equal(released.path, '/v/0.13.0/'); + assert.equal(released.status, 'archived'); + assert.equal(released.availability, 'released'); + assert.equal(released.source, 'registry-stack-v0.13.0'); + assert.match(released.description, /^Released RegistryStack v0\.13\.0/); + for (const [productId, product] of Object.entries(released.products)) { + if (productId === 'crosswalk') continue; + assert.equal(product.version, 'v0.13.0'); + assert.equal( + product.ref, + 'd45761a0104bd3d9c2e4b4db391d4223f289bd44', + `${productId} v0.13.0 docs must stay on the immutable release ref`, + ); + } + + for (const docset of docsets.docsets) { + if (docset.id === 'latest') continue; + assert.equal(docset.status, 'archived'); + assert.equal( + docset.availability, + docset.id.startsWith('v') ? 'released' : 'candidate', + `${docset.id} must expose release availability`, + ); + } +}); + +test('current combined-topology pages require separate product bundles and compatible staged admission', async () => { + const pages = await Promise.all( + currentActivationPages.map(async (path) => [path, await readRepo(path)]), + ); + + for (const [path, source] of pages) { + assert.match( + source, + /(?:separate product bundles|product bundles separately|separately[\s\S]{0,100}product bundles)/i, + path, + ); + assert.match(source, /anti-rollback/i, path); + assert.match(source, /not atomic project activation/i, path); + assert.match(source, /Relay[\s\S]{0,160}without admitting\s+caller traffic/i, path); + assert.match(source, /health[\s\S]{0,120}readiness[\s\S]{0,120}audit[\s\S]{0,120}posture/i, path); + assert.match(source, /Notary[\s\S]{0,180}(?:Relay|consultation) contract/i, path); + assert.match(source, /admit caller traffic only (?:after|when) both products are ready/i, path); + assert.match(source, /contract mismatch[\s\S]{0,100}before source access/i, path); + + for (const staleClaim of [ + /combined generation must activate[\s\S]*atomically/i, + /activate Relay and Notary as one compatible project generation/i, + /stage a complete Relay and Notary generation/i, + /activate one complete generation/i, + /root manifest binds compatible Relay and Notary/i, + ]) { + assert.doesNotMatch(source, staleClaim, `${path} reintroduced ${staleClaim}`); + } + } +}); + +test('glossary defers issue 361 without describing an implemented project-root bundle or coordinator', async () => { + const glossary = await readRepo('docs/site/src/content/docs/reference/glossary.mdx'); + + assert.match( + glossary, + /href="https:\/\/github\.com\/registrystack\/registry-stack\/issues\/361"/, + ); + assert.match(glossary, /Current source does not generate, sign, verify, or activate a project-root bundle/); + assert.match(glossary, /no Registry Stack coordinator binds or atomically activates them/); + assert.match(glossary, /this is not atomic project activation/); + assert.doesNotMatch(glossary, /root manifest binds compatible Relay and Notary/i); + assert.doesNotMatch(glossary, /One activated deployment-bundle generation/i); +}); diff --git a/docs/site/scripts/diagnostic-reference-docs.test.mjs b/docs/site/scripts/diagnostic-reference-docs.test.mjs new file mode 100644 index 000000000..bd7f0a689 --- /dev/null +++ b/docs/site/scripts/diagnostic-reference-docs.test.mjs @@ -0,0 +1,160 @@ +import assert from 'node:assert/strict'; +import { execFile } from 'node:child_process'; +import { readFile } from 'node:fs/promises'; +import { resolve } from 'node:path'; +import { test } from 'node:test'; +import { promisify } from 'node:util'; + +import { + diagnosticCatalogs, + validateDiagnosticReference, +} from './generate-diagnostic-references.mjs'; + +const siteRoot = resolve(import.meta.dirname, '..'); +const repoRoot = resolve(siteRoot, '../..'); +const execFileAsync = promisify(execFile); +const expectedCounts = { + authoring: 17, + fixture: 16, + operator: 59, +}; + +async function artifactBytes(catalog) { + const contract = diagnosticCatalogs[catalog]; + return Promise.all([ + readFile(resolve(siteRoot, contract.internal), 'utf8'), + readFile(resolve(siteRoot, contract.public), 'utf8'), + readFile(resolve(repoRoot, contract.fixture), 'utf8'), + ]); +} + +async function executableBytes(catalog) { + const { stdout } = await execFileAsync( + 'cargo', + [ + 'run', + '--locked', + '--quiet', + '-p', + 'registryctl', + '--', + 'project', + 'diagnostics', + '--catalog', + catalog, + '--format', + 'json', + ], + { + cwd: repoRoot, + encoding: 'utf8', + maxBuffer: 16 * 1024 * 1024, + }, + ); + return stdout; +} + +test('committed diagnostic artifacts are strict and byte-identical at every publication point', async () => { + for (const catalog of Object.keys(diagnosticCatalogs)) { + const [internal, publicArtifact, registryctlFixture] = await artifactBytes(catalog); + assert.equal(publicArtifact, internal); + assert.equal(registryctlFixture, internal); + + const reference = JSON.parse(internal); + validateDiagnosticReference(catalog, reference); + assert.equal(reference.entries.length, expectedCounts[catalog]); + assert.ok( + reference.entries.every( + (entry) => entry.lifecycle === 'unreleased' && entry.introduced_in === null, + ), + `${catalog} must not attribute newly introduced codes to an older release`, + ); + if (catalog === 'operator') { + assert.deepEqual(reference.omissions, []); + } + } +}); + +test('committed diagnostic artifacts are byte-exact to the registryctl executable', async () => { + for (const catalog of Object.keys(diagnosticCatalogs)) { + const first = await executableBytes(catalog); + const second = await executableBytes(catalog); + assert.equal( + second, + first, + `${catalog} registryctl diagnostic output is not byte deterministic`, + ); + const [internal, publicArtifact, registryctlFixture] = await artifactBytes(catalog); + assert.equal(internal, first, `${catalog} internal reference drifted from registryctl`); + assert.equal(publicArtifact, first, `${catalog} public reference drifted from registryctl`); + assert.equal( + registryctlFixture, + first, + `${catalog} registryctl fixture drifted from its executable`, + ); + + const reference = JSON.parse(first); + validateDiagnosticReference(catalog, reference); + assert.ok( + reference.entries.every( + (entry) => entry.lifecycle === 'unreleased' && entry.introduced_in === null, + ), + `${catalog} executable must not attribute unreleased codes to an older release`, + ); + } +}); + +test('every machine docs anchor resolves to its catalog page and generated component id', async () => { + const component = await readFile( + resolve(siteRoot, 'src/components/DiagnosticReference.astro'), + 'utf8', + ); + assert.match( + component, + /const anchorId = \(entry: Entry\) => entry\.docs_anchor\.split\('#', 2\)\[1\]/, + ); + assert.match(component, /id=\{anchorId\(entry\)\}/); + + for (const catalog of Object.keys(diagnosticCatalogs)) { + const [bytes] = await artifactBytes(catalog); + const reference = JSON.parse(bytes); + const pagePath = resolve( + siteRoot, + 'src/content/docs/reference/diagnostics', + `${catalog}.mdx`, + ); + const page = await readFile(pagePath, 'utf8'); + assert.match(page, new RegExp(`catalog="${catalog}"`)); + for (const entry of reference.entries) { + const [route, id] = entry.docs_anchor.split('#'); + assert.equal(route, `/reference/diagnostics/${catalog}/`); + assert.match(id, new RegExp(`^${entry.product}--[a-z0-9._-]+$`)); + } + } +}); + +test('published diagnostic pages state the pure CLI and evidence boundaries', async () => { + const pages = await Promise.all( + Object.keys(diagnosticCatalogs).map((catalog) => + readFile( + resolve( + siteRoot, + 'src/content/docs/reference/diagnostics', + `${catalog}.mdx`, + ), + 'utf8', + ), + ), + ); + const source = pages.join('\n'); + assert.doesNotMatch(source, /\/reference\/registryctl\/(?:authoring-diagnostics|fixture-errors|preflight-errors)\//); + assert.match(source, /registryctl project diagnostics --catalog authoring --format json/); + assert.match(source, /registryctl project diagnostics --catalog fixture --format json/); + assert.match(source, /registryctl project diagnostics --catalog operator --format json/); + assert.match(source, /does not open a country project/); + assert.match(source, /do not disclose the received configuration/); + assert.doesNotMatch( + source, + /COUNTRY_(?:SECRET|VALUE)_SENTINEL|BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY/, + ); +}); diff --git a/docs/site/scripts/generate-authoring-reference.mjs b/docs/site/scripts/generate-authoring-reference.mjs new file mode 100644 index 000000000..924c9126a --- /dev/null +++ b/docs/site/scripts/generate-authoring-reference.mjs @@ -0,0 +1,344 @@ +import { execFile } from 'node:child_process'; +import { readFileSync } from 'node:fs'; +import { mkdir, rename, unlink, writeFile } from 'node:fs/promises'; +import { dirname, resolve } from 'node:path'; +import { fileURLToPath } from 'node:url'; +import { promisify } from 'node:util'; + +const execFileAsync = promisify(execFile); +const scriptDir = dirname(fileURLToPath(import.meta.url)); +const defaultDocsRoot = resolve(scriptDir, '..'); +const defaultRepoRoot = resolve(defaultDocsRoot, '../..'); +const sourceManifest = JSON.parse( + readFileSync(new URL('./authoring-reference-sources.json', import.meta.url), 'utf8'), +); + +const referenceSchemaId = + 'https://id.registrystack.org/schemas/registryctl/project-documentation/registry.project.configuration_reference.v1.schema.json'; +const coverageSchemaId = + 'https://id.registrystack.org/schemas/registryctl/project-documentation/registry.project.configuration_reference_coverage.v1.schema.json'; +const schemaOrder = sourceManifest.schema_order; +const schemaSources = sourceManifest.schema_sources; +const fieldKnowledgeSource = sourceManifest.field_knowledge; +const humanIntentSource = sourceManifest.human_intent; +const runtimeIntentSources = sourceManifest.runtime_intent; +const runtimeSchemas = new Set(['relay', 'notary']); +const pathKinds = ['root', 'property', 'map_key', 'map_value', 'array_item', 'branch']; + +function parseJson(text, label) { + try { + return JSON.parse(text); + } catch (error) { + throw new Error(`${label} did not emit JSON: ${error.message}`); + } +} + +async function executeRegistryctl(repoRoot, args) { + try { + const { stdout } = await execFileAsync( + 'cargo', + ['run', '--locked', '--quiet', '-p', 'registryctl', '--', ...args], + { + cwd: repoRoot, + encoding: 'utf8', + maxBuffer: 16 * 1024 * 1024, + }, + ); + return stdout; + } catch (error) { + const stdout = typeof error?.stdout === 'string' ? error.stdout.trim() : ''; + const stderr = typeof error?.stderr === 'string' ? error.stderr.trim() : ''; + const detail = stdout || stderr || error.message; + throw new Error(`registryctl ${args.join(' ')} failed: ${detail}`); + } +} + +function assertInteger(value, label) { + if (!Number.isSafeInteger(value) || value < 0) { + throw new Error(`${label} must be a non-negative safe integer`); + } +} + +function assertSourceContract(source, label) { + if ( + !source || + source.reads_country_workspaces !== false || + source.reads_runtime_configuration !== false + ) { + throw new Error(`${label} must prohibit country-workspace and runtime-configuration reads`); + } + if (JSON.stringify(source.schemas) !== JSON.stringify(schemaOrder)) { + throw new Error(`${label} must cover the exact seven configuration domains in order`); + } + if ( + JSON.stringify(source.schema_sources) !== JSON.stringify(schemaSources) || + source.field_knowledge !== fieldKnowledgeSource || + source.human_intent !== humanIntentSource || + JSON.stringify(source.runtime_intent) !== JSON.stringify(runtimeIntentSources) + ) { + throw new Error(`${label} must identify the exact committed authoring-reference sources`); + } +} + +function assertReferenceBaseline(baseline, label) { + if ( + !baseline || + baseline.generator_lifecycle !== 'unreleased' || + baseline.published_release !== null || + baseline.field_history_status !== 'not_verified' || + baseline.history_verification_method !== null || + !Array.isArray(baseline.compared_releases) || + baseline.compared_releases.length !== 0 + ) { + throw new Error( + `${label} must identify an unreleased generator with field history not verified`, + ); + } +} + +function assertCoverageShape(coverage, label) { + if (!coverage || typeof coverage !== 'object') { + throw new Error(`${label}.coverage must be an object`); + } + assertInteger(coverage.schema_count, `${label}.coverage.schema_count`); + assertInteger(coverage.path_count, `${label}.coverage.path_count`); + assertInteger(coverage.reference_count, `${label}.coverage.reference_count`); + if (coverage.schema_count !== schemaOrder.length) { + throw new Error(`${label} must cover all seven configuration schemas`); + } + const schemaTotal = schemaOrder.reduce((total, schema) => { + assertInteger(coverage.by_schema?.[schema], `${label}.coverage.by_schema.${schema}`); + return total + coverage.by_schema[schema]; + }, 0); + if (schemaTotal !== coverage.path_count) { + throw new Error(`${label} schema counts do not add up to path_count`); + } + const pathKindTotal = pathKinds.reduce((total, kind) => { + assertInteger(coverage.by_path_kind?.[kind], `${label}.coverage.by_path_kind.${kind}`); + return total + coverage.by_path_kind[kind]; + }, 0); + if (pathKindTotal !== coverage.path_count) { + throw new Error(`${label} path-kind counts do not add up to path_count`); + } + const intentSourceEntries = Object.entries(coverage.by_intent_source ?? {}); + const intentSourceTotal = intentSourceEntries.reduce((total, [source, count]) => { + assertInteger(count, `${label}.coverage.by_intent_source.${source}`); + return total + count; + }, 0); + if (intentSourceTotal !== coverage.path_count) { + throw new Error(`${label} intent-source counts do not add up to path_count`); + } + const intentProfileEntries = Object.entries(coverage.by_intent_profile ?? {}); + const intentProfileTotal = intentProfileEntries.reduce((total, [profile, count]) => { + assertInteger(count, `${label}.coverage.by_intent_profile.${profile}`); + return total + count; + }, 0); + const runtimePathCount = [...runtimeSchemas].reduce( + (total, schema) => total + coverage.by_schema[schema], + 0, + ); + if (intentProfileTotal !== runtimePathCount) { + throw new Error(`${label} intent-profile counts do not cover every runtime path`); + } +} + +function fieldIdentity(field) { + return `${field?.address?.schema ?? ''}#${field?.address?.pointer ?? ''}#${ + field?.address?.key_path ?? '' + }`; +} + +export function validateAuthoringReferenceCoverage(coverage) { + if (coverage?.schema_id !== coverageSchemaId || coverage.format_version !== '1.0') { + throw new Error('configuration-reference coverage uses an unsupported contract'); + } + if (coverage.status !== 'complete') { + const missing = Array.isArray(coverage.missing_intent) ? coverage.missing_intent.length : 'unknown'; + throw new Error(`configuration-reference coverage is incomplete (${missing} missing intents)`); + } + assertCoverageShape(coverage.coverage, 'coverage report'); + assertReferenceBaseline(coverage.reference_baseline, 'coverage report reference baseline'); + assertSourceContract(coverage.source_contract, 'coverage report source contract'); + for (const field of [ + 'reviewed_intent_assignment_required_count', + 'reviewed_intent_assignment_covered_count', + 'distinct_reviewed_intent_count', + 'distinct_reviewed_intents_reused_count', + 'reviewed_intent_assignments_using_reused_intent_count', + ]) { + assertInteger(coverage[field], `coverage report.${field}`); + } + if ( + coverage.reviewed_intent_assignment_required_count !== coverage.coverage.path_count || + coverage.reviewed_intent_assignment_covered_count !== coverage.coverage.path_count || + coverage.distinct_reviewed_intent_count > + coverage.reviewed_intent_assignment_covered_count || + coverage.distinct_reviewed_intents_reused_count > + coverage.distinct_reviewed_intent_count || + coverage.reviewed_intent_assignments_using_reused_intent_count > + coverage.reviewed_intent_assignment_covered_count || + (coverage.distinct_reviewed_intents_reused_count === 0) !== + (coverage.reviewed_intent_assignments_using_reused_intent_count === 0) || + coverage.reviewed_intent_assignments_using_reused_intent_count < + coverage.distinct_reviewed_intents_reused_count * 2 || + !Array.isArray(coverage.missing_intent) || + coverage.missing_intent.length !== 0 + ) { + throw new Error( + 'configuration-reference reviewed-intent assignment coverage is not exhaustively consistent', + ); + } +} + +export function validateAuthoringReference(reference, coverage) { + validateAuthoringReferenceCoverage(coverage); + if (reference?.schema_id !== referenceSchemaId || reference.format_version !== '1.0') { + throw new Error('configuration reference uses an unsupported contract'); + } + assertCoverageShape(reference.coverage, 'configuration reference'); + assertReferenceBaseline(reference.reference_baseline, 'configuration reference baseline'); + assertSourceContract(reference.source_contract, 'configuration reference source contract'); + if (JSON.stringify(reference.reference_baseline) !== JSON.stringify(coverage.reference_baseline)) { + throw new Error('configuration reference and coverage report baselines differ'); + } + if (JSON.stringify(reference.source_contract) !== JSON.stringify(coverage.source_contract)) { + throw new Error('configuration reference and coverage report provenance differ'); + } + if (JSON.stringify(reference.coverage) !== JSON.stringify(coverage.coverage)) { + throw new Error('configuration reference and coverage report counts differ'); + } + if ( + !Array.isArray(reference.fields) || + reference.fields.length !== reference.coverage.path_count + ) { + throw new Error('configuration reference must contain one entry per covered path'); + } + const identities = new Set(); + const intentCounts = new Map(); + for (const [index, field] of reference.fields.entries()) { + const identity = fieldIdentity(field); + const runtimeField = runtimeSchemas.has(field?.address?.schema); + if ( + !schemaOrder.includes(field?.address?.schema) || + typeof field?.address?.pointer !== 'string' || + (field.address.pointer !== '' && !field.address.pointer.startsWith('/')) || + runtimeField !== (typeof field.address.key_path === 'string') || + !pathKinds.includes(field?.address?.path_kind) + ) { + throw new Error(`configuration reference field ${index} has an invalid address`); + } + if (identities.has(identity)) { + throw new Error(`configuration reference repeats ${identity}`); + } + identities.add(identity); + if ( + typeof field.purpose !== 'string' || + field.purpose.trim().length < 24 || + field.example?.contains_country_values !== false + ) { + throw new Error(`configuration reference field ${identity} lacks reviewed, safe intent`); + } + intentCounts.set(field.purpose, (intentCounts.get(field.purpose) ?? 0) + 1); + if ( + field.history_status !== 'not_verified' || + field.introduced_in !== null || + !Array.isArray(field.version_history) || + field.version_history.length !== 0 || + Object.hasOwn(field.default ?? {}, 'source_version') + ) { + throw new Error( + `configuration reference field ${identity} fabricates unverified release history`, + ); + } + if ( + runtimeField !== + (typeof field.intent_profile === 'string' && field.intent_profile.trim().length > 0) + ) { + throw new Error( + `configuration reference field ${identity} must have an exact product-owned runtime intent profile`, + ); + } + if (runtimeField && Object.hasOwn(field.default ?? {}, 'schema_value')) { + throw new Error( + `configuration reference field ${identity} exposes a runtime default value`, + ); + } + } + const reusedIntentCounts = [...intentCounts.values()].filter((count) => count > 1); + if ( + coverage.distinct_reviewed_intent_count !== intentCounts.size || + coverage.distinct_reviewed_intents_reused_count !== reusedIntentCounts.length || + coverage.reviewed_intent_assignments_using_reused_intent_count !== + reusedIntentCounts.reduce((total, count) => total + count, 0) + ) { + throw new Error( + 'configuration reference reviewed-intent reuse differs from the coverage report', + ); + } +} + +async function readAuthoringReference( + repoRoot = defaultRepoRoot, + execute = executeRegistryctl, +) { + const coverageText = await execute(repoRoot, ['authoring', 'reference', '--coverage']); + const coverage = parseJson( + coverageText, + 'registryctl authoring reference --coverage', + ); + validateAuthoringReferenceCoverage(coverage); + const referenceText = await execute(repoRoot, ['authoring', 'reference']); + const reference = parseJson(referenceText, 'registryctl authoring reference'); + validateAuthoringReference(reference, coverage); + return { reference, coverage, referenceText, coverageText }; +} + +export async function buildAuthoringReference( + repoRoot = defaultRepoRoot, + execute = executeRegistryctl, +) { + const { reference, coverage } = await readAuthoringReference(repoRoot, execute); + return { reference, coverage }; +} + +async function publishJson(path, text) { + await mkdir(dirname(path), { recursive: true }); + const temporary = `${path}.${process.pid}.tmp`; + try { + await writeFile(temporary, text.endsWith('\n') ? text : `${text}\n`, { + encoding: 'utf8', + flag: 'wx', + }); + await rename(temporary, path); + } catch (error) { + await unlink(temporary).catch(() => {}); + throw error; + } +} + +export async function generateAuthoringReference( + docsRoot = defaultDocsRoot, + repoRoot = defaultRepoRoot, + execute = executeRegistryctl, +) { + const { reference, referenceText, coverageText } = await readAuthoringReference( + repoRoot, + execute, + ); + const destinations = [ + ['src/data/generated/configuration-reference.json', referenceText], + ['src/data/generated/configuration-reference-coverage.json', coverageText], + ['public/generated/configuration-reference.v1.json', referenceText], + ['public/generated/configuration-reference-coverage.v1.json', coverageText], + ]; + await Promise.all( + destinations.map(([relative, text]) => publishJson(resolve(docsRoot, relative), text)), + ); + console.log( + `Generated authoring reference for ${reference.fields.length} paths across ${reference.coverage.schema_count} schemas.`, + ); +} + +if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) { + await generateAuthoringReference(); +} diff --git a/docs/site/scripts/generate-authoring-reference.test.mjs b/docs/site/scripts/generate-authoring-reference.test.mjs new file mode 100644 index 000000000..bcc53cce2 --- /dev/null +++ b/docs/site/scripts/generate-authoring-reference.test.mjs @@ -0,0 +1,300 @@ +import assert from 'node:assert/strict'; +import { mkdtemp, readFile, rm } from 'node:fs/promises'; +import { tmpdir } from 'node:os'; +import { join, resolve } from 'node:path'; +import { test } from 'node:test'; + +import { + buildAuthoringReference, + generateAuthoringReference, + validateAuthoringReference, +} from './generate-authoring-reference.mjs'; + +const schemas = ['project', 'environment', 'integration', 'fixture', 'entity', 'relay', 'notary']; +const sourceContract = { + schemas, + schema_sources: [ + 'project.schema.json', + 'environment.schema.json', + 'integration.schema.json', + 'fixture.schema.json', + 'entity.schema.json', + 'registry-relay.config.schema.json', + 'registry-notary.config.schema.json', + ], + field_knowledge: 'schemas/project-authoring/parity-coverage.json#field_knowledge', + human_intent: 'schemas/project-authoring/documentation-intent.json', + runtime_intent: [ + 'crates/registry-relay/config/documentation-intent.json', + 'crates/registry-notary-core/config/documentation-intent.json', + ], + reads_country_workspaces: false, + reads_runtime_configuration: false, +}; +const referenceBaseline = { + generator_lifecycle: 'unreleased', + published_release: null, + field_history_status: 'not_verified', + history_verification_method: null, + compared_releases: [], +}; +const counts = { + schema_count: 7, + path_count: 7, + reference_count: 0, + by_schema: Object.fromEntries(schemas.map((schema) => [schema, 1])), + by_path_kind: { + root: 7, + property: 0, + map_key: 0, + map_value: 0, + array_item: 0, + branch: 0, + }, + by_sensitivity: { + structural: 7, + }, + by_intent_source: { + schema_description: 7, + }, + by_intent_profile: {}, +}; + +function fixtureData() { + const coverage = { + schema_id: + 'https://id.registrystack.org/schemas/registryctl/project-documentation/registry.project.configuration_reference_coverage.v1.schema.json', + format_version: '1.0', + status: 'complete', + reference_baseline: referenceBaseline, + source_contract: sourceContract, + coverage: counts, + reviewed_intent_assignment_required_count: 7, + reviewed_intent_assignment_covered_count: 7, + distinct_reviewed_intent_count: 7, + distinct_reviewed_intents_reused_count: 0, + reviewed_intent_assignments_using_reused_intent_count: 0, + missing_intent: [], + }; + const reference = { + schema_id: + 'https://id.registrystack.org/schemas/registryctl/project-documentation/registry.project.configuration_reference.v1.schema.json', + format_version: '1.0', + reference_baseline: referenceBaseline, + source_contract: sourceContract, + coverage: counts, + fields: schemas.map((schema) => ({ + address: { + schema, + pointer: '', + ...(schema === 'relay' || schema === 'notary' ? { key_path: '' } : {}), + path_kind: 'root', + }, + purpose: `Documents the reviewed ${schema} configuration contract root and its exact operational intent.`, + ...(schema === 'relay' || schema === 'notary' + ? { intent_profile: `${schema}_runtime_root` } + : {}), + default: { behavior: 'not_applicable' }, + history_status: 'not_verified', + introduced_in: null, + version_history: [], + example: { contains_country_values: false }, + })), + }; + reference.coverage.by_intent_profile = { + relay_runtime_root: 1, + notary_runtime_root: 1, + }; + coverage.coverage.by_intent_profile = reference.coverage.by_intent_profile; + return { reference, coverage }; +} + +function fixtureExecutor(data) { + return async (_repoRoot, args) => + `${JSON.stringify(args.includes('--coverage') ? data.coverage : data.reference)}\n`; +} + +test('accepts one complete, value-safe field reference per covered configuration path', async () => { + const data = fixtureData(); + const built = await buildAuthoringReference('/unused', fixtureExecutor(data)); + + assert.deepEqual(built, data); + assert.doesNotThrow(() => validateAuthoringReference(data.reference, data.coverage)); +}); + +test('publishes identical internal and raw public artifacts only after validation', async () => { + const root = await mkdtemp(join(tmpdir(), 'registry-doc-reference-')); + try { + const data = fixtureData(); + const exactUint64Maximum = '18446744073709551615'; + data.reference.fields[0].constraints = [ + { keyword: 'maximum', value: exactUint64Maximum }, + ]; + const execute = async (_repoRoot, args) => { + if (args.includes('--coverage')) return `${JSON.stringify(data.coverage)}\n`; + return `${JSON.stringify(data.reference).replace( + `"${exactUint64Maximum}"`, + exactUint64Maximum, + )}\n`; + }; + await generateAuthoringReference(root, '/unused', execute); + + for (const [internal, raw] of [ + [ + 'src/data/generated/configuration-reference.json', + 'public/generated/configuration-reference.v1.json', + ], + [ + 'src/data/generated/configuration-reference-coverage.json', + 'public/generated/configuration-reference-coverage.v1.json', + ], + ]) { + assert.equal( + await readFile(resolve(root, internal), 'utf8'), + await readFile(resolve(root, raw), 'utf8'), + ); + } + assert.match( + await readFile( + resolve(root, 'src/data/generated/configuration-reference.json'), + 'utf8', + ), + /"maximum","value":18446744073709551615/, + 'publication preserves integers larger than the JavaScript safe-integer range as opaque CLI JSON', + ); + } finally { + await rm(root, { recursive: true, force: true }); + } +}); + +test('fails closed on incomplete reviewed-intent assignment coverage before requesting the reference', async () => { + const data = fixtureData(); + data.coverage.status = 'incomplete'; + data.coverage.reviewed_intent_assignment_covered_count = 4; + data.coverage.missing_intent = [ + { schema: 'project', pointer: '/properties/version', path_kind: 'property' }, + ]; + const calls = []; + const execute = async (_repoRoot, args) => { + calls.push(args); + if (args.includes('--coverage')) return JSON.stringify(data.coverage); + throw new Error('reference command must not run'); + }; + + await assert.rejects( + buildAuthoringReference('/unused', execute), + /coverage is incomplete \(1 missing intents\)/, + ); + assert.deepEqual(calls, [['authoring', 'reference', '--coverage']]); +}); + +test('rejects fabricated field history and inconsistent intent-reuse counts', () => { + const fabricatedHistory = fixtureData(); + fabricatedHistory.reference.fields[0].introduced_in = '0.13.0'; + assert.throws( + () => + validateAuthoringReference( + fabricatedHistory.reference, + fabricatedHistory.coverage, + ), + /fabricates unverified release history/, + ); + + const falseUniqueness = fixtureData(); + falseUniqueness.coverage.distinct_reviewed_intent_count = 6; + assert.throws( + () => + validateAuthoringReference( + falseUniqueness.reference, + falseUniqueness.coverage, + ), + /reviewed-intent reuse differs/, + ); +}); + +test('rejects duplicated paths and country-value-bearing example metadata', () => { + const data = fixtureData(); + data.reference.fields[1].address = data.reference.fields[0].address; + assert.throws( + () => validateAuthoringReference(data.reference, data.coverage), + /repeats project#/, + ); + + const unsafe = fixtureData(); + unsafe.reference.fields[0].example.contains_country_values = true; + assert.throws( + () => validateAuthoringReference(unsafe.reference, unsafe.coverage), + /lacks reviewed, safe intent/, + ); +}); + +test('rejects runtime paths without exact profiles or with exposed default values', () => { + const missingProfile = fixtureData(); + delete missingProfile.reference.fields.find( + (field) => field.address.schema === 'relay', + ).intent_profile; + assert.throws( + () => validateAuthoringReference(missingProfile.reference, missingProfile.coverage), + /must have an exact product-owned runtime intent profile/, + ); + + const exposedDefault = fixtureData(); + exposedDefault.reference.fields.find( + (field) => field.address.schema === 'notary', + ).default.schema_value = 'COUNTRY_VALUE_SENTINEL'; + assert.throws( + () => validateAuthoringReference(exposedDefault.reference, exposedDefault.coverage), + /exposes a runtime default value/, + ); +}); + +test('keeps JSON Schema pointers distinct from runtime configuration key paths', () => { + const missingKeyPath = fixtureData(); + delete missingKeyPath.reference.fields.find( + (field) => field.address.schema === 'relay', + ).address.key_path; + assert.throws( + () => validateAuthoringReference(missingKeyPath.reference, missingKeyPath.coverage), + /has an invalid address/, + ); + + const authoredKeyPath = fixtureData(); + authoredKeyPath.reference.fields.find( + (field) => field.address.schema === 'project', + ).address.key_path = 'project'; + assert.throws( + () => validateAuthoringReference(authoredKeyPath.reference, authoredKeyPath.coverage), + /has an invalid address/, + ); + + const dottedPointer = fixtureData(); + dottedPointer.reference.fields.find( + (field) => field.address.schema === 'notary', + ).address.pointer = 'auth.api_keys[]'; + assert.throws( + () => validateAuthoringReference(dottedPointer.reference, dottedPointer.coverage), + /has an invalid address/, + ); +}); + +test('rejects mismatched or unrecognized source provenance', () => { + const mismatched = fixtureData(); + mismatched.reference.source_contract = { + ...mismatched.reference.source_contract, + human_intent: 'schemas/project-authoring/unreviewed-intent.json', + }; + assert.throws( + () => validateAuthoringReference(mismatched.reference, mismatched.coverage), + /exact committed authoring-reference sources/, + ); + + const divergent = fixtureData(); + divergent.reference.source_contract = { + ...divergent.reference.source_contract, + reads_runtime_configuration: true, + }; + assert.throws( + () => validateAuthoringReference(divergent.reference, divergent.coverage), + /must prohibit country-workspace and runtime-configuration reads/, + ); +}); diff --git a/docs/site/scripts/generate-diagnostic-references.mjs b/docs/site/scripts/generate-diagnostic-references.mjs new file mode 100644 index 000000000..ac3cf59a2 --- /dev/null +++ b/docs/site/scripts/generate-diagnostic-references.mjs @@ -0,0 +1,365 @@ +import { execFile } from 'node:child_process'; +import { mkdir, rename, unlink, writeFile } from 'node:fs/promises'; +import { dirname, resolve } from 'node:path'; +import { fileURLToPath } from 'node:url'; +import { promisify } from 'node:util'; + +const execFileAsync = promisify(execFile); +const scriptDir = dirname(fileURLToPath(import.meta.url)); +const defaultDocsRoot = resolve(scriptDir, '..'); +const defaultRepoRoot = resolve(defaultDocsRoot, '../..'); + +export const diagnosticCatalogs = { + authoring: { + schemaVersion: 'registryctl.authoring_error_reference.v1', + families: new Set(['authoring_validation']), + internal: 'src/data/generated/diagnostics/authoring.json', + public: 'public/generated/diagnostics/authoring.v1.json', + fixture: + 'crates/registryctl/tests/fixtures/project-reports/registryctl.authoring_error_reference.v1.json', + }, + fixture: { + schemaVersion: 'registryctl.fixture_error_reference.v1', + families: new Set(['fixture_execution']), + internal: 'src/data/generated/diagnostics/fixture.json', + public: 'public/generated/diagnostics/fixture.v1.json', + fixture: + 'crates/registryctl/tests/fixtures/project-reports/registryctl.fixture_error_reference.v1.json', + }, + operator: { + schemaVersion: 'registryctl.operator_error_reference.v1', + families: new Set([ + 'bundle_verification', + 'notary_activation', + 'operator_preflight', + 'relay_activation', + 'relay_process_startup', + ]), + internal: 'src/data/generated/diagnostics/operator.json', + public: 'public/generated/diagnostics/operator.v1.json', + fixture: + 'crates/registryctl/tests/fixtures/project-reports/registryctl.operator_error_reference.v1.json', + }, +}; + +const entryFields = new Set([ + 'family', + 'code', + 'owner', + 'product', + 'phase', + 'safe_meaning', + 'rule', + 'safe_remediation', + 'field_address_pattern', + 'evidence_scope', + 'secret_sensitive_value_policy', + 'docs_anchor', + 'lifecycle', + 'introduced_in', + 'stability', + 'evidence_limitation', +]); +const ownerByProduct = new Map([ + ['registry_notary', 'registry_notary'], + ['registry_platform_ops', 'registry_platform_ops'], + ['registry_relay', 'registry_relay'], + ['registryctl', 'registryctl'], + ['registryctl_relay_offline_harness', 'registryctl'], +]); +const familyCatalog = new Map([ + ['authoring_validation', 'authoring'], + ['fixture_execution', 'fixture'], + ['bundle_verification', 'operator'], + ['notary_activation', 'operator'], + ['operator_preflight', 'operator'], + ['relay_activation', 'operator'], + ['relay_process_startup', 'operator'], +]); +const productOwnedDocsSlugFamilies = new Set([ + 'bundle_verification', + 'notary_activation', + 'relay_activation', + 'relay_process_startup', +]); +const unsafePublishedText = + /(COUNTRY_(?:SECRET|VALUE)_SENTINEL|BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY|Bearer\s+[A-Za-z0-9._~-]+|\/(?:private|tmp)\/[^\s]*)/i; + +function parseJson(text, label) { + try { + return JSON.parse(text); + } catch (error) { + throw new Error(`${label} did not emit JSON: ${error.message}`); + } +} + +async function executeRegistryctl(repoRoot, args) { + try { + const { stdout } = await execFileAsync( + 'cargo', + ['run', '--locked', '--quiet', '-p', 'registryctl', '--', ...args], + { + cwd: repoRoot, + encoding: 'utf8', + maxBuffer: 16 * 1024 * 1024, + }, + ); + return stdout; + } catch (error) { + const stdout = typeof error?.stdout === 'string' ? error.stdout.trim() : ''; + const stderr = typeof error?.stderr === 'string' ? error.stderr.trim() : ''; + throw new Error( + `registryctl ${args.join(' ')} failed: ${stdout || stderr || error.message}`, + ); + } +} + +function exactKeys(value, expected, label) { + if (!value || typeof value !== 'object' || Array.isArray(value)) { + throw new Error(`${label} must be an object`); + } + const actual = Object.keys(value).sort(); + const required = [...expected].sort(); + if (JSON.stringify(actual) !== JSON.stringify(required)) { + throw new Error(`${label} must contain exactly ${required.join(', ')}`); + } +} + +function nonemptyString(value, label) { + if (typeof value !== 'string' || value.trim() === '') { + throw new Error(`${label} must be a non-empty string`); + } + if (unsafePublishedText.test(value)) { + throw new Error(`${label} contains runtime or secret-bearing text`); + } +} + +function isNumericReleaseVersion(value) { + return ( + typeof value === 'string' && + /^(?:0|[1-9][0-9]*)\.(?:0|[1-9][0-9]*)\.(?:0|[1-9][0-9]*)$/.test(value) + ); +} + +function key(entry) { + return [entry.family, entry.product, entry.code]; +} + +function compareText(left, right) { + if (left < right) return -1; + if (left > right) return 1; + return 0; +} + +function compareKeys(left, right) { + return compareText(left[0], right[0]) || + compareText(left[1], right[1]) || + compareText(left[2], right[2]); +} + +function compareOmissionKeys(left, right) { + return compareText(left[0], right[0]) || compareText(left[1], right[1]); +} + +function expectedAnchor(catalog, entry) { + if (productOwnedDocsSlugFamilies.has(entry.family)) { + return new RegExp( + `^/reference/diagnostics/${catalog}/#${entry.product}--[a-z0-9]+(?:-[a-z0-9]+)*$`, + ); + } + return `/reference/diagnostics/${catalog}/#${entry.product}--${entry.code}`; +} + +export function validateDiagnosticReference(catalog, reference) { + const contract = diagnosticCatalogs[catalog]; + if (!contract) throw new Error(`unknown diagnostic catalog ${catalog}`); + const topLevel = catalog === 'operator' + ? new Set(['schema_version', 'entries', 'omissions']) + : new Set(['schema_version', 'entries']); + exactKeys(reference, topLevel, `${catalog} diagnostic reference`); + if (reference.schema_version !== contract.schemaVersion) { + throw new Error(`${catalog} diagnostic reference has an unsupported schema_version`); + } + if (!Array.isArray(reference.entries) || reference.entries.length === 0) { + throw new Error(`${catalog} diagnostic reference must contain entries`); + } + + let previous; + const identities = new Set(); + const docsAnchors = new Set(); + for (const [index, entry] of reference.entries.entries()) { + const label = `${catalog}.entries[${index}]`; + exactKeys(entry, entryFields, label); + if (!contract.families.has(entry.family)) { + throw new Error(`${label}.family is not part of the ${catalog} catalog`); + } + if (familyCatalog.get(entry.family) !== catalog) { + throw new Error(`${label}.family resolves to the wrong public catalog`); + } + if (ownerByProduct.get(entry.product) !== entry.owner) { + throw new Error(`${label} has an invalid product-owner mapping`); + } + for (const field of [ + 'family', + 'code', + 'owner', + 'product', + 'phase', + 'safe_meaning', + 'rule', + 'safe_remediation', + 'evidence_scope', + 'secret_sensitive_value_policy', + 'docs_anchor', + 'lifecycle', + 'stability', + 'evidence_limitation', + ]) { + nonemptyString(entry[field], `${label}.${field}`); + } + if ( + entry.field_address_pattern !== null && + typeof entry.field_address_pattern !== 'string' + ) { + throw new Error(`${label}.field_address_pattern must be a string or null`); + } + if (typeof entry.field_address_pattern === 'string') { + nonemptyString(entry.field_address_pattern, `${label}.field_address_pattern`); + } + if ( + !['no_received_value', 'no_runtime_values', 'received_type_only'].includes( + entry.secret_sensitive_value_policy, + ) + ) { + throw new Error(`${label}.secret_sensitive_value_policy is not closed`); + } + if (entry.stability !== 'pre1_stable_code') { + throw new Error(`${label}.stability is not supported`); + } + if (entry.lifecycle === 'unreleased') { + if (entry.introduced_in !== null) { + throw new Error(`${label} unreleased lifecycle requires introduced_in: null`); + } + } else if ( + !['active', 'deprecated', 'released'].includes(entry.lifecycle) || + !isNumericReleaseVersion(entry.introduced_in) + ) { + throw new Error(`${label} released lifecycle requires a numeric introduced_in`); + } + const entryKey = key(entry); + const identity = JSON.stringify(entryKey); + if (identities.has(identity)) { + throw new Error(`${label} duplicates ${identity}`); + } + identities.add(identity); + if (previous && compareKeys(previous, entryKey) >= 0) { + throw new Error(`${label} is not ordered by family, product, code`); + } + previous = entryKey; + + const expectedDocsAnchor = expectedAnchor(catalog, entry); + if ( + typeof expectedDocsAnchor === 'string' + ? entry.docs_anchor !== expectedDocsAnchor + : !expectedDocsAnchor.test(entry.docs_anchor) + ) { + throw new Error(`${label}.docs_anchor is not derived from its owned static metadata`); + } + if (docsAnchors.has(entry.docs_anchor)) { + throw new Error(`${label}.docs_anchor is duplicated`); + } + docsAnchors.add(entry.docs_anchor); + } + + if (catalog === 'operator') { + if (!Array.isArray(reference.omissions)) { + throw new Error('operator.omissions must be an array'); + } + let previousOmission; + const omissionKeys = new Set(); + for (const [index, omission] of reference.omissions.entries()) { + const label = `operator.omissions[${index}]`; + exactKeys( + omission, + new Set(['family', 'product', 'reason', 'evidence', 'required_action']), + label, + ); + for (const field of ['family', 'product', 'reason', 'evidence', 'required_action']) { + nonemptyString(omission[field], `${label}.${field}`); + } + if (!diagnosticCatalogs.operator.families.has(omission.family)) { + throw new Error(`${label}.family is not an operator family`); + } + if (!ownerByProduct.has(omission.product)) { + throw new Error(`${label}.product is not closed`); + } + if (omission.reason !== 'no_complete_public_code_catalog') { + throw new Error(`${label}.reason is not supported`); + } + const omissionKey = [omission.family, omission.product]; + const identity = JSON.stringify(omissionKey); + if (omissionKeys.has(identity)) throw new Error(`${label} is duplicated`); + omissionKeys.add(identity); + if ( + previousOmission && + compareOmissionKeys(previousOmission, omissionKey) >= 0 + ) { + throw new Error(`${label} is not lexically ordered`); + } + previousOmission = omissionKey; + } + } +} + +async function publishJson(path, text) { + await mkdir(dirname(path), { recursive: true }); + const temporary = `${path}.${process.pid}.tmp`; + try { + await writeFile(temporary, text, { + encoding: 'utf8', + flag: 'wx', + }); + await rename(temporary, path); + } catch (error) { + await unlink(temporary).catch(() => {}); + throw error; + } +} + +export async function generateDiagnosticReferences( + docsRoot = defaultDocsRoot, + repoRoot = defaultRepoRoot, + execute = executeRegistryctl, +) { + const publications = []; + const counts = []; + for (const [catalog, contract] of Object.entries(diagnosticCatalogs)) { + const args = [ + 'project', + 'diagnostics', + '--catalog', + catalog, + '--format', + 'json', + ]; + const first = await execute(repoRoot, args); + const second = await execute(repoRoot, args); + if (first !== second) { + throw new Error(`registryctl ${catalog} diagnostic reference is not byte deterministic`); + } + const reference = parseJson(first, `registryctl ${catalog} diagnostic reference`); + validateDiagnosticReference(catalog, reference); + publications.push( + [resolve(docsRoot, contract.internal), first], + [resolve(docsRoot, contract.public), first], + [resolve(repoRoot, contract.fixture), first], + ); + counts.push(`${catalog}=${reference.entries.length}`); + } + await Promise.all(publications.map(([path, text]) => publishJson(path, text))); + console.log(`Generated diagnostic references (${counts.join(', ')}).`); +} + +if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) { + await generateDiagnosticReferences(); +} diff --git a/docs/site/scripts/generate-diagnostic-references.test.mjs b/docs/site/scripts/generate-diagnostic-references.test.mjs new file mode 100644 index 000000000..074841ad4 --- /dev/null +++ b/docs/site/scripts/generate-diagnostic-references.test.mjs @@ -0,0 +1,181 @@ +import assert from 'node:assert/strict'; +import { mkdtemp, readFile, rm } from 'node:fs/promises'; +import { tmpdir } from 'node:os'; +import { join, resolve } from 'node:path'; +import { test } from 'node:test'; + +import { + diagnosticCatalogs, + generateDiagnosticReferences, + validateDiagnosticReference, +} from './generate-diagnostic-references.mjs'; + +const productOwnedDocsSlugFamilies = new Set([ + 'bundle_verification', + 'notary_activation', + 'relay_activation', + 'relay_process_startup', +]); + +const entry = (catalog, family, owner, product, code) => ({ + family, + code, + owner, + product, + phase: 'static_phase', + safe_meaning: 'Static catalog meaning without runtime values.', + rule: 'registry.reference.static_rule', + safe_remediation: 'Correct the reviewed static input and retry.', + field_address_pattern: null, + evidence_scope: 'static catalog metadata', + secret_sensitive_value_policy: 'no_runtime_values', + docs_anchor: `/reference/diagnostics/${catalog}/#${product}--${ + productOwnedDocsSlugFamilies.has(family) ? 'static-test' : code + }`, + lifecycle: 'unreleased', + introduced_in: null, + stability: 'pre1_stable_code', + evidence_limitation: 'This reference does not inspect runtime values.', +}); + +function fixtureReferences() { + return { + authoring: { + schema_version: diagnosticCatalogs.authoring.schemaVersion, + entries: [ + entry( + 'authoring', + 'authoring_validation', + 'registryctl', + 'registryctl', + 'registryctl.authoring.test', + ), + ], + }, + fixture: { + schema_version: diagnosticCatalogs.fixture.schemaVersion, + entries: [ + entry( + 'fixture', + 'fixture_execution', + 'registryctl', + 'registryctl_relay_offline_harness', + 'fixture.test', + ), + ], + }, + operator: { + schema_version: diagnosticCatalogs.operator.schemaVersion, + entries: [ + entry( + 'operator', + 'bundle_verification', + 'registry_platform_ops', + 'registry_platform_ops', + 'rejected_test', + ), + entry( + 'operator', + 'relay_activation', + 'registry_relay', + 'registry_relay', + 'relay.activation.test', + ), + ], + omissions: [], + }, + }; +} + +function fixtureExecutor(references, { divergent = false } = {}) { + const calls = new Map(); + return async (_repoRoot, args) => { + const catalog = args[args.indexOf('--catalog') + 1]; + const count = (calls.get(catalog) ?? 0) + 1; + calls.set(catalog, count); + const output = JSON.stringify(references[catalog], null, 2); + return `${output}${divergent && count === 2 ? ' ' : ''}\n`; + }; +} + +test('publishes opaque, byte-identical internal and public artifacts after two exact CLI runs', async () => { + const root = await mkdtemp(join(tmpdir(), 'registry-diagnostic-reference-')); + try { + const references = fixtureReferences(); + const repoRoot = join(root, 'repo'); + await generateDiagnosticReferences(root, repoRoot, fixtureExecutor(references)); + for (const contract of Object.values(diagnosticCatalogs)) { + const internal = await readFile(resolve(root, contract.internal), 'utf8'); + assert.equal( + internal, + await readFile(resolve(root, contract.public), 'utf8'), + ); + assert.equal( + internal, + await readFile(resolve(repoRoot, contract.fixture), 'utf8'), + ); + } + } finally { + await rm(root, { recursive: true, force: true }); + } +}); + +test('rejects nondeterminism before publishing', async () => { + const root = await mkdtemp(join(tmpdir(), 'registry-diagnostic-reference-')); + try { + await assert.rejects( + generateDiagnosticReferences( + root, + '/unused', + fixtureExecutor(fixtureReferences(), { divergent: true }), + ), + /not byte deterministic/, + ); + } finally { + await rm(root, { recursive: true, force: true }); + } +}); + +test('rejects unknown, reordered, duplicate, stale-lifecycle, unsafe, and wrong-owner entries', () => { + const unknown = fixtureReferences().authoring; + unknown.entries[0].unexpected = true; + assert.throws(() => validateDiagnosticReference('authoring', unknown), /exactly/); + + const reordered = fixtureReferences().operator; + reordered.entries.reverse(); + assert.throws(() => validateDiagnosticReference('operator', reordered), /not ordered/); + + const duplicate = fixtureReferences().operator; + duplicate.entries.push({ ...duplicate.entries[1] }); + assert.throws(() => validateDiagnosticReference('operator', duplicate), /duplicate/); + + const stale = fixtureReferences().fixture; + stale.entries[0].introduced_in = '0.13.0'; + assert.throws(() => validateDiagnosticReference('fixture', stale), /introduced_in: null/); + + const unsafe = fixtureReferences().authoring; + unsafe.entries[0].safe_meaning = 'COUNTRY_SECRET_SENTINEL'; + assert.throws(() => validateDiagnosticReference('authoring', unsafe), /runtime or secret/); + + const owner = fixtureReferences().operator; + owner.entries[0].owner = 'registry_relay'; + assert.throws(() => validateDiagnosticReference('operator', owner), /product-owner/); + + const policy = fixtureReferences().operator; + policy.entries[0].secret_sensitive_value_policy = 'print_received_value'; + assert.throws(() => validateDiagnosticReference('operator', policy), /not closed/); + + const stability = fixtureReferences().operator; + stability.entries[0].stability = 'experimental'; + assert.throws(() => validateDiagnosticReference('operator', stability), /not supported/); + + const omission = fixtureReferences().operator; + omission.omissions.push({ + family: 'relay_process_startup', + product: 'registry_relay', + reason: 'temporary_gap', + evidence: 'A static catalog gap.', + required_action: 'Publish complete product-owned metadata.', + }); + assert.throws(() => validateDiagnosticReference('operator', omission), /reason is not supported/); +}); diff --git a/docs/site/scripts/generate-project-starters.mjs b/docs/site/scripts/generate-project-starters.mjs index 10bccbef6..9921b9cfa 100644 --- a/docs/site/scripts/generate-project-starters.mjs +++ b/docs/site/scripts/generate-project-starters.mjs @@ -8,7 +8,7 @@ const docsRoot = resolve(scriptDir, '..'); const defaultRepoRoot = resolve(docsRoot, '../..'); const catalogRelative = 'crates/registryctl/tests/fixtures/project-authoring-journeys.yaml'; const goldenPrefix = 'crates/registryctl/tests/fixtures/project-authoring/'; -const supportedSteps = ['init', 'editor', 'trace', 'watch', 'test', 'check', 'build']; +const supportedSteps = ['init', 'editor', 'trace', 'watch', 'test', 'check', 'compare', 'build']; const starterSteps = supportedSteps; const publicStarterOrder = ['http', 'dhis2-tracker', 'opencrvs-dci', 'fhir-r4', 'snapshot']; const safeCliTokenPattern = /^[A-Za-z0-9][A-Za-z0-9._-]*$/u; @@ -126,6 +126,14 @@ function buildCommands(workspace, selection) { `registryctl check --project-dir ${workspace.project_dir} --environment ${workspace.environment}${workspace.check_explain ? ' --explain' : ''}`, ); break; + case 'compare': + if (!workspace.starter) { + throw new Error(`${workspace.id} cannot compare with an embedded starter`); + } + commands.push( + `registryctl compare --project-dir ${workspace.project_dir} --environment ${workspace.environment} --from-starter`, + ); + break; case 'build': commands.push( `registryctl build --project-dir ${workspace.project_dir} --environment ${workspace.environment}`, @@ -203,10 +211,10 @@ export async function buildProjectAuthoringJourneyMatrix(repoRoot = defaultRepoR } if (workspace.starter) { if (!equalValues(workspace.steps, starterSteps)) { - throw new Error(`${workspace.id} starter must expose the canonical seven-command journey`); + throw new Error(`${workspace.id} starter must expose the canonical eight-command journey`); } - } else if (workspace.steps.includes('init')) { - throw new Error(`${workspace.id} is not a starter and cannot emit init --from`); + } else if (workspace.steps.includes('init') || workspace.steps.includes('compare')) { + throw new Error(`${workspace.id} is not a starter and cannot emit starter-only commands`); } const projectRoot = resolve(repoRoot, workspace.source); diff --git a/docs/site/scripts/generate-project-starters.test.mjs b/docs/site/scripts/generate-project-starters.test.mjs index ae6906db3..deeab8c17 100644 --- a/docs/site/scripts/generate-project-starters.test.mjs +++ b/docs/site/scripts/generate-project-starters.test.mjs @@ -78,7 +78,7 @@ test('derives all advertised starter selections from committed workspaces', asyn ); }); -test('emits one canonical seven-command sequence for exactly five starters', async () => { +test('emits one canonical eight-command sequence for exactly five starters', async () => { const starters = await buildProjectStarterMatrix(repoRoot); assert.equal(starters.length, 5); @@ -90,16 +90,18 @@ test('emits one canonical seven-command sequence for exactly five starters', asy 'watch', 'test', 'check', + 'compare', 'build', ]); - assert.equal(starter.commands.length, 7); + assert.equal(starter.commands.length, 8); assert.match(starter.commands[0], /^registryctl init --from /); assert.match(starter.commands[1], /^registryctl authoring editor --project-dir /); assert.match(starter.commands[2], / --trace$/); assert.match(starter.commands[3], / --watch$/); assert.match(starter.commands[4], /^registryctl test --project-dir [^ ]+$/); assert.match(starter.commands[5], / --environment local --explain$/); - assert.match(starter.commands[6], / --environment local$/); + assert.match(starter.commands[6], / --environment local --from-starter$/); + assert.match(starter.commands[7], / --environment local$/); } }); @@ -289,7 +291,7 @@ test('rejects a catalog with fewer than five starter entries', async () => { await withIsolatedProjectCatalog(async ({ root, catalog, catalogPath }) => { const fhir = catalog.workspaces.find((workspace) => workspace.starter === 'fhir-r4'); delete fhir.starter; - fhir.steps = fhir.steps.filter((step) => step !== 'init'); + fhir.steps = fhir.steps.filter((step) => !['init', 'compare'].includes(step)); await writeFile(catalogPath, YAML.stringify(catalog)); await assert.rejects( @@ -325,9 +327,9 @@ test('publishes the authoring tutorial with the catalog-backed HTTP command sequ 1, 'authoring tutorial has one author-path placement', ); - const integrations = astroConfig.slice( - astroConfig.indexOf("label: 'Integrations'"), - astroConfig.indexOf("label: 'Concepts'"), + const configure = astroConfig.slice( + astroConfig.indexOf("label: 'Configure'"), + astroConfig.indexOf("label: 'Verify'"), ); - assert.match(integrations, /slug: 'tutorials\/author-registry-project'/); + assert.match(configure, /slug: 'tutorials\/author-registry-project'/); }); diff --git a/docs/site/scripts/generate-standard-journeys.mjs b/docs/site/scripts/generate-standard-journeys.mjs new file mode 100644 index 000000000..edb8f9a02 --- /dev/null +++ b/docs/site/scripts/generate-standard-journeys.mjs @@ -0,0 +1,1363 @@ +import { mkdir, readFile, realpath, stat, writeFile } from "node:fs/promises"; +import { dirname, isAbsolute, relative, resolve, sep } from "node:path"; +import { fileURLToPath } from "node:url"; + +import YAML from "yaml"; + +import { buildProjectAuthoringJourneyMatrix } from "./generate-project-starters.mjs"; + +const scriptDirectory = dirname(fileURLToPath(import.meta.url)); +const docsRoot = resolve(scriptDirectory, ".."); +const defaultRepoRoot = resolve(docsRoot, "../.."); +const manifestRelative = "docs/site/src/data/standard-journeys.yaml"; +const generatedRelative = "docs/site/src/data/generated/standard-journeys.json"; +const publicGeneratedRelative = + "docs/site/public/generated/standard-journeys.json"; +const diagnosticCatalogs = [ + "docs/site/src/data/generated/diagnostics/authoring.json", + "docs/site/src/data/generated/diagnostics/fixture.json", + "docs/site/src/data/generated/diagnostics/operator.json", +]; + +export const standardJourneyIds = [ + "spreadsheet-protected-api", + "instance-openapi", + "bounded-http", + "bounded-multi-call-script", + "exact-snapshot", + "registry-backed-notary-claim", + "product-input-lifecycle", +]; + +export const standardJourneyHeadings = [ + "Outcome and prerequisites", + "Smallest complete configuration", + "Project tree and artifact ownership", + "Synthetic fixture and expected trace", + "Contract this journey proves", + "Test, explain, compare, and build", + "Review authored and generated artifacts", + "What each gate proves", + "Production delta", + "Troubleshooting and next task", +]; + +const artifactClassifications = new Set([ + "authored", + "environment_binding", + "generated_unsigned", + "generated_signed", + "runtime_observed", + "scaffolded_human_owned", + "synthetic_fixture", +]); +const artifactOwners = new Set([ + "country_author", + "registryctl", + "registry_relay", + "registry_notary", + "operator", +]); +const evidenceClasses = new Set([ + "source_contract", + "maintained_offline_fixture", + "generated_contract", + "source_and_generated_contract", +]); +const evidenceLifecycles = new Set(["main_unreleased"]); +const configurationFormats = new Set(["rhai", "scaffolded", "yaml"]); +const configurationBoundaries = new Set([ + "generated_template", + "maintained_synthetic", +]); +const fixtureFormats = new Set(["generated_sample", "source_reference", "yaml"]); +const commandRecipeKinds = new Set([ + "instance_openapi", + "matrix", + "notary_claim", + "product_input_lifecycle", + "spreadsheet_runtime", +]); +const evidenceDimensions = ["extraction", "execution", "runtime"]; +const evidenceStatuses = new Set(["not_claimed", "verified"]); +const catalogTypes = new Set([ + "project_authoring", + "projects", + "contracts", +]); +const stepKinds = new Set([ + "alternative", + "command", + "long_running", + "operator_interface", + "readiness_gate", + "runtime_interface", +]); +const unsafeCommandPattern = /[\n\r;&|`<>]|\$\(/u; +const commandTokenPattern = /^[A-Za-z0-9][A-Za-z0-9._/:=-]*$/u; +const flagTokenPattern = /^--[a-z][a-z0-9-]*$/u; +const commandPrograms = new Set(["registryctl"]); +const credentialReferenceKeys = new Set([ + "api_key", + "api_key_fingerprint", + "api_token", + "client_secret", + "credential", + "credentials", + "private_key", + "refresh_token", + "secret_ref", + "secret_refs", + "signing_key", + "token", +]); +const publicConfigurationSources = new Set([ + "crates/registryctl/assets/project-starters/bounded-http/environments/local.yaml", + "crates/registryctl/assets/project-starters/bounded-http/integrations/person-record/integration.yaml", + "crates/registryctl/assets/project-starters/bounded-http/registry-stack.yaml", + "crates/registryctl/src/templates/notary_addon/environments/local.yaml", + "crates/registryctl/src/templates/notary_addon/integrations/person-demographics/integration.yaml", + "crates/registryctl/src/templates/notary_addon/registry-stack.yaml", + "crates/registryctl/src/templates/relay_config.yaml.tmpl", + "crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/environments/local.yaml", + "crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/adapter.rhai", + "crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/integration.yaml", + "crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/registry-stack.yaml", + "crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/entities/people.yaml", + "crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/environments/local.yaml", + "crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/integrations/person-snapshot/integration.yaml", + "crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/registry-stack.yaml", +]); +const requiredConfigurationSources = new Map([ + [ + "spreadsheet-protected-api", + ["crates/registryctl/src/templates/relay_config.yaml.tmpl"], + ], + [ + "instance-openapi", + ["crates/registryctl/src/templates/relay_config.yaml.tmpl"], + ], + [ + "bounded-http", + [ + "crates/registryctl/assets/project-starters/bounded-http/registry-stack.yaml", + "crates/registryctl/assets/project-starters/bounded-http/environments/local.yaml", + "crates/registryctl/assets/project-starters/bounded-http/integrations/person-record/integration.yaml", + ], + ], + [ + "bounded-multi-call-script", + [ + "crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/registry-stack.yaml", + "crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/environments/local.yaml", + "crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/integration.yaml", + "crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/adapter.rhai", + ], + ], + [ + "exact-snapshot", + [ + "crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/registry-stack.yaml", + "crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/environments/local.yaml", + "crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/entities/people.yaml", + "crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/integrations/person-snapshot/integration.yaml", + ], + ], + [ + "registry-backed-notary-claim", + [ + "crates/registryctl/src/templates/notary_addon/registry-stack.yaml", + "crates/registryctl/src/templates/notary_addon/environments/local.yaml", + "crates/registryctl/src/templates/notary_addon/integrations/person-demographics/integration.yaml", + ], + ], + [ + "product-input-lifecycle", + [ + "crates/registryctl/assets/project-starters/bounded-http/registry-stack.yaml", + "crates/registryctl/assets/project-starters/bounded-http/environments/local.yaml", + "crates/registryctl/assets/project-starters/bounded-http/integrations/person-record/integration.yaml", + ], + ], +]); + +function invariant(condition, message) { + if (!condition) throw new Error(message); +} + +function isPlainObject(value) { + return ( + value !== null && + typeof value === "object" && + !Array.isArray(value) && + Object.getPrototypeOf(value) === Object.prototype + ); +} + +function object(value, path, allowed, required = allowed) { + invariant(isPlainObject(value), `${path} must be an object`); + const unknown = Object.keys(value).filter((key) => !allowed.includes(key)); + invariant( + unknown.length === 0, + `${path} contains unknown fields: ${unknown.join(", ")}`, + ); + const missing = required.filter((key) => value[key] === undefined); + invariant( + missing.length === 0, + `${path} is missing fields: ${missing.join(", ")}`, + ); + return value; +} + +function string(value, path) { + invariant( + typeof value === "string" && value.trim() !== "", + `${path} must be a non-empty string`, + ); + return value; +} + +function stringArray(value, path, { minimum = 1 } = {}) { + invariant( + Array.isArray(value) && value.length >= minimum, + `${path} must contain at least ${minimum} entries`, + ); + value.forEach((entry, index) => string(entry, `${path}[${index}]`)); + invariant( + new Set(value).size === value.length, + `${path} must not contain duplicates`, + ); + return value; +} + +function boolean(value, path) { + invariant(typeof value === "boolean", `${path} must be a boolean`); + return value; +} + +function enumValue(value, path, allowed) { + string(value, path); + invariant(allowed.has(value), `${path} has unsupported value ${value}`); + return value; +} + +function nullableString(value, path) { + invariant( + value === null || (typeof value === "string" && value.trim() !== ""), + `${path} must be null or a non-empty string`, + ); +} + +function validateAvailability(value, path) { + object(value, path, ["status", "proof", "release"]); + enumValue(value.status, `${path}.status`, new Set(["current_unreleased"])); + enumValue(value.proof, `${path}.proof`, new Set(["source_tree"])); + nullableString(value.release, `${path}.release`); + invariant( + value.release === null, + `${path}.release must remain null for current unreleased source evidence`, + ); +} + +function validateArtifact(entry, path) { + object(entry, path, [ + "path", + "classification", + "owner", + "human_edit", + "version_control", + "note", + ]); + string(entry.path, `${path}.path`); + enumValue( + entry.classification, + `${path}.classification`, + artifactClassifications, + ); + enumValue(entry.owner, `${path}.owner`, artifactOwners); + boolean(entry.human_edit, `${path}.human_edit`); + boolean(entry.version_control, `${path}.version_control`); + string(entry.note, `${path}.note`); + const generatedOrRuntime = new Set([ + "generated_unsigned", + "generated_signed", + "runtime_observed", + ]).has(entry.classification); + invariant( + entry.human_edit !== generatedOrRuntime, + `${path}.human_edit conflicts with its artifact classification`, + ); + if ( + entry.classification === "generated_signed" || + entry.classification === "runtime_observed" + ) { + invariant( + entry.version_control === false, + `${path}.version_control must be false for signed or runtime-observed artifacts`, + ); + } +} + +function validateGate(entry, path) { + object(entry, path, ["name", "proves", "does_not_prove"]); + string(entry.name, `${path}.name`); + string(entry.proves, `${path}.proves`); + string(entry.does_not_prove, `${path}.does_not_prove`); +} + +function validateProductionDelta(value, path) { + object(value, path, [ + "environment", + "secrets", + "approval", + "signing", + "activation", + ]); + for (const key of [ + "environment", + "secrets", + "approval", + "signing", + "activation", + ]) { + string(value[key], `${path}.${key}`); + } +} + +function validateEvidenceRecord(value, path) { + object(value, path, [ + "status", + "source_path", + "test_id", + "command", + "workflow", + "revision", + "lifecycle", + ]); + enumValue(value.status, `${path}.status`, evidenceStatuses); + for (const key of ["source_path", "test_id", "command", "workflow"]) { + string(value[key], `${path}.${key}`); + } + invariant( + value.workflow.includes("#"), + `${path}.workflow must identify a workflow file and job`, + ); + invariant( + value.revision === "main", + `${path}.revision must be main for unreleased source evidence`, + ); + invariant( + value.lifecycle === "current_unreleased", + `${path}.lifecycle must be current_unreleased`, + ); +} + +function validateJourney(journey, index) { + const path = `journeys[${index}]`; + object(journey, path, [ + "id", + "slug", + "title", + "description", + "outcome", + "level", + "prerequisites", + "expected_time", + "evidence_class", + "evidence_lifecycle", + "availability", + "canonical_sources", + "canonical_workspace", + "catalog_references", + "minimal_configuration", + "artifacts", + "fixture", + "contract", + "command_recipe", + "review", + "gates", + "production_delta", + "troubleshooting", + "next_task", + "evidence", + ]); + string(journey.id, `${path}.id`); + string(journey.slug, `${path}.slug`); + invariant( + journey.slug === `journeys/${journey.id}`, + `${path}.slug must match its id`, + ); + for (const key of [ + "title", + "description", + "outcome", + "level", + "expected_time", + ]) { + string(journey[key], `${path}.${key}`); + } + stringArray(journey.prerequisites, `${path}.prerequisites`); + enumValue( + journey.evidence_class, + `${path}.evidence_class`, + evidenceClasses, + ); + enumValue( + journey.evidence_lifecycle, + `${path}.evidence_lifecycle`, + evidenceLifecycles, + ); + validateAvailability(journey.availability, `${path}.availability`); + stringArray(journey.canonical_sources, `${path}.canonical_sources`); + object(journey.canonical_workspace, `${path}.canonical_workspace`, [ + "id", + "path", + ]); + string(journey.canonical_workspace.id, `${path}.canonical_workspace.id`); + string(journey.canonical_workspace.path, `${path}.canonical_workspace.path`); + invariant( + Array.isArray(journey.catalog_references) && + journey.catalog_references.length > 0, + `${path}.catalog_references must contain at least one entry`, + ); + journey.catalog_references.forEach((reference, referenceIndex) => { + const referencePath = `${path}.catalog_references[${referenceIndex}]`; + object(reference, referencePath, ["catalog", "id"]); + enumValue(reference.catalog, `${referencePath}.catalog`, catalogTypes); + string(reference.id, `${referencePath}.id`); + }); + + object( + journey.minimal_configuration, + `${path}.minimal_configuration`, + ["files", "note"], + ); + string( + journey.minimal_configuration.note, + `${path}.minimal_configuration.note`, + ); + invariant( + Array.isArray(journey.minimal_configuration.files) && + journey.minimal_configuration.files.length > 0, + `${path}.minimal_configuration.files must contain a complete file set`, + ); + for (const [fileIndex, file] of journey.minimal_configuration.files.entries()) { + const filePath = `${path}.minimal_configuration.files[${fileIndex}]`; + object(file, filePath, [ + "source", + "destination", + "format", + "public_boundary", + ]); + string(file.source, `${filePath}.source`); + string(file.destination, `${filePath}.destination`); + enumValue(file.format, `${filePath}.format`, configurationFormats); + enumValue( + file.public_boundary, + `${filePath}.public_boundary`, + configurationBoundaries, + ); + invariant( + publicConfigurationSources.has(file.source), + `${filePath}.source is not an explicitly approved public configuration source`, + ); + invariant( + journey.canonical_sources.includes(file.source), + `${filePath}.source must also be a canonical source`, + ); + invariant( + (file.format === "scaffolded") === + (file.public_boundary === "generated_template"), + `${filePath} must pair scaffolded format with generated_template boundary`, + ); + } + invariant( + new Set( + journey.minimal_configuration.files.map((file) => file.destination), + ).size === journey.minimal_configuration.files.length, + `${path}.minimal_configuration.files contains duplicate destinations`, + ); + invariant( + JSON.stringify( + journey.minimal_configuration.files.map((file) => file.source), + ) === JSON.stringify(requiredConfigurationSources.get(journey.id)), + `${path}.minimal_configuration.files must contain the exact complete source set`, + ); + + invariant( + Array.isArray(journey.artifacts) && journey.artifacts.length >= 3, + `${path}.artifacts must contain at least three entries`, + ); + journey.artifacts.forEach((entry, artifactIndex) => + validateArtifact(entry, `${path}.artifacts[${artifactIndex}]`), + ); + invariant( + new Set(journey.artifacts.map((entry) => entry.path)).size === + journey.artifacts.length, + `${path}.artifacts contains duplicate paths`, + ); + + object(journey.fixture, `${path}.fixture`, [ + "source", + "format", + "expected_trace", + ]); + string(journey.fixture.source, `${path}.fixture.source`); + enumValue(journey.fixture.format, `${path}.fixture.format`, fixtureFormats); + stringArray(journey.fixture.expected_trace, `${path}.fixture.expected_trace`); + + object(journey.contract, `${path}.contract`, ["proves", "does_not_prove"]); + stringArray(journey.contract.proves, `${path}.contract.proves`); + stringArray( + journey.contract.does_not_prove, + `${path}.contract.does_not_prove`, + ); + + object( + journey.command_recipe, + `${path}.command_recipe`, + ["kind", "matrix_id"], + ["kind"], + ); + enumValue( + journey.command_recipe.kind, + `${path}.command_recipe.kind`, + commandRecipeKinds, + ); + if ( + journey.command_recipe.kind === "matrix" || + journey.command_recipe.kind === "product_input_lifecycle" + ) { + string( + journey.command_recipe.matrix_id, + `${path}.command_recipe.matrix_id`, + ); + } else { + invariant( + journey.command_recipe.matrix_id === undefined, + `${path}.command_recipe.matrix_id is allowed only for matrix recipes`, + ); + } + + stringArray(journey.review, `${path}.review`); + invariant( + Array.isArray(journey.gates) && journey.gates.length >= 3, + `${path}.gates must contain at least three entries`, + ); + journey.gates.forEach((entry, gateIndex) => + validateGate(entry, `${path}.gates[${gateIndex}]`), + ); + validateProductionDelta(journey.production_delta, `${path}.production_delta`); + stringArray(journey.troubleshooting, `${path}.troubleshooting`); + + object(journey.next_task, `${path}.next_task`, ["label", "href"]); + string(journey.next_task.label, `${path}.next_task.label`); + string(journey.next_task.href, `${path}.next_task.href`); + invariant( + journey.next_task.href.startsWith("/"), + `${path}.next_task.href must be site-absolute`, + ); + + object(journey.evidence, `${path}.evidence`, evidenceDimensions); + for (const dimension of evidenceDimensions) { + validateEvidenceRecord( + journey.evidence[dimension], + `${path}.evidence.${dimension}`, + ); + } +} + +export function validateStandardJourneyManifest(manifest) { + object(manifest, "manifest", ["schema_version", "journeys"]); + invariant( + manifest.schema_version === "registry.standard-journeys.v1", + "manifest.schema_version must be registry.standard-journeys.v1", + ); + invariant( + Array.isArray(manifest.journeys), + "manifest.journeys must be an array", + ); + invariant( + JSON.stringify(manifest.journeys.map((journey) => journey.id)) === + JSON.stringify(standardJourneyIds), + `manifest must contain the seven standard journeys in order: ${standardJourneyIds.join(", ")}`, + ); + manifest.journeys.forEach(validateJourney); + return manifest; +} + +async function parseYaml(path) { + const source = await readFile(path, "utf8"); + const document = YAML.parseDocument(source, { + strict: true, + uniqueKeys: true, + }); + invariant( + document.errors.length === 0, + `${path} is not valid YAML: ${document.errors.join("; ")}`, + ); + return document.toJS(); +} + +function assertPublicSyntheticValue(value, path) { + if (Array.isArray(value)) { + value.forEach((entry, index) => + assertPublicSyntheticValue(entry, `${path}[${index}]`), + ); + return; + } + if (!isPlainObject(value)) return; + if (Object.hasOwn(value, "secret")) { + invariant( + Object.keys(value).length === 1 && + typeof value.secret === "string" && + /^[A-Z][A-Z0-9_]*$/u.test(value.secret), + `${path} secret reference must contain only one uppercase environment name`, + ); + return; + } + for (const [key, entry] of Object.entries(value)) { + const normalizedKey = key.toLowerCase(); + invariant( + !["country", "jurisdiction", "password", "literal"].includes( + normalizedKey, + ), + `${path} contains a non-public field ${key}`, + ); + if (credentialReferenceKeys.has(normalizedKey)) { + invariant( + isPlainObject(entry), + `${path}.${key} must use a structured credential reference`, + ); + } + assertPublicSyntheticValue(entry, `${path}.${key}`); + } +} + +export function validateStandardJourneyPublicValue(value) { + assertPublicSyntheticValue(value, "public configuration"); + return value; +} + +async function extractConfigurationFiles(repoRoot, journey) { + const files = []; + for (const file of journey.minimal_configuration.files) { + if (file.format === "scaffolded") { + files.push({ + ...file, + language: null, + content: null, + }); + continue; + } + const sourcePath = resolve(repoRoot, file.source); + if (file.format === "rhai") { + files.push({ + ...file, + language: "rhai", + content: `${(await readFile(sourcePath, "utf8")).trimEnd()}\n`, + }); + continue; + } + const source = await parseYaml(sourcePath); + assertPublicSyntheticValue(source, `${journey.id}:${file.source}`); + files.push({ + ...file, + language: "yaml", + content: YAML.stringify(source, { + lineWidth: 0, + sortMapEntries: true, + }), + }); + } + return files; +} + +async function extractFixture(repoRoot, fixture) { + if (fixture.format === "generated_sample") { + return { + language: "text", + content: `Generated synthetic sample: ${fixture.source}\n`, + }; + } + if (fixture.format === "source_reference") { + return { + language: "text", + content: `Source-backed proof: ${fixture.source}\n`, + }; + } + const source = await parseYaml(resolve(repoRoot, fixture.source)); + assertPublicSyntheticValue(source, `${fixture.source} fixture excerpt`); + return { + language: "yaml", + content: YAML.stringify(source, { lineWidth: 0, sortMapEntries: true }), + }; +} + +function commandStep(id, label, command, cwd = ".") { + return { + id, + kind: "command", + label, + cwd, + argv: command.split(/\s+/u), + }; +} + +function longRunningStep(id, label, command, cwd, note) { + return { + id, + kind: "long_running", + label, + cwd, + argv: command.split(/\s+/u), + note, + }; +} + +function matrixSteps(journey, matrixEntry) { + const steps = []; + let commandIndex = 0; + for (const command of matrixEntry.commands) { + const argv = command.split(/\s+/u); + const operation = + argv[1] === "authoring" ? `${argv[1]}-${argv[2]}` : argv[1]; + if (command.includes(" --watch")) { + steps.push( + longRunningStep( + `${journey.id}-${operation}`, + "Optional watch loop", + command, + ".", + "This long-running alternative reruns the focused synthetic fixture after authored files change. It is not part of the required noninteractive sequence.", + ), + ); + continue; + } + if (operation === "compare") { + steps.push( + commandStep( + `${journey.id}-semantic-comparison`, + "Compare authored semantics with the embedded starter", + command, + ), + ); + continue; + } + steps.push( + commandStep( + `${journey.id}-${operation}-${commandIndex}`, + `Required ${operation.replaceAll("-", " ")} step`, + command, + ), + ); + commandIndex += 1; + } + const checkIndex = steps.findIndex( + (step) => step.kind === "command" && step.argv[1] === "check", + ); + invariant(checkIndex >= 0, `${journey.id} matrix must contain check`); + invariant( + matrixEntry.starter !== undefined, + `${journey.id} semantic comparison requires starter provenance`, + ); + const expectedComparison = [ + "registryctl", + "compare", + "--project-dir", + matrixEntry.project_dir, + "--environment", + "local", + "--from-starter", + ]; + let comparisonIndexes = steps.flatMap((step, index) => + step.kind === "command" && step.argv[1] === "compare" ? [index] : [], + ); + invariant( + comparisonIndexes.length <= 1, + `${journey.id} matrix must contain at most one starter comparison`, + ); + if (comparisonIndexes.length === 0) { + steps.splice( + checkIndex + 1, + 0, + commandStep( + `${journey.id}-semantic-comparison`, + "Compare authored semantics with the embedded starter", + expectedComparison.join(" "), + ), + ); + comparisonIndexes = [checkIndex + 1]; + } + const comparison = steps[comparisonIndexes[0]]; + invariant( + comparison.argv.length === expectedComparison.length && + comparison.argv.every( + (argument, index) => argument === expectedComparison[index], + ), + `${journey.id} starter comparison must use the exact local embedded-starter command`, + ); + invariant( + comparisonIndexes[0] === checkIndex + 1, + `${journey.id} starter comparison must immediately follow check`, + ); + const buildIndex = steps.findIndex( + (step) => step.kind === "command" && step.argv[1] === "build", + ); + invariant( + buildIndex > comparisonIndexes[0], + `${journey.id} starter comparison must precede build`, + ); + return steps; +} + +function buildSteps(journey, matrixById) { + const recipe = journey.command_recipe; + if (recipe.kind === "spreadsheet_runtime") { + return [ + commandStep( + "spreadsheet-init", + "Create the disposable spreadsheet scaffold", + "registryctl init relay my-first-api --sample benefits", + ), + { + id: "spreadsheet-doctor", + kind: "alternative", + label: "Product doctor", + cwd: "my-first-api", + argv: ["registryctl", "doctor", "--profile", "local"], + note: "Run after the source-built product commands and Docker provider are available.", + }, + longRunningStep( + "spreadsheet-start", + "Start the disposable local runtime", + "registryctl start", + "my-first-api", + "This is a long-running runtime boundary and is exercised by the source tutorial gate, not the clean-temp authoring sequence.", + ), + { + id: "spreadsheet-smoke", + kind: "alternative", + label: "Runtime smoke after readiness", + cwd: "my-first-api", + argv: ["registryctl", "smoke"], + note: "Run only after the local runtime reports ready.", + }, + ]; + } + if (recipe.kind === "instance_openapi") { + return [ + commandStep( + "openapi-init", + "Create the disposable local instance", + "registryctl init relay openapi-inspection --sample benefits", + ), + longRunningStep( + "openapi-start", + "Start the disposable local instance", + "registryctl start", + "openapi-inspection", + "The generated local sample explicitly opts out of OpenAPI authentication. Product defaults remain authentication-gated.", + ), + { + id: "openapi-capture", + kind: "runtime_interface", + label: "Capture the disposable instance contract", + method: "GET", + url: "http://127.0.0.1:4242/openapi.json", + authentication: "none_disposable_local_opt_out", + output_path: "openapi-inspection/output/instance.openapi.json", + note: "Use an HTTP client that preserves the response bytes. This interface is public only because the generated disposable local configuration sets server.openapi_requires_auth to false.", + }, + { + id: "openapi-consumer-review", + kind: "operator_interface", + label: "Consumer contract comparison", + inputs: [ + "Captured openapi-inspection/output/instance.openapi.json", + "Consumer-owned reviewed baseline and compatibility policy", + ], + outputs: ["Consumer-owned compatibility decision"], + procedure: + "Compare the captured bytes using the consumer's reviewed compatibility tool. Registry Stack does not turn an external baseline into an executable shell placeholder.", + }, + ]; + } + if (recipe.kind === "notary_claim") { + return [ + commandStep( + "notary-init", + "Create the disposable Relay scaffold", + "registryctl init relay my-first-api --sample benefits", + ), + commandStep( + "notary-add", + "Add the maintained Notary project", + "registryctl add notary", + "my-first-api", + ), + commandStep( + "notary-test", + "Execute every Notary project fixture offline", + "registryctl test --project-dir my-first-api/notary/project", + ), + commandStep( + "notary-check", + "Check and explain the combined project", + "registryctl check --project-dir my-first-api/notary/project --environment local --explain", + ), + commandStep( + "notary-build", + "Build separate unsigned product inputs", + "registryctl build --project-dir my-first-api/notary/project --environment local", + ), + longRunningStep( + "notary-start", + "Start the combined disposable runtime", + "registryctl start", + "my-first-api", + "This runtime step is exercised by the source tutorial gate and remains separate from the required clean-temp sequence.", + ), + ]; + } + + const matrixEntry = matrixById.get(recipe.matrix_id); + invariant( + matrixEntry !== undefined, + `${journey.id} references unknown command matrix id ${recipe.matrix_id}`, + ); + const steps = matrixSteps(journey, matrixEntry); + if (recipe.kind !== "product_input_lifecycle") return steps; + const comparisonIndex = steps.findIndex( + (step) => step.kind === "command" && step.argv[1] === "compare", + ); + invariant( + comparisonIndex >= 0, + `${journey.id} lifecycle must contain starter comparison`, + ); + steps.splice( + comparisonIndex + 1, + 0, + { + id: "lifecycle-preflight", + kind: "readiness_gate", + label: "Inspect missing offline requirements before operator handoff", + cwd: ".", + argv: [ + "registryctl", + "preflight", + "--project-dir", + matrixEntry.project_dir, + "--environment", + "local", + "--format", + "json", + ], + note: "This clean-workspace step is expected to exit 1 with a value-free not_ready report because operator-provisioned runtime files and secret references are absent. It proves the diagnostic boundary, not readiness. Provision the reviewed environment bindings, rerun this command, and require a passing report before signing, verification, promotion, or activation handoff.", + }, + commandStep( + "lifecycle-capabilities", + "Inspect declared and available capabilities", + `registryctl capabilities --project-dir ${matrixEntry.project_dir} --environment local`, + ), + ); + return [ + ...steps, + { + id: "lifecycle-governed-promotion-review", + kind: "operator_interface", + label: "Review against governed product baselines", + inputs: [ + "Separately verified Relay baseline bundle and Relay trust anchor", + "Separately verified Notary baseline bundle and Notary trust anchor", + ], + outputs: ["Value-safe promotion report and required-action review"], + procedure: + "Only after operators supply both product-owned baseline paths and trust anchors, use the registryctl promote lifecycle interface for the fixed project directory and local environment. This governed review is separate from the first-time starter comparison and does not authorize activation.", + }, + { + id: "lifecycle-relay-bundle", + kind: "operator_interface", + label: "Sign and verify the Relay product input", + inputs: [ + "registry-project/.registry-stack/build/local/private/relay", + "Operator-selected Relay signing key", + "Operator-selected Relay trust anchor and anti-rollback sequence", + ], + outputs: ["journey-output/registry-relay-bundle"], + procedure: + "Use registryctl bundle sign with --out journey-output/registry-relay-bundle, then verify that directory with the product-owned Relay trust anchor. Signing material is never rendered into a shell block.", + }, + { + id: "lifecycle-notary-bundle", + kind: "operator_interface", + label: "Sign and verify the Notary product input", + inputs: [ + "registry-project/.registry-stack/build/local/private/notary", + "Operator-selected Notary signing key", + "Operator-selected Notary trust anchor and anti-rollback sequence", + ], + outputs: ["journey-output/registry-notary-bundle"], + procedure: + "Use registryctl bundle sign with --out journey-output/registry-notary-bundle, then verify that directory with the product-owned Notary trust anchor. This does not claim product activation.", + }, + ]; +} + +function validateCommandArgv(argv, path) { + invariant( + Array.isArray(argv) && argv.length > 0, + `${path} must contain command arguments`, + ); + argv.forEach((token, index) => string(token, `${path}[${index}]`)); + invariant( + commandPrograms.has(argv[0]), + `${path} invokes an unsupported program`, + ); + invariant( + argv.every( + (token) => + commandTokenPattern.test(token) || + flagTokenPattern.test(token), + ), + `${path} contains an unsafe command token`, + ); + invariant( + !unsafeCommandPattern.test(argv.join(" ")), + `${path} contains an unsafe command token`, + ); +} + +function validateStep(step, path) { + invariant(isPlainObject(step), `${path} must be an object`); + enumValue(step.kind, `${path}.kind`, stepKinds); + string(step.id, `${path}.id`); + string(step.label, `${path}.label`); + if ( + ["command", "alternative", "long_running", "readiness_gate"].includes( + step.kind, + ) + ) { + const fields = + step.kind === "command" + ? ["id", "kind", "label", "cwd", "argv"] + : ["id", "kind", "label", "cwd", "argv", "note"]; + object(step, path, fields); + safeRelativePath(step.cwd, `${path}.cwd`, { allowDot: true }); + validateCommandArgv(step.argv, `${path}.argv`); + if (step.kind !== "command") string(step.note, `${path}.note`); + return; + } + if (step.kind === "runtime_interface") { + object(step, path, [ + "id", + "kind", + "label", + "method", + "url", + "authentication", + "output_path", + "note", + ]); + invariant(step.method === "GET", `${path}.method must be GET`); + invariant( + step.authentication === "none_disposable_local_opt_out", + `${path}.authentication must identify the disposable local public opt-out`, + ); + string(step.url, `${path}.url`); + safeRelativePath(step.output_path, `${path}.output_path`); + string(step.note, `${path}.note`); + return; + } + object(step, path, [ + "id", + "kind", + "label", + "inputs", + "outputs", + "procedure", + ]); + stringArray(step.inputs, `${path}.inputs`); + stringArray(step.outputs, `${path}.outputs`); + string(step.procedure, `${path}.procedure`); +} + +export function validateStandardJourneyCommand(command) { + const rendered = Array.isArray(command) ? command.join(" ") : command; + string(rendered, "command"); + invariant( + !unsafeCommandPattern.test(rendered), + "command contains an unsafe command token", + ); + validateCommandArgv( + Array.isArray(command) ? command : command.split(/\s+/u), + "command", + ); +} + +export function renderStandardJourneyCommand(step) { + invariant( + ["command", "alternative", "long_running", "readiness_gate"].includes( + step.kind, + ), + `${step.id} is not a command-bearing step`, + ); + validateCommandArgv(step.argv, `${step.id}.argv`); + return step.argv.join(" "); +} + +async function loadDiagnosticEntries(repoRoot) { + const entries = []; + for (const relativePath of diagnosticCatalogs) { + const catalog = JSON.parse( + await readFile(resolve(repoRoot, relativePath), "utf8"), + ); + invariant( + Array.isArray(catalog.entries), + `${relativePath} does not contain entries`, + ); + entries.push(...catalog.entries); + } + const byCode = new Map(); + for (const entry of entries) { + invariant( + !byCode.has(entry.code), + `diagnostic code ${entry.code} is duplicated across catalogs`, + ); + byCode.set(entry.code, entry); + } + return byCode; +} + +function safeRelativePath(value, path, { allowDot = false } = {}) { + string(value, path); + const segments = value.split(/[\\/]/u); + invariant( + !isAbsolute(value) && + !value.startsWith("-") && + ((allowDot && value === ".") || + (value !== "." && + segments.every( + (segment) => + segment !== "" && segment !== ".." && segment !== ".", + ))), + `${path} must be a safe repository-relative path`, + ); +} + +async function canonicalRepositoryPath(repoRoot, relativePath, path, kind) { + safeRelativePath(relativePath, path); + const root = await realpath(repoRoot); + const candidate = await realpath(resolve(root, relativePath)); + invariant( + candidate === root || candidate.startsWith(`${root}${sep}`), + `${path} resolves outside the repository`, + ); + const metadata = await stat(candidate); + invariant( + (kind === "file" && metadata.isFile()) || + (kind === "directory" && metadata.isDirectory()), + `${path} must resolve to a ${kind}`, + ); + return candidate; +} + +async function assertCanonicalSources(repoRoot, journey) { + const paths = [ + ...journey.canonical_sources, + ...journey.minimal_configuration.files.map((file) => file.source), + journey.fixture.source, + ]; + for (const [index, relativePath] of paths.entries()) { + await canonicalRepositoryPath( + repoRoot, + relativePath, + `${journey.id}.canonical_source[${index}]`, + "file", + ); + } + await canonicalRepositoryPath( + repoRoot, + journey.canonical_workspace.path, + `${journey.id}.canonical_workspace.path`, + "directory", + ); +} + +async function assertEvidenceRecords(repoRoot, journey) { + for (const dimension of evidenceDimensions) { + const record = journey.evidence[dimension]; + const source = await canonicalRepositoryPath( + repoRoot, + record.source_path, + `${journey.id}.evidence.${dimension}.source_path`, + "file", + ); + const sourceContent = await readFile(source, "utf8"); + invariant( + sourceContent.includes(record.test_id), + `${journey.id}.evidence.${dimension}.test_id does not resolve in ${record.source_path}`, + ); + const [workflowPath, workflowJob] = record.workflow.split("#"); + invariant( + workflowJob !== undefined && workflowJob !== "", + `${journey.id}.evidence.${dimension}.workflow must name a job`, + ); + const workflow = await canonicalRepositoryPath( + repoRoot, + workflowPath, + `${journey.id}.evidence.${dimension}.workflow`, + "file", + ); + const workflowContent = await readFile(workflow, "utf8"); + invariant( + workflowContent.includes(`\n ${workflowJob}:`), + `${journey.id}.evidence.${dimension}.workflow job ${workflowJob} does not resolve`, + ); + } +} + +async function loadCatalogIds(repoRoot, matrix) { + const projects = JSON.parse( + await readFile( + resolve(repoRoot, "docs/site/src/data/generated/projects.json"), + "utf8", + ), + ); + const contracts = JSON.parse( + await readFile( + resolve(repoRoot, "docs/site/src/data/generated/contracts.json"), + "utf8", + ), + ); + return { + project_authoring: new Set(matrix.map((entry) => entry.id)), + projects: new Set(projects.map((entry) => entry.id)), + contracts: new Set(contracts.map((entry) => entry.id)), + }; +} + +function assertCatalogReferences(journey, catalogIds) { + invariant( + Object.values(catalogIds).some((ids) => + ids.has(journey.canonical_workspace.id), + ), + `${journey.id}.canonical_workspace.id does not resolve current catalogs`, + ); + for (const reference of journey.catalog_references) { + invariant( + catalogIds[reference.catalog].has(reference.id), + `${journey.id} catalog reference ${reference.catalog}:${reference.id} does not resolve`, + ); + } +} + +export async function buildStandardJourneys( + repoRoot = defaultRepoRoot, + manifestPath = manifestRelative, +) { + const manifest = validateStandardJourneyManifest( + await parseYaml(resolve(repoRoot, manifestPath)), + ); + const matrix = await buildProjectAuthoringJourneyMatrix(repoRoot); + const matrixById = new Map(matrix.map((entry) => [entry.id, entry])); + const catalogIds = await loadCatalogIds(repoRoot, matrix); + const diagnosticsByCode = await loadDiagnosticEntries(repoRoot); + const output = []; + + for (const journey of manifest.journeys) { + await assertCanonicalSources(repoRoot, journey); + await assertEvidenceRecords(repoRoot, journey); + assertCatalogReferences(journey, catalogIds); + const troubleshooting = journey.troubleshooting.map((code) => { + const entry = diagnosticsByCode.get(code); + invariant( + entry !== undefined, + `${journey.id} references unknown diagnostic code ${code}`, + ); + return { + code, + family: entry.family, + product: entry.product, + meaning: entry.safe_meaning, + remediation: entry.safe_remediation, + docs_anchor: entry.docs_anchor, + lifecycle: entry.lifecycle, + introduced_in: entry.introduced_in, + evidence_limitation: entry.evidence_limitation, + }; + }); + const steps = buildSteps(journey, matrixById); + steps.forEach((step, index) => + validateStep(step, `${journey.id}.steps[${index}]`), + ); + invariant( + new Set(steps.map((step) => step.id)).size === steps.length, + `${journey.id}.steps contains duplicate ids`, + ); + output.push({ + ...journey, + source_label: "Main source (unreleased)", + section_headings: standardJourneyHeadings, + configuration_files: await extractConfigurationFiles(repoRoot, journey), + fixture_excerpt: await extractFixture(repoRoot, journey.fixture), + steps, + troubleshooting, + }); + } + return output; +} + +export async function generateStandardJourneys( + repoRoot = defaultRepoRoot, + outputPaths = [generatedRelative, publicGeneratedRelative], + { check = false } = {}, +) { + const journeys = await buildStandardJourneys(repoRoot); + const content = `${JSON.stringify(journeys, null, 2)}\n`; + const destinations = (Array.isArray(outputPaths) ? outputPaths : [outputPaths]).map( + (outputPath) => + isAbsolute(outputPath) ? outputPath : resolve(repoRoot, outputPath), + ); + for (const destination of destinations) { + if (check) { + let committed; + try { + committed = await readFile(destination, "utf8"); + } catch (error) { + if (error?.code === "ENOENT") { + throw new Error( + `${relative(repoRoot, destination)} is missing; run generate-standard-journeys.mjs`, + ); + } + throw error; + } + invariant( + committed === content, + `${relative(repoRoot, destination)} is stale; run generate-standard-journeys.mjs`, + ); + } else { + await mkdir(dirname(destination), { recursive: true }); + await writeFile(destination, content); + } + } + if (!check) { + console.log(`Generated ${journeys.length} normalized standard journeys.`); + } + return content; +} + +if ( + process.argv[1] && + resolve(process.argv[1]) === fileURLToPath(import.meta.url) +) { + const args = process.argv.slice(2); + invariant( + args.every((argument) => argument === "--check") && + args.filter((argument) => argument === "--check").length <= 1, + "usage: node scripts/generate-standard-journeys.mjs [--check]", + ); + await generateStandardJourneys(defaultRepoRoot, undefined, { + check: args.includes("--check"), + }); +} diff --git a/docs/site/scripts/generate-standard-journeys.test.mjs b/docs/site/scripts/generate-standard-journeys.test.mjs new file mode 100644 index 000000000..0a5c2f8a5 --- /dev/null +++ b/docs/site/scripts/generate-standard-journeys.test.mjs @@ -0,0 +1,776 @@ +import assert from "node:assert/strict"; +import { execFile as execFileCallback, spawnSync } from "node:child_process"; +import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises"; +import { tmpdir } from "node:os"; +import { join, resolve } from "node:path"; +import { promisify } from "node:util"; +import { test } from "node:test"; + +import YAML from "yaml"; + +import { + buildStandardJourneys, + generateStandardJourneys, + renderStandardJourneyCommand, + standardJourneyHeadings, + standardJourneyIds, + validateStandardJourneyCommand, + validateStandardJourneyManifest, + validateStandardJourneyPublicValue, +} from "./generate-standard-journeys.mjs"; + +const execFile = promisify(execFileCallback); +const repoRoot = resolve(import.meta.dirname, "../../.."); +const docsRoot = resolve(repoRoot, "docs/site"); +const manifestPath = resolve( + repoRoot, + "docs/site/src/data/standard-journeys.yaml", +); +const registryctlBinary = process.env.REGISTRYCTL_BIN; + +async function readManifest() { + return YAML.parse(await readFile(manifestPath, "utf8")); +} + +async function withManifest(run) { + const temporary = await mkdtemp(join(tmpdir(), "standard-journeys-")); + try { + const manifest = await readManifest(); + const candidatePath = join(temporary, "standard-journeys.yaml"); + await run({ temporary, manifest, candidatePath }); + } finally { + await rm(temporary, { force: true, recursive: true }); + } +} + +async function writeManifest(candidatePath, manifest) { + await writeFile(candidatePath, YAML.stringify(manifest, { lineWidth: 0 })); +} + +function byId(journeys) { + return Object.fromEntries(journeys.map((journey) => [journey.id, journey])); +} + +function commandSteps(journey) { + return journey.steps.filter((step) => step.kind === "command"); +} + +test("builds exactly seven ordered journeys with ten stable headings", async () => { + const journeys = await buildStandardJourneys(repoRoot); + + assert.equal(journeys.length, 7); + assert.deepEqual( + journeys.map((journey) => journey.id), + standardJourneyIds, + ); + assert.equal(standardJourneyHeadings.length, 10); + for (const journey of journeys) { + assert.deepEqual(journey.section_headings, standardJourneyHeadings); + assert.deepEqual(journey.availability, { + status: "current_unreleased", + proof: "source_tree", + release: null, + }); + assert.equal(journey.source_label, "Main source (unreleased)"); + } +}); + +test("extracts every declared complete configuration file from its canonical source", async () => { + const first = await buildStandardJourneys(repoRoot); + const second = await buildStandardJourneys(repoRoot); + assert.equal(JSON.stringify(first), JSON.stringify(second)); + const journeys = byId(first); + + assert.deepEqual( + journeys["bounded-http"].configuration_files.map((file) => file.destination), + [ + "registry-project/registry-stack.yaml", + "registry-project/environments/local.yaml", + "registry-project/integrations/person-record/integration.yaml", + ], + ); + + const fhir = journeys["bounded-multi-call-script"]; + assert.equal(fhir.configuration_files.length, 4); + const adapter = fhir.configuration_files.find( + (file) => file.destination.endsWith("/adapter.rhai"), + ); + assert.equal(adapter.language, "rhai"); + assert.equal( + adapter.content, + await readFile(resolve(repoRoot, adapter.source), "utf8"), + ); + const integration = fhir.configuration_files.find( + (file) => file.destination.endsWith("/integration.yaml"), + ); + assert.match(integration.content, /calls: 4/u); + assert.match(integration.content, /source_bytes: 512KiB/u); + assert.match(integration.content, /request_bytes: 8KiB/u); + assert.match(integration.content, /deadline: 12s/u); + + const snapshot = journeys["exact-snapshot"]; + assert.equal(snapshot.configuration_files.length, 4); + assert.match( + snapshot.configuration_files.find((file) => + file.destination.endsWith("/entities/people.yaml"), + ).content, + /primary_key: person_id/u, + ); + + for (const id of ["spreadsheet-protected-api", "instance-openapi"]) { + assert.deepEqual( + journeys[id].configuration_files.map((file) => ({ + content: file.content, + format: file.format, + })), + [{ content: null, format: "scaffolded" }], + ); + } +}); + +test("preserves exact scaffold ownership and emitted build paths", async () => { + const journeys = byId(await buildStandardJourneys(repoRoot)); + const spreadsheet = journeys["spreadsheet-protected-api"]; + assert.equal( + spreadsheet.artifacts.find( + (artifact) => artifact.path === "my-first-api/registryctl.yaml", + ).classification, + "scaffolded_human_owned", + ); + assert.equal( + spreadsheet.artifacts.find( + (artifact) => artifact.path === "my-first-api/relay/config.yaml", + ).classification, + "scaffolded_human_owned", + ); + + for (const [id, projectDirectory] of Object.entries({ + "bounded-http": "registry-project", + "bounded-multi-call-script": "fhir-project", + "exact-snapshot": "snapshot-project", + "product-input-lifecycle": "registry-project", + })) { + const paths = new Set(journeys[id].artifacts.map((artifact) => artifact.path)); + for (const path of [ + `${projectDirectory}/.registry-stack/build/local/reviewable`, + `${projectDirectory}/.registry-stack/build/local/private/relay`, + `${projectDirectory}/.registry-stack/build/local/private/notary`, + ]) { + assert(paths.has(path), `${id} is missing exact emitted path ${path}`); + } + assert.equal( + [...paths].some((path) => path.startsWith("generated/")), + false, + `${id} retained an invented generated path`, + ); + } + + assert.deepEqual( + journeys["product-input-lifecycle"].artifacts + .filter((artifact) => artifact.classification === "generated_signed") + .map((artifact) => artifact.path), + [ + "journey-output/registry-relay-bundle", + "journey-output/registry-notary-bundle", + ], + ); +}); + +test("uses the current explicit registry-backed predicate and matching fixture", async () => { + const journey = byId(await buildStandardJourneys(repoRoot))[ + "registry-backed-notary-claim" + ]; + const project = journey.configuration_files.find((file) => + file.destination.endsWith("/registry-stack.yaml"), + ); + + assert.match( + project.content, + /cel: enrollment\.matched && enrollment\.registration_status == "active"/u, + ); + assert.match(journey.fixture_excerpt.content, /active-registration-exists: true/u); + assert.doesNotMatch( + project.content + journey.fixture_excerpt.content, + /person-registration-accepted|v0\.13\.0/u, + ); +}); + +test("rejects missing sections, reordered IDs, and extra journeys", async () => { + const manifest = await readManifest(); + delete manifest.journeys[0].production_delta; + assert.throws( + () => validateStandardJourneyManifest(manifest), + /missing fields: production_delta/u, + ); + + const reordered = await readManifest(); + [reordered.journeys[0], reordered.journeys[1]] = [ + reordered.journeys[1], + reordered.journeys[0], + ]; + assert.throws( + () => validateStandardJourneyManifest(reordered), + /seven standard journeys in order/u, + ); + + const extra = await readManifest(); + extra.journeys.push(structuredClone(extra.journeys[0])); + assert.throws( + () => validateStandardJourneyManifest(extra), + /seven standard journeys in order/u, + ); +}); + +test("rejects shell control, unsupported programs, and executable placeholders", () => { + for (const command of [ + "registryctl start; touch escaped", + "registryctl start && registryctl smoke", + "registryctl build $(printenv)", + "registryctl build > report", + "cd registry-project", + "curl http://127.0.0.1:4242/openapi.json", + "diff expected actual", + "registryctl bundle verify --bundle-dir ", + ]) { + assert.throws( + () => validateStandardJourneyCommand(command), + /unsafe command token|unsupported program/u, + ); + } + assert.doesNotThrow(() => + validateStandardJourneyCommand([ + "registryctl", + "check", + "--project-dir", + "registry-project", + "--environment", + "local", + "--explain", + ]), + ); +}); + +test("keeps starter prerequisites and noninteractive commands separate from alternatives", async () => { + const journeys = byId(await buildStandardJourneys(repoRoot)); + const starterProjects = { + "bounded-http": "registry-project", + "bounded-multi-call-script": "fhir-project", + "exact-snapshot": "snapshot-project", + "product-input-lifecycle": "registry-project", + }; + for (const [id, projectDirectory] of Object.entries(starterProjects)) { + const steps = journeys[id].steps; + const required = commandSteps(journeys[id]); + const operations = required.map((step) => step.argv.slice(1, 3).join(" ")); + assert.deepEqual(required[0].argv.slice(0, 3), [ + "registryctl", + "init", + "--from", + ]); + assert.match(operations[1], /^authoring editor/u); + const checkIndex = required.findIndex((step) => step.argv[1] === "check"); + const compareIndex = required.findIndex((step) => step.argv[1] === "compare"); + const buildIndex = required.findIndex((step) => step.argv[1] === "build"); + assert.deepEqual(required[compareIndex].argv, [ + "registryctl", + "compare", + "--project-dir", + projectDirectory, + "--environment", + "local", + "--from-starter", + ]); + assert.equal( + compareIndex, + checkIndex + 1, + `${id} must compare immediately after explained check`, + ); + assert.equal( + checkIndex < compareIndex && compareIndex < buildIndex, + true, + `${id} must compare after check and before build`, + ); + assert.equal( + required.findIndex((step) => step.argv[1] === "test") < checkIndex, + true, + `${id} must test before check`, + ); + assert.equal( + required.some( + (step) => + step.argv[1] === "promote" || + step.argv.includes("--watch") || + renderStandardJourneyCommand(step).includes("<"), + ), + false, + `${id} beginner sequence must not promote, watch, or render placeholders`, + ); + assert.equal( + steps.some( + (step) => + step.kind === "long_running" && + step.argv.includes("--watch"), + ), + true, + `${id} must keep watch separate`, + ); + } +}); + +test("initializes every journey before its first project use", async () => { + const journeys = await buildStandardJourneys(repoRoot); + for (const journey of journeys) { + const required = commandSteps(journey); + const initIndex = required.findIndex((step) => step.argv[1] === "init"); + assert.equal(initIndex, 0, `${journey.id} must initialize first`); + assert.equal( + required.slice(0, initIndex).some((step) => step.argv.includes("--project-dir")), + false, + `${journey.id} used a project before initialization`, + ); + } +}); + +test("keeps runtime and product activation claims bounded to traceable evidence", async () => { + const journeys = byId(await buildStandardJourneys(repoRoot)); + const openapi = journeys["instance-openapi"]; + const capture = openapi.steps.find((step) => step.kind === "runtime_interface"); + assert.equal(capture.authentication, "none_disposable_local_opt_out"); + assert.equal(capture.output_path, "openapi-inspection/output/instance.openapi.json"); + assert.match(openapi.minimal_configuration.note, /product default remains true/u); + assert.doesNotMatch( + openapi.prerequisites.join(" "), + /authorization material|protected instance route/u, + ); + assert.match( + openapi.fixture.expected_trace.join(" "), + /explicitly sets server\.openapi_requires_auth to false/u, + ); + assert.doesNotMatch( + openapi.contract.proves.join(" "), + /product default is public|runtime evidence is verified/u, + ); + assert.equal(openapi.evidence.runtime.status, "not_claimed"); + + const snapshot = journeys["exact-snapshot"]; + assert.equal(snapshot.evidence.runtime.status, "not_claimed"); + const snapshotMaterializationGate = snapshot.gates.find( + (gate) => gate.name === "build", + ); + assert.equal( + snapshotMaterializationGate.proves, + "Unsigned Relay input contains the reviewed snapshot materialization requirements.", + ); + assert.equal( + snapshotMaterializationGate.does_not_prove, + "A runtime loaded a concrete snapshot generation or the upstream collection is complete.", + ); + assert.doesNotMatch( + [ + snapshotMaterializationGate.proves, + JSON.stringify(snapshot.configuration_files), + JSON.stringify(snapshot.artifacts), + ].join(" "), + /runtime (?:loaded|accepted) (?:a )?(?:concrete )?snapshot generation/u, + ); + + const lifecycle = journeys["product-input-lifecycle"]; + assert.equal(lifecycle.evidence.runtime.status, "not_claimed"); + assert.doesNotMatch( + lifecycle.contract.proves.join(" "), + /runtime accepted|reached readiness|activated the bundle/u, + ); + assert.equal( + lifecycle.artifacts.some((artifact) => artifact.path.startsWith("runtime/")), + false, + ); + assert.equal( + lifecycle.steps.filter((step) => step.kind === "operator_interface").length >= 3, + true, + ); + const governedPromotion = lifecycle.steps.find( + (step) => + step.kind === "operator_interface" && + step.procedure.includes("registryctl promote"), + ); + const lifecycleBuildIndex = lifecycle.steps.findIndex( + (step) => step.kind === "command" && step.argv[1] === "build", + ); + const lifecyclePreflight = lifecycle.steps.find( + (step) => step.id === "lifecycle-preflight", + ); + assert.equal(lifecyclePreflight.kind, "readiness_gate"); + assert.match( + lifecyclePreflight.note, + /expected to exit 1 with a value-free not_ready report/u, + ); + assert.equal( + lifecycle.steps.indexOf(governedPromotion) > lifecycleBuildIndex, + true, + ); + assert.match(governedPromotion.procedure, /separate from the first-time starter comparison/u); +}); + +test("rejects incomplete, partial, and non-allowlisted configuration sources", async () => { + const incomplete = await readManifest(); + incomplete.journeys[3].minimal_configuration.files.pop(); + assert.throws( + () => validateStandardJourneyManifest(incomplete), + /exact complete source set/u, + ); + + const ranged = await readManifest(); + ranged.journeys[3].minimal_configuration.files[0].line_start = 2; + assert.throws( + () => validateStandardJourneyManifest(ranged), + /unknown fields: line_start/u, + ); + + const copied = await readManifest(); + copied.journeys[2].minimal_configuration.files[0].source = + "docs/site/src/data/standard-journeys.yaml"; + copied.journeys[2].canonical_sources[0] = + "docs/site/src/data/standard-journeys.yaml"; + assert.throws( + () => validateStandardJourneyManifest(copied), + /not an explicitly approved public configuration source/u, + ); +}); + +test("accepts schema-shaped secret references and rejects literal credential extraction", async () => { + assert.doesNotThrow(() => + validateStandardJourneyPublicValue({ + credential: { token: { secret: "FICTIONAL_REGISTRY_TOKEN" } }, + }), + ); + assert.throws( + () => + validateStandardJourneyPublicValue({ + credential: { + client_secret: "embedded-real-looking-token", + token: "embedded-real-looking-token", + }, + }), + /structured credential reference/u, + ); + assert.throws( + () => validateStandardJourneyPublicValue({ Jurisdiction: "real-country" }), + /non-public field Jurisdiction/u, + ); + + const journeys = await buildStandardJourneys(repoRoot); + const environment = byId(journeys)["bounded-http"].configuration_files.find( + (file) => file.destination.endsWith("/environments/local.yaml"), + ); + assert.match(environment.content, /secret: FICTIONAL_REGISTRY_TOKEN/u); + + await withManifest(async ({ manifest, candidatePath }) => { + const source = + "crates/registry-relay/config/example.yaml"; + const journey = manifest.journeys[2]; + journey.canonical_sources.push(source); + journey.minimal_configuration.files[0].source = source; + await writeManifest(candidatePath, manifest); + await assert.rejects( + buildStandardJourneys(repoRoot, candidatePath), + /not an explicitly approved public configuration source/u, + ); + }); +}); + +test("rejects stale canonical files, diagnostics, catalogs, and evidence links", async () => { + await withManifest(async ({ manifest, candidatePath }) => { + manifest.journeys[0].canonical_sources[0] = + "crates/registryctl/src/missing.rs"; + await writeManifest(candidatePath, manifest); + await assert.rejects(buildStandardJourneys(repoRoot, candidatePath), /ENOENT/u); + }); + + await withManifest(async ({ manifest, candidatePath }) => { + manifest.journeys[0].troubleshooting[0] = + "registryctl.authoring.removed"; + await writeManifest(candidatePath, manifest); + await assert.rejects( + buildStandardJourneys(repoRoot, candidatePath), + /unknown diagnostic code/u, + ); + }); + + await withManifest(async ({ manifest, candidatePath }) => { + manifest.journeys[0].catalog_references[0].id = "removed-project"; + await writeManifest(candidatePath, manifest); + await assert.rejects( + buildStandardJourneys(repoRoot, candidatePath), + /catalog reference .* does not resolve/u, + ); + }); + + await withManifest(async ({ manifest, candidatePath }) => { + manifest.journeys[0].evidence.extraction.source_path = + "docs/site/scripts/generate-standard-journeys.mjs"; + manifest.journeys[0].evidence.extraction.test_id = "missing test id"; + await writeManifest(candidatePath, manifest); + await assert.rejects( + buildStandardJourneys(repoRoot, candidatePath), + /test_id does not resolve/u, + ); + }); +}); + +test("rejects release-label, evidence lifecycle, and artifact ownership drift", async () => { + const releaseMismatch = await readManifest(); + releaseMismatch.journeys[0].availability.release = "v0.13.0"; + assert.throws( + () => validateStandardJourneyManifest(releaseMismatch), + /must remain null/u, + ); + + const evidenceMismatch = await readManifest(); + evidenceMismatch.journeys[0].evidence.runtime.revision = "v0.13.0"; + assert.throws( + () => validateStandardJourneyManifest(evidenceMismatch), + /revision must be main/u, + ); + + const ownershipMismatch = await readManifest(); + ownershipMismatch.journeys[0].artifacts[0].owner = "shared"; + assert.throws( + () => validateStandardJourneyManifest(ownershipMismatch), + /owner has unsupported value shared/u, + ); +}); + +test("emits only typed safe steps and product-owned diagnostics", async () => { + const journeys = await buildStandardJourneys(repoRoot); + for (const journey of journeys) { + for (const step of journey.steps) { + if ( + ["command", "alternative", "long_running", "readiness_gate"].includes( + step.kind, + ) + ) { + validateStandardJourneyCommand(step.argv); + assert.equal(step.argv[0], "registryctl"); + assert.doesNotMatch(renderStandardJourneyCommand(step), /[<>;&|`]|\$\(/u); + } else { + assert.equal(Object.hasOwn(step, "argv"), false); + } + } + for (const diagnostic of journey.troubleshooting) { + assert.equal(typeof diagnostic.product, "string"); + assert.equal(typeof diagnostic.family, "string"); + assert.equal(typeof diagnostic.meaning, "string"); + assert.equal(typeof diagnostic.remediation, "string"); + assert.match(diagnostic.docs_anchor, /^\/reference\/diagnostics\//u); + assert.equal(diagnostic.lifecycle, "unreleased"); + assert.equal(diagnostic.introduced_in, null); + } + } +}); + +test("every rendered command and combined block parses in POSIX sh, Bash, and Zsh", async () => { + const journeys = await buildStandardJourneys(repoRoot); + const commands = journeys.flatMap((journey) => + journey.steps + .filter((step) => + ["command", "alternative", "long_running", "readiness_gate"].includes( + step.kind, + ), + ) + .map(renderStandardJourneyCommand), + ); + const scripts = [ + ...commands.map((command) => `set -eu\n${command}\n`), + `set -eu\n${commands.join("\n")}\n`, + ]; + for (const shell of ["/bin/sh", "bash", "zsh"]) { + for (const script of scripts) { + const result = spawnSync(shell, ["-n"], { + encoding: "utf8", + input: script, + }); + assert.equal( + result.status, + 0, + `${shell} rejected rendered commands: ${result.stderr}`, + ); + } + } +}); + +test( + "executes every required noninteractive sequence from a clean temporary directory", + { skip: registryctlBinary === undefined }, + async () => { + const version = ( + await execFile(registryctlBinary, ["--version"], { encoding: "utf8" }) + ).stdout.trim().split(/\s+/u).at(-1); + const journeys = await buildStandardJourneys(repoRoot); + + for (const journey of journeys) { + const temporary = await mkdtemp(join(tmpdir(), `journey-${journey.id}-`)); + try { + const imageLock = join(temporary, "release-image-lock.json"); + await writeFile( + imageLock, + `${JSON.stringify( + { + schema_version: "registryctl.release_image_lock.v1", + release_tag: `v${version}`, + manifest_source_ref: "a".repeat(40), + tag_target: "b".repeat(40), + platform: "linux/amd64", + images: { + "registry-relay": + `ghcr.io/registrystack/registry-relay@sha256:${"a".repeat(64)}`, + "registry-notary": + `ghcr.io/registrystack/registry-notary@sha256:${"b".repeat(64)}`, + }, + }, + null, + 2, + )}\n`, + ); + const executableSteps = journey.steps.filter((step) => + ["command", "readiness_gate"].includes(step.kind), + ); + for (const step of executableSteps) { + const cwd = resolve(temporary, step.cwd); + const execution = execFile(registryctlBinary, step.argv.slice(1), { + cwd, + env: { + ...process.env, + REGISTRYCTL_IMAGE_LOCK: imageLock, + REGISTRYCTL_NO_UPDATE_CHECK: "1", + }, + encoding: "utf8", + }); + if (step.kind === "readiness_gate") { + await assert.rejects(execution, (error) => { + assert.equal(error.code, 1, `${journey.id}:${step.id} exit`); + assert.equal(error.stderr, "", `${journey.id}:${step.id} wrote stderr`); + const report = JSON.parse(error.stdout); + assert.equal(report.schema_version, "registryctl.project_preflight.v1"); + assert.equal(report.status, "not_ready"); + const diagnosticCodes = new Set( + report.diagnostics.map((diagnostic) => diagnostic.code), + ); + assert.equal( + diagnosticCodes.has("registryctl.preflight.secret_missing"), + true, + ); + assert.equal( + diagnosticCodes.has("registryctl.preflight.runtime_file_missing"), + true, + ); + return true; + }); + } else { + const result = await execution; + assert.equal( + result.stderr, + "", + `${journey.id}:${step.id} wrote stderr`, + ); + } + } + } finally { + await rm(temporary, { force: true, recursive: true }); + } + } + }, +); + +test("renders the same ten-section component through exactly seven wrapper pages", async () => { + const component = await readFile( + resolve(docsRoot, "src/components/StandardJourney.astro"), + "utf8", + ); + for (let index = 0; index < standardJourneyHeadings.length; index += 1) { + assert.match( + component, + new RegExp(`journey\\.section_headings\\[${index}\\]`, "u"), + ); + } + assert.match(component, /Required readiness gates/u); + + const manifest = await readManifest(); + for (const journey of manifest.journeys) { + const page = await readFile( + resolve(docsRoot, "src/content/docs", `${journey.slug}.mdx`), + "utf8", + ); + assert.match(page, /import StandardJourney/u); + assert.match( + page, + new RegExp(``, "u"), + ); + if (journey.id === "product-input-lifecycle") { + assert.match(page, /activation handoff/u); + assert.doesNotMatch(page, /from authoring to activation/u); + } + } +}); + +test("wires generation and exposes the seven journeys in navigation", async () => { + const packageJson = JSON.parse( + await readFile(resolve(docsRoot, "package.json"), "utf8"), + ); + assert.match( + packageJson.scripts.generate, + /node scripts\/generate-standard-journeys\.mjs/u, + ); + assert( + packageJson.scripts.generate.indexOf("scripts/fetch-openapi.mjs") < + packageJson.scripts.generate.indexOf( + "scripts/generate-standard-journeys.mjs", + ), + "standard journeys must derive from the freshly fetched OpenAPI source", + ); + + const astro = await readFile(resolve(docsRoot, "astro.config.mjs"), "utf8"); + for (const id of standardJourneyIds) { + assert.match(astro, new RegExp(`slug: 'journeys/${id}'`, "u")); + } +}); + +test("generation is byte-stable and check mode fails closed on drift", async () => { + await withManifest(async ({ temporary }) => { + const outputs = [ + join(temporary, "internal.json"), + join(temporary, "public.json"), + ]; + const first = await generateStandardJourneys(repoRoot, outputs); + const second = await generateStandardJourneys(repoRoot, outputs); + assert.equal(first, second); + assert.equal( + await readFile(outputs[0], "utf8"), + await readFile(outputs[1], "utf8"), + ); + await generateStandardJourneys(repoRoot, outputs, { check: true }); + + await writeFile(outputs[1], "{}\n"); + await assert.rejects( + generateStandardJourneys(repoRoot, outputs, { check: true }), + /is stale/u, + ); + }); +}); + +test("the exact workflow command validates both committed generated outputs", async () => { + await execFile( + process.execPath, + ["scripts/generate-standard-journeys.mjs", "--check"], + { cwd: docsRoot }, + ); + assert.equal( + await readFile( + resolve(docsRoot, "src/data/generated/standard-journeys.json"), + "utf8", + ), + await readFile( + resolve(docsRoot, "public/generated/standard-journeys.json"), + "utf8", + ), + ); +}); diff --git a/docs/site/scripts/information-architecture.test.mjs b/docs/site/scripts/information-architecture.test.mjs new file mode 100644 index 000000000..56ca73d6e --- /dev/null +++ b/docs/site/scripts/information-architecture.test.mjs @@ -0,0 +1,139 @@ +// Guards the Phase 2 task-oriented documentation IA. The site keeps the +// existing public page URLs, so this test checks both the sidebar discovery +// path and the redirects that preserve older entry points. + +import assert from 'node:assert/strict'; +import { existsSync, readFileSync } from 'node:fs'; +import { dirname, resolve } from 'node:path'; +import { fileURLToPath } from 'node:url'; +import { test } from 'node:test'; + +const here = dirname(fileURLToPath(import.meta.url)); +const siteRoot = resolve(here, '..'); +const configSource = readFileSync(resolve(siteRoot, 'astro.config.mjs'), 'utf8'); +const homepageSource = readFileSync(resolve(siteRoot, 'src/content/docs/index.mdx'), 'utf8'); +const sidebarSource = configSource.match(/sidebar: \[([\s\S]*?)\n \],\n \}\),/)?.[1]; + +assert.ok(sidebarSource, 'could not isolate the Starlight sidebar configuration'); + +function topLevelLabels(source) { + return [...source.matchAll(/^ label: '([^']+)',$/gm)].map((match) => match[1]); +} + +function topLevelSection(source, label) { + const matches = [...source.matchAll(/^ label: '([^']+)',$/gm)]; + const position = matches.findIndex((match) => match[1] === label); + if (position === -1) return null; + const start = matches[position].index; + const end = matches[position + 1]?.index ?? source.length; + return source.slice(start, end); +} + +function hasDocForSlug(slug) { + return [ + resolve(siteRoot, 'src/content/docs', `${slug}.mdx`), + resolve(siteRoot, 'src/content/docs', slug, 'index.mdx'), + ].some((path) => existsSync(path) && !/^draft: true$/m.test(readFileSync(path, 'utf8'))); +} + +test('uses the Phase 2 top-level task flow in its published order', () => { + assert.deepEqual(topLevelLabels(sidebarSource), [ + 'Start', + 'Journeys', + 'Configure', + 'Verify', + 'Generated artifacts', + 'Operate', + 'Reference', + 'Specifications', + ]); +}); + +test('publishes one stable overview route for every task-flow section', () => { + for (const [label, route] of [ + ['Start', "link: '/'"], + ['Journeys', "slug: 'journeys'"], + ['Configure', "slug: 'configure'"], + ['Verify', "slug: 'verify'"], + ['Generated artifacts', "slug: 'generated-artifacts'"], + ['Operate', "slug: 'operate'"], + ['Reference', "slug: 'reference'"], + ['Specifications', "slug: 'spec'"], + ]) { + const section = topLevelSection(sidebarSource, label); + assert.ok(section, `could not isolate ${label}`); + assert.match(section, new RegExp(route.replaceAll(/[.*+?^${}()|[\]\\]/g, '\\$&'))); + } +}); + +test('keeps the bounded current-source procedure discoverable from Start', () => { + const start = topLevelSection(sidebarSource, 'Start'); + assert.ok(start, 'could not isolate Start'); + assert.match( + start, + /label: 'Test one current source revision', slug: 'start\/test-current-source-revision'/, + ); +}); + +test('keeps the Relay and Notary generated product navigation under Configure', () => { + const configureSource = sidebarSource.match( + /label: 'Configure',[\s\S]*?(?=\n \{\n label: 'Verify',)/, + )?.[0]; + + assert.ok(configureSource, 'could not isolate the Configure sidebar section'); + assert.match(configureSource, /label: 'Registry Relay',[\s\S]*?generatedProduct\('Relay'\)\.items/); + assert.match(configureSource, /label: 'Registry Notary',[\s\S]*?generatedProduct\('Notary'\)\.items/); +}); + +test('keeps generated-artifact navigation tied to the Manifest product group', () => { + const artifactsSource = sidebarSource.match( + /label: 'Generated artifacts',[\s\S]*?(?=\n \{\n \/\/ Stack-wide operator)/, + )?.[0]; + + assert.ok(artifactsSource, 'could not isolate the Generated artifacts sidebar section'); + assert.match(artifactsSource, /label: 'Registry Manifest',[\s\S]*?generatedProduct\('Manifest'\)\.items/); + assert.match(artifactsSource, /slug: 'reference\/contracts'/); +}); + +test('every hand-authored sidebar slug resolves to a published documentation page', () => { + const slugs = [...sidebarSource.matchAll(/slug: '([^']+)'/g)].map((match) => match[1]); + const missing = [...new Set(slugs)].filter((slug) => !hasDocForSlug(slug)); + + assert.deepEqual(missing, []); +}); + +test('legacy entry points redirect to current task-flow pages', () => { + assert.match(configSource, /'\/start\/': internalRedirect\('\/'\)/); + assert.match( + configSource, + /'\/start\/see-it-live\/': internalRedirect\('\/journeys\/spreadsheet-protected-api\/'\)/, + ); + assert.match( + configSource, + /'\/start\/your-first-call\/': internalRedirect\('\/tutorials\/first-run-with-solmara-lab\/'\)/, + ); + assert.match( + configSource, + /'\/tutorials\/first-run-with-registry-lab\/': internalRedirect\('\/tutorials\/first-run-with-solmara-lab\/'\)/, + ); +}); + +test('homepage uses generated journey summaries while Verify leads to the complete runtime tutorial', () => { + const spreadsheetIndex = homepageSource.indexOf('](journeys/spreadsheet-protected-api/)'); + const openapiIndex = homepageSource.indexOf('](journeys/instance-openapi/)'); + const notaryIndex = homepageSource.indexOf('](journeys/registry-backed-notary-claim/)'); + assert.ok(spreadsheetIndex >= 0); + assert.ok(openapiIndex > spreadsheetIndex); + assert.ok(notaryIndex > openapiIndex); + assert.doesNotMatch(homepageSource, /\]\(tutorials\/verify-claim-registry-api\/\)/); + assert.doesNotMatch( + sidebarSource, + /label: 'Evaluate a registry-backed claim', slug: 'journeys\/registry-backed-notary-claim'/, + ); + assert.match( + sidebarSource, + /label: 'Evaluate a registry-backed claim', slug: 'tutorials\/verify-claim-registry-api'/, + ); + assert.ok(hasDocForSlug('tutorials/publish-spreadsheet-secured-registry-api')); + assert.ok(hasDocForSlug('tutorials/verify-claim-registry-api')); +}); diff --git a/docs/site/scripts/registryctl-release-provenance.test.mjs b/docs/site/scripts/registryctl-release-provenance.test.mjs new file mode 100644 index 000000000..accc54b81 --- /dev/null +++ b/docs/site/scripts/registryctl-release-provenance.test.mjs @@ -0,0 +1,118 @@ +import assert from 'node:assert/strict'; +import { execFile as execFileCallback } from 'node:child_process'; +import { readFile } from 'node:fs/promises'; +import { resolve } from 'node:path'; +import { test } from 'node:test'; +import { promisify } from 'node:util'; + +import YAML from 'yaml'; + +const siteRoot = resolve(import.meta.dirname, '..'); +const repositoryRoot = resolve(siteRoot, '../..'); +const execFile = promisify(execFileCallback); + +async function readSite(relative) { + return readFile(resolve(siteRoot, relative), 'utf8'); +} + +test('current-source registryctl docs do not attribute unreleased commands to v0.13.0', async () => { + const [docsetsSource, generatedDocsetsSource, registryctl, configuration, tutorial, releaseSource] = + await Promise.all([ + readSite('src/data/docsets.yaml'), + readSite('src/data/generated/docsets.json'), + readSite('src/content/docs/reference/registryctl.mdx'), + readSite('src/content/docs/reference/project-configuration.mdx'), + readSite('src/content/docs/tutorials/author-registry-project.mdx'), + execFile('git', ['show', 'v0.13.0:crates/registryctl/src/main.rs'], { + cwd: repositoryRoot, + maxBuffer: 4 * 1024 * 1024, + }).then(({ stdout }) => stdout), + ]); + const docsets = YAML.parse(docsetsSource); + const generatedDocsets = JSON.parse(generatedDocsetsSource); + assert.deepEqual(generatedDocsets, docsets, 'generated docset truth must match its source'); + + const current = docsets.docsets.find((docset) => docset.id === docsets.current); + const lastRelease = docsets.docsets.find((docset) => docset.id === 'v0.13.0'); + assert.equal(current.label, 'Main source (unreleased)'); + assert.equal(current.availability, 'unreleased'); + assert.equal(lastRelease.availability, 'released'); + + const registryctlLead = registryctl.split('## Registry Stack project authoring')[0]; + assert.match(registryctlLead, /Main source \(unreleased\)/); + assert.match(registryctlLead, /has not been designated as a release candidate/); + assert.match(registryctlLead, /The last released `registryctl` is `v0\.13\.0`/); + for (const command of [ + 'preflight', + 'capabilities', + 'compare', + 'promote', + 'migrate', + 'authoring reference', + 'project diagnostics', + ]) { + assert.match( + registryctlLead, + new RegExp(`does not contain[\\s\\S]*?\`${command}\``), + `${command} must remain identified as absent from v0.13.0`, + ); + } + assert.doesNotMatch( + registryctl, + /The released command tree comes from the registryctl source at `v0\.13\.0`/, + ); + assert.match( + registryctl, + /The command tables on this page come from Main source \(unreleased\)/, + ); + + assert.match(configuration, /Generated by: Main source \(unreleased\)/); + assert.match(configuration, /Published release containing this generator: none/); + assert.match(configuration, /Field release history: not verified/); + assert.match(configuration, /Compared releases: none/); + assert.match(configuration, /`history_status: not_verified`/); + assert.match(configuration, /`introduced_in: null`/); + assert.doesNotMatch(configuration, /Field availability baseline/); + assert.doesNotMatch(configuration, /field baseline records when/); + assert.doesNotMatch(configuration, /Configuration release: `0\.13\.0`/); + + assert.match(tutorial, /documents Main source \(unreleased\)/); + assert.match(tutorial, /has not been designated as a release candidate/); + assert.match(tutorial, /The `v0\.13\.0` `registryctl` command-tree source does not define/); + const releaseCommands = releaseSource + .split('enum Commands {')[1] + .split('#[derive(Debug, Args)]')[0]; + for (const command of [ + 'Preflight', + 'Capabilities', + 'Compare', + 'Promote', + 'Migrate', + 'ProjectDiagnostics', + ]) { + assert.doesNotMatch( + releaseCommands, + new RegExp(`\\b${command}\\b`), + `${command} must remain absent from the v0.13.0 command tree`, + ); + } + const releaseAuthoring = releaseSource + .split('enum AuthoringCommand {')[1] + .split('#[derive(Debug, Parser)]')[0]; + assert.doesNotMatch(releaseAuthoring, /\bReference\b/); + assert.match( + tutorial, + /`Registry Stack 0\.13\.0` value printed by `init` is bundled starter provenance/, + ); + for (const page of [registryctl, tutorial]) { + assert.match(page, /--show-authored-values/); + assert.match(page, /human(?:-only| output only)/i); + assert.match( + page, + /Secret values, secret references and runtime secret-file locators, fixture data, raw parser text,\s+defaulted values, and derived values remain hidden/, + ); + assert.match(page, /not a\s+report, evidence, or export mode/); + } + assert.match(registryctl, /Default human output,[\s\S]*JSON output,[\s\S]*remain redacted/); + assert.match(tutorial, /combining[\s\S]*with JSON output is rejected/); +}); diff --git a/docs/site/scripts/registryctl-tutorial.test.mjs b/docs/site/scripts/registryctl-tutorial.test.mjs index 65711fafc..653a44c42 100644 --- a/docs/site/scripts/registryctl-tutorial.test.mjs +++ b/docs/site/scripts/registryctl-tutorial.test.mjs @@ -1,8 +1,16 @@ import assert from 'node:assert/strict'; -import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'; +import { execFileSync } from 'node:child_process'; +import { + chmodSync, + copyFileSync, + mkdtempSync, + readFileSync, + rmSync, + writeFileSync, +} from 'node:fs'; import { tmpdir } from 'node:os'; -import { join } from 'node:path'; -import { test } from 'node:test'; +import { join, resolve } from 'node:path'; +import { after, test } from 'node:test'; import { parse } from 'yaml'; @@ -19,6 +27,67 @@ import { setRelayMinGroupSize, } from './registryctl-tutorial.mjs'; +const siteRoot = resolve(import.meta.dirname, '..'); +const repoRoot = resolve(siteRoot, '../..'); +let registryctlBinary; +let registryctlBinaryDirectory; + +after(() => { + if (registryctlBinaryDirectory !== undefined) { + rmSync(registryctlBinaryDirectory, { recursive: true, force: true }); + } +}); + +function exactRegistryctlBinary() { + if (registryctlBinary !== undefined) return registryctlBinary; + if (process.env.REGISTRYCTL_BIN !== undefined) { + registryctlBinary = process.env.REGISTRYCTL_BIN; + return registryctlBinary; + } + + const buildEvents = execFileSync( + 'cargo', + [ + 'build', + '--locked', + '--quiet', + '-p', + 'registryctl', + '--bin', + 'registryctl', + '--message-format=json', + ], + { cwd: repoRoot, encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 }, + ) + .trim() + .split('\n') + .filter(Boolean) + .map((line) => JSON.parse(line)); + const artifact = buildEvents.findLast( + (event) => + event.reason === 'compiler-artifact' && + event.target?.name === 'registryctl' && + event.executable, + ); + assert.ok(artifact, 'cargo did not identify the exact registryctl executable'); + registryctlBinaryDirectory = mkdtempSync(join(tmpdir(), 'registryctl-docs-binary-')); + registryctlBinary = join( + registryctlBinaryDirectory, + process.platform === 'win32' ? 'registryctl.exe' : 'registryctl', + ); + copyFileSync(artifact.executable, registryctlBinary); + chmodSync(registryctlBinary, 0o700); + return registryctlBinary; +} + +function registryctl(args) { + return execFileSync(exactRegistryctlBinary(), args, { + cwd: repoRoot, + encoding: 'utf8', + maxBuffer: 16 * 1024 * 1024, + }); +} + test('extracts shell fences with headings, occurrences, and multiline commands intact', () => { const markdown = `## Start @@ -144,6 +213,29 @@ test('redacts generated env values and credential headers before output is print assert.match(redacted, /REDACTED:ROW_READER_RAW/); }); +test('Relay disclosure-floor rejection uses the value-free startup contract', () => { + const tutorial = readFileSync( + new URL( + '../src/content/docs/tutorials/publish-spreadsheet-secured-registry-api.mdx', + import.meta.url, + ), + 'utf8', + ); + const script = readFileSync(new URL('./check-registryctl-tutorials.sh', import.meta.url), 'utf8'); + + assert.match(tutorial, /relay\.startup\.config_validation_rejected/); + assert.doesNotMatch(tutorial, /code="config\.validation_error"/); + assert.doesNotMatch(tutorial, /requires disclosure_control\.min_cell_size >= 2/); + assert.match( + script, + /assert_contains "\$LAST_OUTPUT" relay\.startup\.config_validation_rejected/, + ); + assert.match( + script, + /assert_not_contains "\$LAST_OUTPUT" config\.validation_error 'min_cell_size >= 2'/, + ); +}); + test('source tutorial image staging includes the dedicated Relay Rhai worker', () => { const script = readFileSync(new URL('./check-registryctl-tutorials.sh', import.meta.url), 'utf8'); const worker = 'registry-relay-rhai-worker'; @@ -162,3 +254,194 @@ test('source tutorial image staging includes the dedicated Notary CEL worker', ( assert.match(script, new RegExp(`dist/image-bin/${worker}`)); assert.match(script, new RegExp(`chmod 0755[\\s\\S]*dist/image-bin/${worker}`)); }); + +test('HTTP authoring tutorial output stays synchronized with the current starter', () => { + const directory = mkdtempSync(join(tmpdir(), 'registryctl-http-trace-')); + const projectDirectory = join(directory, 'registry-project'); + try { + registryctl(['init', '--from', 'http', '--project-dir', projectDirectory]); + assert.match( + readFileSync( + join( + projectDirectory, + 'integrations/person-record/fixtures/active.yaml', + ), + 'utf8', + ), + /^request:$/m, + 'the exact executable must embed the governed-request starter', + ); + const actual = registryctl( + [ + 'test', + '--project-dir', + projectDirectory, + '--integration', + 'person-record', + '--fixture', + 'active-person', + '--trace', + ], + ).trimEnd(); + const tutorial = readFileSync( + resolve(siteRoot, 'src/content/docs/tutorials/author-registry-project.mdx'), + 'utf8', + ); + const documented = extractFencedBlocks(tutorial).find( + (block) => block.heading === 'Trace one fixture offline' && block.language === 'text', + ); + assert.ok(documented, 'tutorial trace output block is missing'); + assert.equal(documented.content, actual); + + assert.match(actual, /^PASS: 9\/9 fixtures passed$/m); + assert.deepEqual( + actual + .split('\n') + .filter((line) => line.startsWith(' PASS person-record.')) + .map((line) => line.trim().slice('PASS person-record.'.length)), + [ + 'active-person', + 'active-person::derived/request_to_consultation_binding', + 'active-person::derived/request_authority', + 'active-person::derived/status_rejection', + 'active-person::derived/malformed_decode', + 'active-person::derived/byte_ceiling', + 'active-person::derived/timeout', + 'active-person::derived/authorization_before_source', + 'active-person::derived/output_minimization', + ], + ); + + const built = registryctl( + [ + 'build', + '--project-dir', + projectDirectory, + '--environment', + 'local', + ], + ).trimEnd(); + const documentedBuild = extractFencedBlocks(tutorial).find( + (block) => block.heading === 'Build unsigned product inputs' && block.language === 'text', + ); + assert.ok(documentedBuild, 'tutorial build output block is missing'); + assertOutputContainsLines(built, documentedBuild.content.split('\n').slice(1).join('\n')); + assert.match(built, /^ Output: \.registry-stack\/build\/local$/m); + assert.match(tutorial, /An artifact action of `regenerate` is lifecycle metadata/); + + const trustedLocal = registryctl( + [ + 'check', + '--project-dir', + projectDirectory, + '--environment', + 'local', + '--explain', + '--show-authored-values', + ], + ).trimEnd(); + const documentedTrustedLocal = extractFencedBlocks(tutorial).find( + (block) => + block.heading === 'Review the generated plan' && + block.language === 'text' && + block.content.startsWith('WARNING: trusted-local authored values follow.'), + ); + assert.ok(documentedTrustedLocal, 'trusted-local safety output block is missing'); + assertOutputContainsLines(trustedLocal, documentedTrustedLocal.content); + + const checkHelp = registryctl(['check', '--help']); + assert.match( + checkHelp, + /--show-authored-values[\s\S]*Show directly authored non-secret values for trusted-local terminal review/, + ); + } finally { + rmSync(directory, { recursive: true, force: true }); + } +}); + +test('Notary tutorial keeps no-match false bounded and renames broadened semantics', () => { + const tutorial = readFileSync( + new URL('../src/content/docs/tutorials/verify-claim-registry-api.mdx', import.meta.url), + 'utf8', + ); + const script = readFileSync(new URL('./check-registryctl-tutorials.sh', import.meta.url), 'utf8'); + + assert.match(tutorial, /active-registration-exists/); + assert.match( + tutorial, + /false` means no active matching record was found by this[\s\S]*selected registry source/, + ); + for (const broaderNegative of [ + 'global nonexistence', + 'identity fraud', + 'ineligibility', + 'legal negative', + ]) { + assert.match(tutorial, new RegExp(broaderNegative)); + } + assert.match(tutorial, /active-or-pending-registration-exists/); + for (const fixture of ['match.yaml', 'pending.yaml', 'no-match.yaml']) { + assert.match(script, new RegExp(`fixtures/${fixture.replace('.', '\\.')}`)); + } + assert.match(script, /pending-registration-request\.json/); +}); + +test('Notary tutorial does not pair the unreleased claim with v0.13.0 assets', () => { + const tutorial = readFileSync( + new URL('../src/content/docs/tutorials/verify-claim-registry-api.mdx', import.meta.url), + 'utf8', + ); + + assert.match(tutorial, /^status: draft$/m); + assert.match(tutorial, /Registry Stack Main checkout pinned to one exact commit/); + assert.match(tutorial, /git rev-parse HEAD/); + assert.match(tutorial, /manifest_source_ref/); + assert.match(tutorial, /tag_target/); + assert.match(tutorial, /v0\.13\.0 is incompatible with these instructions/); + assert.match( + tutorial, + /registryctl --version` reports a[\s\S]*does not establish source revision or artifact identity/, + ); + assert.doesNotMatch(tutorial, /Matching Registry Stack v0\.13\.0/); + assert.doesNotMatch(tutorial, /same Registry Stack `v0\.13\.0` release/); +}); + +test('current-source bootstrap stays executable and non-candidate', () => { + const bootstrap = readFileSync( + new URL('../src/content/docs/start/test-current-source-revision.mdx', import.meta.url), + 'utf8', + ); + const authoring = readFileSync( + new URL('../src/content/docs/tutorials/author-registry-project.mdx', import.meta.url), + 'utf8', + ); + const notary = readFileSync( + new URL('../src/content/docs/tutorials/verify-claim-registry-api.mdx', import.meta.url), + 'utf8', + ); + const reference = readFileSync( + new URL('../src/content/docs/reference/registryctl.mdx', import.meta.url), + 'utf8', + ); + + assert.match(bootstrap, /^status: current$/m); + assert.match(bootstrap, /^doc_type: how-to$/m); + assert.match(bootstrap, /git switch --detach "\$SOURCE_REF"/); + assert.match(bootstrap, /cargo build --locked -p registryctl/); + assert.match(bootstrap, /npm run test:tutorial:registryctl/); + assert.match(bootstrap, /npm run check:tutorial:registryctl/); + assert.match(bootstrap, /temporary source-test lock/); + assert.match(bootstrap, /generation-only image sentinels/); + assert.match(bootstrap, /does not retain or publish the[\s\S]*lock as a reusable artifact/); + assert.match(bootstrap, /\.manifest_source_ref == \$source_ref/); + assert.match(bootstrap, /\.tag_target == \$source_ref/); + assert.match(bootstrap, /export REGISTRYCTL_IMAGE_LOCK="\$LOCK_PATH"/); + assert.match( + bootstrap, + /not a release, release candidate, signed artifact set, production image, country[\s\S]*acceptance result, or interoperability result/, + ); + + for (const page of [authoring, notary, reference]) { + assert.match(page, /test-current-source-revision/); + } +}); diff --git a/docs/site/scripts/shell-fence-syntax.test.mjs b/docs/site/scripts/shell-fence-syntax.test.mjs new file mode 100644 index 000000000..7a4de29cb --- /dev/null +++ b/docs/site/scripts/shell-fence-syntax.test.mjs @@ -0,0 +1,54 @@ +import assert from 'node:assert/strict'; +import { readdirSync, readFileSync } from 'node:fs'; +import { resolve } from 'node:path'; +import { spawnSync } from 'node:child_process'; +import { test } from 'node:test'; + +const docsRoot = resolve(import.meta.dirname, '../src/content/docs'); +const releaseExerciseReadme = resolve(import.meta.dirname, '../../../release/exercises/README.md'); +const owningSourceDocs = [ + resolve(import.meta.dirname, '../../../crates/registry-relay/docs/ops.md'), + resolve(import.meta.dirname, '../../../products/manifest/docs/validate-and-render.md'), +]; + +function markdownFiles(directory) { + return readdirSync(directory, { withFileTypes: true }) + .flatMap((entry) => { + const path = resolve(directory, entry.name); + if (entry.isDirectory()) return markdownFiles(path); + return /\.(?:md|mdx)$/u.test(entry.name) ? [path] : []; + }) + .toSorted(); +} + +function shellFences(path) { + const markdown = readFileSync(path, 'utf8'); + return [...markdown.matchAll(/```(?:sh|bash)\n([\s\S]*?)```/gu)].map( + (match, index) => ({ + index: index + 1, + source: match[1], + }), + ); +} + +test('public documentation and release exercises contain POSIX-parseable shell fences', () => { + const files = [...new Set([...markdownFiles(docsRoot), ...owningSourceDocs, releaseExerciseReadme])]; + let checked = 0; + + for (const path of files) { + for (const fence of shellFences(path)) { + checked += 1; + const result = spawnSync('/bin/sh', ['-n'], { + input: fence.source, + encoding: 'utf8', + }); + assert.equal( + result.status, + 0, + `${path} shell fence ${fence.index} must parse with /bin/sh -n:\n${result.stderr}`, + ); + } + } + + assert.ok(checked > 100, 'the syntax gate must cover the maintained shell-example surface'); +}); diff --git a/docs/site/src/components/AuthoringConfigurationReference.astro b/docs/site/src/components/AuthoringConfigurationReference.astro new file mode 100644 index 000000000..b2267a112 --- /dev/null +++ b/docs/site/src/components/AuthoringConfigurationReference.astro @@ -0,0 +1,371 @@ +--- +import reference from '../data/generated/configuration-reference.json'; +import coverage from '../data/generated/configuration-reference-coverage.json'; + +const schemaOrder = ['project', 'environment', 'integration', 'fixture', 'entity', 'relay', 'notary']; +const schemaLabels: Record = { + project: 'Project configuration', + environment: 'Environment configuration', + integration: 'Integration configuration', + fixture: 'Fixture configuration', + entity: 'Entity configuration', + relay: 'Relay runtime configuration', + notary: 'Notary runtime configuration', +}; +const schemaFiles: Record = { + project: 'registry-stack.yaml', + environment: 'environments/*.yaml', + integration: 'integrations/*/integration.yaml', + fixture: 'integrations/*/fixtures/*.yaml', + entity: 'entities/*.yaml', + relay: 'registry-relay runtime configuration', + notary: 'registry-notary runtime configuration', +}; +type ReferenceField = (typeof reference.fields)[number] & { + address: (typeof reference.fields)[number]['address'] & { + key_path?: string; + }; + default: { + behavior: string; + schema_value?: unknown; + reviewed_behavior?: string; + }; + history_status: string; + introduced_in: string | null; + intent_profile?: string; + local_reference?: { + pointer: string; + }; +}; +const fields = reference.fields as ReferenceField[]; + +if ( + coverage.status !== 'complete' || + coverage.missing_intent.length !== 0 || + coverage.reviewed_intent_assignment_covered_count !== + coverage.reviewed_intent_assignment_required_count +) { + throw new Error('generated authoring reference has incomplete reviewed-intent coverage'); +} +if ( + reference.reference_baseline.generator_lifecycle !== 'unreleased' || + reference.reference_baseline.published_release !== null || + reference.reference_baseline.field_history_status !== 'not_verified' || + reference.reference_baseline.history_verification_method !== null || + reference.reference_baseline.compared_releases.length !== 0 +) { + throw new Error('generated authoring reference has unsupported release-history provenance'); +} +if ( + reference.coverage.path_count !== coverage.coverage.path_count || + fields.length !== coverage.coverage.path_count +) { + throw new Error('generated authoring reference and coverage report have drifted'); +} +if ( + fields.some( + (field) => + field.history_status !== 'not_verified' || + field.introduced_in !== null || + field.version_history.length !== 0 || + Object.hasOwn(field.default, 'source_version'), + ) +) { + throw new Error('generated authoring reference contains unverified release-history values'); +} + +const fieldsBySchema = Object.fromEntries( + schemaOrder.map((schema) => [ + schema, + fields.filter((field) => field.address.schema === schema), + ]), +); + +const words = (value: string) => value.replaceAll('_', ' '); +const list = (values: string[]) => values.map(words).join(', '); +const fieldType = (field: ReferenceField) => { + const types = field.field_type.schema_types; + if (types.length > 0) return types.join(' or '); + if (field.field_type.local_reference) return `reference to ${field.field_type.local_reference}`; + return field.field_type.composed ? 'composed schema' : 'schema-constrained value'; +}; +const defaultValue = (field: ReferenceField) => { + if (field.default.reviewed_behavior) return field.default.reviewed_behavior; + if (field.default.behavior !== 'schema_default') return words(field.default.behavior); + if (!Object.hasOwn(field.default, 'schema_value')) return 'schema default (value omitted)'; + return `schema default ${JSON.stringify(field.default.schema_value)}`; +}; +const address = (field: ReferenceField) => + (field.address.key_path !== undefined ? field.address.key_path : field.address.pointer) || + '(document root)'; +const base = import.meta.env.BASE_URL === '/' ? '' : import.meta.env.BASE_URL.replace(/\/$/, ''); +--- + +

+ Download the + + machine-readable configuration reference + + or its + + machine-readable coverage report + . +

+ +
+
+
+
Configuration schemas
+
{coverage.coverage.schema_count}
+
+
+
Documented paths
+
{coverage.coverage.path_count}
+
+
+
Reviewed intent assignments
+
+ {coverage.reviewed_intent_assignment_covered_count} of{' '} + {coverage.reviewed_intent_assignment_required_count} +
+
+
+
Distinct reviewed intents
+
{coverage.distinct_reviewed_intent_count}
+
+
+
Reused reviewed intents
+
+ {coverage.distinct_reviewed_intents_reused_count} texts across{' '} + {coverage.reviewed_intent_assignments_using_reused_intent_count} assignments +
+
+
+
Country workspace reads
+
None
+
+
+
+ +

+ Project, environment, integration, fixture, and entity sections describe human-authored country + files. Relay and Notary sections describe generated product runtime contracts. The reviewed intent + sidecars are documentation knowledge only and are not runtime configuration. +

+

+ Assignment coverage means that every documented path resolves to reviewed intent. It does not mean + that every path has unique prose. Reviewed profiles and structural taxonomy intentionally reuse + intent text across paths with the same operational meaning. +

+ +{ + schemaOrder.map((schema) => ( +
+

{schemaLabels[schema]}

+

+ Configuration surface: {schemaFiles[schema]}. This section contains{' '} + {fieldsBySchema[schema].length} documented schema paths. +

+
+ {fieldsBySchema[schema].map((field) => ( +
+ + {address(field)} + {field.purpose} + +
+
+
Path kind
+
{words(field.address.path_kind)}
+
+ { + field.address.key_path !== undefined && ( +
+
JSON Schema pointer
+
{field.address.pointer || '(document root)'}
+
+ ) + } +
+
Purpose source
+
{words(field.purpose_source)}
+
+ { + field.intent_profile && ( +
+
Reviewed intent profile
+
{field.intent_profile}
+
+ ) + } +
+
Scope
+
{field.scope}
+
+
+
Type
+
{fieldType(field)}
+
+
+
Requiredness
+
{words(field.requiredness)}
+
+
+
Null behavior
+
{words(field.null_behavior)}
+
+
+
Empty behavior
+
{words(field.empty_behavior)}
+
+
+
Default
+
{defaultValue(field)}
+
+
+
Environment behavior
+
{words(field.environment_behavior)}
+
+
+
Configuration state
+
{words(field.state)}
+
+
+
Sensitivity
+
{words(field.sensitivity)}
+
+
+
Owners
+
{words(field.semantic_owner)}; {words(field.human_owner)}
+
+
+
Products
+
{list(field.products)}
+
+
+
Validation stages
+
{list(field.validation_stages)}
+
+
+
Diagnostic
+
{field.diagnostic}
+
+
+
Availability
+
{words(field.availability)}
+
+
+
Stability
+
{words(field.stability)}
+
+
+
Release history
+
Not verified
+
+
+
Migration
+
{words(field.migration)}. {field.migration_note}
+
+
+
Example guidance
+
{field.example.guidance}
+
+
+
Consumers
+
{list(field.consumers)}
+
+
+
Generated artifacts
+
{list(field.generated_artifacts)}
+
+
+
Review classes
+
{list(field.review_classes)}
+
+ { + field.local_reference && ( +
+
Local schema reference
+
{field.local_reference.pointer}
+
+ ) + } +
+
+ ))} +
+
+ )) +} + + diff --git a/docs/site/src/components/DiagnosticReference.astro b/docs/site/src/components/DiagnosticReference.astro new file mode 100644 index 000000000..302850f6d --- /dev/null +++ b/docs/site/src/components/DiagnosticReference.astro @@ -0,0 +1,217 @@ +--- +import authoringReference from '../data/generated/diagnostics/authoring.json'; +import fixtureReference from '../data/generated/diagnostics/fixture.json'; +import operatorReference from '../data/generated/diagnostics/operator.json'; + +type Catalog = 'authoring' | 'fixture' | 'operator'; +type Entry = { + family: string; + code: string; + owner: string; + product: string; + phase: string; + safe_meaning: string; + rule: string; + safe_remediation: string; + field_address_pattern: string | null; + evidence_scope: string; + secret_sensitive_value_policy: string; + docs_anchor: string; + lifecycle: string; + introduced_in: string | null; + stability: string; + evidence_limitation: string; +}; +type Omission = { + family: string; + product: string; + reason: string; + evidence: string; + required_action: string; +}; +type Reference = { + schema_version: string; + entries: Entry[]; + omissions?: Omission[]; +}; + +const { catalog } = Astro.props as { catalog: Catalog }; +const references: Record = { + authoring: authoringReference, + fixture: fixtureReference, + operator: operatorReference, +}; +const reference = references[catalog]; +const base = import.meta.env.BASE_URL === '/' ? '' : import.meta.env.BASE_URL.replace(/\/$/, ''); +const words = (value: string) => value.replaceAll('_', ' '); +const anchorId = (entry: Entry) => entry.docs_anchor.split('#', 2)[1]; +const publicArtifact = `${base}/generated/diagnostics/${catalog}.v1.json`; +--- + +

+ This page is generated from product-owned static definitions. It does not inspect a project, + environment variables, secrets, runtime configuration, source responses, or country values. +

+ +
+
+
+
Catalog
+
{catalog}
+
+
+
Schema
+
{reference.schema_version}
+
+
+
Entries
+
{reference.entries.length}
+
+
+
Runtime value reads
+
None
+
+
+
+ +

+ Download the machine-readable {catalog} diagnostic catalog. + Entries are ordered by family, product, and code. An unreleased entry has no release attribution; + its introduced_in value remains null until a product owner records a + released lifecycle. +

+ +
+ { + reference.entries.map((entry) => ( +
+

{entry.code}

+

{entry.safe_meaning}

+
+
+
Family
+
{words(entry.family)}
+
+
+
Product and owner
+
{words(entry.product)}; {words(entry.owner)}
+
+
+
Phase
+
{words(entry.phase)}
+
+
+
Rule
+
{entry.rule}
+
+
+
Safe remediation
+
{entry.safe_remediation}
+
+
+
Evidence scope
+
{entry.evidence_scope}
+
+
+
Evidence limitation
+
{entry.evidence_limitation}
+
+
+
Value policy
+
{words(entry.secret_sensitive_value_policy)}
+
+
+
Lifecycle
+
+ {words(entry.lifecycle)} + {entry.introduced_in ? `, introduced in ${entry.introduced_in}` : ', not released'} +
+
+ { + entry.field_address_pattern && ( +
+
Static address pattern
+
{entry.field_address_pattern}
+
+ ) + } +
+
+ )) + } +
+ +{ + reference.omissions && reference.omissions.length > 0 && ( +
+

Explicit omissions

+

+ An omission remains until that product exports a complete closed catalog with all required + static metadata. It is not evidence that the omitted boundary has no failures. +

+ {reference.omissions.map((omission) => ( +
+

{words(omission.product)}: {words(omission.family)}

+

{omission.evidence}

+

Required action: {omission.required_action}

+
+ ))} +
+ ) +} + + diff --git a/docs/site/src/components/ProjectStarterSequence.astro b/docs/site/src/components/ProjectStarterSequence.astro index 0df2bf7ee..dc409ea0b 100644 --- a/docs/site/src/components/ProjectStarterSequence.astro +++ b/docs/site/src/components/ProjectStarterSequence.astro @@ -3,9 +3,10 @@ import starters from '../data/generated/project-starters.json'; interface Props { starter?: string; + adaptationStep?: string; } -const { starter } = Astro.props; +const { starter, adaptationStep } = Astro.props; const selected = starter ? starters.filter((item) => item.starter === starter) : starters; if (selected.length === 0) { throw new Error(`Unknown Registry Stack project starter: ${starter}`); @@ -20,6 +21,12 @@ if (selected.length === 0) { explain the redacted plan, and build the unsigned product inputs.

+{adaptationStep && ( +

+ Authoring pause: {adaptationStep} +

+)} + {selected.map((item) => (

{item.starter}: {item.label}

diff --git a/docs/site/src/components/StandardJourney.astro b/docs/site/src/components/StandardJourney.astro new file mode 100644 index 000000000..e41cd5222 --- /dev/null +++ b/docs/site/src/components/StandardJourney.astro @@ -0,0 +1,437 @@ +--- +import QuickstartMeta from './QuickstartMeta.astro'; +import journeys from '../data/generated/standard-journeys.json'; + +interface Props { + journeyId?: string; + index?: boolean; +} + +interface CommandStep { + id: string; + kind: 'command'; + label: string; + cwd: string; + argv: string[]; +} + +interface AnnotatedCommandStep { + id: string; + kind: 'alternative' | 'long_running' | 'readiness_gate'; + label: string; + cwd: string; + argv: string[]; + note: string; +} + +interface RuntimeInterfaceStep { + id: string; + kind: 'runtime_interface'; + label: string; + method: string; + url: string; + authentication: string; + output_path: string; + note: string; +} + +interface OperatorInterfaceStep { + id: string; + kind: 'operator_interface'; + label: string; + procedure: string; + inputs: string[]; + outputs: string[]; +} + +type JourneyStep = + | CommandStep + | AnnotatedCommandStep + | RuntimeInterfaceStep + | OperatorInterfaceStep; + +const { journeyId, index = false } = Astro.props; +const journey = journeyId + ? journeys.find((entry) => entry.id === journeyId) + : undefined; + +if (!index && !journey) { + throw new Error(`Unknown standard journey: ${journeyId ?? '(missing id)'}`); +} + +const artifactLabels: Record = { + authored: 'Authored', + environment_binding: 'Environment binding', + generated_signed: 'Generated and signed', + generated_unsigned: 'Generated and unsigned', + runtime_observed: 'Runtime-observed', + scaffolded_human_owned: 'Scaffolded, then human-owned', + synthetic_fixture: 'Synthetic fixture', +}; + +const ownerLabels: Record = { + country_author: 'Country or project author', + operator: 'Operator', + registry_notary: 'Registry Notary', + registry_relay: 'Registry Relay', + registryctl: 'Registryctl', +}; + +function artifactLabel(value: string) { + return artifactLabels[value] ?? value; +} + +function ownerLabel(value: string) { + return ownerLabels[value] ?? value; +} + +function renderCommand(argv: string[]) { + return argv.join(' '); +} + +const journeySteps = (journey?.steps ?? []) as JourneyStep[]; +const requiredSteps = + journeySteps.filter((step): step is CommandStep => step.kind === 'command'); +const alternativeSteps = + journeySteps.filter( + (step): step is AnnotatedCommandStep => step.kind === 'alternative', + ); +const longRunningSteps = + journeySteps.filter( + (step): step is AnnotatedCommandStep => step.kind === 'long_running', + ); +const readinessSteps = + journeySteps.filter( + (step): step is AnnotatedCommandStep => step.kind === 'readiness_gate', + ); +const interfaceSteps = + journeySteps.filter( + (step): step is OperatorInterfaceStep | RuntimeInterfaceStep => + step.kind === 'operator_interface' || step.kind === 'runtime_interface', + ); +--- + +{index ? ( +
    + {journeys.map((entry) => ( +
  1. +

    {entry.title}

    +

    {entry.description}

    +
    +
    Outcome
    +
    {entry.outcome}
    +
    Level
    +
    {entry.level}
    +
    Expected time
    +
    {entry.expected_time}
    +
    +
    2. + ))} +
+) : journey && ( + <> +

{journey.description}

+ + + +

+ Evidence availability: {journey.source_label}. + The generated journey is checked against the current source tree and does not claim a + released version or live-country evidence. +

+ +

{journey.section_headings[0]}

+ +

{journey.outcome}

+ +

Exact prerequisites

+ +
    + {journey.prerequisites.map((prerequisite) =>
  • {prerequisite}
    • )} +
+ +

{journey.section_headings[1]}

+ +

{journey.minimal_configuration.note}

+ {journey.configuration_files.map((file) => ( +
+

{file.destination}

+

+ Canonical source: {file.source}. + Public boundary: {file.public_boundary}. +

+ {file.content === null ? ( +

+ Registryctl emits this complete file from the linked template. Unresolved generation + tokens are intentionally not presented as an executable configuration. +

+ ) : ( + 
{file.content}
+ )} +
+ ))} + +

{journey.section_headings[2]}

+ + 
{journey.artifacts.map((artifact) =>
+      `${artifact.path} [${artifactLabel(artifact.classification)}; ${ownerLabel(artifact.owner)}]`,
+    ).join('\n')}
+ + + + + + + + + + + + + {journey.artifacts.map((artifact) => ( + + + + + + + + ))} + +
PathClassOwnerHuman editVersion control
{artifact.path}
{artifact.note}		{artifactLabel(artifact.classification)}{ownerLabel(artifact.owner)}{artifact.human_edit ? 'Allowed' : 'No'}{artifact.version_control ? 'Yes' : 'No'}
+ +

{journey.section_headings[3]}

+ +

+ Canonical fixture source: {journey.fixture.source} +

+ 
{journey.fixture_excerpt.content}
+ +

Expected trace

+ +
    + {journey.fixture.expected_trace.map((step) =>
  1. {step}
    2. )} +
+ +

{journey.section_headings[4]}

+ +

Proves

+ +
    + {journey.contract.proves.map((claim) =>
  • {claim}
    • )} +
+ +

Does not prove

+ +
    + {journey.contract.does_not_prove.map((limitation) =>
  • {limitation}
    • )} +
+ +

{journey.section_headings[5]}

+ +

+ Required noninteractive commands use argument arrays, fixed synthetic paths, and explicit + working directories. Long-running commands, optional alternatives, runtime interfaces, and + operator-owned signing or trust procedures remain separate. +

+ +

Required noninteractive sequence

+
    + {requiredSteps.map((step) => ( +
  1. + {step.label} +

    Working directory: {step.cwd}

    + 
    {renderCommand(step.argv)}
    +
    2. + ))} +
+ + {alternativeSteps.length > 0 && ( + <> +

Optional alternatives

+
    + {alternativeSteps.map((step) => ( +
  • + {step.label}: {step.note} +

    Working directory: {step.cwd}

    + 
    {renderCommand(step.argv)}
    +
    • + ))} +
+ + )} + + {readinessSteps.length > 0 && ( + <> +

Required readiness gates

+
    + {readinessSteps.map((step) => ( +
  • + {step.label}: {step.note} +

    Working directory: {step.cwd}

    + 
    {renderCommand(step.argv)}
    +
    • + ))} +
+ + )} + + {longRunningSteps.length > 0 && ( + <> +

Long-running runtime steps

+
    + {longRunningSteps.map((step) => ( +
  • + {step.label}: {step.note} +

    Working directory: {step.cwd}

    + 
    {renderCommand(step.argv)}
    +
    • + ))} +
+ + )} + + {interfaceSteps.length > 0 && ( + <> +

Runtime and operator interfaces

+
    + {interfaceSteps.map((step) => ( +
  • + {step.label} + {step.kind === 'runtime_interface' ? ( +
    +
    Request
    +
    {step.method} {step.url}
    +
    Authentication
    +
    {step.authentication}
    +
    Capture
    +
    {step.output_path}
    +
    Boundary
    +
    {step.note}
    +
    + ) : ( + <> +

    {step.procedure}

    +
    +
    Required operator inputs
    +
      {step.inputs.map((input) =>
    • {input}
      • )}
    +
    Expected outputs
    +
      {step.outputs.map((output) =>
    • {output}
      • )}
    +
    + + )} +
    • + ))} +
+ + )} + +

{journey.section_headings[6]}

+ +
    + {journey.review.map((step) =>
  1. {step}
    2. )} +
+ +

Canonical committed sources

+ +
    + {journey.canonical_sources.map((source) =>
  • {source}
    • )} +
+ +

Traceable evidence

+ + + + + + + + + + + + {Object.entries(journey.evidence).map(([dimension, evidence]) => ( + + + + + + + ))} + +
DimensionStatusSource and testWorkflow
{dimension}{evidence.status.replaceAll('_', ' ')} + {evidence.source_path}
+ {evidence.test_id}
+ {evidence.command} + 		+ {evidence.workflow}
+ {evidence.revision}, {evidence.lifecycle.replaceAll('_', ' ')} +
+ +

{journey.section_headings[7]}

+ + + + + + + + + + + {journey.gates.map((gate) => ( + + + + + + ))} + +
GateWhat it provesWhat it does not prove
{gate.name}{gate.proves}{gate.does_not_prove}
+ +

{journey.section_headings[8]}

+ +
+
Environment
+
{journey.production_delta.environment}
+
Secrets
+
{journey.production_delta.secrets}
+
Approval
+
{journey.production_delta.approval}
+
Signing
+
{journey.production_delta.signing}
+
Activation
+
{journey.production_delta.activation}
+
+ +

{journey.section_headings[9]}

+ + + + + + + + + + + {journey.troubleshooting.map((entry) => ( + + + + + + ))} + +
Stable codeMeaningSafe remediation
{entry.code}{entry.meaning}{entry.remediation}
+ +

+ Next advanced task: {journey.next_task.label}. +

+ +)} diff --git a/docs/site/src/content/docs/changelog.mdx b/docs/site/src/content/docs/changelog.mdx index 0049eaa7c..d3573a8aa 100644 --- a/docs/site/src/content/docs/changelog.mdx +++ b/docs/site/src/content/docs/changelog.mdx @@ -5,7 +5,7 @@ status: current owner: registry-docs source_repos: - registry-docs -last_reviewed: "2026-07-25" +last_reviewed: "2026-07-26" doc_type: reference locale: en standards_referenced: [] @@ -16,6 +16,27 @@ documents. Per-product release notes live in each product repository; the entries below link to the relevant product pages on this site rather than duplicating release notes. +## 2026-07-26 + +Unreleased current-source documentation updates: + +- Added task-oriented Start, Journeys, Configure, Verify, Generated artifacts, + Operate, Reference, and Specifications navigation. +- Added generated references for all five authored and both runtime + configuration domains, with fail-closed field-intent and ownership coverage. +- Added separate generated authoring, fixture, and operator diagnostic + references. +- Added seven common-structure journeys for spreadsheet, instance OpenAPI, + bounded HTTP, bounded multi-call Script, exact snapshot, registry-backed + Notary claim, and separate product-input lifecycle work. +- Added goal-oriented advanced operations for rotation, materialization, + reapproval, diagnosis, Script workers, backup, recovery, upgrade, migration, + and rollback. + +These pages describe the current source under test. They are not part of the +immutable v0.13.0 archive and do not claim candidate, hosted, country, +interoperability, or production evidence. + ## 2026-07-25 Documentation updates for the v0.13.0 beta-17 release: diff --git a/docs/site/src/content/docs/configure/index.mdx b/docs/site/src/content/docs/configure/index.mdx new file mode 100644 index 000000000..d8740acfa --- /dev/null +++ b/docs/site/src/content/docs/configure/index.mdx @@ -0,0 +1,52 @@ +--- +title: Configure +description: Configure Registry Stack projects, environments, integrations, fixtures, entities, Relay, and Notary. +status: current +owner: registry-docs +source_repos: + - registry-stack + - registry-relay + - registry-notary +last_reviewed: "2026-07-26" +doc_type: reference +locale: en +standards_referenced: [] +--- + +Configure human intent in project files, bind operator-owned deployment values in an environment, +then generate product inputs with `registryctl`. + +## Project configuration + +Start with [project authoring](../tutorials/author-registry-project/). +Use the [generated configuration reference](../reference/project-configuration/) for exact +field purpose, ownership, defaults, environment behavior, sensitivity, validation, and migration +metadata. + +The five authored file classes are: + +- `registry-stack.yaml` for the project graph and services +- `integrations/*/integration.yaml` for source contracts and bounded adaptation +- `integrations/*/fixtures/*.yaml` for offline synthetic interactions +- `entities/*.yaml` for materialized entity contracts +- `environments/*.yaml` for operator-owned trust, secrets, network, callers, state, and deployment + +## Adapt a source + +- [Configure API-key source authentication](../tutorials/configure-project-api-key-authentication/) +- [Configure a bounded script adapter](../tutorials/configure-project-script-adapter/) +- [Configure exact snapshot materialization](../tutorials/configure-project-snapshot-materialization/) +- [Configure a FHIR R4 integration](../tutorials/configure-project-fhir-r4/) + +## Product configuration + +Registry Relay owns protected source access and minimized records APIs. +Registry Notary owns claim evaluation, disclosure, issuance, and evidence provenance. +Use each product's configuration pages for runtime contracts after `registryctl build` produces +separate product inputs. + +## Next + +- [Verify authored configuration](../verify/) +- [Inspect generated artifacts](../generated-artifacts/) +- [registryctl CLI reference](../reference/registryctl/) diff --git a/docs/site/src/content/docs/generated-artifacts/index.mdx b/docs/site/src/content/docs/generated-artifacts/index.mdx new file mode 100644 index 000000000..ef57d74d8 --- /dev/null +++ b/docs/site/src/content/docs/generated-artifacts/index.mdx @@ -0,0 +1,52 @@ +--- +title: Generated artifacts +description: Review the generated Registry Stack artifacts without confusing author intent, product inputs, signed bundles, or runtime state. +status: current +owner: registry-docs +source_repos: + - registry-stack + - registry-relay + - registry-notary +last_reviewed: "2026-07-26" +doc_type: explanation +locale: en +standards_referenced: [] +--- + +Treat each generated artifact as a projection with one owner and lifecycle. +Do not edit generated files to change project intent. + +## Artifact classes + +- Editor schemas mirror the five authored contracts for completion and local syntax validation. +- Explanation and semantic-impact reports describe reviewed author intent without secret values. +- Fixture and preflight reports record offline evidence for their separate validation boundaries. +- The artifact manifest hashes every consumed authored input and every generated output. +- Relay and Notary build directories contain separate unsigned, non-deployable product inputs. +- Signed product Config Bundles bind one exact product input to approval, compatibility, and + anti-rollback evidence. +- Runtime configuration and state belong to the active Relay or Notary instance, not to project + authoring. + +`registryctl build` writes `.registry-stack/build/` and generates the artifact +manifest last. +The generated files carry do-not-edit and publication classifications. +An unsigned build tree is review material, not a production deployment artifact. + +## Generated references + +- [Configuration reference](../reference/project-configuration/) +- [Instance API references](../reference/apis/) +- [Contracts](../reference/contracts/) + +## Review boundary + +Compare authored intent with generated review artifacts before signing. +Verify a signed product bundle before promotion or activation. +Inspect runtime posture separately after activation. + +## Next + +- [Verify a project](../verify/) +- [Upgrade and roll back](../operate/upgrade-and-rollback/) +- [API stability and versioning](../reference/api-stability/) diff --git a/docs/site/src/content/docs/index.mdx b/docs/site/src/content/docs/index.mdx index d0cfe547d..5c0b2eb1c 100644 --- a/docs/site/src/content/docs/index.mdx +++ b/docs/site/src/content/docs/index.mdx @@ -17,8 +17,10 @@ Registry Stack adds registry-facing services, protected reads, records, over data an institution already holds. The data never leaves the source system. -Start with [your first registry API](tutorials/publish-spreadsheet-secured-registry-api/), then -[evaluate a claim](tutorials/verify-claim-registry-api/) against that local API. +Start with [your first registry API](journeys/spreadsheet-protected-api/), then +[inspect its instance OpenAPI](journeys/instance-openapi/) as the next maintained step. +Continue through the Journeys path to +[evaluate a claim](journeys/registry-backed-notary-claim/) against a local registry API. ## Two products @@ -31,7 +33,7 @@ Use the local tutorials below for the current first-run path. Registry Relay exposes protected, scoped, read-only APIs over existing sources: files, extracts, databases, and legacy registry systems. -[Your first registry API](tutorials/publish-spreadsheet-secured-registry-api/): run a protected +[Your first registry API](journeys/spreadsheet-protected-api/): run a protected API locally over a sample spreadsheet. ### Registry Notary @@ -39,7 +41,7 @@ API locally over a sample spreadsheet. Registry Notary certifies evidence: claim evaluation, credential issuance, disclosure policy, and audit provenance. -[Your first claim check](tutorials/verify-claim-registry-api/): evaluate a claim and compare the +[Your first claim check](journeys/registry-backed-notary-claim/): evaluate a claim and compare the result with a protected row read. ## Security diff --git a/docs/site/src/content/docs/journeys/bounded-http.mdx b/docs/site/src/content/docs/journeys/bounded-http.mdx new file mode 100644 index 000000000..fbd1be093 --- /dev/null +++ b/docs/site/src/content/docs/journeys/bounded-http.mdx @@ -0,0 +1,18 @@ +--- +title: Author one bounded HTTP integration +description: Start from the maintained HTTP starter, execute its synthetic fixture, and build separate unsigned Relay and Notary product inputs. +status: current +owner: registry-docs +source_repos: + - registry-stack + - registry-relay + - registry-notary +last_reviewed: "2026-07-26" +doc_type: tutorial +locale: en +standards_referenced: [] +--- + +import StandardJourney from '../../../components/StandardJourney.astro'; + + diff --git a/docs/site/src/content/docs/journeys/bounded-multi-call-script.mdx b/docs/site/src/content/docs/journeys/bounded-multi-call-script.mdx new file mode 100644 index 000000000..895366c3d --- /dev/null +++ b/docs/site/src/content/docs/journeys/bounded-multi-call-script.mdx @@ -0,0 +1,19 @@ +--- +title: Adapt a bounded multi-call source +description: Use the maintained FHIR R4 golden workspace to review a bounded multi-call script, its closed helper surface, and its synthetic trace. +status: current +owner: registry-docs +source_repos: + - registry-stack + - registry-relay + - registry-notary +last_reviewed: "2026-07-26" +doc_type: tutorial +locale: en +standards_referenced: + - fhir-r4 +--- + +import StandardJourney from '../../../components/StandardJourney.astro'; + + diff --git a/docs/site/src/content/docs/journeys/exact-snapshot.mdx b/docs/site/src/content/docs/journeys/exact-snapshot.mdx new file mode 100644 index 000000000..03af40bf3 --- /dev/null +++ b/docs/site/src/content/docs/journeys/exact-snapshot.mdx @@ -0,0 +1,18 @@ +--- +title: Configure an exact snapshot lookup +description: Review an immutable local materialization, its unique-key exact selector, and fixtures that distinguish match from no match. +status: current +owner: registry-docs +source_repos: + - registry-stack + - registry-relay + - registry-notary +last_reviewed: "2026-07-26" +doc_type: tutorial +locale: en +standards_referenced: [] +--- + +import StandardJourney from '../../../components/StandardJourney.astro'; + + diff --git a/docs/site/src/content/docs/journeys/index.mdx b/docs/site/src/content/docs/journeys/index.mdx new file mode 100644 index 000000000..6fa772611 --- /dev/null +++ b/docs/site/src/content/docs/journeys/index.mdx @@ -0,0 +1,20 @@ +--- +title: Standard journeys +description: Seven generated, source-checked journeys from a first protected result through separately verified product bundles and their activation handoff. +status: current +owner: registry-docs +source_repos: + - registry-stack +last_reviewed: "2026-07-26" +doc_type: reference +locale: en +standards_referenced: [] +--- + +import StandardJourney from '../../../components/StandardJourney.astro'; + +Choose a journey by the source contract or result you need. +Every journey uses the same ten-section contract, names artifact ownership, derives configuration +from a canonical source, and separates offline evidence from runtime and country acceptance. + + diff --git a/docs/site/src/content/docs/journeys/instance-openapi.mdx b/docs/site/src/content/docs/journeys/instance-openapi.mdx new file mode 100644 index 000000000..c1e797e79 --- /dev/null +++ b/docs/site/src/content/docs/journeys/instance-openapi.mdx @@ -0,0 +1,18 @@ +--- +title: Inspect an instance OpenAPI contract +description: Capture the OpenAPI document from an explicitly public disposable local Relay instance and compare it with the source-under-test contract. +status: current +owner: registry-docs +source_repos: + - registry-stack + - registry-relay +last_reviewed: "2026-07-26" +doc_type: tutorial +locale: en +standards_referenced: + - openapi +--- + +import StandardJourney from '../../../components/StandardJourney.astro'; + + diff --git a/docs/site/src/content/docs/journeys/product-input-lifecycle.mdx b/docs/site/src/content/docs/journeys/product-input-lifecycle.mdx new file mode 100644 index 000000000..65c670c0f --- /dev/null +++ b/docs/site/src/content/docs/journeys/product-input-lifecycle.mdx @@ -0,0 +1,18 @@ +--- +title: Govern product inputs through activation handoff +description: Carry one maintained combined project through deterministic build, separate product signing, verification, and separately owned activation handoffs. +status: current +owner: registry-docs +source_repos: + - registry-stack + - registry-relay + - registry-notary +last_reviewed: "2026-07-26" +doc_type: tutorial +locale: en +standards_referenced: [] +--- + +import StandardJourney from '../../../components/StandardJourney.astro'; + + diff --git a/docs/site/src/content/docs/journeys/registry-backed-notary-claim.mdx b/docs/site/src/content/docs/journeys/registry-backed-notary-claim.mdx new file mode 100644 index 000000000..bdd5ac02c --- /dev/null +++ b/docs/site/src/content/docs/journeys/registry-backed-notary-claim.mdx @@ -0,0 +1,18 @@ +--- +title: Evaluate a registry-backed Notary claim +description: Add the maintained Notary project to the synthetic spreadsheet scaffold and verify the bounded active-registration-exists predicate. +status: current +owner: registry-docs +source_repos: + - registry-stack + - registry-relay + - registry-notary +last_reviewed: "2026-07-26" +doc_type: tutorial +locale: en +standards_referenced: [] +--- + +import StandardJourney from '../../../components/StandardJourney.astro'; + + diff --git a/docs/site/src/content/docs/journeys/spreadsheet-protected-api.mdx b/docs/site/src/content/docs/journeys/spreadsheet-protected-api.mdx new file mode 100644 index 000000000..9bf781b1d --- /dev/null +++ b/docs/site/src/content/docs/journeys/spreadsheet-protected-api.mdx @@ -0,0 +1,17 @@ +--- +title: Publish a spreadsheet through a protected API +description: Generate the maintained local spreadsheet scaffold, verify its protected Relay surface, and identify which files become human-owned after generation. +status: current +owner: registry-docs +source_repos: + - registry-stack + - registry-relay +last_reviewed: "2026-07-26" +doc_type: tutorial +locale: en +standards_referenced: [] +--- + +import StandardJourney from '../../../components/StandardJourney.astro'; + + diff --git a/docs/site/src/content/docs/operate/advanced/compare-and-reapprove-source-change.mdx b/docs/site/src/content/docs/operate/advanced/compare-and-reapprove-source-change.mdx new file mode 100644 index 000000000..8643a8418 --- /dev/null +++ b/docs/site/src/content/docs/operate/advanced/compare-and-reapprove-source-change.mdx @@ -0,0 +1,185 @@ +--- +title: Compare a baseline and reapprove a source change +description: Compare a verified product baseline, change source protocol evidence without widening authority, and produce separately approved product inputs. +status: current +owner: registry-docs +source_repos: + - registry-stack + - registry-relay + - registry-notary +last_reviewed: "2026-07-26" +doc_type: how-to +locale: en +standards_referenced: [] +--- + +Use this procedure when a source changes product version, protocol profile, request shape, response +shape, or adapter logic and the deployment needs a reviewable comparison with its approved +product baseline. + +## Prerequisites + +- Keep the current authored project unchanged as the review baseline. +- Obtain the verified signed Relay baseline and its product trust anchor. +- Obtain the separate Notary baseline and anchor when the project includes Notary. +- Define the source-owner evidence required to move a version label from `unverified` to `tested`. +- Use synthetic fixtures until separate authority permits a live compatibility check. + +## Ownership and trust boundary + +The integration declares product-neutral inputs, one `http`, `script`, or `snapshot` capability, +source authority, outputs, and limits. +`source.product` and `source.versions` record interoperability evidence. +They do not select a runtime executor, enable a protocol helper, or grant source authority. + +The environment binds the source origin, credential reference, private trust, rate, concurrency, +and timeout without widening the integration. +Registry Relay owns source access and adaptation. +Registry Notary owns service policy, claim evaluation, disclosure, and issuance. + +{/* Evidence: docs/site/src/content/docs/tutorials/author-registry-project.mdx, + crates/registryctl/src/project_authoring/project.rs, and + crates/registryctl/tests/project_authoring.rs. */} + +## Establish the verified baseline + +Run the unchanged project against the signed baseline before editing: + +```sh +registryctl check \ + --project-dir \ + --environment \ + --against \ + --anchor \ + --explain \ + --format json +``` + +For a combined project, use product-specific baseline pairs with `promote`. +Do not substitute one product bundle for a project-root baseline. + +```sh +registryctl promote \ + --project-dir \ + --environment \ + --relay-against \ + --relay-anchor \ + --notary-against \ + --notary-anchor \ + --format json +``` + +The report is an offline promotion decision. +The command does not sign, activate, deploy, contact a source, or mutate either environment. + +## Make the narrow source change + +1. Update the source product or version label only when the transport contract is unchanged. + Keep the new version `unverified` until the required evidence exists. +2. When transport behavior changes, edit only the required method, path, query, headers, body, + response mapping, Script branch, or protocol profile. +3. Keep the origin, credentials, private CA, and deployment controls in the environment. +4. Do not add a wider wildcard, another origin, another credential, another HTTP method, more + outputs, a larger call or byte budget, or a longer deadline unless the review explicitly + approves that authority. +5. Update every affected fixture interaction and expected outcome. + Preserve match, no-match, ambiguity, subject mismatch, source rejection, and minimized-output + evidence that applies to the integration. + +The [project configuration reference](../../../reference/project-configuration/) identifies field +ownership, sensitivity, environment behavior, validation, and migration intent. +Use the [bounded Script guide](../../../tutorials/configure-project-script-adapter/) when the +change requires reviewed orchestration. + +## Compare and reapprove + +Run the complete offline gates: + +```sh +PROJECT_DIR=registry-project +ENVIRONMENT=staging +RELAY_BASELINE=operator-inputs/reviewed-relay-bundle +RELAY_TRUST_ANCHOR=operator-inputs/relay-trust-anchor.json +registryctl test --project-dir "$PROJECT_DIR" +registryctl check \ + --project-dir "$PROJECT_DIR" \ + --environment "$ENVIRONMENT" \ + --against "$RELAY_BASELINE" \ + --anchor "$RELAY_TRUST_ANCHOR" \ + --explain \ + --format json +registryctl preflight \ + --project-dir "$PROJECT_DIR" \ + --environment "$ENVIRONMENT" \ + --format json +``` + +Review the semantic change dimensions, effective source authority, canonical requests, output and +claim changes, disclosure changes, service policy, operator-security changes, and generated +artifact manifest. +For a combined project, run the four-argument product-pair `promote` comparison again. + +Build against the same verified baseline: + +```sh +registryctl build \ + --project-dir \ + --environment \ + --against \ + --anchor \ + --format json +``` + +The build produces unsigned review material. +Sign and verify each generated product input independently after the authorized reviewer approves +the report. +Stage Relay first and Notary second, then admit traffic only after both product checks pass. + +## Expected evidence + +Retain: + +- The baseline verification result and exact product identities. +- Fixture traces for each changed request, response, branch, output, and claim. +- The redacted semantic comparison and promotion report. +- The preflight report showing required bindings without secret values. +- Separate verified Relay and Notary bundle reports when both products changed. +- Source-owner compatibility evidence with scope, version, date, and limitations. + +## What this proves + +Fixture tests prove deterministic behavior against synthetic observations. +Baseline comparison proves the classified authored and generated delta against verified signed +approval state. +Preflight proves offline binding availability and non-widening. +Product verification proves each signed bundle boundary. + +These gates do not prove live source interoperability, source-owner acceptance, legal approval, +production readiness, or atomic activation. +A version label alone proves none of those properties. + +## Roll back or recover + +Before signing, discard the candidate and restore the unchanged authored project. +Before traffic admission, restore the prior product recovery set. +After a higher product sequence is accepted, create a reviewed higher-sequence recovery bundle +instead of deleting anti-rollback state. + +If only Relay changes, keep Notary traffic blocked until Notary validates the exact new Relay +consultation contract. +If the source contract cannot remain narrow, split the change into a separately reviewed +integration or a separate registry trust domain. + +## Escalate + +Escalate to the source owner and security reviewer when the change adds an origin, write-like +operation, wildcard authority, output, credential, private trust root, call, byte, or deadline +budget. +Escalate to the product owners when the change alters both Relay and Notary semantics or requires +a source capability that current closed contracts do not support. + +## Next + +- [Rotate credentials and trust](../rotate-credentials-and-trust/) +- [Operate bounded Script workers](../operate-script-workers/) +- [Use the registryctl CLI reference](../../../reference/registryctl/) diff --git a/docs/site/src/content/docs/operate/advanced/index.mdx b/docs/site/src/content/docs/operate/advanced/index.mdx new file mode 100644 index 000000000..a6a5e4a2f --- /dev/null +++ b/docs/site/src/content/docs/operate/advanced/index.mdx @@ -0,0 +1,48 @@ +--- +title: Advanced operations +description: Recoverable operator journeys for configuration, trust, materialization, runtime inspection, diagnostics, and bounded Script sources. +status: current +owner: registry-docs +source_repos: + - registry-stack + - registry-relay + - registry-notary + - registry-platform +last_reviewed: "2026-07-26" +doc_type: reference +locale: en +standards_referenced: [] +--- + +Use these task guides after the project fixtures, environment preflight, generated inputs, and +product activation boundaries are familiar. +Each guide names the evidence to retain, the limit of each gate, and a recovery path. + +## Configuration and trust + +- [Rotate credentials, keys, certificates, and trust](rotate-credentials-and-trust/) +- [Compare a baseline and reapprove a source change](compare-and-reapprove-source-change/) + +## State and runtime + +- [Refresh and recover a materialization](refresh-and-recover-materialization/) +- [Recover, restart, upgrade, migrate, and roll back](recover-upgrade-migrate-and-rollback/) +- [Inspect and diagnose a running deployment](inspect-and-diagnose/) + +## Source adaptation + +- [Operate bounded Script workers and protocol helpers](operate-script-workers/) + +Registry Relay and Registry Notary activate separate product bundles. +Stage Relay first, stage Notary against that Relay, and admit traffic only after both product +boundaries pass. +This sequence is compatible staged admission, not atomic project activation. + +{/* Evidence: products/notary/docs/configuration-trust-and-integrity.md and + products/notary/docs/deployment-hardening-runbook.md. */} + +## Next + +- [Verify the project](../../verify/) +- [Review generated artifacts](../../generated-artifacts/) +- [Use the operator diagnostic reference](../../reference/diagnostics/operator/) diff --git a/docs/site/src/content/docs/operate/advanced/inspect-and-diagnose.mdx b/docs/site/src/content/docs/operate/advanced/inspect-and-diagnose.mdx new file mode 100644 index 000000000..5cedc519f --- /dev/null +++ b/docs/site/src/content/docs/operate/advanced/inspect-and-diagnose.mdx @@ -0,0 +1,216 @@ +--- +title: Inspect and diagnose a running deployment +description: Inspect redacted runtime posture, audit, health, readiness, and instance OpenAPI, then classify failures with stable diagnostics. +status: current +owner: registry-docs +source_repos: + - registry-stack + - registry-relay + - registry-notary + - registry-platform +last_reviewed: "2026-07-26" +doc_type: how-to +locale: en +standards_referenced: [] +--- + +Use this procedure to inspect a running Relay or Notary instance and diagnose source denial, +policy denial, ambiguity, stale materialization, bundle rejection, or product capability mismatch +without collecting source rows or secret values. + +## Prerequisites + +- Use the protected operator network and a least-privilege posture or API credential. +- Know the active product, environment, stream, instance, and expected bundle sequence. +- Keep public problem responses, operator diagnostics, restricted posture, and protected audit + records in separate access classes. +- Reproduce with synthetic identifiers unless separate authority permits another probe. + +## Ownership and trust boundary + +Public problem details give callers stable, minimized classifications. +The default posture tier is redacted for operational sharing. +Restricted posture can contain per-resource or provider detail and belongs only to trusted +operators. +Relay and Notary write separate audit chains and keep their keys separate. + +The generated diagnostic catalogs contain static meanings, rules, remediation, evidence scope, +and limitations. +They never need a project, environment, secret, runtime service, received configuration, path, +hash, credential, source response, or country value. + +{/* Evidence: docs/site/src/content/docs/reference/diagnostics/operator.mdx, + docs/site/src/content/docs/reference/errors.mdx, + crates/registry-relay/docs/ops.md, and + products/notary/docs/security-assurance.md. */} + +## Inspect the runtime surfaces + +Inspect each surface for its own purpose: + +| Surface | Use | Boundary | +| --- | --- | --- | +| `GET /healthz` | Process liveness | Does not check all dependencies or data freshness | +| `GET /ready` | Current traffic-admission readiness | Does not prove backup freshness or country approval | +| `GET /admin/v1/posture` | Redacted deployment and control observations | Default and restricted tiers expose different detail | +| Product audit sink | Security and request evidence | Retained chain integrity does not prove complete off-host receipt | +| `GET /openapi.json` | Concrete API shape for the running instance | Access is product configuration and authentication dependent | + +Query health and readiness through the same network path used by traffic admission: + +```sh +curl -fsS https:///healthz +curl -fsS https:///ready +curl -fsS https:///healthz +curl -fsS https:///ready +``` + +Read Relay posture only through its protected admin listener: + +```sh +curl -fsS \ + -H "Authorization: Bearer " \ + http://127.0.0.1:8081/admin/v1/posture +``` + +Fetch the concrete Relay or Notary instance OpenAPI only through its configured authenticated +route. +Compare the instance document with the reviewed generated input and the +[Relay API reference](../../../reference/apis/registry-relay/) or +[Notary API reference](../../../reference/apis/registry-notary/). +An OpenAPI match does not prove authorization, source behavior, or claim semantics. + +## Load the stable diagnostic catalogs + +Print the catalogs without opening a project or contacting a runtime: + +```sh +registryctl project diagnostics --catalog operator --format json +registryctl project diagnostics --catalog fixture --format json +registryctl project diagnostics --catalog authoring --format json +``` + +Use the generated [operator](../../../reference/diagnostics/operator/), +[fixture](../../../reference/diagnostics/fixture/), and +[authoring](../../../reference/diagnostics/authoring/) references for the same code definitions. +Branch on the exact code and response status. +Do not parse error prose, paths, or type URI segments. + +## Diagnose the failure class + +### Source denial or source failure + +Separate caller authorization from upstream source access. +Public `auth.*` codes describe Relay caller authentication and scope. +`relay.consultation.activation.source_credentials_unavailable` and +`notary.relay.credential_unavailable` describe activation boundaries. +`notary.relay.credentials_rejected` describes a rejected Notary workload credential. +Offline fixture failures such as `source.status_rejected`, `source.unavailable`, and +`authorization.denied` classify synthetic source behavior. + +Confirm which boundary denied access before changing a credential or policy. +Do not widen a source path or caller scope to clear a source credential failure. + +### Policy denial + +Stable `pdp.*` codes identify policy decisions such as `pdp.purpose_not_permitted`, +`pdp.assurance_insufficient`, and `pdp.evidence_stale`. +Use the policy id, hash, checked rule ids, and other redacted audit evidence available to the +authorized operator. +Do not turn a policy denial into source unavailability or bypass the rule during diagnosis. + +### Ambiguity + +`ambiguous` is a valid minimized consultation outcome, not an operator startup failure. +The result carries no selected output map, and Notary must not choose a source record. +Reproduce the selector and cardinality with synthetic fixtures. +Use `source.cardinality_violation` only when the source behavior violates the declared fixture or +decoder contract. + +### Stale materialization + +Check restricted `relay.refresh_health`, the last successful load, consecutive failures, and +`serving_last_good`. +`pdp.evidence_stale` is a policy decision. +`schema.resource_unavailable` is a serving failure. +A last-good table can remain ready while the acquisition path is unhealthy, so readiness alone +cannot close this diagnosis. + +### Bundle rejection + +Use the shared stable results `rejected_signature`, `rejected_binding`, +`rejected_validation`, and `rejected_rollback`. +Product startup codes include: + +- `relay.startup.bundle_signature_rejected` +- `relay.startup.bundle_binding_rejected` +- `relay.startup.bundle_validation_rejected` +- `relay.startup.bundle_rollback_rejected` +- `notary.configuration.invalid` +- `notary.runtime.activation_failed` + +Correct the signer, binding, closed file set, product validation, or sequence. +Do not disclose the rejected configuration or delete anti-rollback state. + +### Capability or Relay-to-Notary mismatch + +Use `relay.consultation.activation.unsupported_plan`, +`relay.consultation.activation.artifact_registry_invalid`, +`notary.relay.profile_not_found`, and `notary.relay.profile_mismatch` for activation failures. +The public admin code `registry.admin.capability.not_supported` means the requested admin +capability is absent. + +Compare the generated capability inventory, public consultation contract, and exact +`contract_hash`. +Relay rejects an execute-time contract mismatch before source access. +Stage compatible product bundles separately and repeat the Notary-to-Relay check. + +## Expected evidence + +Retain: + +- Timestamped health and readiness status without response secrets. +- Default redacted posture and restricted fields only in the protected operator record. +- Stable public, operator, fixture, or authoring diagnostic codes. +- Product, environment, stream, instance, and bundle sequence. +- Redacted audit correlation ids and the tested synthetic canary outcome. +- The traffic-admission, quarantine, or escalation decision. + +## What this proves + +The diagnostic code identifies a stable product-owned failure class and safe remediation. +Posture reports the controls and observations available to the running product. +Audit records prove the retained product event chain under the configured sink and keys. +The instance OpenAPI proves the exposed API description returned by that instance. + +These surfaces do not prove off-host audit completeness, legal approval, country acceptance, +source-domain correctness, backup freshness, or an untested client journey. + +## Roll back or recover + +Keep traffic blocked while a startup, bundle, capability, or cross-product contract failure +remains. +Restore the last verified product recovery set before traffic when recovery does not violate +anti-rollback or state compatibility. +After a higher sequence or new correctness-state write, use a reviewed higher-sequence fix-forward +path unless the release documents safe rollback. + +For ambiguity, fix or narrow the reviewed selector or source data. +Do not select a record manually inside Relay or Notary. +For stale materialization, follow the materialization recovery procedure without enabling live +fallback. + +## Escalate + +Escalate to security when diagnostics or logs expose secret, source, path, hash, identity, or +country values. +Escalate to the source owner for unexplained denials, ambiguity, or freshness. +Escalate to both product owners for contract or capability mismatch. +Escalate to release operations for a rejection that cannot be resolved without changing +anti-rollback state or runtime schemas. + +## Next + +- [Refresh and recover a materialization](../refresh-and-recover-materialization/) +- [Recover, upgrade, migrate, and roll back](../recover-upgrade-migrate-and-rollback/) +- [Review the error and status code reference](../../../reference/errors/) diff --git a/docs/site/src/content/docs/operate/advanced/operate-script-workers.mdx b/docs/site/src/content/docs/operate/advanced/operate-script-workers.mdx new file mode 100644 index 000000000..8d17715ef --- /dev/null +++ b/docs/site/src/content/docs/operate/advanced/operate-script-workers.mdx @@ -0,0 +1,167 @@ +--- +title: Operate bounded Script workers and protocol helpers +description: Review, verify, stage, and recover Registry Relay Script workers and versioned protocol helpers without adding ambient authority. +status: current +owner: registry-docs +source_repos: + - registry-stack + - registry-relay +last_reviewed: "2026-07-26" +doc_type: how-to +locale: en +standards_referenced: [] +--- + +Use this procedure when a Registry Relay integration needs bounded branching, pagination, +normalization, or a versioned protocol helper that one declarative HTTP request cannot express. + +## Prerequisites + +- Start from a passing integration with synthetic request-aware fixtures. +- Document why one fixed `http` request cannot express the source journey. +- Identify every method, path, header, response header, call, byte, and deadline requirement. +- Keep a verified Relay baseline and a staged no-traffic environment. + +## Ownership and trust boundary + +The authored integration selects the product-neutral `script` capability and declares source +authority. +Registry Relay owns the code-built worker executable, isolation, host API, request authorization, +credential resolution, dispatch permits, response bounds, and result validation. +The worker cannot access the network, filesystem, environment, subprocesses, clock, random source, +credentials, or production logs. + +Protocol helpers add closed parsing or verified exchange behavior. +They do not add an origin, credential, method, path, or output. +Source product and version labels remain review evidence and do not enable a helper. + +{/* Evidence: docs/site/src/content/docs/tutorials/configure-project-script-adapter.mdx, + docs/site/src/content/docs/tutorials/configure-project-fhir-r4.mdx, + crates/registry-relay/src/rhai_worker.rs, and + crates/registryctl/src/project_authoring/authoring_contract.rs. */} + +## Review the bounded contract + +1. Keep source methods and path patterns as narrow as the real read journey permits. +2. Keep source credentials and origin in the private environment binding. +3. Set only limits demonstrated by fixtures. + Deployment settings may narrow the integration but cannot widen it. +4. Return only the complete declared output map with exact types and nullability. +5. Preserve `match`, `no_match`, `ambiguous`, subject mismatch, source rejection, and null as + distinct outcomes. +6. Put larger adapters into explicitly ordered local Rhai modules. + Module paths and bytes remain hash-covered and cannot load another file at runtime. + +The [Script source adapter guide](../../../tutorials/configure-project-script-adapter/) defines the +host API, defaults, hard ceilings, modules, and fixture shape. + +## Use code-owned helpers + +Print the exact generated `xw.v1` callable reference from the installed CLI: + +```sh +registryctl authoring xw --format reference +``` + +`xw.v1` provides deterministic bounded text, date, identifier, JSON, email, and redaction helpers. +Date helpers require an explicit reference date. +The helper catalog excludes filesystem, clock, random, network, logging, regex, and ambient +package functions. + +Use `protocol.fhir.parse_searchset` only for the reviewed FHIR R4 search-set journey. +The helper validates the Bundle type, resource type, match and included collections, outcome +entries, and next-link shape before the Script uses the result. +Every followed link still passes same-origin, path, method, call, byte, and deadline checks. + +Use `protocol.dci.search` only when the authored `source.protocol.signed_dci` profile enables the +closed helper. +The profile permits one high-level Script call and binds the signed exchange, verification +destination, selector mappings, and minimized response pointers. +A generic Script source POST cannot substitute for that helper. + +## Verify and stage the worker + +Run the focused trace, complete fixture set, semantic explanation, preflight, and capability +inventory: + +```sh +PROJECT_DIR=registry-project +ENVIRONMENT=local +INTEGRATION_ID=person-record +FIXTURE_ID=active-person +registryctl test \ + --project-dir "$PROJECT_DIR" \ + --integration "$INTEGRATION_ID" \ + --fixture "$FIXTURE_ID" \ + --trace +registryctl test --project-dir "$PROJECT_DIR" +registryctl check \ + --project-dir "$PROJECT_DIR" \ + --environment "$ENVIRONMENT" \ + --explain +registryctl preflight \ + --project-dir "$PROJECT_DIR" \ + --environment "$ENVIRONMENT" \ + --format json +registryctl capabilities \ + --project-dir "$PROJECT_DIR" \ + --environment "$ENVIRONMENT" \ + --format json +``` + +Confirm fixture traces contain only reviewed canonical requests in the expected order. +Confirm generated artifacts hash every Script entrypoint and module. +Confirm the capability inventory distinguishes compiled, declared, enabled, used, available, +missing, and inactive without claiming activation. + +Build and verify the Relay product bundle, then stage Relay without traffic. +Require the code-owned worker, health, readiness, audit, and redacted posture to pass before a +bounded canary. + +## Expected evidence + +Retain: + +- The rationale for `script` rather than `http`. +- The source allow rules and effective cumulative limits. +- Synthetic traces for every meaningful branch and request order. +- Derived authorization-before-source, malformed-response, timeout, byte, call, and output + minimization results. +- Script and module hashes in the generated artifact closure. +- The capability inventory and staged worker readiness. +- An authorized bounded canary when separate source authority permits one. + +## What this proves + +Offline fixtures prove deterministic Script and helper behavior against synthetic observations. +The generated closure proves which reviewed Script and module bytes enter the Relay input. +Preflight proves required local bindings and non-widening without source contact. +Staged readiness proves that the code-owned worker is available to that Relay process. + +These checks do not prove live source interoperability, source-owner approval, every production +response shape, legal suitability, or country acceptance. +A product or version label does not prove helper compatibility. + +## Roll back or recover + +Before traffic, restore the prior verified Relay bundle and matching worker artifact. +After accepting a higher sequence, create a higher-sequence recovery bundle instead of deleting +anti-rollback state. +Keep Notary traffic blocked until the restored Relay contract matches Notary. + +If the worker is unavailable, repair the code-owned adjacent worker and process isolation. +Do not configure an in-process fallback or grant the Script ambient network, filesystem, +environment, credential, or logging access. + +## Escalate + +Escalate to the Relay product owner when the source requires cross-origin calls, writes, unbounded +pagination, dynamic code loading, another helper, or limits above the closed ceilings. +Escalate to security when a Script or fixture can select credentials, expose raw source values, +bypass authorization-before-source, or reach an ambient host capability. + +## Next + +- [Compare and reapprove a source change](../compare-and-reapprove-source-change/) +- [Inspect and diagnose the deployment](../inspect-and-diagnose/) +- [Configure a FHIR R4 integration](../../../tutorials/configure-project-fhir-r4/) diff --git a/docs/site/src/content/docs/operate/advanced/recover-upgrade-migrate-and-rollback.mdx b/docs/site/src/content/docs/operate/advanced/recover-upgrade-migrate-and-rollback.mdx new file mode 100644 index 000000000..3f9823d33 --- /dev/null +++ b/docs/site/src/content/docs/operate/advanced/recover-upgrade-migrate-and-rollback.mdx @@ -0,0 +1,173 @@ +--- +title: Recover, restart, upgrade, migrate, and roll back +description: Choose the correct recovery path for configuration restart, project migration, product state, software upgrade, and rollback. +status: current +owner: registry-docs +source_repos: + - registry-stack + - registry-relay + - registry-notary +last_reviewed: "2026-07-26" +doc_type: how-to +locale: en +standards_referenced: [] +--- + +Use this decision procedure before restarting a product, migrating authored configuration or +durable state, restoring a backup, upgrading software, or rolling back a failed change. +The detailed backup, database, and release runbooks remain authoritative. + +## Prerequisites + +- Pin the current and target software by release or image digest. +- Preserve the complete current recovery set before a stateful change. +- Know whether Relay consultation PostgreSQL state and Notary PostgreSQL state are enabled. +- Keep traffic blocked while a target process or restored database is being attested. +- Read every intervening release note and migration instruction in order. + +## Ownership and trust boundary + +Relay owns its cache, consultation schemas, serving fence, materialization publication history, +audit chain, and product configuration state. +Notary owns its correctness schemas, signing providers, status and replay state, audit chain, and +product configuration state. +The products do not share schemas, runtime roles, keyrings, trust anchors, bundles, or +anti-rollback files. + +The deployment operator owns coordinated recovery points and traffic admission. +`registryctl migrate` owns reviewed project-authoring compatibility only. +It does not migrate Relay or Notary runtime databases. + +{/* Evidence: docs/site/src/content/docs/operate/backup-and-restore.mdx, + docs/site/src/content/docs/operate/upgrade-and-rollback.mdx, + crates/registry-relay/docs/ops.md, + products/notary/docs/postgresql-state-operations.md, and + crates/registryctl/src/project_authoring/migration.rs. */} + +## Choose the operation + +- Use a restart when secret-plane material changed but the configured references and software + contract remain valid. +- Use `registryctl migrate` when a project contains a catalogued authored-contract transition. +- Use the Notary state installer and doctor for the exact released Notary schema path. +- Use Relay `consultation bootstrap-state` to install or attest its exact compiled consultation + schema. +- Use the upgrade procedure for a software or schema change. +- Use restore only with a complete, matching, isolated recovery set. +- Use rollback after target traffic only when the target release proves a safe state conversion. + +Relay bootstrap is a clean-or-attested installer, not a general migration framework. + +## Preserve the recovery set + +Follow [Back up and restore a deployment](../../backup-and-restore/) before changing the running +deployment. +Preserve: + +- Generated secrets and product configuration. +- Separate signed bundles, trust anchors, and anti-rollback state. +- Relay source inputs, cache, audit, and complete consultation database when enabled. +- Notary audit, complete database, role provisioning, and sensitive-state key version. +- Software identities, PostgreSQL major versions, retained key material, and audit watermarks. + +Do not print secret values while recording hashes, owners, modes, and versions. + +## Check a project-authoring migration + +Inspect the same-v1 compatibility catalog without changing the source project: + +```sh +registryctl migrate \ + --project-dir \ + --target-version 1 \ + --format json +``` + +When the report permits candidate emission, write to a new absent directory: + +```sh +registryctl migrate \ + --project-dir \ + --target-version 1 \ + --output \ + --write-candidate \ + --format json +``` + +Review the candidate, disposition, reviews, blocking reasons, and rerun gates. +The command preserves the source project and does not approve or activate the candidate. +Use the [registryctl CLI reference](../../../reference/registryctl/) for the current catalogued +transition. + +## Stage a restart or upgrade + +1. Run offline fixture, check, preflight, product doctor, and product bundle-verification gates + with the target binaries. +2. Quiesce writers and prevent another product instance from acquiring the active fence. +3. For Relay consultation state, run the target release's documented + `registry-relay consultation bootstrap-state` command with the recorded inputs. + Continue only when the exact schema and role capability attest. +4. For Notary state, run the target release's `state install` as the migration role, then + `state doctor` as the runtime role. + Do not run old and target Notary writers concurrently across a schema change. +5. Start one Relay without traffic. + Require health, readiness, audit, posture, and a bounded canary. +6. Start one Notary against that Relay. + Require the complete Relay consultation contract, health, readiness, audit, posture, and a + bounded evidence canary. +7. Admit traffic only after both product boundaries pass. + +Use [Upgrade and roll back](../../upgrade-and-rollback/) for the exact release procedure and the +[Notary PostgreSQL operations guide](../../../products/registry-notary/postgresql-state-operations/) +for role, migration, pruning, and stale-restore controls. + +## Expected evidence + +Retain: + +- Verified current and target software identities. +- The complete recovery-set inventory and checksums. +- Project migration report and candidate review when applicable. +- Relay bootstrap or Notary state-install and doctor results. +- Separate product bundle verification and anti-rollback sequences. +- Health, readiness, audit, posture, and canary results before traffic admission. +- Start, stop, restore, and traffic-admission timestamps. + +## What this proves + +Project migration gates prove the catalogued authoring transition and generated candidate. +Database attestation proves the exact schema, role, and capability boundary checked by the product. +Bundle verification proves the product configuration closure. +Staged runtime checks prove the tested target process and dependency path. + +These gates do not prove backup freshness, every acknowledged write, country acceptance, full live +interoperability, or a safe downgrade across an undocumented state change. +`/healthz` proves process liveness only. + +## Roll back or recover + +Before target traffic, stop the target and restore the complete previous-release set. +Never start an old binary against a newer unapproved schema or copy anti-rollback state between +release lineages. + +After target traffic writes correctness state, fix forward by default. +Restore a pre-upgrade database only when no acknowledged target write can be lost or a +release-specific recovery procedure proves the conversion. +Keep a potentially stale restore offline until write-ahead-log or point-in-time recovery reaches +the last acknowledged write and external audit watermark. + +Do not delete schemas, audit history, or anti-rollback state to make a target boot. + +## Escalate + +Escalate to both product owners when a combined topology lacks a coordinated recovery point. +Escalate to the database owner when role object identities, schema fingerprints, key versions, or +acknowledged-write coverage cannot be proved. +Escalate to the release owner when no explicit migration or rollback path covers the source and +target versions. + +## Next + +- [Inspect and diagnose the deployment](../inspect-and-diagnose/) +- [Refresh and recover a materialization](../refresh-and-recover-materialization/) +- [Review retention and persistent state](../../retention-and-persistent-state/) diff --git a/docs/site/src/content/docs/operate/advanced/refresh-and-recover-materialization.mdx b/docs/site/src/content/docs/operate/advanced/refresh-and-recover-materialization.mdx new file mode 100644 index 000000000..5fc0ac2e9 --- /dev/null +++ b/docs/site/src/content/docs/operate/advanced/refresh-and-recover-materialization.mdx @@ -0,0 +1,188 @@ +--- +title: Refresh and recover a materialization +description: Refresh Registry Relay materializations, distinguish last-good service from freshness, retain governed state, and recover without live fallback. +status: current +owner: registry-docs +source_repos: + - registry-stack + - registry-relay +last_reviewed: "2026-07-26" +doc_type: how-to +locale: en +standards_referenced: [] +--- + +Use this procedure to refresh, investigate, retain, or recover a Registry Relay materialization +without changing the source contract or enabling request-time source fallback. + +## Prerequisites + +- Identify the logical entity, physical environment binding, current generation, refresh mode, + and freshness contract. +- Know the protected Relay admin listener and the least-privilege reload and posture credentials. +- Preserve the source file, Relay cache, Relay consultation database when enabled, configuration, + secrets, trust anchor, and anti-rollback state under the deployment retention policy. +- Block dependent traffic before a recovery that can change the published generation. + +## Ownership and trust boundary + +The entity owns the logical schema, primary key, maximum records and bytes, refresh policy, and +retained-generation intent. +The environment owns the private provider path, physical columns, source revision, and generation. +Registry Relay owns ingest, immutable publication, readiness, and last-good serving. + +An exact `snapshot` consultation reads the published handle and does not open a live source +connection during the request. +If the required materialization is absent, stale, or inconsistent, the dependent profile becomes +unready. +Registry Relay does not fall back to live source access. + +{/* Evidence: docs/site/src/content/docs/tutorials/configure-project-snapshot-materialization.mdx, + crates/registry-relay/docs/configuration.md, + crates/registry-relay/docs/ops.md, and + crates/registry-relay/src/source_backend/materialization.rs. */} + +## Inspect before refreshing + +Read liveness, readiness, and redacted posture separately. +Use restricted posture only on the protected admin network when the operator needs per-resource +refresh observations. + +The restricted `relay.refresh_health` observations report the last successful load, consecutive +refresh failures, and whether Relay serves last-good data. +They report acquisition health, not the source record's business freshness. + +Review the [Relay operations runbook](../../../products/registry-relay/ops/) for the current admin +listener and scope requirements. + +## Refresh the materialization + +Registry Relay supports `mtime`, `interval`, and `manual` refresh modes. +For a manual table reload, call the protected table endpoint: + +```sh +curl -X POST \ + -H "Authorization: Bearer " \ + http://127.0.0.1:8081/admin/v1/datasets//tables//reload +``` + +The table-specific endpoint runs the bounded acquisition and durable materialization-publication +path for that one resource. +On failure, ordinary reads retain their previous ready table when one exists. If durable +SnapshotExact publication already advanced before local registration failed, Relay removes that +publication slot from consultation use. Global `/ready` can remain `200`, but every dependent +SnapshotExact consultation fails closed until exact durable reconciliation succeeds. + +Do not use `/admin/v1/reload` for a deployment that contains any audited SnapshotExact plan. +Current Relay rejects the complete reload-all request with `ingest.materialization_failed`, marks +every resource failed in that report, and refreshes no resource. +There is no atomic multi-materialization admin refresh in current source. +When several materializations must move together, block dependent traffic, refresh each exact +table through its table-specific endpoint, verify every intended publication, then readmit traffic. +If the deployment requires atomic publication across several materializations, keep traffic +blocked and escalate because current Relay cannot establish that property. + +After a successful reload, require the dependent readiness and posture observations to refer to +the intended generation before admitting traffic. +Run an authorized exact-lookup canary with synthetic identifiers when the deployment permits that +probe. + +## Handle stale or failed refreshes + +A refresh failure after a successful ingest leaves the last-good table active and can leave +`/ready` at `200`. +The last successful load timestamp does not advance, and consecutive failure observations +increase. +A resource with no successful generation remains not ready. + +Treat these states differently: + +- `ready` with `serving_last_good: true` means the process can serve the retained generation. + It does not mean that the source owner published current business data. +- An ordinary last-good table can keep global `/ready` at `200` after refresh acquisition fails. + This is an availability state, not SnapshotExact freshness evidence. +- `pdp.evidence_stale` means the policy rejected evidence age. + Do not weaken the policy or rewrite the timestamp to clear the denial. +- `schema.resource_unavailable` means the configured resource cannot serve. + Inspect ingest health and the stable error reference before changing traffic. +- Execution-time SnapshotExact freshness is checked during each request. A stale publication returns + `consultation.unavailable` for that execution while global `/ready` can remain `200`. + A digest-inconsistent or incomplete publication slot also stays unavailable. Do not enable a + live connector as an automatic fallback. + +Use the [error and status code reference](../../../reference/errors/) and +[operator diagnostic reference](../../../reference/diagnostics/operator/) for stable +classifications. + +## Retain materialization state + +Relay's ingest cache can contain complete normalized source rows. +Protect the cache with the same data classification as the source. +For audited SnapshotExact, the entity's authored `retain_generations` value keeps from `1` through +`16` completed cache generations, including the active generation, after successful publication. +Ordinary resources keep the built-in current and immediately previous snapshot. Relay removes +older cache files on a best-effort basis. +There is no time-to-live for the ingest cache. +The bounded retained set supports recovery and readers. It is not an admin-selectable list of +arbitrary rollback targets. + +Consultation materialization publication history is separate durable PostgreSQL correctness state. +Registry Relay does not provide general time-based pruning for that history. +Back up immutable source inputs, the Relay ingest cache, and the complete Relay consultation +database at one coordinated quiesced recovery point. Preserve role bindings, audit-pseudonym key +material, and the audit watermark. The recovery evidence must bind the source archive, cache +archive, database active pointer and history, and exact active generation and restricted content +digest. + +The [retention and persistent-state reference](../../retention-and-persistent-state/) defines the +complete store inventory. + +## Expected evidence + +Retain: + +- The previous and candidate generation identities without source rows. +- The reload result and per-resource status. +- The last successful load time and consecutive failure count. +- Health, readiness, audit, and redacted posture after publication. +- The exact-lookup canary outcome and the traffic-admission decision. +- One attested recovery record binding source inputs, cache, Relay database active pointer and + history, exact generation, restricted content digest, and recovery-point metadata. + +## What this proves + +A successful table-specific reload proves that Relay read, validated, and published that +configured source resource under the active runtime contract. +Readiness proves that the required runtime dependencies accept traffic at the time of the probe. +An exact synthetic canary proves the selected published path. + +These checks do not prove source-domain freshness, completeness, legal suitability, country +acceptance, off-host audit receipt, or every record. +Readiness cannot detect writes missing from a stale database restore. + +## Roll back or recover + +A failed table-specific reload preserves that resource's last-good generation when one exists. +It does not provide an atomic rollback boundary across several materializations. +Current docs do not define an admin operation that selects an arbitrary older cache generation. +Do not edit cache files or publication rows to simulate rollback. + +For recovery, keep traffic blocked and restore the complete matching recovery set, or republish a +reviewed source export with a new environment generation and repeat the offline, reload, posture, +and canary gates. +When consultation state may be stale, recover forward to the last acknowledged write and external +audit watermark before resuming the same workload. + +## Escalate + +Escalate to the source owner when business freshness or completeness cannot be established. +Escalate to Relay operations when reload-all cannot retain the previous coherent generation, +cache integrity is uncertain, publication history and cache disagree, or the recovery point may +omit an acknowledged consultation. +Escalate to the security owner before moving or exposing a cache that contains source rows. + +## Next + +- [Inspect and diagnose the deployment](../inspect-and-diagnose/) +- [Back up and restore state](../../backup-and-restore/) +- [Configure an exact snapshot](../../../tutorials/configure-project-snapshot-materialization/) diff --git a/docs/site/src/content/docs/operate/advanced/rotate-credentials-and-trust.mdx b/docs/site/src/content/docs/operate/advanced/rotate-credentials-and-trust.mdx new file mode 100644 index 000000000..39df3bc80 --- /dev/null +++ b/docs/site/src/content/docs/operate/advanced/rotate-credentials-and-trust.mdx @@ -0,0 +1,242 @@ +--- +title: Rotate credentials, keys, certificates, and trust +description: Rotate Registry Relay and Registry Notary trust material while preserving product ownership, overlap, recovery, and staged traffic admission. +status: current +owner: registry-docs +source_repos: + - registry-stack + - registry-relay + - registry-notary + - registry-platform +last_reviewed: "2026-07-26" +doc_type: how-to +locale: en +standards_referenced: [] +--- + +Use this procedure to rotate a source credential, caller key, Notary-to-Relay workload token, +configuration signer, credential-issuance signer, certificate, or trust anchor without exposing +secret material or widening authority. + +## Prerequisites + +- Identify the material, every consumer, its current secret or trust reference, and its expiry. +- Preserve a verified recovery set for the current Relay and Notary product configurations. +- Keep caller traffic outside the staged instances until the affected product checks pass. +- Use synthetic or institution-approved canaries. Do not use personal data for a rotation probe. + +## Ownership and trust boundary + +Registry Relay owns source destinations, source credentials, private certification authority +material, mutual TLS keys, source protocol credentials, and Relay caller keys. +Registry Notary owns its Relay workload token, Notary caller policy, and evidence-signing keys. +The deployment operator owns secret storage, certificates, product trust anchors, traffic +admission, and revocation. + +Configuration signing keys and trust anchors are product-specific. +Relay and Notary bundles have separate signatures, anchors, anti-rollback state, and activation +events. +A combined project has no signed project-root bundle or atomic activation coordinator. + +{/* Evidence: products/notary/docs/configuration-trust-and-integrity.md, + products/platform/docs/governed-configuration.md, + crates/registry-relay/docs/ops.md, and + products/notary/docs/signing-key-provider.md. */} + +## Classify the rotation + +1. Treat suspected exposure as an incident. + Revoke or disable the affected material, stop affected traffic, and preserve redacted audit + evidence before routine rollout work. +2. Decide whether consumers need an overlap window. + Caller keys, certificate chains, configuration signers, and public credential-verification + keys normally need overlap. +3. Decide whether the change remains in the secret plane or changes a governed reference. + A secret-plane change retains the reviewed reference and replaces the value through the + secret provider. + A governed change produces a reviewed product configuration and a new signed product bundle. + +The [Notary deployment hardening runbook](../../../products/registry-notary/deployment-hardening-runbook/) +defines the incident boundary. +The [Relay operations runbook](../../../products/registry-relay/ops/) defines Relay API-key and +runtime-secret rotation. + +## Rotate source credentials, certificates, or source trust + +1. Add the replacement to the operator-owned Relay secret and trust boundary. + Use a versioned reference when the provider treats references as immutable. +2. Change only the affected Relay environment binding. + Do not change the source origin, method, path rules, projection, or limits as part of a + credential rotation. +3. Run the offline environment gate: + + ```sh + registryctl preflight \ + --project-dir \ + --environment \ + --format json + ``` + +4. Compare the change with the verified Relay baseline, then build, sign, and verify the Relay + product input. + Use the [registryctl CLI reference](../../../reference/registryctl/) for the exact baseline and + bundle commands. +5. Stage Relay without caller traffic. + Require health, readiness, audit, and redacted deployment posture to pass. +6. Run one authorized, bounded source canary when the source authority permits that test. + Offline preflight does not contact the source. +7. Move callers to the staged Relay and retire the old secret or trust material after the overlap + window closes. + +Private CA and mutual TLS changes stay in Relay. +Do not copy source certificates, keys, or destinations into a Notary bundle. + +## Rotate caller keys and the Relay workload token + +For a Relay API key, generate a new raw key and fingerprint: + +```sh +registry-relay generate-api-key --id caller-rotation-2026-01 +``` + +Store the emitted raw key only in the authorized client secret store. +Store the fingerprint under the configured Relay secret reference, keep both caller entries during +the overlap window, restart or roll Relay, move the caller, then remove the old entry. +Relay does not provide live keyring reload in the documented v1 path. + +For the Notary-to-Relay workload token, update the Relay workload policy and atomically replace the +owner-readable token file used by Notary. +Stage Relay first, then stage Notary against Relay and require the complete consultation contract +check. +Admit caller traffic only after both products are ready. + +## Rotate configuration signers and trust anchors + +1. Create or inspect product-specific trust-anchor operations with: + + ```sh + registryctl anchor --help + ``` + +2. Add the replacement public signer to the affected product's local trust anchor before a bundle + depends on that signer. +3. Distribute the updated anchor through the deployment trust path and restart staged instances. +4. Sign the next product bundle with the replacement key and a strictly higher sequence. +5. Run the stateless bundle check against the affected product anchor: + + ```sh + SIGNED_PRODUCT_BUNDLE=operator-inputs/signed-relay-bundle + PRODUCT_TRUST_ANCHOR=operator-inputs/relay-trust-anchor.json + registryctl bundle verify \ + --bundle-dir "$SIGNED_PRODUCT_BUNDLE" \ + --anchor-path "$PRODUCT_TRUST_ANCHOR" + ``` + + This command verifies the signature, product binding, trust anchor, and signed file closure. + It does not read product anti-rollback state or establish local rollback eligibility. +6. For an existing Relay state lineage, validate the later candidate or restart read-only against + that node's accepted state: + + ```sh + SIGNED_RELAY_BUNDLE=operator-inputs/signed-relay-bundle + RELAY_TRUST_ANCHOR=operator-inputs/relay-trust-anchor.json + RELAY_ROLLBACK_STATE=operator-state/relay-config-state.json + registry-relay config verify-bundle \ + --bundle-dir "$SIGNED_RELAY_BUNDLE" \ + --anchor-path "$RELAY_TRUST_ANCHOR" \ + --state-path "$RELAY_ROLLBACK_STATE" + ``` + +7. For an existing Notary state lineage, run the equivalent Notary-owned check: + + ```sh + SIGNED_NOTARY_BUNDLE=operator-inputs/signed-notary-bundle + NOTARY_TRUST_ANCHOR=operator-inputs/notary-trust-anchor.json + NOTARY_ROLLBACK_STATE=operator-state/notary-config-state.json + registry-notary config verify-bundle \ + --bundle-dir "$SIGNED_NOTARY_BUNDLE" \ + --anchor-path "$NOTARY_TRUST_ANCHOR" \ + --state-path "$NOTARY_ROLLBACK_STATE" + ``` + + Each product command verifies the candidate against that product's existing local state without + persisting an acceptance. + These read-only commands require accepted state to exist and are for later candidate validation + and restarts. + A genuinely absent, version-specific state path is initialized only by the documented product + boot path, not by either read-only verifier. +8. Remove or disable the old signer only after every retained deployment and rollback set has an + accepted recovery path. + +Repeat this workflow independently for Relay and Notary when both signers change. +Do not interpret two successful verifications as atomic project activation. + +## Rotate Notary evidence-signing keys + +Add a new key with a new `kid` and `status: active`. +Move the intended credential or federation profiles to the new named key. +Change the old key to `publish_only` for the full verifier and credential lifetime window, then +disable or remove the old key through its governed cleanup path. +Never reuse a `kid` for different key material. + +The [Notary signing key provider guide](../../../products/registry-notary/signing-key-provider/) +defines local JWK and PKCS#11 provider configuration, readiness behavior, and the complete key +lifecycle. + +Audit hash-secret rotation is a separate evidence-lifecycle event. +Retain the old secret under the audit retention policy because changing the secret breaks lookup +correlation with older pseudonyms. + +## Expected evidence + +Retain: + +- The redacted preflight and semantic-comparison reports. +- The verified product bundle report and product-specific sequence. +- Health, readiness, audit-write, and redacted posture results from the staged instance. +- A synthetic or authorized bounded canary result. +- The old-material retirement time and the approved overlap window. + +Evidence records may contain key ids, product ids, scopes, and certificate metadata. +They must not contain raw keys, fingerprints, private certificates, tokens, environment values, or +full configuration dumps. + +## What this proves + +The offline gates prove that required references exist, file posture is acceptable, the +environment does not widen the authored contract, and the generated product input validates. +`registryctl bundle verify` proves the stateless signature, binding, trust-anchor, and file-closure +checks. +The product-owned `config verify-bundle` command additionally proves read-only local rollback +eligibility against that product's existing accepted state. +Neither command persists bundle acceptance. +Staged readiness and a bounded canary prove the tested runtime path. + +These gates do not prove country approval, legal authority, every source operation, every caller +migration, remote audit retention, or live interoperability that was not tested. + +## Roll back or recover + +Before the replacement serves traffic, restore the prior secret reference, anchor, bundle, and +runtime recovery set. +After a higher configuration sequence has been accepted, do not delete anti-rollback state or +activate an older sequence. +Issue a reviewed higher-sequence recovery bundle, or use the exact documented, expiring local +break-glass process. + +Keep old Notary public verification keys published while credentials signed by those keys can +still be verified. +Keep both products staged and traffic blocked when Relay and Notary no longer agree on the +consultation contract. + +## Escalate + +Escalate to the product security owner when material may be exposed, a private key or token reaches +logs, trust cannot overlap safely, a certificate changes source identity, an old Notary public key +cannot remain published, anti-rollback state is missing, or a canary requires live country data. + +## Next + +- [Compare a baseline and reapprove a source change](../compare-and-reapprove-source-change/) +- [Inspect and diagnose a running deployment](../inspect-and-diagnose/) +- [Back up and restore state](../../backup-and-restore/) diff --git a/docs/site/src/content/docs/operate/backup-and-restore.mdx b/docs/site/src/content/docs/operate/backup-and-restore.mdx index b23c078e9..d49522746 100644 --- a/docs/site/src/content/docs/operate/backup-and-restore.mdx +++ b/docs/site/src/content/docs/operate/backup-and-restore.mdx @@ -41,8 +41,12 @@ preauthorization state survives in PostgreSQL. and `state/`. - Know whether Relay consultations or Registry Notary are enabled, which PostgreSQL database each product uses, and which role-provisioning record belongs to each database. -- Stop write traffic or use a filesystem snapshot if you need an exact point-in-time copy of - audit files. +- For a deployment with audited SnapshotExact materializations, remove dependent traffic, stop + the Relay fence holder and every Notary caller, and prevent replacement processes from starting. + Keep that topology quiesced while capturing source inputs, the Relay ingest cache, and the Relay + consultation database at one coordinated recovery point. +- For a deployment without audited SnapshotExact, stop write traffic or use a filesystem snapshot + if you need an exact point-in-time copy of audit files. - Keep backups encrypted and access-controlled. `secrets/local.env`, audit files, config-trust state, PostgreSQL correctness state, and sensitive-state key versions are security-sensitive. @@ -83,6 +87,11 @@ Those paths are where generated Compose projects mount Relay cache, optional fil directories, and config-trust anti-rollback state if you enable it with `antirollback_state_path`. +When audited SnapshotExact is configured, run this archive command only after the topology is +quiesced. Keep Relay and its Notary callers stopped until the matching Relay database backup +finishes. A source archive, ingest-cache archive, and Relay database taken at independent live +times do not form a recoverable materialization set. + If your hand-written config uses different paths, include them in the archive: - Relay or Notary file-audit directories, such as `/var/log/registry-relay/` or @@ -105,10 +114,11 @@ and audit-pseudonym keyring metadata. They are separate from Notary's products. Remove traffic from Notary callers first, then stop the Relay fence holder and prevent another -Relay process from starting. If Relay and Notary form one service, keep both products quiesced -while their backups are taken or use a platform snapshot that gives both product databases one -coordinated recovery point. A transactionally consistent dump of one live database does not make -two independently backed-up product databases share a recovery point. +Relay process from starting. Keep the source inputs and Relay ingest cache unchanged while the +database backup is captured. If Relay and Notary form one service, keep both products quiesced +while their source, cache, and database backups are taken or use a platform snapshot that gives +all stores one coordinated recovery point. A transactionally consistent dump of one live database +does not make independently backed-up source, cache, or product databases share a recovery point. For a database dedicated to Relay and an empty-database restore in the same PostgreSQL cluster, where the pre-created roles keep their object identifiers, back up the complete Relay database @@ -135,6 +145,20 @@ PostgreSQL major, all five role names, the four bound role object identifiers, b keyring lifecycle settings, PostgreSQL trust root, and retained audit-pseudonym key material with the encrypted recovery record. Keep secret values outside the database dump. +For every audited SnapshotExact binding, the access-controlled recovery record must bind: + +- The source-input archive SHA-256 and the exact source revision. +- The Relay ingest-cache archive SHA-256. +- The complete Relay database backup SHA-256, including materialization active-pointer and history + tables. +- The exact active binding, publication sequence, generation, and restricted content digest. +- The time or write-ahead-log position shared by the quiesced recovery set. + +Hash and sign or independently attest that closed recovery record. Do not put restricted content +digests, source paths, rows, credentials, or key material in general logs or a public release +record. A list of unrelated artifact hashes is not evidence that the stores belong to one +generation. + For recovery into another PostgreSQL cluster, use a physical backup or cluster-level managed snapshot that preserves the PostgreSQL role catalog and its object identifiers. Recreating the same role names does not preserve those identifiers, and Relay intentionally rejects the restored @@ -222,6 +246,11 @@ if [ -n "$runtime_uid" ] && [ -n "$runtime_gid" ] && [ -d state ]; then fi ``` +For audited SnapshotExact, do not start Relay after restoring the files. First verify that the +source-input archive, ingest-cache archive, and Relay database dump match the same attested +recovery record. The record's active generation and restricted content digest must agree with the +database active pointer and history and with the retained cache generation. + ## Restore Relay consultation PostgreSQL state Skip this section when no Relay consultation dump or snapshot is present. Keep Relay and every @@ -255,6 +284,13 @@ The command must report `installed_or_attested` and `identical`. A drift respons recovery set does not match; do not drop the Relay schemas or change bootstrap inputs to make it pass. +For audited SnapshotExact, startup reconciles the database-authoritative active generation and +digest with the restored cache before opening a newer source generation. A missing, mismatched, or +unreadable retained cache generation keeps the dependent SnapshotExact publication unavailable. +Do not replace the database pointer, edit the cache, or open live source fallback to clear the +failure. Restore the matching coordinated set or republish a reviewed source input as a new +generation. + Relay startup and `/ready` attest the restored catalog, role grants, keyring, audit, quota, materialization, and current serving fence. They do not prove that the recovery point includes every write Relay previously acknowledged. If the backup might be stale, keep it offline and use @@ -316,8 +352,10 @@ authenticated claim or credential journey appropriate to that deployment. `regis provide a product-scoped Notary smoke subcommand. When OID4VCI preauthorization is enabled, complete an offer-to-credential journey before admitting traffic. For a consultation-enabled Relay, require `/ready` to return `200`, then run one authenticated -consultation canary while downstream Notary traffic remains blocked. Admit Notary traffic only -after both product recovery points and the canary have been reconciled. +consultation canary while downstream Notary traffic remains blocked. Global readiness can remain +`200` while an individual SnapshotExact execution rejects a stale snapshot, so the canary must +exercise every recovered materialization relied on by the deployment. Admit Notary traffic only +after both product recovery points and the canaries have been reconciled. For a deployment that uses `config_trust`, verify that the restored anti-rollback state still matches the configured trust anchor and signed bundle before the service is allowed to serve. @@ -343,6 +381,7 @@ than the bundle you are trying to boot. | Audit records cannot be correlated across the restore | The audit HMAC secret changed | Restore the prior `secrets/local.env`; if the old file is gone, document the break as a key-rotation event | | Relay consultation bootstrap reports capability or keyring drift | The restore has different role object identifiers, schema ownership, bootstrap identity, or keyring lifecycle state | Keep traffic blocked and restore the matching complete recovery set; do not drop schemas or reinitialize the keyring | | Relay is ready but the recovery point might be stale | Readiness attests the restored state plane but cannot infer missing acknowledged writes | Keep Relay and Notary traffic blocked and recover forward to the last acknowledged write and audit watermark | +| Relay is ready but one SnapshotExact canary is unavailable | The execution-time freshness bound failed, or the restored source, cache generation, content digest, and database publication pointer do not agree | Keep dependent traffic blocked and restore the coordinated recovery set or publish a reviewed new generation | | Notary state doctor rejects the restore | The schema, runtime role, server major, write authority, durability settings, or configured sensitive-state key is invalid | Keep traffic blocked, restore the matching recovery set, and rerun `state install` and `state doctor` | | Config bundle startup fails with a rollback code | The anti-rollback state records a newer accepted sequence | Boot a signed bundle with a higher sequence, or follow the break-glass process documented for config trust | diff --git a/docs/site/src/content/docs/operate/index.mdx b/docs/site/src/content/docs/operate/index.mdx new file mode 100644 index 000000000..416459a6e --- /dev/null +++ b/docs/site/src/content/docs/operate/index.mdx @@ -0,0 +1,45 @@ +--- +title: Operate +description: Operate Registry Relay and Registry Notary with explicit trust, state, retention, upgrade, recovery, and security boundaries. +status: current +owner: registry-docs +source_repos: + - registry-relay + - registry-notary +last_reviewed: "2026-07-26" +doc_type: reference +locale: en +standards_referenced: [] +--- + +Operate Registry Relay and Registry Notary as separate runtime products with explicit state, +secrets, trust anchors, health, audit, promotion, and rollback responsibilities. + +## Deployment and state + +- [Run single-node Compose behind a proxy](single-node-compose-behind-proxy/) +- [Back up and restore state](backup-and-restore/) +- [Manage retention and persistent state](retention-and-persistent-state/) +- [Upgrade and roll back](upgrade-and-rollback/) + +## Security operations + +- [Harden a deployment](../security/hardening-checklist/) +- [Review the security support window](../security/support-window/) +- [Report a vulnerability](../security/report-a-vulnerability/) + +## Advanced operations + +Use the [advanced operations guides](advanced/) for credential and trust +rotation, reviewed source changes, materialization recovery, product upgrades +and rollback, runtime diagnosis, and bounded Script workers. + +Generated build output remains unsigned review material until the owning product's signing and +verification lifecycle binds the exact bytes. +Runtime readiness does not establish country legal approval or source interoperability. + +## Next + +- [Verify Registry Stack](../verify/) +- [Generated artifacts](../generated-artifacts/) +- [Reference](../reference/) diff --git a/docs/site/src/content/docs/operate/retention-and-persistent-state.mdx b/docs/site/src/content/docs/operate/retention-and-persistent-state.mdx index c10631b91..732f4e4b3 100644 --- a/docs/site/src/content/docs/operate/retention-and-persistent-state.mdx +++ b/docs/site/src/content/docs/operate/retention-and-persistent-state.mdx @@ -39,7 +39,7 @@ Two consequences follow from that boundary: |---|---|---|---| | Relay and Notary audit sinks | Chained audit envelopes with timestamps, event bodies, hashes, and HMAC-pseudonymized sensitive handles when configured. Operational metadata can still identify actors or actions. | Product file sinks default to `100 MB` and `14` retained files. `stdout` and `syslog` retention belongs to the collector. | Configure `audit.sink`, file path, rotation, `audit.hash_secret_env`, and off-host shipping. | | Relay and Notary audit shipper cursor | Local `registry.audit.ack_cursor.v1` state with the acknowledgement time and last acknowledged chain hash, plus an optional shipper identifier. | The shipper atomically replaces the file after each successful hand-off. The runtime does not expire or rewrite it. | Mount the file read-only for the Registry process, keep it on local storage and at or below 16 KiB, and configure `deployment.evidence.audit_ack_cursor_path`. | -| Relay ingest cache | Normalized Parquet snapshots under `server.cache_dir`. These snapshots can contain full source rows from configured registries. | No time TTL. A successful refresh keeps the current and immediately previous snapshot for each resource and removes older snapshots best effort. | Place `server.cache_dir` on writable storage with the same data classification as the source rows. | +| Relay ingest cache | Normalized Parquet snapshots under `server.cache_dir`. These snapshots can contain full source rows from configured registries. | No time TTL. For audited SnapshotExact, the authored `retain_generations` value keeps between `1` and `16` completed cache generations, including the active generation, after successful publication. Ordinary sources keep the built-in current and previous generations. Older snapshots are removed best effort. | Place `server.cache_dir` on writable storage with the same data classification as the source rows. Treat authored retention as a bounded recovery set, not an API for selecting arbitrary rollback targets. | | Config-trust anti-rollback state | The last accepted sequence, config and bundle hashes, root version, and optional break-glass pin metadata. Operator names, approval references, and reasons can be sensitive. | The state file is rewritten atomically and has no normal TTL. Break-glass overrides require expiry, and consumed override files are renamed. | Preserve `antirollback_state_path` across upgrades and protect break-glass override files with local root controls. | | Relay consultation correctness state | Durable consultation audit, attempts and completions, dispatch permits, quota buckets, materialization publication history, batch-child replay bindings, serving-fence state, and audit-pseudonym keyring metadata. Pseudonymous handles and operational metadata can remain linkable. | Batch-child replay rows expire after `15 minutes` and are pruned on later reservations. Other Relay consultation tables have no general time-based pruning. Keyring retention controls when retired pseudonym key metadata can leave the retained set; it does not delete durable audit rows. | Back up the complete Relay database at a quiesced or coordinated recovery point. Preserve role bindings and key material, and keep any potentially stale restore offline until acknowledged writes are reconciled. | | Notary correctness state | Hashed replay and nonce identifiers, evaluations, batch idempotency, credential status, keyed quota pseudonyms, encrypted preauthorization login state, and transaction-code verifiers. Credential identifiers and operational metadata can still be linkable. | Each typed domain has an absolute expiry or bounded window. Consumed nonce tombstones last `60` seconds. Credential status lasts through credential expiry plus `retention_seconds`. | Use the Notary-owned PostgreSQL schema for production and multi-instance deployments. Back up the complete database and keep a potentially stale restore offline through the documented quarantine. | @@ -120,6 +120,13 @@ cannot detect writes missing from a stale recovery point. The [Relay product documentation](../../products/registry-relay/) and [backup and restore procedure](../backup-and-restore/) define the recovery boundary. +For audited SnapshotExact, the recoverable unit also includes the immutable source inputs and +Relay ingest cache captured at the same quiesced point as the Relay database. Bind the source and +cache artifact hashes to the database active-pointer and history state, exact generation, and +restricted content digest in access-controlled recovery evidence. `retain_generations` keeps a +bounded set of cache files available for recovery and readers. It does not expose an operation +that activates any retained generation as an arbitrary rollback target. + ## Notary correctness-state retention Registry Notary enforces one-time use, cross-replica quota decisions, evaluation retention, diff --git a/docs/site/src/content/docs/operate/single-node-compose-behind-proxy.mdx b/docs/site/src/content/docs/operate/single-node-compose-behind-proxy.mdx index 1b3bc4935..3e73ce3c3 100644 --- a/docs/site/src/content/docs/operate/single-node-compose-behind-proxy.mdx +++ b/docs/site/src/content/docs/operate/single-node-compose-behind-proxy.mdx @@ -64,14 +64,16 @@ You need: Run the offline fixture and semantic gates before deployment: ```sh -registryctl test --project-dir +PROJECT_DIR=registry-project +ENVIRONMENT=staging +registryctl test --project-dir "$PROJECT_DIR" registryctl check \ - --project-dir \ - --environment \ + --project-dir "$PROJECT_DIR" \ + --environment "$ENVIRONMENT" \ --explain registryctl build \ - --project-dir \ - --environment + --project-dir "$PROJECT_DIR" \ + --environment "$ENVIRONMENT" ``` The human-readable test report starts with `PASS`, the check report marks the project `valid`, and @@ -83,18 +85,22 @@ project-level root. Package and sign each generated product input, then verify it against the product trust anchor: ```sh +PRODUCT_INPUT=registry-project/.registry-stack/build/staging/private/relay +SIGNING_KEY=operator-inputs/approved-signing-key.jwk +SIGNED_BUNDLE=operator-inputs/signed-relay-bundle +TRUST_ANCHOR=operator-inputs/relay-trust-anchor.json registryctl bundle sign \ - --input \ - --key \ - --product \ - --environment \ - --stream-id \ - --sequence \ - --bundle-id \ - --out + --input "$PRODUCT_INPUT" \ + --key "$SIGNING_KEY" \ + --product registry-relay \ + --environment staging \ + --stream-id configuration \ + --sequence 42 \ + --bundle-id staging-relay-42 \ + --out "$SIGNED_BUNDLE" registryctl bundle verify \ - --bundle-dir \ - --anchor-path + --bundle-dir "$SIGNED_BUNDLE" \ + --anchor-path "$TRUST_ANCHOR" ``` Activation remains product-specific. Keep each verified bundle, trust anchor, anti-rollback state, diff --git a/docs/site/src/content/docs/reference/diagnostics/authoring.mdx b/docs/site/src/content/docs/reference/diagnostics/authoring.mdx new file mode 100644 index 000000000..955383083 --- /dev/null +++ b/docs/site/src/content/docs/reference/diagnostics/authoring.mdx @@ -0,0 +1,27 @@ +--- +title: Authoring diagnostic reference +description: Generated static meanings, rules, remediation, evidence limitations, and lifecycle for Registry Stack project-authoring diagnostics. +status: current +owner: registry-docs +source_repos: + - registry-stack +last_reviewed: "2026-07-26" +doc_type: reference +locale: en +standards_referenced: [] +wide: true +--- + +import DiagnosticReference from '../../../../components/DiagnosticReference.astro'; + +Use this catalog when `registryctl check` rejects authored project structure, syntax, or +cross-file semantics. Diagnostic output can add a safe file address or received type class, but +the stable meaning, rule, and remediation below come from the same closed authoring definitions +that own each code. + +Run `registryctl project diagnostics --catalog authoring --format json` for the exact +workspace-independent machine catalog. A valid catalog command exits zero and writes only the +selected format to standard output. Invalid CLI arguments exit with Clap's usage status. A +fail-closed catalog invariant error exits nonzero without reading project or runtime state. + + diff --git a/docs/site/src/content/docs/reference/diagnostics/fixture.mdx b/docs/site/src/content/docs/reference/diagnostics/fixture.mdx new file mode 100644 index 000000000..7c6c2ded8 --- /dev/null +++ b/docs/site/src/content/docs/reference/diagnostics/fixture.mdx @@ -0,0 +1,25 @@ +--- +title: Fixture diagnostic reference +description: Generated static meanings, rules, remediation, evidence limitations, and lifecycle for offline fixture execution diagnostics. +status: current +owner: registry-docs +source_repos: + - registry-stack +last_reviewed: "2026-07-26" +doc_type: reference +locale: en +standards_referenced: [] +wide: true +--- + +import DiagnosticReference from '../../../../components/DiagnosticReference.astro'; + +Use this catalog for the safe error codes produced by Registryctl's offline synthetic fixture +harness. These entries describe bounded fixture evidence. They do not prove that a live source is +reachable, compatible, or authorized. + +Run `registryctl project diagnostics --catalog fixture --format json` for the exact +workspace-independent machine catalog. The command does not open a country project, contact a +runtime, or read environment variables and secrets. + + diff --git a/docs/site/src/content/docs/reference/diagnostics/operator.mdx b/docs/site/src/content/docs/reference/diagnostics/operator.mdx new file mode 100644 index 000000000..3c1f0b677 --- /dev/null +++ b/docs/site/src/content/docs/reference/diagnostics/operator.mdx @@ -0,0 +1,29 @@ +--- +title: Operator diagnostic reference +description: Generated static meanings, rules, remediation, evidence limitations, and lifecycle for preflight, bundle verification, and product activation diagnostics. +status: current +owner: registry-docs +source_repos: + - registry-stack + - registry-relay + - registry-notary + - registry-platform +last_reviewed: "2026-07-26" +doc_type: reference +locale: en +standards_referenced: [] +wide: true +--- + +import DiagnosticReference from '../../../../components/DiagnosticReference.astro'; + +Use this catalog for Registryctl preflight, shared bundle verification, Relay activation, and +Notary activation codes. Each product owns its closed code definitions and static guidance. +The generated reference aggregates those definitions without copying runtime errors or values. + +Run `registryctl project diagnostics --catalog operator --format json` for the exact +workspace-independent machine catalog. Operator codes classify a boundary and provide safe next +actions. They do not disclose the received configuration, path, hash, identity, credential, source +response, or country value that caused a failure. + + diff --git a/docs/site/src/content/docs/reference/glossary.mdx b/docs/site/src/content/docs/reference/glossary.mdx index 7a7066c8e..d165caf16 100644 --- a/docs/site/src/content/docs/reference/glossary.mdx +++ b/docs/site/src/content/docs/reference/glossary.mdx @@ -73,10 +73,10 @@ Product names are always in English, including on future translated pages.
Registry Notary configuration that names which non-delegated registry-backed claims may be issued as a credential. Profile and claim bindings are mutually validated. Only evaluations whose selected roots share a profile retain private issuance provenance, and issuance requires exact claim pins, per-claim execution bindings, and unique Relay execution records for every selected root's dependency closure.
deployment bundle
-
The target generated, signed artifact for one Registry Stack project and environment. Its root manifest binds compatible Relay and Notary submanifests when both are present. The current authoring command builds separate unsigned product inputs, not a deployment bundle; signed project-root bundles are deferred.
+
A deferred project-root packaging concept tracked by registry-stack issue #361. Current source does not generate, sign, verify, or activate a project-root bundle. Relay and Notary instead use separate product-owned bundles, and no Registry Stack coordinator binds or atomically activates them.
deployment
-
One activated deployment-bundle generation. Replicas of that generation are one logical deployment.
+
An operated set of Registry Relay or Registry Notary product instances. A combined topology stages each product's separately verified bundle and admits traffic only after both products are ready and their consultation contract agrees; this is not atomic project activation.
decision owner
The institution accountable for the requirements, rules, decisions, and actions that use evidence. The decision owner can operate the evidence consumer directly or rely on a separate caller or intermediary.
@@ -235,7 +235,7 @@ Product names are always in English, including on future translated pages.
Standalone Rust service for Relay-backed or self-attested claim evaluation, disclosure policy, credential issuance from exact Relay-backed evaluation provenance, and audit. Source-free claims are evaluation-only. Repo slug: `registry-notary`.
Registry Stack project
-
The authored root for one registry trust domain. A project can describe a Relay-only, Notary-only, or combined deployment and compiles separate product inputs for the selected topology.
+
The authored root for one registry trust domain. A project can describe a Relay-only, Notary-only, or combined deployment and compiles separate product inputs for the selected topology. It is not a deployment bundle or an activation coordinator.
Registry Stack project workspace
The local directory containing one Registry Stack project's authored YAML, scripts, fixtures, and generated review and build outputs.
diff --git a/docs/site/src/content/docs/reference/index.mdx b/docs/site/src/content/docs/reference/index.mdx new file mode 100644 index 000000000..10fb36018 --- /dev/null +++ b/docs/site/src/content/docs/reference/index.mdx @@ -0,0 +1,44 @@ +--- +title: Reference +description: Registry Stack configuration, CLI, API, error, contract, standards, stability, and terminology reference. +status: current +owner: registry-docs +source_repos: + - registry-stack + - registry-relay + - registry-notary +last_reviewed: "2026-07-26" +doc_type: reference +locale: en +standards_referenced: [] +--- + +Use these references for exact fields, commands, interfaces, diagnostics, contracts, versions, and +terms. +Task instructions remain in Journeys, Configure, Verify, and Operate. + +## Configuration and commands + +- [Configuration reference](project-configuration/) +- [registryctl CLI reference](registryctl/) +- [Environment variables](environment-variables/) +- [Errors and status codes](errors/) + +## Interfaces and contracts + +- [Instance API references](apis/) +- [Contracts](contracts/) +- [API stability and versioning](api-stability/) +- [Deprecation policy](deprecation-policy/) + +## Standards and terms + +- [Standards](standards/) +- [ITB and SEMIC evidence](itb-semic-evidence/) +- [Glossary](glossary/) + +## Next + +- [Generated artifacts](../generated-artifacts/) +- [Specifications](../spec/) +- [Changelog](../changelog/) diff --git a/docs/site/src/content/docs/reference/project-configuration.mdx b/docs/site/src/content/docs/reference/project-configuration.mdx new file mode 100644 index 000000000..7ed5901a8 --- /dev/null +++ b/docs/site/src/content/docs/reference/project-configuration.mdx @@ -0,0 +1,80 @@ +--- +title: Configuration reference +description: Generated field reference for Registry Stack authored project files and Relay and Notary runtime configuration. +status: current +owner: registry-docs +source_repos: + - registry-stack +last_reviewed: "2026-07-26" +doc_type: reference +locale: en +standards_referenced: [] +wide: true +--- + +import AuthoringConfigurationReference from '../../../components/AuthoringConfigurationReference.astro'; + +This generated reference documents every reachable path in seven Registry Stack configuration +schemas: the five project-authoring schemas plus the Relay and Notary runtime schemas. +Use the purpose, reviewed intent profile, and ownership metadata to choose a field. +Then use `registryctl check` for a complete project or the product configuration checks for Relay +and Notary runtime configuration. + +## Contract status + +- Status: current, experimental +- Reference format: `1.0` +- Generated by: Main source (unreleased) +- Published release containing this generator: none +- Field release history: not verified +- Compared releases: none +- Generator: `registryctl authoring reference` +- Coverage gate: `registryctl authoring reference --coverage` +- Country workspace or runtime configuration reads: none + +The generated reference is next-release candidate evidence from current source. +Its field entries use `history_status: not_verified`, `introduced_in: null`, and an empty +`version_history`. +Per-field release history is not published until a release-schema comparison establishes the +versions. + +The generator joins the five committed project-authoring JSON Schemas, the Relay and Notary schemas +produced directly by their Rust schema APIs, the typed field-knowledge index, and reviewed +product-owned human-intent metadata. +JSON Schema and Rust validation remain the configuration authority. +The reference does not inspect a project, live runtime configuration, environment variables, secret +stores, or country values. + +The five project-authoring sections describe configuration people commit in a country project. +The Relay and Notary sections describe product-owned runtime contracts generated by `registryctl`; +they are not additional country-authored files. Their intent sidecars are documentation knowledge +only and are never loaded by either product at runtime. + +{/* Generated from the five crates/registryctl/schemas/project-authoring schemas, + registry_relay::config::schema::document(), registry_notary_core::config::schema::document(), + parity-coverage.json#field_knowledge, and the three product-owned intent sidecars. + Run npm run generate from docs/site. */} + + + +## Validation boundary + +The generated field entries describe schema facts and exact reviewed intent. +Relay and Notary fields carry a product-owned intent profile, while schema or reviewed override +flags explicitly identify the source of purpose and default behavior. +Runtime entries show the human-facing configuration `key_path` separately from the authoritative +JSON Schema `pointer`; authored entries use their JSON Schema pointer directly. +Runtime schema defaults are described without publishing their values. +The coverage report counts reviewed intent assignments, distinct intent texts, reused intent texts, +and assignments that use reused text separately. +Assignment coverage does not claim that every path has unique prose. +They do not prove that a complete project satisfies cross-file semantics, fixtures pass, an +environment resolves required secret references, or a generated product configuration is valid. +Run the authoring, fixture, preflight, and build commands for those separate gates. + +## Next + +- [Author a Registry Stack project](../../tutorials/author-registry-project/) +- [registryctl CLI reference](../registryctl/) +- [Errors and status codes](../errors/) +- [Generated artifacts](../../generated-artifacts/) diff --git a/docs/site/src/content/docs/reference/registryctl.mdx b/docs/site/src/content/docs/reference/registryctl.mdx index 47503ac06..392c7a8f8 100644 --- a/docs/site/src/content/docs/reference/registryctl.mdx +++ b/docs/site/src/content/docs/reference/registryctl.mdx @@ -5,7 +5,7 @@ status: current owner: registry-docs source_repos: - registry-stack -last_reviewed: "2026-07-19" +last_reviewed: "2026-07-26" doc_type: reference locale: en standards_referenced: [] @@ -16,7 +16,13 @@ import ProjectWorkspaceJourneys from '../../../components/ProjectWorkspaceJourne `registryctl` is the local adopter command-line tool for Registry Stack. It creates a local project, starts and stops the generated services, and runs validation and smoke checks against them. -This page lists commands in the current `registryctl` source. +This page lists commands in Main source (unreleased). +The source has not been designated as a release candidate. +The last released `registryctl` is `v0.13.0`. +That artifact does not contain `preflight`, `capabilities`, `compare`, `promote`, `migrate`, +`authoring reference`, or `project diagnostics`; use a current source build for those commands. +The [current-source test procedure](../../start/test-current-source-revision/) pins the checkout, +builds the CLI, and distinguishes the temporary source-test artifacts from release evidence. Run `registryctl --help` for the built-in usage text. Most human-facing commands also perform a once-per-day update check; see [Update check](#update-check). @@ -46,24 +52,53 @@ complete workflow and generated trust boundary. | `test --environment --live` | After offline fixtures pass, send one governed evaluation through a deployed Notary. The environment must be explicitly non-production. | | `check --project-dir --environment ` | Validate fixtures and the generated configuration for the project's Relay-only, Notary-only, or combined topology without writing build output. | | `check --explain` | Include the redacted acquisition, authorization, output, claim, and disclosure plan. | +| `check --explain --show-authored-values` | Show directly authored non-secret scalar metadata for explicit trusted-local human review. Human output only; never a report, evidence, or export mode. | | `check --format json` | Emit the machine-readable success report or typed invalid-project diagnostics instead of the default human-readable report. | | `check --against --anchor ` | Verify a signed product baseline and compare against its signed human review plus internal approval state. Both flags are required together. | +| `preflight --project-dir --environment ` | Verify required secret-reference availability, runtime-file posture, environment binding, product compatibility, and non-widening offline. It performs no DNS, HTTP, token, or source contact. | +| `preflight --format json` | Emit the strict value-free `registryctl.project_preflight.v1` readiness report. A not-ready result exits nonzero. | +| `capabilities --project-dir --environment ` | Inspect which closed capabilities are compiled, declared, enabled, used, available, missing, or inactive without claiming runtime activation. | +| `capabilities --format json` | Emit the strict value-free `registry.project.capability_inventory.v1` report. | +| `compare --project-dir --environment --from-starter` | Compare normalized effective project state with the exact starter embedded in this registryctl release. Recorded starter provenance must match exactly. | +| `compare --from-environment ` | Compare two explicit environment bindings of the same local project. | +| `compare --from-project-dir --from-environment ` | Compare with another explicitly environment-bound local project. Local project inputs are not treated as reviewed or signed authority. | +| `compare --format json` | Emit the strict value-free `registry.project.semantic_comparison.v1` report. The comparison does not read runtime state or evaluate external approval. | +| `promote --project-dir --environment --against --anchor ` | Compare a single-product project with one verified signed baseline. The command analyzes promotion only; it does not sign, activate, deploy, or mutate either environment. | +| `promote --relay-against --relay-anchor --notary-against --notary-anchor ` | Compare a combined project with separate verified Relay and Notary product baselines. All four flags are required as pairs; no project-root or atomic activation is implied. | +| `promote --format json` | Emit the strict value-free `registry.project.promotion.v1` report. A blocked disposition exits nonzero. | +| `migrate --project-dir --target-version 1` | Check the reviewed same-v1 compatibility catalog without changing the source project. | +| `migrate --output --write-candidate` | Emit an atomic, separate review candidate. Both flags are required, and the destination must not exist. | +| `migrate --format json` | Emit the strict `registry.project.migration.v1` report. | | `authoring xw --format reference` | Print the generated `xw.v1` function reference for Script authors. | | `authoring xw --format editor` | Print generated editor metadata for the `xw.v1` function surface. | | `authoring schema --kind ` | Print a strict project, environment, integration, fixture, or entity JSON Schema. | +| `authoring reference` | Print the deterministic configuration reference for the five authored schemas and generated Relay and Notary runtime schemas after reviewed-intent coverage is complete. | +| `authoring reference --coverage` | Print the seven-domain field-reference coverage audit and exit nonzero when any reachable path lacks reviewed human intent. | | `authoring editor --project-dir ` | Create or verify version-matched VS Code and Zed schema configuration. Defaults to the current directory. | | `authoring editor --format json` | Emit the versioned machine-readable editor setup report. | | `authoring language-server` | Run Registry Stack navigation and reference diagnostics over the Language Server Protocol on standard input and output. | +| `project diagnostics --catalog ` | Print the pure static `authoring`, `fixture`, or `operator` diagnostic reference without reading a project, environment, secret, or runtime service. | +| `project diagnostics --catalog --format json` | Emit only the selected versioned machine-readable catalog. Valid catalogs exit zero; invalid CLI arguments use the standard usage exit, and a failed catalog invariant exits nonzero. | | `build --project-dir --environment ` | Emit deterministic unsigned Config Bundle input directories for the products in the selected topology. | | `build --against --anchor ` | Build against an explicitly verified signed baseline. Both flags are required together. | | `build --format json` | Emit the versioned machine-readable build report instead of the default human-readable result. | Interactive report commands print concise human-readable results by default. Add `--format json` -when another program needs a report containing only versioned JSON on standard output. This policy -covers `init`, `add notary`, non-watch `test`, `check`, `authoring editor`, `build`, `doctor`, -`bundle`, and `anchor`. Watch mode prints one concise pass/fail summary per run and rejects JSON +when another program needs a report containing only versioned JSON on standard output. +This policy covers `init`, `add notary`, non-watch `test`, `check`, `preflight`, `capabilities`, +`compare`, `promote`, `migrate`, `authoring editor`, `project diagnostics`, `build`, `doctor`, `bundle`, and +`anchor`. Watch mode prints one concise +pass/fail summary per run and rejects JSON formatting. Artifact and protocol streams retain their native formats, including `authoring xw`, -`authoring schema`, `authoring language-server`, and `logs`. +`authoring schema`, `authoring reference`, `authoring language-server`, and `logs`. + +`authoring reference` reads only the five committed authoring schemas, the Relay and Notary schemas +generated from their Rust configuration types, typed field knowledge, and reviewed product-owned +human-intent metadata. +It does not accept a project directory or read country configuration, runtime configuration, +environment values, or secrets. +Registry Docs runs the coverage command before the reference command and publishes neither output +when coverage is incomplete. | JSON command result | Schema version | | --- | --- | @@ -71,17 +106,42 @@ formatting. Artifact and protocol streams retain their native formats, including | `add notary` | `registryctl.add_notary.v1` | | Successful `test`, `check`, or `build` | `registryctl.project_command.v1` | | Invalid-project `check` | `registryctl.project_diagnostics.v1` | +| `preflight` | `registryctl.project_preflight.v1` | +| `capabilities` | `registry.project.capability_inventory.v1` | +| `compare` | `registry.project.semantic_comparison.v1` | +| `promote` | `registry.project.promotion.v1` | +| `migrate` | `registry.project.migration.v1` | | `authoring editor` | `registryctl.project_editor.v1` | +| `project diagnostics --catalog authoring` | `registryctl.authoring_error_reference.v1` | +| `project diagnostics --catalog fixture` | `registryctl.fixture_error_reference.v1` | +| `project diagnostics --catalog operator` | `registryctl.operator_error_reference.v1` | | `doctor` | `registryctl.validation.report.v1` | | `smoke` | `registryctl.smoke.v1` | | `bundle` or `anchor` | The operation-specific `schema_version` in the report | An initialized starter records its starter ID, Registry Stack release, and -authored-content digest in `registry-stack.yaml`. `init` verifies that digest, -and `check --explain` reports `matches` or `diverged` together with the current -platform-defaults release, script runtime, and `xw.v1` ABI. Divergence is -informational: it identifies intentional project changes without blocking a -valid adapted workspace. +authored-content digest in `registry-stack.yaml`. `init` verifies that digest. +`compare --from-starter` fails closed unless the recorded ID, release, and +content digest identify the exact starter embedded in the current binary. It +then compares normalized effective fields and generated review projections, +so formatting changes and explicit defaults with the same meaning remain +equivalent while intentional configuration changes produce a value-free review +plan. The result is offline evidence, not runtime observation, signed approval, +or country governance acceptance. + +`check --explain` reports the current redacted acquisition, authorization, +output, claim, and disclosure plan. It does not compare the project with its +starter. +For an explicit trusted-local terminal review, add `--show-authored-values`. +This human-only view can show directly authored or environment-bound scalar metadata classified +as public, internal, structural, or sensitive. It prints each source and sensitivity so a reviewer +can inspect their local project without weakening the portable report boundary. Treat the output +as project-sensitive and do not copy it into logs, tickets, or shared artifacts. It is not a +report, evidence, or export mode. +Secret values, secret references and runtime secret-file locators, fixture data, raw parser text, +defaulted values, and derived values remain hidden. +The flag requires `--explain`; combining it with `--format json` is rejected. Default human output, +JSON output, generated artifacts, and comparison and promotion reports remain redacted. Without `--against`, `check` and `build` label the baseline `initial_without_baseline`. Their `semantic_changes` entries identify changed `claim`, `integration`, `service_policy`, @@ -90,6 +150,55 @@ Registry Stack does not create a separate reviewer workflow. The `registryctl.project_command.v1` build report identifies the complete generated build root in its `output` field. Automation must use that field instead of constructing a path from registryctl's private generated directory layout. +Treat the Relay and Notary configuration below that root as build output, not another authoring +surface. `registryctl` diagnostics apply to the project sources that produced it. Hand-editing +compiled configuration is unsupported and has no project-level diagnostic path; change the project +and regenerate the output. + +### Same-v1 migration checks + +`migrate` implements one reviewed compatibility adapter, not a new authoring contract version. +The adapter recognizes the three project-authoring paths retired when attribute release became a +default Registry Relay capability: + +- `/services/*/api/attribute_release_profiles/*/subject/input`, an unused hint whose removal + preserves behavior. +- `/services/*/api/attribute_release_profiles/*/response/max_age_seconds`, whose removal changes + a previously cacheable response to + `private, no-store` and requires semantic review. +- `/services/*/api/attribute_release_profiles/*/response`, the empty wrapper left after the + reviewed field removal. + +The command preserves original bytes for every unaffected authored file. +A current starter returns `no_migration_required` and does not emit a formatting-only candidate. +An eligible historical project returns `review_required` because the cache policy changed. +That disposition exits zero because the check or candidate emission succeeded, but it is not +approval or migration completion. +Automation must inspect `disposition`, every `reviews[].status`, `blocking_reasons`, and +`rerun_gates` before applying a separate candidate. + +Source version failures that can be safely inspected return a value-free JSON report with a closed +diagnostic code, phase, and remediation. +An unsupported target request records `target_version: null` and `direction: unsupported_target` +for every contract because no supported target contract exists. +Its gates are `not_applicable`, and a request with an otherwise supported source reports only the +`target_version_unsupported` blocker, without implying contract removal, downgrade, missing +catalog work, or an unrun gate. +Failed schema, fixture, check, build, and generated-reference gates retain the same closed evidence +without embedding the underlying error, authored values, or paths. +The JSON Schema closes every diagnostic field and value. +The Rust data-transfer object additionally enforces diagnostic-to-version-support and +diagnostic-to-gate-status relationships that JSON Schema cannot correlate across arrays. + +Command-line syntax errors, an unsafe or unreadable project root, and a symlink encountered before +safe inspection of the root YAML occur before report construction. +Those boundary failures exit nonzero without a migration report. +Candidate staging rejects every symlink and has bounded file-count, per-file, and total-size limits; +the published candidate contains only the strict loader's authored-input closure. + +{/* Evidence: crates/registryctl/src/project_authoring/migration.rs, + crates/registryctl/tests/project_migration_command.rs, and + crates/registryctl/tests/project_migration_contract.rs. */} For invalid authoring, `check` exits nonzero and reports a nonempty typed diagnostic list. The default human output and `--format json` use the same diagnostics, stable codes, normalized @@ -133,7 +242,7 @@ OpenSPP release. earlier `registryctl`, create or verify the same files with: ```sh -registryctl authoring editor --project-dir +registryctl authoring editor --project-dir registry-project ``` The command copies the five JSON Schema Draft 2020-12 documents embedded in the running @@ -391,6 +500,9 @@ Related environment variables are listed in the [environment variable reference] ## Source -The released command tree comes from the registryctl source at `v0.13.0`. -For its canonical definitions, read the -[registryctl command tree in `src/main.rs`](https://github.com/registrystack/registry-stack/blob/v0.13.0/crates/registryctl/src/main.rs). +The command tables on this page come from Main source (unreleased). +They do not establish a release candidate and do not describe the `v0.13.0` artifact. +Use [Test one current source revision](../../start/test-current-source-revision/) to build and +identify the exact source used for a review. +For the last released command tree, read the +[registryctl `v0.13.0` command tree](https://github.com/registrystack/registry-stack/blob/v0.13.0/crates/registryctl/src/main.rs). diff --git a/docs/site/src/content/docs/start/credential-tour.mdx b/docs/site/src/content/docs/start/credential-tour.mdx index 3690b23f3..f877a2eae 100644 --- a/docs/site/src/content/docs/start/credential-tour.mdx +++ b/docs/site/src/content/docs/start/credential-tour.mdx @@ -23,7 +23,7 @@ evaluation provenance for every selected claim. Source-free claims remain available for evaluation and rendering. They cannot belong to a credential profile or OID4VCI credential configuration. -Use [Evaluate a claim with Registry Notary](../../tutorials/verify-claim-registry-api/) +Use [Evaluate a claim with Registry Notary](/journeys/registry-backed-notary-claim/) for the current local Relay-backed journey. A hosted credential tour can return only after the lab provides a combined Relay and Notary flow that preserves and verifies the exact compiler-pinned Relay execution before signing. diff --git a/docs/site/src/content/docs/start/quickstart.mdx b/docs/site/src/content/docs/start/quickstart.mdx index a8c9d92f6..83e16806d 100644 --- a/docs/site/src/content/docs/start/quickstart.mdx +++ b/docs/site/src/content/docs/start/quickstart.mdx @@ -101,7 +101,7 @@ URL, or monorepo path is part of the journey. inspect the topology and call a Notary evaluation route directly. - [Run a protected registry API locally](../../tutorials/publish-spreadsheet-secured-registry-api/): generate a smaller Relay project from a sample workbook. -- [Evaluate a claim with Registry Notary](../../tutorials/verify-claim-registry-api/): +- [Evaluate a claim with Registry Notary](../../journeys/registry-backed-notary-claim/): extend the generated project with Notary. ## Troubleshooting diff --git a/docs/site/src/content/docs/start/test-current-source-revision.mdx b/docs/site/src/content/docs/start/test-current-source-revision.mdx new file mode 100644 index 000000000..9cf6fbc86 --- /dev/null +++ b/docs/site/src/content/docs/start/test-current-source-revision.mdx @@ -0,0 +1,207 @@ +--- +title: Test one current source revision +description: Pin one Registry Stack commit, build registryctl, and run the matching local Relay and Notary source-under-test gate. +status: current +owner: registry-docs +source_repos: + - registry-stack +last_reviewed: "2026-07-26" +doc_type: how-to +locale: en +standards_referenced: [] +--- + +Use this procedure when a Registry Docs page requires behavior from Main source that has not been +released. +You will freeze one Git commit, build its `registryctl`, and run the repository-owned gate that +builds matching local Registry Relay and Registry Notary artifacts from the same checkout. + +This procedure produces source-under-test evidence only. +The result is not a release, release candidate, signed artifact set, production image, country +acceptance result, or interoperability result. + +{/* Evidence: docs/site/scripts/check-registryctl-tutorials.sh, + docs/site/scripts/registryctl-tutorial.test.mjs, + crates/registryctl/src/lib.rs, and release/VERIFY.md. */} + +## Prerequisites + +- Git +- Rust and Cargo +- Node.js 22.12.0 and npm +- Docker with Linux AMD64 container support and Docker Compose v2 +- `curl` and `jq` +- Free loopback ports `4242` and `4255` + +The complete source-under-test gate can take up to one hour on an uncached machine. +It uses only synthetic tutorial data and local demo credentials. + +## Pin one commit + +Clone the repository, resolve Main once, and detach the checkout at that full commit: + +```sh +git clone https://github.com/registrystack/registry-stack registry-stack-source-review +cd registry-stack-source-review +git fetch --prune origin main +SOURCE_REF="$(git rev-parse --verify origin/main^{commit})" +test "$(printf '%s' "$SOURCE_REF" | wc -c | tr -d ' ')" = 40 +git switch --detach "$SOURCE_REF" +test "$(git rev-parse HEAD)" = "$SOURCE_REF" +printf 'Registry Stack source: %s\n' "$SOURCE_REF" +``` + +If a review names a different commit, fetch the named review ref first and resolve that ref in +place of `origin/main`. +Do not continue from a branch name or abbreviated commit. +Record the printed `SOURCE_REF` with the review results. + +## Build registryctl for offline authoring + +Build the CLI from the pinned checkout with the committed Cargo lockfile: + +```sh +cargo build --locked -p registryctl +REGISTRYCTL_BIN="$PWD/target/debug/registryctl" +test -x "$REGISTRYCTL_BIN" +"$REGISTRYCTL_BIN" --version +test "$(git rev-parse HEAD)" = "$SOURCE_REF" +``` + +The package version printed by `registryctl --version` does not identify the source commit. +Keep the recorded `SOURCE_REF` with every result. + +The current project-authoring commands do not need an image lock because they build unsigned +product configuration inputs and do not select runtime images. +You can run the offline authoring journey with this binary: + +```sh +"$REGISTRYCTL_BIN" init --from http --project-dir registry-project +"$REGISTRYCTL_BIN" test --project-dir registry-project +"$REGISTRYCTL_BIN" check \ + --project-dir registry-project \ + --environment local \ + --explain +"$REGISTRYCTL_BIN" build \ + --project-dir registry-project \ + --environment local +``` + +These commands do not build, sign, or deploy a runtime bundle. + +## Run the matching local runtime gate + +Run the repository-owned test and gate from the same pinned checkout: + +```sh +cd docs/site +npm ci +npm run test:tutorial:registryctl +npm run check:tutorial:registryctl +``` + +The gate performs these source-bound steps without downloading released Registry Stack +artifacts: + +1. Builds Linux AMD64 `registryctl`, Registry Relay, Registry Notary, and their dedicated Rhai and + CEL workers from the pinned checkout with `Cargo.lock`. +2. Builds the local Relay and Notary image shapes with the product release Dockerfiles. +3. Produces a strict temporary source-test lock beside the source-built `registryctl`, with both + `manifest_source_ref` and `tag_target` set to the checkout commit. +4. Runs project generation through that lock, then rebinds the generated Compose files to the + local source-under-test image tags. +5. Executes the protected spreadsheet API and registry-backed claim tutorials, then removes the + temporary lock, images, projects, and demo credentials. + +The temporary lock contains generation-only image sentinels. +The sentinels are not the identity of the local images, and the gate does not retain or publish the +lock as a reusable artifact. +The explicit rebind step is part of the source test. +A successful run ends with: + +```text +registryctl tutorial source check: PASS +``` + +The pass result proves that the two local tutorial journeys ran against products built from the +recorded checkout. +It does not prove release authenticity, reproducible image digests, provenance, production +fitness, or external acceptance. + +## Verify an explicitly supplied test lock + +The all-in-one gate selects its temporary lock beside its source-built binary and deletes the lock +at cleanup. +It does not leave a lock for later commands. + +Use `REGISTRYCTL_IMAGE_LOCK` only when a separate source test has supplied a regular file at an +explicit absolute path. +Do not copy, edit, or relabel a released lock. +Before selecting the supplied file, verify its closed shape, package version, platform, +repositories, and source fields: + +```sh +cd registry-stack-source-review +SOURCE_REF="$(git rev-parse HEAD)" +REGISTRYCTL_BIN="$PWD/target/debug/registryctl" +REGISTRYCTL_VERSION="$("$REGISTRYCTL_BIN" --version | awk 'NR == 1 { print $2 }')" +LOCK_PATH=/absolute/path/to/registryctl-source-test-image-lock.json + +case "$LOCK_PATH" in + /*) ;; + *) printf 'LOCK_PATH must be absolute\n' >&2; exit 1 ;; +esac +test -f "$LOCK_PATH" +test ! -L "$LOCK_PATH" + +jq -e \ + --arg source_ref "$SOURCE_REF" \ + --arg release_tag "v$REGISTRYCTL_VERSION" \ + ' + keys == [ + "images", + "manifest_source_ref", + "platform", + "release_tag", + "schema_version", + "tag_target" + ] and + .schema_version == "registryctl.release_image_lock.v1" and + .release_tag == $release_tag and + .manifest_source_ref == $source_ref and + .tag_target == $source_ref and + .platform == "linux/amd64" and + (.images | keys == ["registry-notary", "registry-relay"]) and + (.images["registry-relay"] | + test("^ghcr.io/registrystack/registry-relay@sha256:[0-9a-f]{64}$")) and + (.images["registry-notary"] | + test("^ghcr.io/registrystack/registry-notary@sha256:[0-9a-f]{64}$")) + ' "$LOCK_PATH" + +export REGISTRYCTL_IMAGE_LOCK="$LOCK_PATH" +``` + +The equality checks bind the lock metadata to the checkout. +They do not prove that the referenced images were built from the commit. +A retained artifact set needs separate image-digest, signature, and provenance evidence. +Use the [release verification procedure](https://github.com/registrystack/registry-stack/blob/v0.13.0/release/VERIFY.md) +for a published release. + +`REGISTRYCTL_IMAGE_LOCK` changes only where `registryctl` reads the lock. +The CLI still rejects an invalid schema, version, platform, repository, digest shape, symlink, or +oversized file. +Unset the override after the bounded source test: + +```sh +unset REGISTRYCTL_IMAGE_LOCK +``` + +## Troubleshooting + +| Symptom | Cause | Fix | +| --- | --- | --- | +| The source gate reports a missing command | A prerequisite is absent from `PATH` | Install the named prerequisite, then rerun the gate from the pinned checkout | +| The source gate reports that Docker is unavailable | The Docker daemon is stopped or inaccessible | Start Docker and verify `docker info` before retrying | +| The gate reports that a loopback port is occupied | Another process uses `4242` or `4255` | Stop that local process, then rerun the complete gate | +| The lock field check exits nonzero | The lock is malformed, belongs to another package version or commit, or uses an unsupported image reference | Reject the lock; do not edit it into agreement | +| A source-built generation command reports a missing lock | The command is `init relay` or `add notary`, which selects runnable images | Use the complete source-under-test gate, or use a verified released binary and its matching released lock | diff --git a/docs/site/src/content/docs/start/when-to-use.mdx b/docs/site/src/content/docs/start/when-to-use.mdx index 310eb3202..a327ff490 100644 --- a/docs/site/src/content/docs/start/when-to-use.mdx +++ b/docs/site/src/content/docs/start/when-to-use.mdx @@ -107,6 +107,6 @@ Registry Stack deliberately leaves these to other systems: ## Next - [Run a protected registry API locally](../../tutorials/publish-spreadsheet-secured-registry-api/) -- [Evaluate a claim with Registry Notary](../../tutorials/verify-claim-registry-api/) +- [Evaluate a claim with Registry Notary](/journeys/registry-backed-notary-claim/) - [Choose by question (homepage router)](../../) - [Architecture overview](../../explanation/architecture/) diff --git a/docs/site/src/content/docs/tutorials/author-registry-project.mdx b/docs/site/src/content/docs/tutorials/author-registry-project.mdx index 53c96e6e0..b228e6ea0 100644 --- a/docs/site/src/content/docs/tutorials/author-registry-project.mdx +++ b/docs/site/src/content/docs/tutorials/author-registry-project.mdx @@ -20,6 +20,16 @@ You will copy the built-in starter, prove its synthetic journey offline, inspect acquisition and disclosure plan, and build separate unsigned inputs for Registry Relay and Registry Notary. +This tutorial documents Main source (unreleased). +The source has not been designated as a release candidate. +The `v0.13.0` `registryctl` command-tree source does not define the `preflight`, `capabilities`, +`compare`, `promote`, `migrate`, `authoring reference`, or `project diagnostics` steps required +by this tutorial. +The `Registry Stack 0.13.0` value printed by `init` is bundled starter provenance, not evidence +that every command in this tutorial shipped in `v0.13.0`. +Follow [Test one current source revision](../../start/test-current-source-revision/) to pin the +checkout and build the exact `registryctl` used for this journey. + One project defines one registry trust domain. A deployment can use Relay only for governed materialization and records APIs, Notary only for source-free or self-attested evidence, or both products for registry-backed consultations and claims derived from Relay outputs. Independent @@ -43,7 +53,10 @@ Do not add source credentials, production endpoints, or real subject records. Use this compact sequence as the workflow checklist. The sections that follow explain each command and the trust boundary it verifies. - + ## Copy the HTTP starter @@ -70,8 +83,18 @@ Next: Add `--format json` when another program needs the versioned initialization report. The copied `registry-stack.yaml` keeps the complete starter provenance, -including its authored-content digest. Later, `check --explain` reports whether -the workspace still matches that starter or has intentionally diverged. +including its authored-content digest. Compare normalized effective state with +the exact starter embedded in the current source build: + +```sh +registryctl compare \ + --project-dir registry-project \ + --environment local \ + --from-starter +``` + +The value-free result distinguishes an equivalent starter from an intentionally +adapted project. It does not observe runtime behavior or grant approval. The command creates this authored layout: @@ -126,22 +149,60 @@ registryctl test \ ``` The human-readable report identifies the selected fixture, typed input, source call, minimized -output, claim results, and derived security cases. The report starts with: +output, claim results, and derived security cases. The complete report is: ```text -PASS: 7/7 fixtures passed +PASS: 9/9 fixtures passed PASS person-record.active-person inputs: person_id calls: call=1 operation=request method=GET path=/people/* query=[fields] headers=[] body=none outputs: active claims: person-active, person-record-exists outcome: match + PASS person-record.active-person::derived/request_to_consultation_binding + inputs: person_id + calls: notary-relay-consultation + claims: person-record-exists + source access: true + PASS person-record.active-person::derived/request_authority + inputs: person_id + expected error: fixture.request_mismatch + source access: false + PASS person-record.active-person::derived/status_rejection + inputs: person_id + calls: call=1 operation=request method=GET path=/people/* query=[fields] headers=[] body=none + expected error: source.status_rejected + source access: true + PASS person-record.active-person::derived/malformed_decode + inputs: person_id + calls: call=1 operation=request method=GET path=/people/* query=[fields] headers=[] body=none + expected error: source.response_malformed + source access: true + PASS person-record.active-person::derived/byte_ceiling + inputs: person_id + calls: call=1 operation=request method=GET path=/people/* query=[fields] headers=[] body=none + expected error: source.response_too_large + source access: true + PASS person-record.active-person::derived/timeout + inputs: person_id + calls: call=1 operation=request method=GET path=/people/* query=[fields] headers=[] body=none + expected error: source.deadline_exceeded + source access: true + PASS person-record.active-person::derived/authorization_before_source + inputs: person_id + expected error: authorization.denied + source access: false + PASS person-record.active-person::derived/output_minimization + inputs: person_id + calls: call=1 operation=request method=GET path=/people/* query=[fields] headers=[] body=none + outputs: active + claims: person-active, person-record-exists + outcome: match + source access: true ``` -The same report includes derived malformed-decoding, byte-ceiling, timeout, -authorization-before-source, and output-minimization cases. The command does not contact Registry -Relay, Registry Notary, or a source registry. Add `--format json` when another program needs the -versioned fixture report. +The command does not contact Registry Relay, Registry Notary, or a source registry. +Add `--format json` when another program needs the versioned fixture report. ## Watch the selected fixture @@ -155,7 +216,7 @@ registryctl test \ --watch ``` -The command prints `PASS: 1/1 fixtures passed`, waits for an authored file to change, then reruns +The command prints `PASS: 9/9 fixtures passed`, waits for an authored file to change, then reruns the selected fixture. Use the preceding non-watch command for the full trace. Press `Ctrl+C` after you confirm the initial pass. The watcher ignores generated `.registry-stack` output and never enables live source access. @@ -309,7 +370,7 @@ registryctl check \ The human-readable review report starts with: ```text -Registry Stack project: fictional-citizen-registry (valid) +Registry Stack project: fictional-civic-support-registry (valid) Environment: local Baseline: initial_without_baseline ``` @@ -317,6 +378,31 @@ Baseline: initial_without_baseline Review the fixed request authority, input mappings, caller scopes, purpose, outputs, claims, disclosure modes, and credential membership. Use `--format json` only when another tool needs the machine-readable report. + +When a human reviewer needs to inspect directly authored non-secret scalar metadata in this local +workspace, opt in to the trusted-local terminal view: + +```sh +registryctl check \ + --project-dir registry-project \ + --environment local \ + --explain \ + --show-authored-values +``` + +The extra section starts with both safety notices: + +```text +WARNING: trusted-local authored values follow. This output includes project-sensitive metadata and must not be shared. +Secret values, secret references and runtime secret-file locators, fixture data, raw parser text, defaulted values, and derived values remain hidden. +``` + +This view can show directly authored or environment-bound public, internal, structural, and +sensitive metadata, including its source and sensitivity. It is human output only, requires +`--explain`, and is not a report, evidence, or export mode. Treat the terminal output as +project-sensitive, and do not share it. Default human output and `--format json` remain redacted; +combining `--show-authored-values` with JSON output is rejected. + An initial project without an approved baseline requires the `claim`, `integration`, `service_policy`, `operator_security`, and `disclosure` review classes. A valid report is not legal approval, source interoperability evidence, or deployment authority. @@ -334,29 +420,22 @@ registryctl build \ The human-readable report starts with the built project and output directory: ```text -Built Registry Stack project "fictional-citizen-registry". +Built Registry Stack project "fictional-civic-support-registry". Environment: local - Output: registry-project/.registry-stack/build/local + Output: .registry-stack/build/local ``` Add `--format json` when another program needs the versioned build report. -The output root contains: - -```text -registry-project/.registry-stack/build/local/ - reviewable/ - integration-packs/ - consultation-contracts/ - review.json - private/ - relay/ - config/relay.yaml - approval/review.json - notary/ - config/notary.yaml - approval/review.json -``` +The build report identifies `.registry-stack/build/local/artifact-manifest.json`, relative to the +project directory. Treat that strict `registry.project.artifact_manifest.v1` document as the +complete tree and classification source. +It records every reviewable, private, operations, secret-consumer, approval-state, Relay, and +Notary artifact plus its digest, edit policy, publication boundary, consumers, and permitted +lifecycle actions. The top-level `generator` records which `registryctl` version produced the tree. +An artifact action of `regenerate` is lifecycle metadata, not a per-artifact command. Rerun the +top-level `registryctl build` command above to regenerate the complete environment output. Do not +maintain or automate against a copied directory listing. The product input directories remain separate and contain secret references, not secret values. They are inputs to each product's Config Bundle workflow, not a signed project root or a deployable diff --git a/docs/site/src/content/docs/tutorials/configure-project-api-key-authentication.mdx b/docs/site/src/content/docs/tutorials/configure-project-api-key-authentication.mdx index 12e972686..607fc418d 100644 --- a/docs/site/src/content/docs/tutorials/configure-project-api-key-authentication.mdx +++ b/docs/site/src/content/docs/tutorials/configure-project-api-key-authentication.mdx @@ -114,10 +114,12 @@ Record that residual risk in the operator-security review. Run the offline fixtures and semantic check: ```sh -registryctl test --project-dir +PROJECT_DIR=registry-project +ENVIRONMENT=local +registryctl test --project-dir "$PROJECT_DIR" registryctl check \ - --project-dir \ - --environment \ + --project-dir "$PROJECT_DIR" \ + --environment "$ENVIRONMENT" \ --explain ``` diff --git a/docs/site/src/content/docs/tutorials/configure-project-fhir-r4.mdx b/docs/site/src/content/docs/tutorials/configure-project-fhir-r4.mdx index ac3097959..688252fdc 100644 --- a/docs/site/src/content/docs/tutorials/configure-project-fhir-r4.mdx +++ b/docs/site/src/content/docs/tutorials/configure-project-fhir-r4.mdx @@ -5,7 +5,7 @@ status: draft owner: registry-docs source_repos: - registry-stack -last_reviewed: "2026-07-13" +last_reviewed: "2026-07-26" doc_type: how-to locale: en standards_referenced: @@ -64,7 +64,7 @@ revision: 1 source: product: fhir-server versions: { unverified: [r4-api] } - auth: { type: none } + auth: { type: static_bearer } allow: - { method: GET, path: /fhir/Patient } - { method: GET, path: /fhir/Coverage } @@ -84,13 +84,10 @@ capability: script: { file: adapter.rhai } outputs: - coverage_status: { type: string, maxLength: 32 } - insurer_name: { type: string, maxLength: 160 } + coverage_status: { type: [string, "null"], maxLength: 16 } + insurer_name: { type: [string, "null"], maxLength: 120 } -limits: - calls: 5 - source_bytes: 2MiB - deadline: 15s +limits: { calls: 4, source_bytes: 512KiB, request_bytes: 8KiB, deadline: 12s } ``` An exact rule admits only that path. `*` admits one bounded path segment. A terminal `/**` is @@ -137,13 +134,15 @@ integrations: coverage: source: origin: https://fhir.internal.invalid - timeout: 10s - concurrency: 4 - rate: { per_minute: 120, burst: 10 } + credential: + token: { secret: FHIR_ACCESS_TOKEN } + generation: 1 ``` -Add private CIDRs, a private CA, mTLS, or a credential binding only when the deployment needs -them. These settings cannot widen the stable method and path authority. +The `static_bearer` declaration requires this environment-owned token reference. Preflight checks +that the reference resolves without retaining or printing the token. Add private CIDRs, a private +CA, or mTLS only when the deployment needs them. Environment settings cannot widen the stable +method, path, call, byte, or deadline authority. ## Add request-aware fixtures @@ -156,10 +155,12 @@ checks. ## Verify the journey ```sh -registryctl test --project-dir +PROJECT_DIR=fhir-project +ENVIRONMENT=local +registryctl test --project-dir "$PROJECT_DIR" registryctl check \ - --project-dir \ - --environment \ + --project-dir "$PROJECT_DIR" \ + --environment "$ENVIRONMENT" \ --explain ``` diff --git a/docs/site/src/content/docs/tutorials/configure-project-snapshot-materialization.mdx b/docs/site/src/content/docs/tutorials/configure-project-snapshot-materialization.mdx index 4d3c76cf6..b01554fd2 100644 --- a/docs/site/src/content/docs/tutorials/configure-project-snapshot-materialization.mdx +++ b/docs/site/src/content/docs/tutorials/configure-project-snapshot-materialization.mdx @@ -1,6 +1,6 @@ --- title: Configure an exact snapshot materialization -description: Use one private materialization binding for a governed records API and exact evidence consultations in a Registry Stack project. +description: Use one private materialization binding for exact evidence consultations, then optionally share it with a governed records API. status: draft owner: registry-docs source_repos: @@ -16,10 +16,11 @@ import ProjectStarterSequence from '../../../components/ProjectStarterSequence.a Use this guide when Registry Relay must query an immutable local materialization instead of opening a source connection for each consultation. You will declare one logical entity, bind its physical source once in the private -environment, and reuse the published snapshot for a governed records API and exact `snapshot` -consultations. +environment, and use the published snapshot for exact `snapshot` consultations. An advanced +variant can expose the same materialization through a governed records API. -{/* Evidence: crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/ and +{/* Evidence: crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/, + crates/registryctl/tests/fixtures/project-authoring/snapshot-with-records/, and crates/registryctl/tests/project_authoring.rs, records_and_snapshot_share_one_generated_materialization. */} @@ -64,11 +65,12 @@ primary_key: person_id schema: type: object additionalProperties: false - required: [person_id, registration_status, residency_confirmed] + required: [person_id, registration_status, residency_confirmed, guardian_id] properties: person_id: { type: string, maxLength: 64 } registration_status: { type: [string, "null"], maxLength: 32 } residency_confirmed: { type: [boolean, "null"] } + guardian_id: { type: [string, "null"], maxLength: 64 } materialization: max_records: 1000000 max_bytes: 256MiB @@ -79,10 +81,15 @@ materialization: The entity owns the reusable logical schema and bounded materialization footprint. It rejects physical provider, path, table, worksheet, and column members. A records service is optional and does not change the entity used by `snapshot`. +`retain_generations` is an authored value from `1` through `16`. It includes the active completed +generation in a bounded cache recovery set. Retaining a generation does not make that generation +an operator-selectable rollback target. -## Add the records service +## Optionally add the records service -Reference the entity and configure its optional records service in `registry-stack.yaml`: +The smallest `snapshot-exact` workspace has evidence services only. The maintained +`snapshot-with-records` workspace proves the advanced shared-materialization shape. In that +variant, reference the same entity from an optional records service in `registry-stack.yaml`: ```yaml entities: @@ -136,9 +143,11 @@ capability: outputs: [registration_status, residency_confirmed] ``` -The `snapshot` capability applies the complete exact selector to one immutable published handle and probes at -most two rows. -Two matches return `ambiguous`; Registry Relay does not choose one. +The `snapshot` capability applies the complete exact selector to one immutable published handle. +In this canonical journey, the selector is the entity primary key and its materialized unique-key +constraint permits at most one record. Ambiguity is therefore explicitly not applicable, with the +reviewed rationale and `snapshot-match` request fixture recorded in the integration. Registry Relay +does not probe for or invent an ambiguity case that the compiled contract makes impossible. Add an evidence service and consultation in `registry-stack.yaml`, mapping `person_id` from one declared request identifier. This Notary-owned service defines its service policy, claims, @@ -170,6 +179,7 @@ entities: person_id: subject_key registration_status: status_code residency_confirmed: residency_flag + guardian_id: guardian_key source_revision: population-export-v1 generation: 2026-07-12 ``` @@ -177,23 +187,26 @@ entities: Every logical field has one physical column, and physical columns must be unique. Change `generation` when the provider or mapping changes. -`registryctl build` emits one ingest plan and one materialization identity. -The records service and compatible snapshot profiles capture the same published handle -instead of creating another source path or copying the physical mapping. +`registryctl build` emits one ingest plan and one materialization identity. In the +`snapshot-with-records` advanced variant, the records service and compatible snapshot profiles +capture the same published handle instead of creating another source path or copying the physical +mapping. ## Verify shared materialization Run the fixtures, semantic check, and build: ```sh -registryctl test --project-dir +PROJECT_DIR=snapshot-project +ENVIRONMENT=local +registryctl test --project-dir "$PROJECT_DIR" registryctl check \ - --project-dir \ - --environment \ + --project-dir "$PROJECT_DIR" \ + --environment "$ENVIRONMENT" \ --explain registryctl build \ - --project-dir \ - --environment + --project-dir "$PROJECT_DIR" \ + --environment "$ENVIRONMENT" ``` The human-readable test report starts with `PASS`, the check report marks the project `valid`, and @@ -202,9 +215,20 @@ Confirm that the explanation names one logical materialization and that no revie pack or consultation contract contains the provider path or physical column names. If the snapshot is absent, stale, or does not match the active generation and digest, only the -dependent profiles become unready. +dependent SnapshotExact execution fails closed with `consultation.unavailable`. +An execution-time freshness failure does not change global `/ready`, which can remain `200`. Registry Relay does not fall back to live source access. +Reload the audited SnapshotExact source through its table-specific protected admin endpoint. +When any audited SnapshotExact binding is configured, Registry Relay rejects +`POST /admin/v1/reload` before source access and refreshes no resources. Current Relay does not +provide atomic multi-materialization reload. + +Back up immutable source inputs, the Relay ingest cache, and the complete Relay consultation +database at one coordinated quiesced recovery point. Retain access-controlled evidence that binds +their artifact hashes to the exact active generation and restricted content digest. Do not infer a +recoverable set from independently timed backups. + ## Troubleshooting | Symptom | Cause | Fix | diff --git a/docs/site/src/content/docs/tutorials/first-run-with-solmara-lab.mdx b/docs/site/src/content/docs/tutorials/first-run-with-solmara-lab.mdx index 99ca685a9..761ca5041 100644 --- a/docs/site/src/content/docs/tutorials/first-run-with-solmara-lab.mdx +++ b/docs/site/src/content/docs/tutorials/first-run-with-solmara-lab.mdx @@ -37,7 +37,7 @@ Do not use the generated local keys in production. For a standalone local project generated from your own data, use the `registryctl` tutorials: [run a protected registry API](../publish-spreadsheet-secured-registry-api/) or -[evaluate a claim with Registry Notary](../verify-claim-registry-api/). Clone Solmara Lab when you +[evaluate a claim with Registry Notary](/journeys/registry-backed-notary-claim/). Clone Solmara Lab when you want the full multi-service country demo. ## Prerequisites @@ -137,7 +137,7 @@ directly. The topology figure shows the full port map. Each instance publishes its rendered API reference at `/docs`, a route that is always public, and its raw `/openapi.json`, public here because every Relay and Notary configuration in this lab sets `openapi_requires_auth: false`. This is the same route pattern documented in -[Evaluate a claim with Registry Notary](../verify-claim-registry-api/). +[Evaluate a claim with Registry Notary](/journeys/registry-backed-notary-claim/). ## See it: the citizen portal and the Visitor's Center @@ -240,7 +240,7 @@ so you can confirm what you ran by hand against what the lab publishes. - [Run a protected registry API locally](../publish-spreadsheet-secured-registry-api/): generate a smaller local Relay project from a sample workbook. -- [Evaluate a claim with Registry Notary](../verify-claim-registry-api/): add Notary to that local +- [Evaluate a claim with Registry Notary](/journeys/registry-backed-notary-claim/): add Notary to that local project. - [When to use Registry Stack](../../start/when-to-use/): decide whether Relay, Notary, or both fit your integration. diff --git a/docs/site/src/content/docs/tutorials/move-notary-to-production-signing.mdx b/docs/site/src/content/docs/tutorials/move-notary-to-production-signing.mdx index c3c0052db..43f9acaf9 100644 --- a/docs/site/src/content/docs/tutorials/move-notary-to-production-signing.mdx +++ b/docs/site/src/content/docs/tutorials/move-notary-to-production-signing.mdx @@ -59,8 +59,9 @@ check the complete provider contract and current limits before provisioning the Find the demo key, issuer, and every profile that references the key: ```sh +NOTARY_CONFIG=generated-inputs/notary/config/notary.yaml rg -n 'registry-notary-demo|local_jwk_env|private_jwk_env|signing_key:|issuer:' \ - + "$NOTARY_CONFIG" ``` A generated demo configuration contains fields like these: diff --git a/docs/site/src/content/docs/tutorials/publish-spreadsheet-secured-registry-api.mdx b/docs/site/src/content/docs/tutorials/publish-spreadsheet-secured-registry-api.mdx index 4695d0f6e..ae6d27185 100644 --- a/docs/site/src/content/docs/tutorials/publish-spreadsheet-secured-registry-api.mdx +++ b/docs/site/src/content/docs/tutorials/publish-spreadsheet-secured-registry-api.mdx @@ -1,6 +1,6 @@ --- title: Run a protected registry API locally -description: Start a local Registry Relay over a tiny benefits workbook, make denied and allowed requests, inspect the generated contract, and change a disclosure rule. +description: Start a local Registry Relay over a tiny benefits workbook, make denied and allowed requests, inspect the editable local scaffold, and change a disclosure rule. status: current owner: registry-docs source_repos: @@ -19,7 +19,7 @@ Registry Relay turns a tabular source you already hold, such as a spreadsheet or table, into a protected, read-only API without copying the data out. Use this tutorial to start a protected registry API on your machine. You will create a local project from a tiny benefits workbook, compare operational and restricted -identity reads, and inspect the contract Registry Stack generated. +identity reads, and inspect the editable local contract scaffold Registry Stack initialized. = 2 code="config.validation_error" dataset_id=benefits_casework aggregate_id=by_district +relay.startup.config_validation_rejected ``` -The dataset is marked `sensitivity: personal` in the same file, and Relay refuses to run -an aggregate-only definition over personal data with a disclosure floor under 2. -You can raise the rule; you cannot weaken it past the floor. -The error names `min_cell_size`, the API field that corresponds to the `min_group_size` -config key; the aggregate response uses the API name too. +The code establishes that the parsed Relay configuration failed a product invariant. +It does not repeat configured identifiers, values, or raw validation text. +In this controlled exercise, the only configuration edit was changing `min_group_size` +from 3 to 1. +The dataset is marked `sensitivity: personal` in the same file, so restore the documented +floor instead of trying to diagnose the rule from private process output. +Use the [operator diagnostic reference](../../reference/diagnostics/operator/) for the +code's static meaning, evidence limit, and remediation. Restore `min_group_size` to 2 and restart once more: @@ -447,7 +454,8 @@ registryctl stop ``` This stops the local containers. -It does not delete your workbook, generated config, local keys, or smoke results. +It does not delete your workbook, editable Relay configuration scaffold, generated local keys, or +smoke results. ## What you built @@ -464,7 +472,7 @@ Relay refused to start when the floor dropped under 2 on personal data. ## Next -- [Evaluate a registry-backed claim locally](../verify-claim-registry-api/): add Notary to this same +- [Evaluate a registry-backed claim locally](/journeys/registry-backed-notary-claim/): add Notary to this same project, match by name and date of birth, and evaluate registration acceptance without exposing the source row. - [Author an HTTP Registry Stack project](../author-registry-project/): adapt a source through @@ -478,8 +486,8 @@ Relay refused to start when the floor dropped under 2 on personal data. | The installer reports an unsupported platform | No binary is published for that OS or CPU. | Run the pinned `cargo install` command printed by the installer. For `v0.9.0` or later, also checksum-verify the matching `registryctl-vX.Y.Z-image-lock.json` release asset and place it beside the installed binary. | | `registryctl start` cannot find Docker | Docker or another Compose provider is not installed or running. | Start Docker Desktop, OrbStack, Colima, Podman, or your supported provider, then run `registryctl start` again. | | Docker reports no `linux/arm64` manifest for a Registry Stack image | The v0.13.0 Relay and Notary images are published for `linux/amd64` only. | Start with `DOCKER_DEFAULT_PLATFORM=linux/amd64 registryctl start`. | -| `registryctl start` fails and the container log shows `failed to parse config YAML ... unknown field` | The locally cached container image does not match the digest-pinned image in the generated `compose.yaml`. | Run `docker compose pull` in the project directory (on Apple silicon, prefix it with `DOCKER_DEFAULT_PLATFORM=linux/amd64`), then `registryctl start` again. | +| `registryctl start` fails and Relay reports `relay.startup.config_document_invalid` or `relay.startup.config_validation_rejected` after an image change | The locally cached container image may not match the digest-pinned image in the generated `compose.yaml`, or the scaffold is invalid for that image. | Pull the digest-pinned image, then validate the reviewed scaffold without pasting raw configuration into logs or support channels. | | `registryctl init` reports that its image lock is missing or invalid | The binary was moved or built without the strict image lock from the same release, or the file failed its release, source, platform, or digest checks. | Rerun the installer from the same pinned target tag so it checksum-verifies and installs both files. For an operator-managed or source-test location, set `REGISTRYCTL_IMAGE_LOCK` to the checksum-verified lock from that exact release. Do not substitute a lock from another version or a mutable image tag. | -| `registryctl start` fails with `Relay did not become healthy and ready before timeout` after a config edit | The edited `relay/config.yaml` fails validation, so the container exits at startup. | Run `registryctl logs`, fix the field named in the `ERROR` line, then run `registryctl stop` and `registryctl start` again. | +| `registryctl start` fails with `Relay did not become healthy and ready before timeout` after a config edit | The edited `relay/config.yaml` fails startup validation, so the container exits before readiness. | Use the stable Relay startup code and operator diagnostic reference to correct the reviewed field, then stop and start the project again. | | A row read returns `403 Forbidden` | The key is valid but lacks the row-read scope. | Use `ROW_READER_RAW` for row reads. | | A row read returns `400 auth.purpose_required` | The entity requires a `Data-Purpose` header. | Send `Data-Purpose: https://example.local/purpose/tutorial` or another purpose URI. | diff --git a/docs/site/src/content/docs/tutorials/verify-claim-registry-api.mdx b/docs/site/src/content/docs/tutorials/verify-claim-registry-api.mdx index f4766205e..4f469f3d6 100644 --- a/docs/site/src/content/docs/tutorials/verify-claim-registry-api.mdx +++ b/docs/site/src/content/docs/tutorials/verify-claim-registry-api.mdx @@ -1,13 +1,13 @@ --- title: Evaluate a registry-backed claim locally -description: Add Registry Notary to the protected spreadsheet project, match a person by name and date of birth, return one boolean claim, and edit its rule. -status: current +description: Add Registry Notary to the protected spreadsheet project, evaluate a bounded active-registration existence claim, and revise its governed meaning. +status: draft owner: registry-docs source_repos: - registry-stack - registry-relay - registry-notary -last_reviewed: "2026-07-19" +last_reviewed: "2026-07-26" doc_type: tutorial locale: en standards_referenced: [] @@ -15,32 +15,46 @@ standards_referenced: [] import QuickstartMeta from '../../../components/QuickstartMeta.astro'; +The canonical first-country path is the generated +[registry-backed Notary journey](/journeys/registry-backed-notary-claim/). It keeps the +configuration, fixture, evidence, and product-input gates synchronized with current source. Use +this longer Main-source walkthrough when you need the live local runtime details below. + This tutorial continues from the `my-first-api` project created in [Run a protected registry API locally](../publish-spreadsheet-secured-registry-api/). Imagine that a benefits intake service has collected an applicant's name and date of birth. It -needs to know whether the registry accepts that person's registration under the current intake -policy, but it should not receive the registry row or a national identifier. The initial policy -accepts active registrations and rejects pending ones. You will add Registry Notary, evaluate both -cases, and then expand the policy to accept pending registrations too. +needs to know whether one active matching registration exists in a selected registry source, but +the service must not receive the registry row or a national identifier. You will add Registry +Notary, evaluate active, pending, and no-match cases, then broaden and rename the predicate to +include pending registrations. Later tutorials will show how to start from your own registry and author a custom integration. Here, reusing the first tutorial's small workbook keeps the focus on making and changing a Notary claim. This tutorial uses synthetic data and local demo credentials. Do not use the generated keys or database settings in production. -:::note[Release status] -This tutorial requires `registryctl`, immutable Relay and Notary images, and the image lock from -the same Registry Stack `v0.13.0` release. Do not combine a source-built CLI with images or an -image lock from another release. +:::caution[Unreleased Main-source tutorial] +This page documents behavior added after Registry Stack `v0.13.0`. +The `v0.13.0` CLI and release assets are incompatible with these instructions because they +generate the older claim identifier. + +Use a Registry Stack Main checkout pinned to one exact Git commit that contains this page. Build +`registryctl`, the Relay and Notary images, and the source-under-test image lock from that same +checkout. Record the revision with `git rev-parse HEAD`, and require the lock's +`manifest_source_ref` and `tag_target` to equal that full commit. `registryctl --version` reports a +package version; it does not establish source revision or artifact identity. Do not combine +artifacts from different commits. +The [current-source test procedure](../../start/test-current-source-revision/) provides the exact +pin, build, field-verification, and all-in-one local runtime commands. This is an evaluation-only local tutorial. It does not issue a credential or prove wallet, credential-presentation, or OID4VCI interoperability. @@ -71,6 +85,14 @@ The add-on creates an editable Registry Stack project under `notary/project/`. I private consultation Relay that reads the same workbook. Relay still owns registry access. Notary receives only the minimized consultation result needed to evaluate the claim. +This template change applies only to newly generated add-ons. `registryctl add notary` does not +rewrite an existing Notary project. Projects generated with the older +`person-registration-accepted` identifier keep that identifier. Before renaming an existing claim, +review its CEL expression and downstream use. If the expression is the active-registration +predicate shown in this tutorial, rename the claim to `active-registration-exists`, then update +caller claim lists and the match, pending, and no-match fixture keys together. Do not mechanically +rename a claim that represents a broader policy or legal decision. + ## Inspect the claim Read the evidence service before starting it: @@ -97,20 +119,25 @@ The important part is deliberately small: family_name: request.target.attributes.family_name date_of_birth: request.target.attributes.date_of_birth claims: - person-registration-accepted: + active-registration-exists: cel: enrollment.matched && enrollment.registration_status == "active" disclosure: predicate ``` -The caller supplies a name and date of birth already obtained through its intake process. Relay -uses all three values for an exact lookup and returns `registration_status` only to Notary. The -selector fields cannot also be projected as outputs, and the public result does not repeat the -name, date of birth, or status. This keeps matching inputs separate from the registry fact being -proved. +The caller supplies a name and date of birth already obtained through its intake process. Registry +Relay owns the bounded lookup: it uses all three values for an exact match and returns only +`matched` and `registration_status` to Registry Notary. Registry Notary owns the claim: Registry +Notary evaluates the CEL expression and discloses the predicate result. The claim identifier and +boolean are not Relay outputs. -This is evidence that the registry contains exactly one matching record whose status satisfies the -current acceptance policy. It is not proof that the caller is that person. Authentication, -identity assurance, and authority to act for the person remain separate controls. +The selector fields cannot also be projected as outputs, and the public result does not repeat the +name, date of birth, or status. `true` means this bounded consultation found exactly one matching +record with status `active` in the selected registry source. `false` means the consultation did not +find an active matching record. `false` does not prove global nonexistence, identity fraud, +ineligibility, or any legal negative. + +The result is not proof that the caller is the matched person. Authentication, identity assurance, +and authority to act for the person remain separate controls. Names and dates of birth can collide or be recorded differently. Requiring exactly one match rejects ambiguity, but a production service still needs a jurisdiction-appropriate identity @@ -147,7 +174,7 @@ test -n "$TUTORIAL_EVALUATOR_RAW" The raw key stays in the ignored `secrets/local.env` file. Do not paste it into the request body or commit it. -## Evaluate an accepted active registration +## Evaluate an active registration Evaluate an active registration from the workbook: @@ -166,7 +193,7 @@ curl -sS -X POST \ "date_of_birth": "2019-02-03" } }, - "claims": ["person-registration-accepted"], + "claims": ["active-registration-exists"], "disclosure": "predicate", "format": "application/vnd.registry-notary.claim-result+json", "purpose": "https://example.local/purpose/tutorial" @@ -181,7 +208,7 @@ The stable fields to look for are: { "results": [ { - "claim_id": "person-registration-accepted", + "claim_id": "active-registration-exists", "value": true, "satisfied": true, "disclosure": "predicate", @@ -191,10 +218,11 @@ The stable fields to look for are: } ``` -`true` is the claim result. The response does not contain `Jo`, `Elm`, `2019-02-03`, or the source -value `active`. +`true` means this selected registry source returned one exact matching record with status `active` +for the bounded consultation. The response does not contain `Jo`, `Elm`, `2019-02-03`, or the +source value `active`. -## Reject a pending registration +## Evaluate a pending registration Save a request for a person whose registry record is pending. You will repeat it after changing the policy: @@ -210,7 +238,7 @@ cat > notary/pending-registration-request.json <<'JSON' "date_of_birth": "1998-03-05" } }, - "claims": ["person-registration-accepted"], + "claims": ["active-registration-exists"], "disclosure": "predicate", "format": "application/vnd.registry-notary.claim-result+json", "purpose": "https://example.local/purpose/tutorial" @@ -226,13 +254,13 @@ curl -sS -X POST \ http://127.0.0.1:4255/v1/evaluations ``` -The person matches exactly, but `pending` does not satisfy the initial policy: +The person matches exactly, but the record does not have status `active`: ```json { "results": [ { - "claim_id": "person-registration-accepted", + "claim_id": "active-registration-exists", "value": false, "satisfied": false, "disclosure": "predicate" @@ -241,8 +269,10 @@ The person matches exactly, but `pending` does not satisfy the initial policy: } ``` -This is a policy rejection, not a failed lookup. The public response still does not reveal the -source status. +`false` means this bounded consultation did not find an active matching record in the selected +registry source. In this example Relay found one matching record, but the active-status condition +was false. The public response does not reveal the source status. The result does not establish +ineligibility or another legal negative. ## Try a non-matching date of birth @@ -263,7 +293,7 @@ curl -sS -X POST \ "date_of_birth": "2019-02-04" } }, - "claims": ["person-registration-accepted"], + "claims": ["active-registration-exists"], "disclosure": "predicate", "format": "application/vnd.registry-notary.claim-result+json", "purpose": "https://example.local/purpose/tutorial" @@ -271,13 +301,13 @@ curl -sS -X POST \ http://127.0.0.1:4255/v1/evaluations ``` -The lookup finds no exact record, so the predicate is false: +The bounded lookup finds no exact record, so the existence predicate is false: ```json { "results": [ { - "claim_id": "person-registration-accepted", + "claim_id": "active-registration-exists", "value": false, "satisfied": false, "disclosure": "predicate" @@ -286,38 +316,50 @@ The lookup finds no exact record, so the predicate is false: } ``` -No-match is a claim result, not a source error. Ambiguous matches are different: the private Relay -rejects them rather than choosing a row. +The same bounded meaning applies: `false` means no active matching record was found by this +consultation in the selected registry source. The result does not prove global nonexistence, +identity fraud, ineligibility, or a legal negative. No-match is a Relay consultation outcome that +Notary uses to evaluate the claim, not a source error or a global fact. Ambiguous matches are +different: the private Relay rejects them rather than choosing a row, and the ambiguous fixture +expects no claim result. ## Edit the claim rule -Open `notary/project/registry-stack.yaml` in your editor. Find this line: +Open `notary/project/registry-stack.yaml` in your editor. Find this claim: ```yaml + active-registration-exists: cel: enrollment.matched && enrollment.registration_status == "active" + disclosure: predicate ``` -Change the expression to accept either status and save the file: +Including pending registrations changes the meaning, not only the implementation. Rename the claim +while changing the expression: ```yaml + active-or-pending-registration-exists: cel: enrollment.matched && (enrollment.registration_status == "active" || enrollment.registration_status == "pending") + disclosure: predicate ``` -The pending fixture is an executable example of the original policy. Open -`notary/project/integrations/person-demographics/fixtures/pending.yaml` and change its expected claim -from: +Update the fixture keys to the new claim identifier. Keep the match fixture `true`, change the +pending fixture from `false` to `true`, and keep the no-match fixture `false`: ```yaml - claims: { person-registration-accepted: false } +# fixtures/match.yaml + claims: { active-or-pending-registration-exists: true } +# fixtures/pending.yaml + claims: { active-or-pending-registration-exists: true } +# fixtures/no-match.yaml + claims: { active-or-pending-registration-exists: false } ``` -to: - -```yaml - claims: { person-registration-accepted: true } -``` +The ambiguous fixture keeps `claims: {}` because Relay refuses an ambiguous consultation instead of +producing a false claim. Update the saved request in +`notary/pending-registration-request.json` to ask for +`active-or-pending-registration-exists`. -Now restart: +Restart after the authored claim, all fixture keys, and the saved request agree: ```sh registryctl restart @@ -342,13 +384,13 @@ curl -sS -X POST \ http://127.0.0.1:4255/v1/evaluations ``` -The same pending source record is now accepted by the expanded policy: +The same pending source record now satisfies the renamed bounded-existence predicate: ```json { "results": [ { - "claim_id": "person-registration-accepted", + "claim_id": "active-or-pending-registration-exists", "value": true, "satisfied": true, "disclosure": "predicate" @@ -357,8 +399,8 @@ The same pending source record is now accepted by the expanded policy: } ``` -You changed claim semantics in the authored project, rebuilt the governed contract, and observed -the new result through the live API. You did not edit the workbook or expose its row. +You changed the claim name and semantics in the authored project, rebuilt the governed contract, +and observed the new result through the live API. You did not edit the workbook or expose its row. ## Stop the stack @@ -369,17 +411,19 @@ registryctl stop ``` This keeps the workbook, authored Notary project, and local request file. To return to the original -claim later, restore the equality expression and change the pending fixture expectation back to -`false` before starting the project. +claim later, restore the `active-registration-exists` identifier and equality expression, restore +all three fixture keys, change the pending expectation back to `false`, and restore the saved +request before starting the project. ## What you built You extended the first tutorial's protected registry with a live Notary evaluation path. An authorized caller supplied name and date of birth instead of a national identifier. Relay required one exact record and released only registration status to Notary. Notary returned one predicate, -with no source fields in the public result. You saw a matched pending registration rejected by the -initial policy, then expanded the policy and watched the same request produce a different governed -answer. +with no source fields in the public result. You saw the active-registration existence predicate +return `false` for both a matched pending record and a no-match consultation, without treating +either result as a global or legal negative. You then broadened and renamed the predicate and +watched the same pending request produce a different governed answer. ## Next @@ -392,9 +436,9 @@ answer. | Symptom | Cause | Resolution | | --- | --- | --- | -| `registryctl add notary` is unknown | The CLI predates Registry Stack v0.11.0 or does not match the installed release image lock. | Install `registryctl`, the immutable Relay and Notary images, and the image lock from the same Registry Stack v0.13.0 release. Do not substitute an ad hoc source build or a lock from another release. | +| `registryctl add notary` is unknown or generates `person-registration-accepted` | The CLI or templates do not come from the exact unreleased Main revision documented by this page. Registry Stack v0.13.0 is incompatible with these instructions. | Build `registryctl`, Relay and Notary images, and the image lock from one exact Main commit containing this page. Verify the lock's full source refs rather than relying on `registryctl --version`. | | `registryctl add notary` says the project already has a Notary add-on | The command has already completed for this project. | Continue with `registryctl start`; do not run the add command twice. | | Notary returns `401` | The evaluator key was not loaded or is from another generated project. | Source `secrets/local.env` again in the current shell. | | Notary returns `403` | The key lacks the evidence scope or the purpose does not match the authored service. | Use `TUTORIAL_EVALUATOR_RAW` and the tutorial purpose shown above. | -| `registryctl restart` reports a claim mismatch | The edited rule no longer agrees with the fixture's expected result. | Update the expected claim in `notary/project/integrations/person-demographics/fixtures/pending.yaml`, then restart again. | -| The edited rule does not take effect | A generated file was edited, or the running services were not rebuilt. | Edit the authored claim and matching fixture under `notary/project/`, then run `registryctl restart`. | +| `registryctl restart` reports a claim mismatch | The edited claim identifier or rule no longer agrees with a fixture expectation. | Update the claim keys in the match, pending, and no-match fixtures, preserve the empty ambiguous expectation, then restart again. | +| The edited rule does not take effect | A generated file was edited, or the running services were not rebuilt. | Edit the authored claim, fixture keys, and saved request under `notary/`, then run `registryctl restart`. | diff --git a/docs/site/src/content/docs/verify/index.mdx b/docs/site/src/content/docs/verify/index.mdx new file mode 100644 index 000000000..66f403260 --- /dev/null +++ b/docs/site/src/content/docs/verify/index.mdx @@ -0,0 +1,53 @@ +--- +title: Verify +description: Verify Registry Stack authoring, fixtures, environment bindings, generated inputs, security posture, and runtime contracts. +status: current +owner: registry-docs +source_repos: + - registry-stack + - registry-relay + - registry-notary +last_reviewed: "2026-07-26" +doc_type: how-to +locale: en +standards_referenced: [] +--- + +Run each verification gate for the artifact and authority boundary the gate owns. +No single command establishes source compatibility, deployment approval, and runtime readiness. + +## Authoring and fixtures + +1. Run `registryctl test --project-dir ` for offline synthetic fixtures. +2. Run `registryctl check --project-dir --environment --explain`. +3. Review the redacted effective intent and semantic impact. + +These commands validate authored configuration, cross-file semantics, fixtures, and generated +product inputs without contacting a source. +Offline success does not prove live source behavior. + +## Environment and generated inputs + +Run the operator-authorized offline preflight for declared secret references, files, trust, +availability, and environment narrowing. +Then build the project and validate the separate Relay and Notary inputs with their owning product +validators. + +Preflight does not read or print secret values, perform Domain Name System resolution, request a +token, or contact a source. + +## Runtime and release evidence + +- [Security self-assessment](../security/self-assessment/) +- [OpenSSF evidence](../security/openssf-evidence/) +- [Relay API reference](../reference/apis/registry-relay/) +- [Notary API reference](../reference/apis/registry-notary/) + +Live source checks, signing, promotion, activation, migration, and rollback require separate +authorization and evidence. + +## Next + +- [Errors and status codes](../reference/errors/) +- [Generated artifacts](../generated-artifacts/) +- [Operate Registry Stack](../operate/) diff --git a/docs/site/src/data/docsets.yaml b/docs/site/src/data/docsets.yaml index 43aa761ae..5d9d9423e 100644 --- a/docs/site/src/data/docsets.yaml +++ b/docs/site/src/data/docsets.yaml @@ -1,33 +1,35 @@ current: latest docsets: - id: latest - label: Latest + label: Main source (unreleased) path: / status: current + availability: unreleased source: registry-stack-main published_at: 2026-06-24 - description: Current RegistryStack monorepo documentation build. + description: Current unreleased RegistryStack source documentation from main; this is not v0.13.0 release proof. products: registry-stack: - version: v0.13.0 + version: main source (unreleased) ref: HEAD registry-relay: - version: v0.13.0 + version: main source (unreleased) ref: HEAD registry-notary: - version: v0.13.0 + version: main source (unreleased) ref: HEAD registry-manifest: - version: v0.13.0 + version: main source (unreleased) ref: HEAD - id: v0.13.0 label: v0.13.0 path: /v/0.13.0/ status: archived + availability: released source: registry-stack-v0.13.0 repo_docs_source: monorepo published_at: 2026-07-25 - description: RegistryStack v0.13.0 beta-17 documentation set. + description: Released RegistryStack v0.13.0 beta-17 documentation set pinned to its immutable source. products: registry-stack: version: v0.13.0 @@ -54,6 +56,7 @@ docsets: label: v0.12.2 path: /v/0.12.2/ status: archived + availability: released source: registry-stack-v0.12.2 repo_docs_source: monorepo published_at: 2026-07-20 @@ -84,6 +87,7 @@ docsets: label: v0.12.1 path: /v/0.12.1/ status: archived + availability: released source: registry-stack-v0.12.1 repo_docs_source: monorepo published_at: 2026-07-20 @@ -114,6 +118,7 @@ docsets: label: v0.12.0 path: /v/0.12.0/ status: archived + availability: released source: registry-stack-v0.12.0 repo_docs_source: monorepo published_at: 2026-07-19 @@ -144,6 +149,7 @@ docsets: label: v0.11.0 path: /v/0.11.0/ status: archived + availability: released source: registry-stack-v0.11.0 repo_docs_source: monorepo published_at: 2026-07-18 @@ -174,6 +180,7 @@ docsets: label: v0.10.0 path: /v/0.10.0/ status: archived + availability: released source: registry-stack-v0.10.0 repo_docs_source: monorepo published_at: 2026-07-17 @@ -204,6 +211,7 @@ docsets: label: v0.9.0 path: /v/0.9.0/ status: archived + availability: released source: registry-stack-v0.9.0 repo_docs_source: monorepo published_at: 2026-07-10 @@ -243,6 +251,7 @@ docsets: label: v0.8.4 path: /v/0.8.4/ status: archived + availability: released source: registry-stack-v0.8.4 repo_docs_source: monorepo published_at: 2026-07-04 @@ -282,6 +291,7 @@ docsets: label: v0.8.3 path: /v/0.8.3/ status: archived + availability: released source: registry-stack-v0.8.3 repo_docs_source: monorepo published_at: 2026-06-26 @@ -321,6 +331,7 @@ docsets: label: v0.8.2 path: /v/0.8.2/ status: archived + availability: released source: registry-stack-v0.8.2 repo_docs_source: monorepo published_at: 2026-06-25 @@ -360,6 +371,7 @@ docsets: label: v0.8.1 path: /v/0.8.1/ status: archived + availability: released source: registry-stack-v0.8.1 repo_docs_source: monorepo published_at: 2026-06-25 @@ -399,6 +411,7 @@ docsets: label: Beta 5 path: /v/beta-5/ status: archived + availability: candidate source: registry-stack-beta-5 published_at: 2026-06-24 description: Beta-5 source-release documentation set prepared for release proof. @@ -431,6 +444,7 @@ docsets: label: Beta 4 path: /v/beta-4/ status: archived + availability: candidate source: registry-stack-beta-4 published_at: 2026-06-22 description: Beta-4 source-release documentation set prepared for release proof. @@ -463,6 +477,7 @@ docsets: label: Beta 3 path: /v/beta-3/ status: archived + availability: candidate source: registry-stack-beta-3 published_at: 2026-06-21 description: Beta-3 candidate documentation set prepared for release proof. @@ -495,6 +510,7 @@ docsets: label: Beta 2026-06-12 path: /v/beta-2026-06-12/ status: archived + availability: candidate source: registry-stack-beta-2026-06-12 published_at: 2026-06-12 description: Frozen public beta documentation set. diff --git a/docs/site/src/data/generated/configuration-reference-coverage.json b/docs/site/src/data/generated/configuration-reference-coverage.json new file mode 100644 index 000000000..096de7d05 --- /dev/null +++ b/docs/site/src/data/generated/configuration-reference-coverage.json @@ -0,0 +1,157 @@ +{ + "schema_id": "https://id.registrystack.org/schemas/registryctl/project-documentation/registry.project.configuration_reference_coverage.v1.schema.json", + "format_version": "1.0", + "status": "complete", + "reference_baseline": { + "generator_lifecycle": "unreleased", + "published_release": null, + "field_history_status": "not_verified", + "history_verification_method": null, + "compared_releases": [] + }, + "source_contract": { + "schemas": [ + "project", + "environment", + "integration", + "fixture", + "entity", + "relay", + "notary" + ], + "schema_sources": [ + "project.schema.json", + "environment.schema.json", + "integration.schema.json", + "fixture.schema.json", + "entity.schema.json", + "registry-relay.config.schema.json", + "registry-notary.config.schema.json" + ], + "field_knowledge": "schemas/project-authoring/parity-coverage.json#field_knowledge", + "human_intent": "schemas/project-authoring/documentation-intent.json", + "runtime_intent": [ + "crates/registry-relay/config/documentation-intent.json", + "crates/registry-notary-core/config/documentation-intent.json" + ], + "reads_country_workspaces": false, + "reads_runtime_configuration": false + }, + "coverage": { + "schema_count": 7, + "path_count": 1758, + "reference_count": 482, + "by_schema": { + "project": 219, + "environment": 191, + "integration": 138, + "fixture": 62, + "entity": 35, + "relay": 584, + "notary": 529 + }, + "by_path_kind": { + "root": 7, + "property": 1406, + "map_key": 25, + "map_value": 47, + "array_item": 177, + "branch": 96 + }, + "by_sensitivity": { + "public": 16, + "internal": 1140, + "sensitive": 396, + "secret_reference": 41, + "redacted_fixture": 50, + "structural": 115 + }, + "by_intent_source": { + "schema_description": 503, + "reviewed_override": 243, + "structural_taxonomy": 121, + "reviewed_profile": 891 + }, + "by_intent_profile": { + "notary_audit_internal": 4, + "notary_audit_secret_reference": 1, + "notary_audit_sensitive": 2, + "notary_auth_internal": 13, + "notary_auth_oidc_scope_map_open_map": 1, + "notary_auth_secret_reference": 4, + "notary_auth_sensitive": 95, + "notary_cel_internal": 14, + "notary_config_trust_internal": 1, + "notary_config_trust_sensitive": 4, + "notary_credential_status_sensitive": 4, + "notary_deployment_internal": 13, + "notary_deployment_sensitive": 1, + "notary_evidence_claims_evidence_mode_consultations_inputs_open_map": 1, + "notary_evidence_claims_evidence_mode_consultations_open_map": 1, + "notary_evidence_claims_evidence_mode_consultations_outputs_open_map": 1, + "notary_evidence_claims_rule_bindings_claims_open_map": 1, + "notary_evidence_credential_profiles_open_map": 1, + "notary_evidence_internal": 91, + "notary_evidence_secret_reference": 5, + "notary_evidence_sensitive": 40, + "notary_evidence_signing_keys_open_map": 1, + "notary_evidence_variables_open_map": 1, + "notary_federation_internal": 43, + "notary_federation_secret_reference": 1, + "notary_federation_sensitive": 5, + "notary_instance_internal": 5, + "notary_instance_sensitive": 1, + "notary_oid4vci_credential_configurations_open_map": 1, + "notary_oid4vci_internal": 33, + "notary_oid4vci_sensitive": 48, + "notary_root_structural": 1, + "notary_server_internal": 13, + "notary_server_sensitive": 2, + "notary_state_internal": 6, + "notary_state_secret_reference": 2, + "notary_state_sensitive": 1, + "notary_subject_access_sensitive": 67, + "relay_audit_internal": 9, + "relay_audit_secret_reference": 1, + "relay_audit_sensitive": 1, + "relay_auth_internal": 15, + "relay_auth_oidc_scope_map_open_map": 1, + "relay_auth_secret_reference": 4, + "relay_auth_sensitive": 15, + "relay_catalog_internal": 1, + "relay_catalog_public": 6, + "relay_catalog_sensitive": 1, + "relay_config_trust_internal": 1, + "relay_config_trust_sensitive": 4, + "relay_consultation_internal": 26, + "relay_consultation_secret_reference": 8, + "relay_consultation_sensitive": 20, + "relay_datasets_internal": 391, + "relay_datasets_secret_reference": 1, + "relay_datasets_sensitive": 7, + "relay_deployment_internal": 12, + "relay_deployment_sensitive": 2, + "relay_instance_internal": 1, + "relay_instance_public": 4, + "relay_metadata_internal": 6, + "relay_metadata_sensitive": 1, + "relay_root_structural": 1, + "relay_server_internal": 13, + "relay_server_sensitive": 5, + "relay_standards_internal": 18, + "relay_standards_sensitive": 3, + "relay_standards_spdci_registries_expression_fields_open_map": 1, + "relay_standards_spdci_registries_identifiers_open_map": 1, + "relay_standards_spdci_registries_open_map": 1, + "relay_standards_spdci_registries_response_fields_open_map": 1, + "relay_vocabularies_internal": 1, + "relay_vocabularies_open_map": 1 + } + }, + "reviewed_intent_assignment_required_count": 1758, + "reviewed_intent_assignment_covered_count": 1758, + "distinct_reviewed_intent_count": 588, + "distinct_reviewed_intents_reused_count": 83, + "reviewed_intent_assignments_using_reused_intent_count": 1253, + "missing_intent": [] +} diff --git a/docs/site/src/data/generated/configuration-reference.json b/docs/site/src/data/generated/configuration-reference.json new file mode 100644 index 000000000..6026660c6 --- /dev/null +++ b/docs/site/src/data/generated/configuration-reference.json @@ -0,0 +1,149733 @@ +{ + "schema_id": "https://id.registrystack.org/schemas/registryctl/project-documentation/registry.project.configuration_reference.v1.schema.json", + "format_version": "1.0", + "reference_baseline": { + "generator_lifecycle": "unreleased", + "published_release": null, + "field_history_status": "not_verified", + "history_verification_method": null, + "compared_releases": [] + }, + "source_contract": { + "schemas": [ + "project", + "environment", + "integration", + "fixture", + "entity", + "relay", + "notary" + ], + "schema_sources": [ + "project.schema.json", + "environment.schema.json", + "integration.schema.json", + "fixture.schema.json", + "entity.schema.json", + "registry-relay.config.schema.json", + "registry-notary.config.schema.json" + ], + "field_knowledge": "schemas/project-authoring/parity-coverage.json#field_knowledge", + "human_intent": "schemas/project-authoring/documentation-intent.json", + "runtime_intent": [ + "crates/registry-relay/config/documentation-intent.json", + "crates/registry-notary-core/config/documentation-intent.json" + ], + "reads_country_workspaces": false, + "reads_runtime_configuration": false + }, + "coverage": { + "schema_count": 7, + "path_count": 1758, + "reference_count": 482, + "by_schema": { + "project": 219, + "environment": 191, + "integration": 138, + "fixture": 62, + "entity": 35, + "relay": 584, + "notary": 529 + }, + "by_path_kind": { + "root": 7, + "property": 1406, + "map_key": 25, + "map_value": 47, + "array_item": 177, + "branch": 96 + }, + "by_sensitivity": { + "public": 16, + "internal": 1140, + "sensitive": 396, + "secret_reference": 41, + "redacted_fixture": 50, + "structural": 115 + }, + "by_intent_source": { + "schema_description": 503, + "reviewed_override": 243, + "structural_taxonomy": 121, + "reviewed_profile": 891 + }, + "by_intent_profile": { + "notary_audit_internal": 4, + "notary_audit_secret_reference": 1, + "notary_audit_sensitive": 2, + "notary_auth_internal": 13, + "notary_auth_oidc_scope_map_open_map": 1, + "notary_auth_secret_reference": 4, + "notary_auth_sensitive": 95, + "notary_cel_internal": 14, + "notary_config_trust_internal": 1, + "notary_config_trust_sensitive": 4, + "notary_credential_status_sensitive": 4, + "notary_deployment_internal": 13, + "notary_deployment_sensitive": 1, + "notary_evidence_claims_evidence_mode_consultations_inputs_open_map": 1, + "notary_evidence_claims_evidence_mode_consultations_open_map": 1, + "notary_evidence_claims_evidence_mode_consultations_outputs_open_map": 1, + "notary_evidence_claims_rule_bindings_claims_open_map": 1, + "notary_evidence_credential_profiles_open_map": 1, + "notary_evidence_internal": 91, + "notary_evidence_secret_reference": 5, + "notary_evidence_sensitive": 40, + "notary_evidence_signing_keys_open_map": 1, + "notary_evidence_variables_open_map": 1, + "notary_federation_internal": 43, + "notary_federation_secret_reference": 1, + "notary_federation_sensitive": 5, + "notary_instance_internal": 5, + "notary_instance_sensitive": 1, + "notary_oid4vci_credential_configurations_open_map": 1, + "notary_oid4vci_internal": 33, + "notary_oid4vci_sensitive": 48, + "notary_root_structural": 1, + "notary_server_internal": 13, + "notary_server_sensitive": 2, + "notary_state_internal": 6, + "notary_state_secret_reference": 2, + "notary_state_sensitive": 1, + "notary_subject_access_sensitive": 67, + "relay_audit_internal": 9, + "relay_audit_secret_reference": 1, + "relay_audit_sensitive": 1, + "relay_auth_internal": 15, + "relay_auth_oidc_scope_map_open_map": 1, + "relay_auth_secret_reference": 4, + "relay_auth_sensitive": 15, + "relay_catalog_internal": 1, + "relay_catalog_public": 6, + "relay_catalog_sensitive": 1, + "relay_config_trust_internal": 1, + "relay_config_trust_sensitive": 4, + "relay_consultation_internal": 26, + "relay_consultation_secret_reference": 8, + "relay_consultation_sensitive": 20, + "relay_datasets_internal": 391, + "relay_datasets_secret_reference": 1, + "relay_datasets_sensitive": 7, + "relay_deployment_internal": 12, + "relay_deployment_sensitive": 2, + "relay_instance_internal": 1, + "relay_instance_public": 4, + "relay_metadata_internal": 6, + "relay_metadata_sensitive": 1, + "relay_root_structural": 1, + "relay_server_internal": 13, + "relay_server_sensitive": 5, + "relay_standards_internal": 18, + "relay_standards_sensitive": 3, + "relay_standards_spdci_registries_expression_fields_open_map": 1, + "relay_standards_spdci_registries_identifiers_open_map": 1, + "relay_standards_spdci_registries_open_map": 1, + "relay_standards_spdci_registries_response_fields_open_map": 1, + "relay_vocabularies_internal": 1, + "relay_vocabularies_open_map": 1 + } + }, + "fields": [ + { + "address": { + "schema": "project", + "pointer": "", + "path_kind": "root" + }, + "purpose": "Declares the product-neutral Registry Stack project graph: integrations, materialized entities, and Relay or Notary services.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": true + }, + "requiredness": "not_applicable", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": true, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "version", + "registry", + "services" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/access/properties/scopes", + "path_kind": "property" + }, + "purpose": "Lists the scopes a caller must hold to use the enclosing evidence service.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 16 + }, + { + "keyword": "minItems", + "value": 1 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/access/properties/scopes/items", + "path_kind": "array_item" + }, + "purpose": "Non-empty token without commas, whitespace, or control characters.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/token", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/token" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/claimValue/properties/max_bytes", + "path_kind": "property" + }, + "purpose": "Bounds the encoded size of a source-free claim value.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 65536 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/claimValue/properties/nullable", + "path_kind": "property" + }, + "purpose": "States whether the source-free claim value may be null.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/claimValue/properties/type", + "path_kind": "property" + }, + "purpose": "Declares the boolean, integer, string, or date type of a source-free claim value.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "boolean", + "integer", + "string", + "date" + ] + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/consultations/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "integration", + "input" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/consultations/additionalProperties/properties/input", + "path_kind": "property" + }, + "purpose": "Maps integration input names to reviewed target-request identifier or attribute bindings.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 16 + }, + { + "keyword": "minProperties", + "value": 1 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/consultations/additionalProperties/properties/input/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Closed target request binding. Attribute values are bounded typed caller-supplied context, not authenticated identifiers.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/targetRequestMapping", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 128 + }, + { + "keyword": "pattern", + "value": "^request\\.target\\.(?:id|identifiers\\.[A-Za-z][A-Za-z0-9._-]{0,95}|attributes\\.[a-z][a-z0-9_]{0,63})$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/targetRequestMapping" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/consultations/additionalProperties/properties/input/propertyNames", + "path_kind": "map_key" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/consultations/additionalProperties/properties/integration", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/consultations/propertyNames", + "path_kind": "map_key" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/disclosure/oneOf/0", + "path_kind": "branch" + }, + "purpose": "Maximum detail a claim may disclose.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "local_reference": "#/$defs/disclosureMode", + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "value", + "predicate", + "redacted" + ] + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/disclosureMode" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/disclosure/oneOf/1", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "default", + "allowed" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/disclosure/oneOf/1/properties/allowed", + "path_kind": "property" + }, + "purpose": "Lists the disclosure modes that may be selected in addition to the policy's declared default.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "minItems", + "value": 1 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/disclosure/oneOf/1/properties/allowed/items", + "path_kind": "array_item" + }, + "purpose": "Maximum detail a claim may disclose.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "local_reference": "#/$defs/disclosureMode", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "value", + "predicate", + "redacted" + ] + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/disclosureMode" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/disclosure/oneOf/1/properties/default", + "path_kind": "property" + }, + "purpose": "Maximum detail a claim may disclose.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "local_reference": "#/$defs/disclosureMode", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "value", + "predicate", + "redacted" + ] + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/disclosureMode" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/access", + "path_kind": "property" + }, + "purpose": "Scopes a caller must hold to use an evidence service.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/access", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "scopes" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/access" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/claims", + "path_kind": "property" + }, + "purpose": "Maps evidence claim identifiers to an output or CEL expression, value contract, and disclosure policy.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 64 + }, + { + "keyword": "minProperties", + "value": 1 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/claims/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": true + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "disclosure" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/claims/additionalProperties/oneOf/0", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "output" + ] + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/claims/additionalProperties/oneOf/1", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "cel" + ] + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/claims/additionalProperties/properties/cel", + "path_kind": "property" + }, + "purpose": "Provides the CEL expression used for a source-free evaluation-only evidence claim.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/claims/additionalProperties/properties/disclosure", + "path_kind": "property" + }, + "purpose": "Fixed disclosure mode or a default constrained by explicitly allowed alternatives.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/disclosure", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [], + "local_reference": { + "schema": "project", + "pointer": "/$defs/disclosure" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/claims/additionalProperties/properties/output", + "path_kind": "property" + }, + "purpose": "Selects the exact Relay consultation output that backs this evidence claim.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/claims/additionalProperties/properties/value", + "path_kind": "property" + }, + "purpose": "Explicit claim value type, nullability, and encoded-size bound for source-free evaluation. A source-free claim cannot be selected by a credential profile.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/claimValue", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "type" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/claimValue" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/claims/propertyNames", + "path_kind": "map_key" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/consent", + "path_kind": "property" + }, + "purpose": "States whether evaluation of this evidence service requires consent.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "not_required", + "required" + ] + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/consultations", + "path_kind": "property" + }, + "purpose": "Relay consultations and their closed bindings to target request identifiers or caller-supplied target attributes.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/consultations", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 16 + }, + { + "keyword": "minProperties", + "value": 1 + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/consultations" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/credential_profiles", + "path_kind": "property" + }, + "purpose": "Credential profiles may select only claims backed by an exact Relay consultation. Source-free claim evaluation cannot be exposed as credential capability.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 32 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/credential_profiles/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "format", + "type", + "validity", + "claims" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/credential_profiles/additionalProperties/properties/claims", + "path_kind": "property" + }, + "purpose": "Lists the registry-backed evidence claims selected into this credential profile.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "minItems", + "value": 1 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/credential_profiles/additionalProperties/properties/claims/items", + "path_kind": "array_item" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/credential_profiles/additionalProperties/properties/format", + "path_kind": "property" + }, + "purpose": "Non-empty token without commas, whitespace, or control characters.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/token", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/token" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/credential_profiles/additionalProperties/properties/type", + "path_kind": "property" + }, + "purpose": "Declares the credential type identifier emitted for this reviewed credential profile.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 2048 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/credential_profiles/additionalProperties/properties/validity", + "path_kind": "property" + }, + "purpose": "Bounds the lifetime of credentials issued from this profile using a positive duration.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[1-9][0-9]*(?:s|m|h)$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/credential_profiles/propertyNames", + "path_kind": "map_key" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/kind", + "path_kind": "property" + }, + "purpose": "Identifies this service declaration as a Notary evidence policy.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": "evidence" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/legal_basis", + "path_kind": "property" + }, + "purpose": "Non-empty token without commas, whitespace, or control characters.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/token", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/token" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/purpose", + "path_kind": "property" + }, + "purpose": "Non-empty token without commas, whitespace, or control characters.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/token", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/token" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/variables", + "path_kind": "property" + }, + "purpose": "Typed request variables exposed to evidence evaluation.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/variables", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 16 + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/variables" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/evidenceService/properties/version", + "path_kind": "property" + }, + "purpose": "Assigns the positive authored version used to track this evidence-service policy contract.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/fieldList/items", + "path_kind": "array_item" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/filterOperators/items", + "path_kind": "array_item" + }, + "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "eq", + "in", + "gte", + "lte", + "between" + ] + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregate/anyOf/0", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "measures" + ] + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregate/anyOf/1", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "indicators" + ] + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregate/properties/access", + "path_kind": "property" + }, + "purpose": "Defines optional metadata and aggregate scopes and whether execution is restricted to aggregate-only access.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/recordAggregateAccess", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/recordAggregateAccess" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregate/properties/allowed_filters", + "path_kind": "property" + }, + "purpose": "Maps aggregate filter fields to the comparison operators permitted for each field.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregate/properties/allowed_filters/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Allowed operators for one queryable field.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "array" + ], + "local_reference": "#/$defs/filterOperators", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "minItems", + "value": 1 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/filterOperators" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregate/properties/default_group_by", + "path_kind": "property" + }, + "purpose": "Bounded unique list of entity field identifiers.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "array" + ], + "local_reference": "#/$defs/fieldList", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 16 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/fieldList" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregate/properties/description", + "path_kind": "property" + }, + "purpose": "Bounded human-readable project metadata.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/text", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 2048 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/text" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregate/properties/dimensions", + "path_kind": "property" + }, + "purpose": "Lists the labeled entity fields available as governed aggregate dimensions.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregate/properties/dimensions/items", + "path_kind": "array_item" + }, + "purpose": "Named grouping dimension backed by one entity field.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/recordAggregateDimension", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id", + "label", + "field" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/recordAggregateDimension" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregate/properties/disclosure_control", + "path_kind": "property" + }, + "purpose": "Defines the minimum group size and suppression behavior applied before aggregate results are disclosed.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregate/properties/disclosure_control/properties/min_group_size", + "path_kind": "property" + }, + "purpose": "Sets the smallest result group that may be disclosed without suppression.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregate/properties/disclosure_control/properties/suppression", + "path_kind": "property" + }, + "purpose": "Selects whether undersized aggregate groups are omitted, masked, or represented as null.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "omit", + "mask", + "null" + ] + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregate/properties/group_by", + "path_kind": "property" + }, + "purpose": "Bounded unique list of entity field identifiers.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "array" + ], + "local_reference": "#/$defs/fieldList", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 16 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/fieldList" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregate/properties/indicators", + "path_kind": "property" + }, + "purpose": "Lists the named aggregate indicators, functions, source columns, and measurement metadata.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregate/properties/indicators/items", + "path_kind": "array_item" + }, + "purpose": "SDMX-style aggregate indicator with units and display metadata.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/recordAggregateIndicator", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id", + "label", + "function", + "column", + "unit_measure" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/recordAggregateIndicator" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregate/properties/joins", + "path_kind": "property" + }, + "purpose": "Bounded unique list of entity field identifiers.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "array" + ], + "local_reference": "#/$defs/fieldList", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 16 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/fieldList" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregate/properties/measures", + "path_kind": "property" + }, + "purpose": "Lists the named aggregation functions and entity columns used to compute this aggregate.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "minItems", + "value": 1 + }, + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregate/properties/measures/items", + "path_kind": "array_item" + }, + "purpose": "Named aggregate calculation over one entity column.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/recordAggregateMeasure", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "name", + "function", + "column" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/recordAggregateMeasure" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregate/properties/required_principal_filters", + "path_kind": "property" + }, + "purpose": "Bounded unique list of entity field identifiers.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "array" + ], + "local_reference": "#/$defs/fieldList", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 16 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/fieldList" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregate/properties/spatial", + "path_kind": "property" + }, + "purpose": "Defines the reviewed administrative-area spatial aggregation and geometry materialization bindings.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/recordAggregateSpatial", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "mode", + "dimension", + "geometry_entity", + "geometry_id_field", + "geometry_field" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/recordAggregateSpatial" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregate/properties/temporal_field", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregate/properties/title", + "path_kind": "property" + }, + "purpose": "Bounded human-readable project metadata.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/text", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 2048 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/text" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateAccess/properties/aggregate_only_execution", + "path_kind": "property" + }, + "purpose": "Restricts this definition to aggregate execution so it cannot be used as a record-level result path.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateAccess/properties/aggregate_scope", + "path_kind": "property" + }, + "purpose": "Authorization scope token.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/scope", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 128 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/scope" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateAccess/properties/metadata_scope", + "path_kind": "property" + }, + "purpose": "Authorization scope token.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/scope", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 128 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/scope" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateDimension/properties/codelist", + "path_kind": "property" + }, + "purpose": "Bounded human-readable project metadata.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/text", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 2048 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/text" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateDimension/properties/field", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateDimension/properties/id", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateDimension/properties/label", + "path_kind": "property" + }, + "purpose": "Bounded human-readable project metadata.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/text", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 2048 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/text" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateIndicator/properties/column", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateIndicator/properties/decimals", + "path_kind": "property" + }, + "purpose": "Sets the non-negative decimal precision published for this aggregate indicator.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateIndicator/properties/definition_uri", + "path_kind": "property" + }, + "purpose": "Bounded human-readable project metadata.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/text", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 2048 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/text" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateIndicator/properties/frequency", + "path_kind": "property" + }, + "purpose": "Bounded human-readable project metadata.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/text", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 2048 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/text" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateIndicator/properties/function", + "path_kind": "property" + }, + "purpose": "Selects the aggregation function used to compute this named indicator.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "local_reference": "#/$defs/recordAggregateFunction", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "count", + "sum", + "avg", + "min", + "max", + "median", + "count_distinct", + "stddev" + ] + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/recordAggregateFunction" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateIndicator/properties/id", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateIndicator/properties/label", + "path_kind": "property" + }, + "purpose": "Bounded human-readable project metadata.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/text", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 2048 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/text" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateIndicator/properties/unit_measure", + "path_kind": "property" + }, + "purpose": "Bounded human-readable project metadata.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/text", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 2048 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/text" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateIndicator/properties/unit_mult", + "path_kind": "property" + }, + "purpose": "Declares the base-ten unit multiplier published with this aggregate indicator.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 2147483647 + }, + { + "keyword": "minimum", + "value": -2147483648 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateMeasure/properties/column", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateMeasure/properties/function", + "path_kind": "property" + }, + "purpose": "Selects the aggregation function applied to the optional source column for this measure.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "local_reference": "#/$defs/recordAggregateFunction", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "count", + "sum", + "avg", + "min", + "max", + "median", + "count_distinct", + "stddev" + ] + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/recordAggregateFunction" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateMeasure/properties/name", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateSpatial/properties/bbox_fields", + "path_kind": "property" + }, + "purpose": "Maps the geometry entity fields that provide the minimum and maximum coordinates of its bounding box.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/recordSpatialBbox", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "min_x", + "min_y", + "max_x", + "max_y" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/recordSpatialBbox" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateSpatial/properties/collection_id", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateSpatial/properties/dimension", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateSpatial/properties/geometry_entity", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateSpatial/properties/geometry_field", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateSpatial/properties/geometry_id_field", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateSpatial/properties/max_geometry_vertices", + "path_kind": "property" + }, + "purpose": "Caps the number of vertices accepted when materializing one administrative-area geometry.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAggregateSpatial/properties/mode", + "path_kind": "property" + }, + "purpose": "Selects the supported administrative-area aggregation mode for this spatial definition.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": "admin_area" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseExpression/properties/cel", + "path_kind": "property" + }, + "purpose": "Provides the bounded CEL expression evaluated only against the projected source object.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 4096 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims", + "path_kind": "property" + }, + "purpose": "Maps released claim names to their reviewed source or expression, requiredness, and sensitivity.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 32 + }, + { + "keyword": "minProperties", + "value": 1 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": true + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "required", + "sensitivity" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/additionalProperties/oneOf/0", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "source_field" + ] + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/additionalProperties/oneOf/1", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "expression" + ] + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/additionalProperties/properties/expression", + "path_kind": "property" + }, + "purpose": "Bounded CEL evaluated only against the projected source object.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/recordAttributeReleaseExpression", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "cel" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseExpression" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/additionalProperties/properties/required", + "path_kind": "property" + }, + "purpose": "States whether failure to produce this released claim makes the attribute-release result invalid.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/additionalProperties/properties/sensitivity", + "path_kind": "property" + }, + "purpose": "Classifies the released claim as a direct identifier, personal, public, or pseudonymous value.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "direct_identifier", + "personal", + "public", + "pseudonymous" + ] + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/additionalProperties/properties/source_field", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfile/properties/claims/propertyNames", + "path_kind": "map_key" + }, + "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9_]{0,63}$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfile/properties/description", + "path_kind": "property" + }, + "purpose": "Bounded human-readable project metadata.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/text", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 2048 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/text" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfile/properties/purpose", + "path_kind": "property" + }, + "purpose": "Binds the release to one permitted records purpose and requires a bounded visible-ASCII header token.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/token", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/token" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfile/properties/release_conditions", + "path_kind": "property" + }, + "purpose": "Contains the bounded expression that must authorize this purpose-bound attribute release.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "expression" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfile/properties/release_conditions/properties/expression", + "path_kind": "property" + }, + "purpose": "Bounded CEL evaluated only against the projected source object.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/recordAttributeReleaseExpression", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "cel" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseExpression" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfile/properties/release_scope", + "path_kind": "property" + }, + "purpose": "Requires the exact entity-bound :identity_release scope and keeps release access distinct from records API scopes.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/scope", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 128 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/scope" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfile/properties/subject", + "path_kind": "property" + }, + "purpose": "Defines the projected source field and identifier type used for exact-one subject resolution.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "source_field", + "id_type" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfile/properties/subject/properties/id_type", + "path_kind": "property" + }, + "purpose": "Labels the identifier type represented by the resolved subject identifier.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 64 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfile/properties/subject/properties/source_field", + "path_kind": "property" + }, + "purpose": "Selects the projected entity field whose value is matched for exact-one subject resolution.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfile/properties/title", + "path_kind": "property" + }, + "purpose": "Bounded human-readable project metadata.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/text", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 2048 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/text" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfile/properties/version", + "path_kind": "property" + }, + "purpose": "Assigns a portable path-segment version matching [A-Za-z0-9][A-Za-z0-9._-]{0,63} to identify one attribute-release profile contract.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 64 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfiles/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "One purpose-bound, minimized identity release compiled into the owning Relay entity.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/recordAttributeReleaseProfile", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "version", + "purpose", + "release_scope", + "subject", + "release_conditions", + "claims" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfile" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfiles/propertyNames", + "path_kind": "map_key" + }, + "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9_-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordFieldMap/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordFieldMap/propertyNames", + "path_kind": "map_key" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpatial/properties/bbox_fields", + "path_kind": "property" + }, + "purpose": "Maps optional entity fields containing precomputed minimum and maximum bounding-box coordinates.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/recordSpatialBbox", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "min_x", + "min_y", + "max_x", + "max_y" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/recordSpatialBbox" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpatial/properties/collection_id", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpatial/properties/datetime_field", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpatial/properties/description", + "path_kind": "property" + }, + "purpose": "Bounded human-readable project metadata.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/text", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 2048 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/text" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpatial/properties/geometry", + "path_kind": "property" + }, + "purpose": "Defines whether feature geometry comes from point-coordinate fields or one encoded geometry field.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/recordSpatialGeometry", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [], + "local_reference": { + "schema": "project", + "pointer": "/$defs/recordSpatialGeometry" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpatial/properties/max_bbox_degrees", + "path_kind": "property" + }, + "purpose": "Caps the geographic span accepted for one bounding-box query.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "number" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "exclusiveMinimum", + "value": 0 + }, + { + "keyword": "type", + "value": "number" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpatial/properties/max_geometry_vertices", + "path_kind": "property" + }, + "purpose": "Caps the number of vertices accepted when returning one feature geometry.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpatial/properties/title", + "path_kind": "property" + }, + "purpose": "Bounded human-readable project metadata.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/text", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 2048 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/text" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpatialBbox/properties/max_x", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpatialBbox/properties/max_y", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpatialBbox/properties/min_x", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpatialBbox/properties/min_y", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpatialGeometry/oneOf/0", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "kind", + "longitude_field", + "latitude_field", + "crs" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpatialGeometry/oneOf/0/properties/crs", + "path_kind": "property" + }, + "purpose": "Non-empty token without commas, whitespace, or control characters.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/token", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/token" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpatialGeometry/oneOf/0/properties/kind", + "path_kind": "property" + }, + "purpose": "Selects geometry assembled from separate longitude and latitude entity fields.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": "point" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpatialGeometry/oneOf/0/properties/latitude_field", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpatialGeometry/oneOf/0/properties/longitude_field", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpatialGeometry/oneOf/1", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "kind", + "field", + "crs" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpatialGeometry/oneOf/1/properties/crs", + "path_kind": "property" + }, + "purpose": "Non-empty token without commas, whitespace, or control characters.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/token", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/token" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpatialGeometry/oneOf/1/properties/field", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpatialGeometry/oneOf/1/properties/kind", + "path_kind": "property" + }, + "purpose": "Selects the GeoJSON, WKT, or WKB encoding used by the configured geometry field.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "geojson", + "wkt", + "wkb" + ] + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpdci/properties/expression_fields", + "path_kind": "property" + }, + "purpose": "Maps SP-DCI expression input names to the entity fields available during expression evaluation.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/recordFieldMap", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 64 + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/recordFieldMap" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpdci/properties/identifiers", + "path_kind": "property" + }, + "purpose": "Maps SP-DCI identifier names to the entity fields used to identify a record.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/recordFieldMap", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 64 + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/recordFieldMap" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpdci/properties/record_type", + "path_kind": "property" + }, + "purpose": "Non-empty token without commas, whitespace, or control characters.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/token", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/token" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpdci/properties/registry", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpdci/properties/registry_type", + "path_kind": "property" + }, + "purpose": "Non-empty token without commas, whitespace, or control characters.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/token", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/token" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordSpdci/properties/response_fields", + "path_kind": "property" + }, + "purpose": "Maps SP-DCI response names to the entity fields returned for an authorized record.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/recordFieldMap", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 64 + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/recordFieldMap" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/aggregates", + "path_kind": "property" + }, + "purpose": "Maps aggregate identifiers to governed aggregate definitions exposed by the records API.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 64 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/aggregates/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Governed aggregate definition with disclosure controls.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/recordAggregate", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "description", + "disclosure_control" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/recordAggregate" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/aggregates/propertyNames", + "path_kind": "map_key" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/attribute_release_profiles", + "path_kind": "property" + }, + "purpose": "Purpose-bound, exact-one identity releases keyed by stable profile id. Generated Relay responses omit source metadata and are never cacheable.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/recordAttributeReleaseProfiles", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 16 + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/recordAttributeReleaseProfiles" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/filters", + "path_kind": "property" + }, + "purpose": "Maps filterable entity fields to the comparison operators the records API permits for each field.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 256 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/filters/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Allowed operators for one queryable field.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "array" + ], + "local_reference": "#/$defs/filterOperators", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "minItems", + "value": 1 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/filterOperators" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/filters/propertyNames", + "path_kind": "map_key" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/pagination", + "path_kind": "property" + }, + "purpose": "Defines the default and maximum row limits enforced by records API pagination.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "default_limit", + "max_limit" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/pagination/properties/default_limit", + "path_kind": "property" + }, + "purpose": "Sets the row limit applied when a records request does not supply its own limit.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 10000 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/pagination/properties/max_limit", + "path_kind": "property" + }, + "purpose": "Caps the row limit that any records request may select; it must be at least 2 when attribute-release profiles are configured so ambiguous subjects can be detected.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 10000 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/projection", + "path_kind": "property" + }, + "purpose": "Lists the entity fields that the records API is permitted to project into row responses.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 256 + }, + { + "keyword": "minItems", + "value": 1 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/projection/items", + "path_kind": "array_item" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/purposes", + "path_kind": "property" + }, + "purpose": "Lists the bounded purpose identifiers accepted by this records API policy.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 32 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/purposes/items", + "path_kind": "array_item" + }, + "purpose": "Non-empty token without commas, whitespace, or control characters.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/token", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/token" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/relationships", + "path_kind": "property" + }, + "purpose": "Declares the bounded named relationships that records queries may follow between authored entities.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 64 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/relationships/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "kind", + "target", + "foreign_key" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/relationships/additionalProperties/properties/concept_uri", + "path_kind": "property" + }, + "purpose": "Bounded human-readable project metadata.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/text", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 2048 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/text" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/relationships/additionalProperties/properties/foreign_key", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/relationships/additionalProperties/properties/kind", + "path_kind": "property" + }, + "purpose": "Selects whether one declared records relationship belongs to, has many, or has one target record.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "belongs_to", + "has_many", + "has_one" + ] + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/relationships/additionalProperties/properties/target", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/relationships/propertyNames", + "path_kind": "map_key" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/required_principal_filters", + "path_kind": "property" + }, + "purpose": "Lists principal-bound fields required for records queries; it must be empty when attribute-release profiles are configured because subject lookup cannot supply principal filters.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "array" + ], + "local_reference": "#/$defs/fieldList", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 16 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/fieldList" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/scopes", + "path_kind": "property" + }, + "purpose": "Groups the authorization scopes required for records metadata, row access, aggregates, and evidence verification.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "metadata", + "rows" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/scopes/properties/aggregate", + "path_kind": "property" + }, + "purpose": "Authorization scope token.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/scope", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 128 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/scope" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/scopes/properties/evidence_verification", + "path_kind": "property" + }, + "purpose": "Authorization scope token.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/scope", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 128 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/scope" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/scopes/properties/metadata", + "path_kind": "property" + }, + "purpose": "Authorization scope token.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/scope", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 128 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/scope" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/scopes/properties/rows", + "path_kind": "property" + }, + "purpose": "Authorization scope token.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/scope", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 128 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/scope" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/standards", + "path_kind": "property" + }, + "purpose": "Declares whether this records API exposes its reviewed OGC Features and SP-DCI standards profiles.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "ogc_features", + "sp_dci" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/standards/properties/ogc_features", + "path_kind": "property" + }, + "purpose": "Disables OGC API Features support or supplies the reviewed spatial profile used to enable it.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": true + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/standards/properties/ogc_features/oneOf/0", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "const", + "value": false + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/standards/properties/ogc_features/oneOf/1", + "path_kind": "branch" + }, + "purpose": "OGC API Features collection metadata and bounded geometry mapping.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/recordSpatial", + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "geometry" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/recordSpatial" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/standards/properties/sp_dci", + "path_kind": "property" + }, + "purpose": "Disables SP-DCI support or supplies the reviewed registry mapping used to enable it.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": true + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/standards/properties/sp_dci/oneOf/0", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "const", + "value": false + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsApi/properties/standards/properties/sp_dci/oneOf/1", + "path_kind": "branch" + }, + "purpose": "SP-DCI registry identity and field mappings for a records service.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/recordSpdci", + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "registry", + "registry_type", + "record_type", + "identifiers", + "expression_fields" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/recordSpdci" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsService/properties/access_rights", + "path_kind": "property" + }, + "purpose": "Classifies the records service as public, restricted, or non-public for catalog and access metadata.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "public", + "restricted", + "non_public" + ] + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsService/properties/api", + "path_kind": "property" + }, + "purpose": "Relay records API behavior, authorization, query bounds, and standards profiles.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/recordsApi", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "scopes", + "projection", + "pagination", + "standards" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/recordsApi" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsService/properties/conforms_to", + "path_kind": "property" + }, + "purpose": "Lists the standards or specifications to which the records service declares conformance.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 32 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsService/properties/conforms_to/items", + "path_kind": "array_item" + }, + "purpose": "Bounded human-readable project metadata.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/text", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 2048 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/text" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsService/properties/description", + "path_kind": "property" + }, + "purpose": "Bounded human-readable project metadata.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/text", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 2048 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/text" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsService/properties/entity", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsService/properties/kind", + "path_kind": "property" + }, + "purpose": "Identifies this service declaration as a Relay records API backed by an authored entity.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": "records_api" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsService/properties/owner", + "path_kind": "property" + }, + "purpose": "Bounded human-readable project metadata.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/text", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 2048 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/text" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsService/properties/sensitivity", + "path_kind": "property" + }, + "purpose": "Classifies the overall sensitivity of records exposed by this service declaration.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "public", + "internal", + "personal", + "confidential", + "secret" + ] + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsService/properties/title", + "path_kind": "property" + }, + "purpose": "Bounded human-readable project metadata.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/text", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 2048 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/text" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/recordsService/properties/update_frequency", + "path_kind": "property" + }, + "purpose": "Declares the reviewed cadence at which the records service's backing data is updated.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "continuous", + "daily", + "weekly", + "termly", + "monthly", + "quarterly", + "annual", + "irregular", + "as_needed", + "unknown" + ] + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/service/oneOf/0", + "path_kind": "branch" + }, + "purpose": "Notary evidence policy, consultations, claims, and registry-backed credential profiles. Source-free claims remain evaluation-only and cannot be selected by a credential profile.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/evidenceService", + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "kind", + "version", + "purpose", + "legal_basis", + "consent", + "access", + "claims" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/evidenceService" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/service/oneOf/1", + "path_kind": "branch" + }, + "purpose": "Relay records API backed by one authored materialized entity.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/recordsService", + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "kind", + "entity", + "api" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/recordsService" + } + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/variables/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "from", + "type" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/variables/additionalProperties/properties/from", + "path_kind": "property" + }, + "purpose": "Binds one evidence variable to its caller-supplied request variable path.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^request\\.variables\\.[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/variables/additionalProperties/properties/type", + "path_kind": "property" + }, + "purpose": "Declares the request variable as a date value for typed evidence evaluation.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": "date" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/$defs/variables/propertyNames", + "path_kind": "map_key" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/anyOf/0", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "integrations" + ] + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/anyOf/0/properties/integrations", + "path_kind": "property" + }, + "purpose": "Requires at least one authored integration when the project satisfies the integration-content alternative.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "minProperties", + "value": 1 + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/anyOf/1", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "entities" + ] + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/anyOf/1/properties/entities", + "path_kind": "property" + }, + "purpose": "Requires at least one authored entity when the project satisfies the entity-content alternative.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "minProperties", + "value": 1 + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/anyOf/2", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "services" + ] + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/anyOf/2/properties/services", + "path_kind": "property" + }, + "purpose": "Requires at least one authored service when the project satisfies the service-content alternative.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "minProperties", + "value": 1 + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/properties/entities", + "path_kind": "property" + }, + "purpose": "Materialized entity definitions keyed by project-local entity identifier.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 32 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/properties/entities/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "file" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/properties/entities/additionalProperties/properties/file", + "path_kind": "property" + }, + "purpose": "Selects the project-relative authored entity document for this project-local entity identifier.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/relativePath", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 4096 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^(?!/)(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/relativePath" + } + }, + { + "address": { + "schema": "project", + "pointer": "/properties/entities/propertyNames", + "path_kind": "map_key" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/properties/integrations", + "path_kind": "property" + }, + "purpose": "Source adaptation definitions keyed by project-local integration identifier.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 16 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/properties/integrations/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "file" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/properties/integrations/additionalProperties/properties/file", + "path_kind": "property" + }, + "purpose": "Selects the project-relative authored integration document for this project-local integration identifier.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/relativePath", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 4096 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^(?!/)(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/relativePath" + } + }, + { + "address": { + "schema": "project", + "pointer": "/properties/integrations/propertyNames", + "path_kind": "map_key" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/properties/registry", + "path_kind": "property" + }, + "purpose": "Stable identity of the Registry Stack project.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/properties/registry/properties/id", + "path_kind": "property" + }, + "purpose": "Assigns the stable project-local registry identifier used to bind generated product inputs and review artifacts.", + "purpose_source": "reviewed_override", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/properties/services", + "path_kind": "property" + }, + "purpose": "Relay records APIs and Notary evidence services exposed by the project.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 32 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/properties/services/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Closed choice between a Notary evidence service and a Relay records service.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "local_reference": "#/$defs/service", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [], + "local_reference": { + "schema": "project", + "pointer": "/$defs/service" + } + }, + { + "address": { + "schema": "project", + "pointer": "/properties/services/propertyNames", + "path_kind": "map_key" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/properties/starter", + "path_kind": "property" + }, + "purpose": "Immutable provenance for a workspace initialized from a Registry Stack starter. The digest excludes this content_digest field and covers the starter's authored project files.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id", + "release", + "content_digest" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/properties/starter/properties/content_digest", + "path_kind": "property" + }, + "purpose": "Digest of the initialized starter authoring content, used to report later workspace divergence.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^sha256:[0-9a-f]{64}$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "project", + "pointer": "/properties/starter/properties/id", + "path_kind": "property" + }, + "purpose": "Registry Stack starter identifier.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "project", + "pointer": "/properties/starter/properties/release", + "path_kind": "property" + }, + "purpose": "Registry Stack release that supplied the starter.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/token", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^[^,\\s\\u0000-\\u001F\\u007F]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "project", + "pointer": "/$defs/token" + } + }, + { + "address": { + "schema": "project", + "pointer": "/properties/version", + "path_kind": "property" + }, + "purpose": "Project authoring format version.", + "purpose_source": "schema_description", + "semantic_owner": "authoring_contract", + "human_owner": "registry_maintainers", + "scope": "The product-neutral project graph and the Relay or Notary services that consume its authored contracts.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "public", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.project.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and values from a maintained golden workspace; never copy a private country contract into reference data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Revalidate and rebuild the project after changing this field; coordinate a deployment when generated product inputs change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": 1 + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "", + "path_kind": "root" + }, + "purpose": "Binds a Registry Stack project to environment-specific services, sources, credentials, and deployment topology.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": true + }, + "requiredness": "not_applicable", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": true, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "version", + "deployment" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/ca/properties/file", + "path_kind": "property" + }, + "purpose": "Normalized absolute path without dot segments or duplicate separators.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/absolutePath", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 4096 + }, + { + "keyword": "minLength", + "value": 2 + }, + { + "keyword": "pattern", + "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/absolutePath" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/ca/properties/generation", + "path_kind": "property" + }, + "purpose": "Records the operator-controlled trust-root generation used for explicit certificate-authority rotation.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 18446744073709551615 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/credential/oneOf/0", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "username", + "password", + "generation" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/credential/oneOf/0/properties/generation", + "path_kind": "property" + }, + "purpose": "Records the generation of the operator-managed basic-authentication credential references.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 18446744073709551615 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/credential/oneOf/0/properties/password", + "path_kind": "property" + }, + "purpose": "Reference to a process-environment variable; secret values are never authored here.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/secret", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "secret" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/secret" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/credential/oneOf/0/properties/username", + "path_kind": "property" + }, + "purpose": "Reference to a process-environment variable; secret values are never authored here.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/secret", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "secret" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/secret" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/credential/oneOf/1", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "token", + "generation" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/credential/oneOf/1/properties/generation", + "path_kind": "property" + }, + "purpose": "Records the generation of the operator-managed bearer-token credential reference.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 18446744073709551615 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/credential/oneOf/1/properties/token", + "path_kind": "property" + }, + "purpose": "Reference to a process-environment variable; secret values are never authored here.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/secret", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "secret" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/secret" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/credential/oneOf/2", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "client_id", + "client_secret", + "generation" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/credential/oneOf/2/properties/client_id", + "path_kind": "property" + }, + "purpose": "Reference to a process-environment variable; secret values are never authored here.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/secret", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "secret" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/secret" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/credential/oneOf/2/properties/client_secret", + "path_kind": "property" + }, + "purpose": "Reference to a process-environment variable; secret values are never authored here.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/secret", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "secret" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/secret" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/credential/oneOf/2/properties/generation", + "path_kind": "property" + }, + "purpose": "Records the generation of the operator-managed OAuth client credential references.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 18446744073709551615 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/credential/oneOf/3", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "value", + "generation" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/credential/oneOf/3/properties/generation", + "path_kind": "property" + }, + "purpose": "Records the generation of the operator-managed API-key credential reference.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 18446744073709551615 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/credential/oneOf/3/properties/value", + "path_kind": "property" + }, + "purpose": "Reference to a process-environment variable; secret values are never authored here.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/secret", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "secret" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/secret" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/endpoint/properties/allowed_private_cidrs", + "path_kind": "property" + }, + "purpose": "Explicit private network ranges this source may resolve to.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "array" + ], + "local_reference": "#/$defs/privateCidrs", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 16 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/privateCidrs" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/endpoint/properties/ca", + "path_kind": "property" + }, + "purpose": "Pinned certificate-authority file and its rotation generation.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/ca", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "file", + "generation" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/ca" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/endpoint/properties/generation", + "path_kind": "property" + }, + "purpose": "Records the operator-controlled private-endpoint generation used for explicit binding rotation.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 18446744073709551615 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/endpoint/properties/mtls", + "path_kind": "property" + }, + "purpose": "Client certificate and private-key reference for mutual TLS.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/mtls", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "certificate_file", + "private_key", + "generation" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/mtls" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/endpoint/properties/origin", + "path_kind": "property" + }, + "purpose": "HTTPS origin without path, query, or fragment.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/origin", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "format", + "value": "uri" + }, + { + "keyword": "pattern", + "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/origin" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/endpoint/properties/path", + "path_kind": "property" + }, + "purpose": "Binds a reviewed private endpoint path beneath its separately configured origin.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 4096 + }, + { + "keyword": "minLength", + "value": 2 + }, + { + "keyword": "pattern", + "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//)(?!.*[?#]).+$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/entity/properties/columns", + "path_kind": "property" + }, + "purpose": "Maps authored entity field names to columns supplied by the environment-owned provider.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "minProperties", + "value": 1 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/entity/properties/columns/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/entity/properties/columns/propertyNames", + "path_kind": "map_key" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/entity/properties/generation", + "path_kind": "property" + }, + "purpose": "Records the operator-controlled generation of this entity materialization binding.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/entity/properties/provider", + "path_kind": "property" + }, + "purpose": "Environment-specific physical provider for a materialized entity.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/provider", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/provider" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/entity/properties/source_revision", + "path_kind": "property" + }, + "purpose": "Records the operator-supplied revision label of the bound entity source.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/integration/properties/source", + "path_kind": "property" + }, + "purpose": "Runtime source connection policy for one authored integration.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/source", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "origin" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/source" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/internalOrigin/anyOf/0", + "path_kind": "branch" + }, + "purpose": "HTTPS origin without path, query, or fragment.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/origin", + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "format", + "value": "uri" + }, + { + "keyword": "pattern", + "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/origin" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/internalOrigin/anyOf/1", + "path_kind": "branch" + }, + "purpose": "HTTP IP-loopback origin; public Relay and issuer fields restrict it to the local profile, while internal Notary-to-Relay connections allow it in any profile.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/localLoopbackOrigin", + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "format", + "value": "uri" + }, + { + "keyword": "pattern", + "value": "^[hH][tT][tT][pP]://(?:127(?:\\.[0-9]{1,3}){3}|\\[::1\\])(?::[0-9]+)?/?$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/localLoopbackOrigin" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/mtls/properties/certificate_file", + "path_kind": "property" + }, + "purpose": "Normalized absolute path without dot segments or duplicate separators.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/absolutePath", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 4096 + }, + { + "keyword": "minLength", + "value": 2 + }, + { + "keyword": "pattern", + "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/absolutePath" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/mtls/properties/generation", + "path_kind": "property" + }, + "purpose": "Records the operator-controlled mutual-TLS generation used for explicit certificate and key rotation.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 18446744073709551615 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/mtls/properties/private_key", + "path_kind": "property" + }, + "purpose": "Reference to a process-environment variable; secret values are never authored here.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/secret", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "secret" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/secret" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/access_token", + "path_kind": "property" + }, + "purpose": "Dedicated Notary access-token signing key and published key identifier.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "signing_key", + "signing_kid" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/access_token/properties/signing_key", + "path_kind": "property" + }, + "purpose": "Reference to a process-environment variable; secret values are never authored here.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/secret", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "secret" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/secret" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/access_token/properties/signing_kid", + "path_kind": "property" + }, + "purpose": "Bounded visible-ASCII token, including full verification-method identifiers.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/token2048", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 2048 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^[!-~]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/token2048" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/allowed_wallet_origins", + "path_kind": "property" + }, + "purpose": "Exact HTTPS browser origins admitted to the wallet-facing Notary routes.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 16 + }, + { + "keyword": "minItems", + "value": 1 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/allowed_wallet_origins/items", + "path_kind": "array_item" + }, + "purpose": "HTTPS origin without path, query, or fragment.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/origin", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uri" + }, + { + "keyword": "pattern", + "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/origin" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/authorization_server", + "path_kind": "property" + }, + "purpose": "Pinned eSignet issuer and exact endpoints used for login and token validation.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "issuer", + "jwks_url", + "userinfo_url", + "authorize_url", + "token_url" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/authorization_server/properties/authorize_url", + "path_kind": "property" + }, + "purpose": "Relay authentication resource using HTTPS, or HTTP IP-loopback under the local profile.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "local_reference": "#/$defs/relayResource", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/relayResource" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/authorization_server/properties/issuer", + "path_kind": "property" + }, + "purpose": "Relay or issuer origin using HTTPS, or HTTP IP-loopback under the local profile.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "local_reference": "#/$defs/relayOrigin", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/relayOrigin" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/authorization_server/properties/jwks_url", + "path_kind": "property" + }, + "purpose": "Relay authentication resource using HTTPS, or HTTP IP-loopback under the local profile.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "local_reference": "#/$defs/relayResource", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/relayResource" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/authorization_server/properties/token_url", + "path_kind": "property" + }, + "purpose": "Relay authentication resource using HTTPS, or HTTP IP-loopback under the local profile.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "local_reference": "#/$defs/relayResource", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/relayResource" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/authorization_server/properties/userinfo_url", + "path_kind": "property" + }, + "purpose": "Relay authentication resource using HTTPS, or HTTP IP-loopback under the local profile.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "local_reference": "#/$defs/relayResource", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/relayResource" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/client", + "path_kind": "property" + }, + "purpose": "eSignet relying-party identity and dedicated private-key reference.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id", + "signing_key", + "signing_kid" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/client/properties/id", + "path_kind": "property" + }, + "purpose": "Bounded visible-ASCII protocol token.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/token256", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^[!-~]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/token256" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/client/properties/signing_key", + "path_kind": "property" + }, + "purpose": "Reference to a process-environment variable; secret values are never authored here.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/secret", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "secret" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/secret" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/client/properties/signing_kid", + "path_kind": "property" + }, + "purpose": "Bounded visible-ASCII token, including full verification-method identifiers.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/token2048", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 2048 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^[!-~]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/token2048" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/credential", + "path_kind": "property" + }, + "purpose": "Existing project service and credential profile exposed through OID4VCI.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "service", + "profile" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/credential/properties/profile", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/credential/properties/service", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/public_base_url", + "path_kind": "property" + }, + "purpose": "Relay or issuer origin using HTTPS, or HTTP IP-loopback under the local profile.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "local_reference": "#/$defs/relayOrigin", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/relayOrigin" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/redirect_uri", + "path_kind": "property" + }, + "purpose": "Relay authentication resource using HTTPS, or HTTP IP-loopback under the local profile.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "local_reference": "#/$defs/relayResource", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/relayResource" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/sensitive_state_key", + "path_kind": "property" + }, + "purpose": "Reference to a process-environment variable; secret values are never authored here.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/secret", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "secret" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/secret" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/subject", + "path_kind": "property" + }, + "purpose": "Verified eSignet userinfo claim bound exactly to the credential subject identifier.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "token_claim", + "id_type" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/subject/properties/id_type", + "path_kind": "property" + }, + "purpose": "Bounded visible-ASCII protocol token.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/token256", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^[!-~]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/token256" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/subject/properties/token_claim", + "path_kind": "property" + }, + "purpose": "Bounded visible-ASCII protocol token.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/token256", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^[!-~]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/token256" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/tx_code", + "path_kind": "property" + }, + "purpose": "Transaction-code policy. Omit for the secure required-PIN default. Set required=false only for a bounded bearer-offer interoperability profile; the compiler fixes the offer lifetime at 300 seconds.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/oid4vci/properties/tx_code/properties/required", + "path_kind": "property" + }, + "purpose": "States whether OID4VCI authorization requires a transaction code before credential issuance.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "schema_value": true + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/privateCidrs/items", + "path_kind": "array_item" + }, + "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 64 + }, + { + "keyword": "minLength", + "value": 3 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/provider/oneOf/0", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "type", + "path" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/provider/oneOf/0/properties/delimiter", + "path_kind": "property" + }, + "purpose": "Selects the byte used to delimit fields in the bound CSV source.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 255 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/provider/oneOf/0/properties/header_row", + "path_kind": "property" + }, + "purpose": "Selects the one-based CSV row containing source column headers.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/provider/oneOf/0/properties/path", + "path_kind": "property" + }, + "purpose": "Normalized absolute path without dot segments or duplicate separators.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/absolutePath", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 4096 + }, + { + "keyword": "minLength", + "value": 2 + }, + { + "keyword": "pattern", + "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/absolutePath" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/provider/oneOf/0/properties/quote", + "path_kind": "property" + }, + "purpose": "Selects the byte used to quote fields in the bound CSV source.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 255 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/provider/oneOf/0/properties/type", + "path_kind": "property" + }, + "purpose": "Selects CSV as the environment-owned materialization provider for an authored entity.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": "csv" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/provider/oneOf/1", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "type", + "path", + "sheet" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/provider/oneOf/1/properties/data_range", + "path_kind": "property" + }, + "purpose": "Restricts entity materialization to the reviewed range within the selected worksheet.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/provider/oneOf/1/properties/header_row", + "path_kind": "property" + }, + "purpose": "Selects the one-based XLSX row containing source column headers.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/provider/oneOf/1/properties/path", + "path_kind": "property" + }, + "purpose": "Normalized absolute path without dot segments or duplicate separators.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/absolutePath", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 4096 + }, + { + "keyword": "minLength", + "value": 2 + }, + { + "keyword": "pattern", + "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/absolutePath" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/provider/oneOf/1/properties/sheet", + "path_kind": "property" + }, + "purpose": "Names the worksheet read from the environment-owned XLSX source.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/provider/oneOf/1/properties/type", + "path_kind": "property" + }, + "purpose": "Selects XLSX as the environment-owned materialization provider for an authored entity.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": "xlsx" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/provider/oneOf/2", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "type", + "path" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/provider/oneOf/2/properties/path", + "path_kind": "property" + }, + "purpose": "Normalized absolute path without dot segments or duplicate separators.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/absolutePath", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 4096 + }, + { + "keyword": "minLength", + "value": 2 + }, + { + "keyword": "pattern", + "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/absolutePath" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/provider/oneOf/2/properties/type", + "path_kind": "property" + }, + "purpose": "Selects Parquet as the environment-owned materialization provider for an authored entity.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": "parquet" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/provider/oneOf/3", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "type", + "connection", + "schema", + "table" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/provider/oneOf/3/properties/connection", + "path_kind": "property" + }, + "purpose": "Reference to a process-environment variable; secret values are never authored here.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/secret", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "secret" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/secret" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/provider/oneOf/3/properties/schema", + "path_kind": "property" + }, + "purpose": "Portable unquoted PostgreSQL schema or table identifier.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/postgresIdentifier", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9_]{0,62}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/postgresIdentifier" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/provider/oneOf/3/properties/table", + "path_kind": "property" + }, + "purpose": "Portable unquoted PostgreSQL schema or table identifier.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/postgresIdentifier", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9_]{0,62}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/postgresIdentifier" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/provider/oneOf/3/properties/type", + "path_kind": "property" + }, + "purpose": "Selects PostgreSQL as the environment-owned materialization provider for an authored entity.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": "postgres" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/relayOrigin/anyOf/0", + "path_kind": "branch" + }, + "purpose": "HTTPS origin without path, query, or fragment.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/origin", + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "format", + "value": "uri" + }, + { + "keyword": "pattern", + "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/origin" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/relayOrigin/anyOf/1", + "path_kind": "branch" + }, + "purpose": "HTTP IP-loopback origin; public Relay and issuer fields restrict it to the local profile, while internal Notary-to-Relay connections allow it in any profile.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/localLoopbackOrigin", + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "format", + "value": "uri" + }, + { + "keyword": "pattern", + "value": "^[hH][tT][tT][pP]://(?:127(?:\\.[0-9]{1,3}){3}|\\[::1\\])(?::[0-9]+)?/?$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/localLoopbackOrigin" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/relayResource/anyOf/0", + "path_kind": "branch" + }, + "purpose": "Exact HTTPS resource without query or fragment.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/httpsResource", + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "format", + "value": "uri" + }, + { + "keyword": "pattern", + "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/[^?#]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/httpsResource" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/relayResource/anyOf/1", + "path_kind": "branch" + }, + "purpose": "HTTP IP-loopback resource accepted only with the local deployment profile.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/localLoopbackResource", + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "format", + "value": "uri" + }, + { + "keyword": "pattern", + "value": "^[hH][tT][tT][pP]://(?:127(?:\\.[0-9]{1,3}){3}|\\[::1\\])(?::[0-9]+)?/[^?#]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/localLoopbackResource" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/secret/properties/secret", + "path_kind": "property" + }, + "purpose": "Names the operator-managed environment secret reference without containing the secret value.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[A-Z_][A-Z0-9_]{0,127}$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/service/properties/service", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/source/properties/allowed_private_cidrs", + "path_kind": "property" + }, + "purpose": "Explicit private network ranges this source may resolve to.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "array" + ], + "local_reference": "#/$defs/privateCidrs", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 16 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/privateCidrs" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/source/properties/ca", + "path_kind": "property" + }, + "purpose": "Pinned certificate-authority file and its rotation generation.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/ca", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "file", + "generation" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/ca" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/source/properties/concurrency", + "path_kind": "property" + }, + "purpose": "Caps the number of requests that may be in flight concurrently for this source.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 64 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/source/properties/credential", + "path_kind": "property" + }, + "purpose": "One supported source credential shape, containing references rather than values.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/credential", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/credential" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/source/properties/jwks", + "path_kind": "property" + }, + "purpose": "Security-bound HTTPS endpoint with optional private-network, CA, and mTLS policy.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/endpoint", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "origin", + "path", + "generation" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/endpoint" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/source/properties/mtls", + "path_kind": "property" + }, + "purpose": "Client certificate and private-key reference for mutual TLS.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/mtls", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "certificate_file", + "private_key", + "generation" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/mtls" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/source/properties/oauth", + "path_kind": "property" + }, + "purpose": "Security-bound HTTPS endpoint with optional private-network, CA, and mTLS policy.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/endpoint", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "origin", + "path", + "generation" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/endpoint" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/source/properties/origin", + "path_kind": "property" + }, + "purpose": "HTTPS origin without path, query, or fragment.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/origin", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "format", + "value": "uri" + }, + { + "keyword": "pattern", + "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/origin" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/source/properties/rate", + "path_kind": "property" + }, + "purpose": "Defines the per-minute request rate and burst bounds applied to one environment source.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "per_minute", + "burst" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/source/properties/rate/properties/burst", + "path_kind": "property" + }, + "purpose": "Caps the short request burst permitted by the source rate limiter.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 1024 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/source/properties/rate/properties/per_minute", + "path_kind": "property" + }, + "purpose": "Caps the number of requests permitted to this source during one minute.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 60000 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/$defs/source/properties/timeout", + "path_kind": "property" + }, + "purpose": "Bounds the elapsed time allowed for one request to this environment source.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[1-9][0-9]*(?:ms|s)$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/0", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/0/else", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/0/else/not", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "relay" + ] + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/0/if", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "deployment" + ] + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/0/if/properties/deployment", + "path_kind": "property" + }, + "purpose": "Matches environments whose deployment declaration enables Relay so the corresponding Relay binding is required.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "relay" + ] + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/0/then", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "relay" + ] + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/1", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/1/if", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "notary_relay" + ] + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/1/then", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/1/then/properties/deployment", + "path_kind": "property" + }, + "purpose": "Requires both Relay and Notary deployment services when a Notary-to-Relay binding is present.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "relay", + "notary" + ] + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/2", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/2/if", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "relay_state" + ] + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/2/then", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/2/then/properties/deployment", + "path_kind": "property" + }, + "purpose": "Requires the Relay deployment service when Relay state storage is configured.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "relay" + ] + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/3", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/3/if", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "notary_state" + ] + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/3/then", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/3/then/properties/deployment", + "path_kind": "property" + }, + "purpose": "Requires the Notary deployment service when Notary state storage is configured.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "notary" + ] + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/4", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/4/if", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "notary_cel" + ] + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/4/then", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/4/then/properties/deployment", + "path_kind": "property" + }, + "purpose": "Requires the Notary deployment service when a Notary CEL worker memory bound is configured.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "notary" + ] + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/5", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/5/else", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/5/else/properties/callers", + "path_kind": "property" + }, + "purpose": "When callers are authored without OID4VCI, requires the caller map to contain at least one binding; cross-file validation separately requires callers for Notary environments and rejects them for Relay-only topology.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "minProperties", + "value": 1 + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/5/if", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "oid4vci" + ] + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/5/then", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "notary_state" + ] + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/5/then/properties/deployment", + "path_kind": "property" + }, + "purpose": "Requires the Notary deployment service when OID4VCI issuance is configured.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "notary" + ] + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/6", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/6/else", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/6/else/properties/oid4vci", + "path_kind": "property" + }, + "purpose": "Applies non-local HTTPS constraints to public OID4VCI endpoints.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/6/else/properties/oid4vci/properties/authorization_server", + "path_kind": "property" + }, + "purpose": "Applies non-local HTTPS constraints to all configured OID4VCI authorization-server endpoints.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/6/else/properties/oid4vci/properties/authorization_server/properties/authorize_url", + "path_kind": "property" + }, + "purpose": "Exact HTTPS resource without query or fragment.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/httpsResource", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "format", + "value": "uri" + }, + { + "keyword": "pattern", + "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/[^?#]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/httpsResource" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/6/else/properties/oid4vci/properties/authorization_server/properties/issuer", + "path_kind": "property" + }, + "purpose": "HTTPS origin without path, query, or fragment.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/origin", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "format", + "value": "uri" + }, + { + "keyword": "pattern", + "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/origin" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/6/else/properties/oid4vci/properties/authorization_server/properties/jwks_url", + "path_kind": "property" + }, + "purpose": "Exact HTTPS resource without query or fragment.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/httpsResource", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "format", + "value": "uri" + }, + { + "keyword": "pattern", + "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/[^?#]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/httpsResource" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/6/else/properties/oid4vci/properties/authorization_server/properties/token_url", + "path_kind": "property" + }, + "purpose": "Exact HTTPS resource without query or fragment.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/httpsResource", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "format", + "value": "uri" + }, + { + "keyword": "pattern", + "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/[^?#]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/httpsResource" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/6/else/properties/oid4vci/properties/authorization_server/properties/userinfo_url", + "path_kind": "property" + }, + "purpose": "Exact HTTPS resource without query or fragment.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/httpsResource", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "format", + "value": "uri" + }, + { + "keyword": "pattern", + "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/[^?#]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/httpsResource" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/6/else/properties/oid4vci/properties/public_base_url", + "path_kind": "property" + }, + "purpose": "HTTPS origin without path, query, or fragment.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/origin", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "format", + "value": "uri" + }, + { + "keyword": "pattern", + "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/origin" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/6/else/properties/oid4vci/properties/redirect_uri", + "path_kind": "property" + }, + "purpose": "Exact HTTPS resource without query or fragment.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/httpsResource", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "format", + "value": "uri" + }, + { + "keyword": "pattern", + "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/[^?#]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/httpsResource" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/6/else/properties/relay", + "path_kind": "property" + }, + "purpose": "Applies non-local HTTPS constraints to the Relay origin, issuer, and key-set bindings.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/6/else/properties/relay/properties/issuer", + "path_kind": "property" + }, + "purpose": "HTTPS origin without path, query, or fragment.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/origin", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "format", + "value": "uri" + }, + { + "keyword": "pattern", + "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/origin" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/6/else/properties/relay/properties/jwks_url", + "path_kind": "property" + }, + "purpose": "Exact HTTPS resource without query or fragment.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/httpsResource", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "format", + "value": "uri" + }, + { + "keyword": "pattern", + "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/[^?#]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/httpsResource" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/6/else/properties/relay/properties/origin", + "path_kind": "property" + }, + "purpose": "HTTPS origin without path, query, or fragment.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/origin", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "format", + "value": "uri" + }, + { + "keyword": "pattern", + "value": "^[hH][tT][tT][pP][sS]://[^/?#]+/?$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/origin" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/6/if", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/6/if/properties/deployment", + "path_kind": "property" + }, + "purpose": "Matches the local deployment profile before relaxing public endpoint transport constraints.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "profile" + ] + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/allOf/6/if/properties/deployment/properties/profile", + "path_kind": "property" + }, + "purpose": "Selects the local-profile condition used by the environment transport-validation branch.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": "local" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/callers", + "path_kind": "property" + }, + "purpose": "Notary API-key caller identities and the scopes each identity receives.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 64 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/callers/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "api_key_fingerprint", + "scopes" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/callers/additionalProperties/properties/api_key_fingerprint", + "path_kind": "property" + }, + "purpose": "Names the secret reference used to verify one caller API key; neither the key nor fingerprint value is authored here.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/secret", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "secret" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/secret" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/callers/additionalProperties/properties/scopes", + "path_kind": "property" + }, + "purpose": "Narrows one caller to the explicitly reviewed service scopes available in this environment.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 16 + }, + { + "keyword": "minItems", + "value": 1 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/callers/additionalProperties/properties/scopes/items", + "path_kind": "array_item" + }, + "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 128 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/callers/propertyNames", + "path_kind": "map_key" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/deployment", + "path_kind": "property" + }, + "purpose": "Products deployed in this environment and the operational profile they use.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": true + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "profile" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/deployment/anyOf/0", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "relay" + ] + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/deployment/anyOf/1", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "notary" + ] + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/deployment/properties/notary", + "path_kind": "property" + }, + "purpose": "Binds an authored product role to a deployed service identifier.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/service", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "service" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/service" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/deployment/properties/profile", + "path_kind": "property" + }, + "purpose": "Selects the deployment assurance profile whose service and transport conditions the environment must satisfy.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "local", + "hosted_lab", + "production", + "evidence_grade" + ] + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/deployment/properties/relay", + "path_kind": "property" + }, + "purpose": "Binds an authored product role to a deployed service identifier.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/service", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "service" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/service" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/entities", + "path_kind": "property" + }, + "purpose": "Environment-specific source bindings keyed by entity identifier.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 32 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/entities/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Maps an authored entity to provider columns and immutable source-generation identifiers.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/entity", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "provider", + "columns", + "source_revision", + "generation" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/entity" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/entities/propertyNames", + "path_kind": "map_key" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/integrations", + "path_kind": "property" + }, + "purpose": "Environment bindings keyed by authored integration identifier.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 16 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/integrations/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Environment binding for an authored source integration.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/integration", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "source" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/integration" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/integrations/propertyNames", + "path_kind": "map_key" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/issuance", + "path_kind": "property" + }, + "purpose": "Notary issuer and signing-key bindings for credential issuance.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "issuer", + "signing_key", + "signing_kid", + "generation" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/issuance/properties/algorithm", + "path_kind": "property" + }, + "purpose": "Credential issuer signing algorithm. Holder proof remains EdDSA with did:jwk.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "schema_value": "EdDSA" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "EdDSA", + "ES256" + ] + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/issuance/properties/generation", + "path_kind": "property" + }, + "purpose": "Records the operator-controlled issuance-key generation used for explicit rotation and rollback checks.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 18446744073709551615 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/issuance/properties/issuer", + "path_kind": "property" + }, + "purpose": "Binds the operator-approved credential issuer identifier without granting claim or disclosure authority.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/issuance/properties/signing_key", + "path_kind": "property" + }, + "purpose": "Names the operator-managed secret reference for credential signing; the signing key value is never authored or reported.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/secret", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "secret" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/secret" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/issuance/properties/signing_kid", + "path_kind": "property" + }, + "purpose": "Selects the reviewed signing-key identifier exposed in issued credential metadata without containing private key material.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/token2048", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 2048 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^[!-~]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/token2048" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/notary_cel", + "path_kind": "property" + }, + "purpose": "Optional per-worker data/address-space ceiling for dedicated Notary CEL processes. The Notary default is 134217728 bytes; 1073741824 is the maximum emulation-compatible exception and remains a limit, not an allocation.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "worker_memory_bytes" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/notary_cel/properties/worker_memory_bytes", + "path_kind": "property" + }, + "purpose": "Caps the memory available to one isolated Notary CEL worker.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 1073741824 + }, + { + "keyword": "minimum", + "value": 33554432 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/notary_relay", + "path_kind": "property" + }, + "purpose": "Deployment-internal Relay connection, Notary workload identity, and token file used only when Notary consults Relay.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "base_url", + "workload_client_id", + "token_file" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/notary_relay/properties/base_url", + "path_kind": "property" + }, + "purpose": "Binds Notary to the operator-reviewed Relay origin used for governed evidence consultations.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "local_reference": "#/$defs/internalOrigin", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/internalOrigin" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/notary_relay/properties/token_file", + "path_kind": "property" + }, + "purpose": "Selects the operator-managed token-file binding for Notary-to-Relay authentication without exposing its contents.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 4096 + }, + { + "keyword": "minLength", + "value": 2 + }, + { + "keyword": "pattern", + "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/notary_relay/properties/workload_client_id", + "path_kind": "property" + }, + "purpose": "Identifies the Notary workload client authorized to request reviewed Relay consultations.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/notary_state", + "path_kind": "property" + }, + "purpose": "Optional deployment binding for Notary-owned PostgreSQL state transport trust.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "postgresql" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/notary_state/properties/postgresql", + "path_kind": "property" + }, + "purpose": "Selects the PostgreSQL trust binding used by Notary state storage.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "root_certificate_path" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/notary_state/properties/postgresql/properties/root_certificate_path", + "path_kind": "property" + }, + "purpose": "Binds Notary state storage to an operator-managed PostgreSQL trust root at a deployment-local path.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/absolutePath", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 4096 + }, + { + "keyword": "minLength", + "value": 2 + }, + { + "keyword": "pattern", + "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/absolutePath" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/oid4vci", + "path_kind": "property" + }, + "purpose": "Explicit registry-backed holder-wallet OID4VCI binding for one authored Notary credential profile.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/oid4vci", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "public_base_url", + "credential", + "authorization_server", + "client", + "access_token", + "sensitive_state_key", + "subject", + "redirect_uri", + "allowed_wallet_origins" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/oid4vci" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/relay", + "path_kind": "property" + }, + "purpose": "Public Relay identity and token-validation settings for a Relay deployment.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "origin", + "issuer", + "jwks_url", + "audience", + "allowed_clients" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/relay/properties/allowed_clients", + "path_kind": "property" + }, + "purpose": "Narrows Relay authentication to the operator-reviewed client identifiers listed for this environment.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 64 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/relay/properties/allowed_clients/items", + "path_kind": "array_item" + }, + "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/relay/properties/audience", + "path_kind": "property" + }, + "purpose": "Binds the token audience Relay requires so tokens issued for another service are rejected.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/relay/properties/issuer", + "path_kind": "property" + }, + "purpose": "Binds the expected token issuer for Relay authentication in this deployment environment.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "local_reference": "#/$defs/relayOrigin", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/relayOrigin" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/relay/properties/jwks_url", + "path_kind": "property" + }, + "purpose": "Binds the operator-reviewed key-set endpoint Relay uses to verify caller tokens.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "local_reference": "#/$defs/relayResource", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/relayResource" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/relay/properties/origin", + "path_kind": "property" + }, + "purpose": "Binds the externally visible Relay origin reviewed by the operator and local network policy.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "local_reference": "#/$defs/relayOrigin", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/relayOrigin" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/relay_state", + "path_kind": "property" + }, + "purpose": "Optional deployment binding for Relay-owned consultation PostgreSQL state transport trust.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "postgresql" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/relay_state/properties/postgresql", + "path_kind": "property" + }, + "purpose": "Selects the PostgreSQL trust binding used by Relay state storage.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "root_certificate_path" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/relay_state/properties/postgresql/properties/root_certificate_path", + "path_kind": "property" + }, + "purpose": "Binds Relay state storage to an operator-managed PostgreSQL trust root at a deployment-local path.", + "purpose_source": "reviewed_override", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/absolutePath", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 4096 + }, + { + "keyword": "minLength", + "value": 2 + }, + { + "keyword": "pattern", + "value": "^/(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "environment", + "pointer": "/$defs/absolutePath" + } + }, + { + "address": { + "schema": "environment", + "pointer": "/properties/version", + "path_kind": "property" + }, + "purpose": "Environment authoring format version.", + "purpose_source": "schema_description", + "semantic_owner": "deployment_security", + "human_owner": "security_maintainers", + "scope": "Operator-owned deployment, trust, secret-reference, network, caller, state, and product availability bindings.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "public", + "state": "environment_bound", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "operator_preflight", + "product_build" + ], + "diagnostic": "registryctl.authoring.environment.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use non-routable example origins and opaque example secret-reference names, never working credentials or private infrastructure details.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate deployment and secret or trust rotation with the environment operator before activating a changed binding.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": 1 + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "", + "path_kind": "root" + }, + "purpose": "Defines a product-neutral source adaptation contract using bounded HTTP, Rhai script, or exact snapshot capabilities.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": true, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "version", + "id", + "revision", + "input", + "capability", + "outputs" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/allowRule/properties/method", + "path_kind": "property" + }, + "purpose": "Selects the GET or POST method permitted by one reviewed source allow rule.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "GET", + "POST" + ] + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/allowRule/properties/path", + "path_kind": "property" + }, + "purpose": "Defines one reviewed source path template; concrete private endpoints and identifiers remain environment-owned.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 4096 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^/[^?#]*$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/allowRule/properties/semantics", + "path_kind": "property" + }, + "purpose": "Declares that the permitted source operation has read-only semantics.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": "read_only" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/byteSize/oneOf/0", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 18446744073709551615 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/byteSize/oneOf/1", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[1-9][0-9]*(?:KiB|MiB)$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/capability/oneOf/0", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "http" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/capability/oneOf/0/properties/http", + "path_kind": "property" + }, + "purpose": "Selects the single-request declarative HTTP capability and its expected response semantics.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "request" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/capability/oneOf/0/properties/http/properties/request", + "path_kind": "property" + }, + "purpose": "Bounded read-only HTTP request template.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/httpRequest", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "method", + "path" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/httpRequest" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/capability/oneOf/0/properties/http/properties/response", + "path_kind": "property" + }, + "purpose": "Rules for translating upstream status and body cardinality into normalized outcomes.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/httpResponse", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/httpResponse" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/capability/oneOf/1", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "script" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/capability/oneOf/1/properties/script", + "path_kind": "property" + }, + "purpose": "Selects the reviewed project-relative script capability and its optional modules.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "file" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/capability/oneOf/1/properties/script/properties/file", + "path_kind": "property" + }, + "purpose": "Project-relative path without traversal or duplicate separators.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/relativePath", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 4096 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^(?!/)(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/relativePath" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/capability/oneOf/1/properties/script/properties/modules", + "path_kind": "property" + }, + "purpose": "Lists the reviewed project-relative modules available to the integration script.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 32 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/capability/oneOf/1/properties/script/properties/modules/items", + "path_kind": "array_item" + }, + "purpose": "Project-relative path without traversal or duplicate separators.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/relativePath", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 4096 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^(?!/)(?!.*(?:^|/)\\.\\.?/)(?!.*//).+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/relativePath" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/capability/oneOf/2", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "snapshot" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/capability/oneOf/2/properties/snapshot", + "path_kind": "property" + }, + "purpose": "Selects an offline entity snapshot capability with exact input matching and freshness control.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "entity", + "exact", + "freshness" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/capability/oneOf/2/properties/snapshot/properties/entity", + "path_kind": "property" + }, + "purpose": "Lowercase stable identifier used in project references.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/capability/oneOf/2/properties/snapshot/properties/exact", + "path_kind": "property" + }, + "purpose": "Maps entity fields to integration inputs that must match exactly in the snapshot lookup.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 8 + }, + { + "keyword": "minProperties", + "value": 1 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/capability/oneOf/2/properties/snapshot/properties/exact/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Reference to a declared integration input.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/inputReference", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "input" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/inputReference" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/capability/oneOf/2/properties/snapshot/properties/freshness", + "path_kind": "property" + }, + "purpose": "Sets the maximum accepted age of the materialized entity snapshot.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[1-9][0-9]*(?:ms|s|m|h|d)$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/credential/oneOf/0", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "type" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/credential/oneOf/0/properties/type", + "path_kind": "property" + }, + "purpose": "Selects an unauthenticated, basic-authentication, or static-bearer credential interface.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "none", + "basic", + "static_bearer" + ] + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/credential/oneOf/1", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "type", + "name", + "max_value_bytes" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/credential/oneOf/1/properties/max_value_bytes", + "path_kind": "property" + }, + "purpose": "Caps the credential value size accepted by the fixed-header API-key interface.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 4096 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/credential/oneOf/1/properties/name", + "path_kind": "property" + }, + "purpose": "Declares the fixed HTTP header name used by the API-key credential interface.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[A-Za-z][A-Za-z0-9_-]{0,63}$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/credential/oneOf/1/properties/type", + "path_kind": "property" + }, + "purpose": "Selects the fixed-header API-key credential interface for this source contract.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": "api_key_header" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/credential/oneOf/2", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "type", + "name", + "max_value_bytes" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/credential/oneOf/2/properties/max_value_bytes", + "path_kind": "property" + }, + "purpose": "Caps the credential value size accepted by the fixed-query API-key interface.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 4096 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/credential/oneOf/2/properties/name", + "path_kind": "property" + }, + "purpose": "Declares the fixed query parameter name used by the API-key credential interface.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[A-Za-z_][A-Za-z0-9._:~-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/credential/oneOf/2/properties/type", + "path_kind": "property" + }, + "purpose": "Selects the fixed-query-parameter API-key credential interface for this source contract.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": "api_key_query" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/credential/oneOf/3", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "type", + "request", + "response_profile" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/credential/oneOf/3/properties/audience", + "path_kind": "property" + }, + "purpose": "Constrains OAuth token acquisition to the reviewed source audience and is treated as sensitive operational metadata.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 2048 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/credential/oneOf/3/properties/refresh_skew", + "path_kind": "property" + }, + "purpose": "Sets the positive interval before token expiry at which the OAuth credential is refreshed.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[1-9][0-9]*(?:ms|s)$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/credential/oneOf/3/properties/request", + "path_kind": "property" + }, + "purpose": "Selects form-encoded or JSON token requests for the OAuth client-credentials interface.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "form", + "json" + ] + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/credential/oneOf/3/properties/response_profile", + "path_kind": "property" + }, + "purpose": "Requires the bounded OAuth bearer-token response profile supported by the source adapter.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": "oauth2_bearer" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/credential/oneOf/3/properties/scope", + "path_kind": "property" + }, + "purpose": "Declares the bounded OAuth scope string requested for this source credential.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 1024 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/credential/oneOf/3/properties/type", + "path_kind": "property" + }, + "purpose": "Selects the OAuth 2.0 client-credentials interface for source authentication.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": "oauth2_client_credentials" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/httpRequest/properties/body", + "path_kind": "property" + }, + "purpose": "Defines the optional authored body template sent by the declarative HTTP request.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/httpRequest/properties/headers", + "path_kind": "property" + }, + "purpose": "Maps reviewed request header names to authored values and input substitutions.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 32 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/httpRequest/properties/headers/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Request value supplied from a declared input or an authored scalar literal.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "boolean", + "integer", + "string" + ], + "local_reference": "#/$defs/inputOrLiteral", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/inputOrLiteral" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/httpRequest/properties/method", + "path_kind": "property" + }, + "purpose": "Selects the single GET or POST request performed by a declarative HTTP capability.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "GET", + "POST" + ] + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/httpRequest/properties/path", + "path_kind": "property" + }, + "purpose": "Defines the reviewed source path template used by the declarative HTTP request.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 4096 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^/[^?#]*$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/httpRequest/properties/query", + "path_kind": "property" + }, + "purpose": "Maps reviewed query parameter names to authored request values and input substitutions.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 64 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/httpRequest/properties/query/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Request value supplied from a declared input or an authored scalar literal.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "boolean", + "integer", + "string" + ], + "local_reference": "#/$defs/inputOrLiteral", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/inputOrLiteral" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/httpRequest/properties/semantics", + "path_kind": "property" + }, + "purpose": "Declares that the declarative HTTP request has read-only source semantics.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": "read_only" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/httpResponse/properties/ambiguous", + "path_kind": "property" + }, + "purpose": "Lists HTTP response statuses that produce the integration's ambiguous outcome.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/httpResponse/properties/ambiguous/items", + "path_kind": "array_item" + }, + "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 599 + }, + { + "keyword": "minimum", + "value": 100 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/httpResponse/properties/no_match", + "path_kind": "property" + }, + "purpose": "Lists HTTP response statuses that produce the integration's no-match outcome.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/httpResponse/properties/no_match/items", + "path_kind": "array_item" + }, + "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 599 + }, + { + "keyword": "minimum", + "value": 100 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/httpResponse/properties/shape", + "path_kind": "property" + }, + "purpose": "Declares whether a successful response is a singleton or a bounded collection.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/httpResponse/properties/shape/oneOf/0", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "const", + "value": "singleton" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/httpResponse/properties/shape/oneOf/1", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "records", + "cardinality" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/httpResponse/properties/shape/oneOf/1/properties/cardinality", + "path_kind": "property" + }, + "purpose": "Requires two-record probing so collection results distinguish one match from ambiguity.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": "probe_two" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/httpResponse/properties/shape/oneOf/1/properties/records", + "path_kind": "property" + }, + "purpose": "Selects the canonical response location containing collection records.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^/(?:[^/~]|~[01])+(?:/(?:[^/~]|~[01])+)*$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/input/properties/canonicalization", + "path_kind": "property" + }, + "purpose": "Selects the reviewed normalization rule applied before an input is compared, interpolated, or sent to a source.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "identity", + "ascii_lowercase" + ] + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/input/properties/format", + "path_kind": "property" + }, + "purpose": "Applies the full-date semantic format to a string-valued integration input.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": "date" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/input/properties/maxLength", + "path_kind": "property" + }, + "purpose": "Caps the character length accepted for a string-valued integration input.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 16384 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/input/properties/maximum", + "path_kind": "property" + }, + "purpose": "Sets the inclusive upper bound accepted for an integer-valued integration input.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 9223372036854775807 + }, + { + "keyword": "minimum", + "value": -9223372036854775808 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/input/properties/minLength", + "path_kind": "property" + }, + "purpose": "Sets the minimum character length accepted for a string-valued integration input.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 16384 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/input/properties/minimum", + "path_kind": "property" + }, + "purpose": "Sets the inclusive lower bound accepted for an integer-valued integration input.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 9223372036854775807 + }, + { + "keyword": "minimum", + "value": -9223372036854775808 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/input/properties/pattern", + "path_kind": "property" + }, + "purpose": "Constrains a string-valued integration input with the authored regular expression.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 16384 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/input/properties/role", + "path_kind": "property" + }, + "purpose": "Declares how one typed authoring input participates in source lookup, selection, or result shaping.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "selector", + "parameter" + ] + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/input/properties/type", + "path_kind": "property" + }, + "purpose": "Declares the closed scalar or array type accepted for one integration input.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "array" + ], + "local_reference": "#/$defs/scalarType", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/scalarType" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/inputOrLiteral/oneOf/0", + "path_kind": "branch" + }, + "purpose": "Reference to a declared integration input.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/inputReference", + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "input" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/inputReference" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/inputOrLiteral/oneOf/1", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "boolean", + "integer", + "string" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "boolean", + "integer" + ] + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/inputReference/properties/input", + "path_kind": "property" + }, + "purpose": "Portable lowercase name for an integration input or output.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/inputName", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9_]{0,63}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/inputName" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/limits/properties/calls", + "path_kind": "property" + }, + "purpose": "Caps the number of high-level source calls available to a script integration.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 16 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/limits/properties/deadline", + "path_kind": "property" + }, + "purpose": "Caps total integration execution time with a positive duration no greater than sixty seconds.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[1-9][0-9]*(?:ms|s)$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/limits/properties/request_bytes", + "path_kind": "property" + }, + "purpose": "Positive byte count expressed as an integer or a KiB/MiB quantity.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "integer", + "string" + ], + "local_reference": "#/$defs/byteSize", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/byteSize" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/limits/properties/source_bytes", + "path_kind": "property" + }, + "purpose": "Positive byte count expressed as an integer or a KiB/MiB quantity.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "integer", + "string" + ], + "local_reference": "#/$defs/byteSize", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/byteSize" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/notApplicable/properties/ambiguity", + "path_kind": "property" + }, + "purpose": "Why the reviewed source contract cannot produce more than one matching record.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/notApplicableReason", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "rationale", + "request_fixture" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/notApplicableReason" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/notApplicable/properties/subject_mismatch", + "path_kind": "property" + }, + "purpose": "Why the reviewed response contract contains no identifier comparable with a requested selector.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/notApplicableReason", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "rationale", + "request_fixture" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/notApplicableReason" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/notApplicableReason/properties/rationale", + "path_kind": "property" + }, + "purpose": "Why the named normally required outcome cannot occur for this source contract.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 512 + }, + { + "keyword": "minLength", + "value": 24 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/notApplicableReason/properties/request_fixture", + "path_kind": "property" + }, + "purpose": "Fixture name containing the supporting bounded source request.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/output/properties/format", + "path_kind": "property" + }, + "purpose": "Applies the full-date semantic format to a string-valued integration output.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": "date" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/output/properties/maxLength", + "path_kind": "property" + }, + "purpose": "Caps the character length produced for a string-valued integration output.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 16384 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/output/properties/maximum", + "path_kind": "property" + }, + "purpose": "Sets the inclusive upper bound produced for an integer-valued integration output.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 9223372036854775807 + }, + { + "keyword": "minimum", + "value": -9223372036854775808 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/output/properties/minimum", + "path_kind": "property" + }, + "purpose": "Sets the inclusive lower bound produced for an integer-valued integration output.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 9223372036854775807 + }, + { + "keyword": "minimum", + "value": -9223372036854775808 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/output/properties/type", + "path_kind": "property" + }, + "purpose": "Supported scalar type, optionally paired with null for nullable values.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "array" + ], + "local_reference": "#/$defs/scalarType", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/scalarType" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/output/properties/x-registry-source", + "path_kind": "property" + }, + "purpose": "Selects the canonical source-response location from which the HTTP output is extracted.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^/(?:[^/~]|~[01])+(?:/(?:[^/~]|~[01])+)*$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/protocol/properties/signed_dci", + "path_kind": "property" + }, + "purpose": "Enables the bounded signed DCI search helper and declares its protocol and selector bindings.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "profile", + "path", + "jwks_profile", + "sender", + "receiver", + "registry_type", + "record_type", + "locale", + "selectors" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/protocol/properties/signed_dci/properties/jwks_profile", + "path_kind": "property" + }, + "purpose": "Selects the supported RSA signing-key-set profile used to verify signed DCI responses.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": "rsa-signing-jwks-v1" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/protocol/properties/signed_dci/properties/locale", + "path_kind": "property" + }, + "purpose": "Declares the language or locale tag carried by signed DCI search requests.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[A-Za-z]{2,8}(?:-[A-Za-z0-9]{1,8})*$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/protocol/properties/signed_dci/properties/path", + "path_kind": "property" + }, + "purpose": "Declares the exact private source path used for signed DCI search requests.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^/[^?#]*$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/protocol/properties/signed_dci/properties/profile", + "path_kind": "property" + }, + "purpose": "Selects the supported DCI search request profile used by the signed protocol helper.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": "dci-search-v1" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/protocol/properties/signed_dci/properties/receiver", + "path_kind": "property" + }, + "purpose": "Declares the signed DCI receiver identifier included in protocol requests.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/protocol/properties/signed_dci/properties/record_type", + "path_kind": "property" + }, + "purpose": "Declares the record type requested through the signed DCI search profile.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 128 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/protocol/properties/signed_dci/properties/registry_type", + "path_kind": "property" + }, + "purpose": "Declares the registry type requested through the signed DCI search profile.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 128 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors", + "path_kind": "property" + }, + "purpose": "Maps every selector input to its signed DCI request field and response location.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 8 + }, + { + "keyword": "minProperties", + "value": 1 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "field", + "response_pointer" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors/additionalProperties/properties/field", + "path_kind": "property" + }, + "purpose": "Declares the signed DCI identifier field bound to one selector input.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 160 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors/additionalProperties/properties/response_pointer", + "path_kind": "property" + }, + "purpose": "Selects the canonical signed-record response location used to recover one selector value.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^/(?:[^/~]|~[01])+(?:/(?:[^/~]|~[01])+)*$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/protocol/properties/signed_dci/properties/selectors/propertyNames", + "path_kind": "map_key" + }, + "purpose": "Portable lowercase name for an integration input or output.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/inputName", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9_]{0,63}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/inputName" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/protocol/properties/signed_dci/properties/sender", + "path_kind": "property" + }, + "purpose": "Declares the signed DCI sender identifier included in protocol requests.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/scalarType/oneOf/0", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "string", + "boolean", + "integer" + ] + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/scalarType/oneOf/1", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 2 + }, + { + "keyword": "minItems", + "value": 2 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/scalarType/oneOf/1/prefixItems/0", + "path_kind": "array_item" + }, + "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "string", + "boolean", + "integer" + ] + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/scalarType/oneOf/1/prefixItems/1", + "path_kind": "array_item" + }, + "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "const", + "value": "null" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/source/properties/allow", + "path_kind": "property" + }, + "purpose": "Constrains source access to the explicitly reviewed method and path templates in this integration contract.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 16 + }, + { + "keyword": "minItems", + "value": 1 + }, + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/source/properties/allow/items", + "path_kind": "array_item" + }, + "purpose": "One read-only upstream method and path pattern the adapter may call.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/allowRule", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "method", + "path" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/allowRule" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/source/properties/auth", + "path_kind": "property" + }, + "purpose": "Declares the credential interface the source contract permits without embedding an environment credential value.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/credential", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/credential" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/source/properties/product", + "path_kind": "property" + }, + "purpose": "Names the source product whose version labels are classified by this integration contract.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/source/properties/protocol", + "path_kind": "property" + }, + "purpose": "Optional interoperable protocol profiles layered over the source transport.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/protocol", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "minProperties", + "value": 1 + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/protocol" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/source/properties/request_headers", + "path_kind": "property" + }, + "purpose": "Lists the bounded source request header names available to the integration adapter.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 32 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/source/properties/request_headers/items", + "path_kind": "array_item" + }, + "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[A-Za-z][A-Za-z0-9-]{0,63}$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/source/properties/response", + "path_kind": "property" + }, + "purpose": "Defines the reviewed source response representation and optional byte bound.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/source/properties/response/properties/format", + "path_kind": "property" + }, + "purpose": "Selects JSON decoding or text handling for reviewed source responses.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "json", + "text" + ] + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/source/properties/response/properties/max_bytes", + "path_kind": "property" + }, + "purpose": "Positive byte count expressed as an integer or a KiB/MiB quantity.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "integer", + "string" + ], + "local_reference": "#/$defs/byteSize", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/byteSize" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/source/properties/response_headers", + "path_kind": "property" + }, + "purpose": "Lists the bounded source response header names available to the integration adapter.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 32 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/source/properties/response_headers/items", + "path_kind": "array_item" + }, + "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[A-Za-z][A-Za-z0-9-]{0,63}$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/source/properties/versions", + "path_kind": "property" + }, + "purpose": "Source versions tested by the project and versions explicitly accepted as unverified.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/versions", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/versions" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/versionList/items", + "path_kind": "array_item" + }, + "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/versions/anyOf/0", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "tested" + ] + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/versions/anyOf/0/properties/tested", + "path_kind": "property" + }, + "purpose": "Requires at least one source product version to be classified as tested in this integration contract.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "minItems", + "value": 1 + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/versions/anyOf/1", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "unverified" + ] + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/versions/anyOf/1/properties/unverified", + "path_kind": "property" + }, + "purpose": "Requires at least one source product version to be classified as unverified in this integration contract.", + "purpose_source": "reviewed_override", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "minItems", + "value": 1 + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/versions/properties/tested", + "path_kind": "property" + }, + "purpose": "Bounded list of source version labels.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "array" + ], + "local_reference": "#/$defs/versionList", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 32 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/versionList" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/$defs/versions/properties/unverified", + "path_kind": "property" + }, + "purpose": "Bounded list of source version labels.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "array" + ], + "local_reference": "#/$defs/versionList", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 32 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/versionList" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/properties/capability", + "path_kind": "property" + }, + "purpose": "Exactly one bounded execution mechanism for the source adaptation.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/capability", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/capability" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/properties/id", + "path_kind": "property" + }, + "purpose": "Stable project-local identifier for the integration.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/properties/input", + "path_kind": "property" + }, + "purpose": "Typed selector and parameter inputs accepted by this integration.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 16 + }, + { + "keyword": "minProperties", + "value": 1 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/properties/input/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Type, validation, and canonicalization rules for one authored input.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/input", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "role", + "type" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/input" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/properties/input/propertyNames", + "path_kind": "map_key" + }, + "purpose": "Portable lowercase name for an integration input or output.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/inputName", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9_]{0,63}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/inputName" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/properties/limits", + "path_kind": "property" + }, + "purpose": "Optional tighter resource limits for one integration execution.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/limits", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/limits" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/properties/not_applicable", + "path_kind": "property" + }, + "purpose": "Explicit rationale and request-fixture evidence for a normally required outcome that the source contract cannot produce.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/notApplicable", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "minProperties", + "value": 1 + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/notApplicable" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/properties/outputs", + "path_kind": "property" + }, + "purpose": "Named typed outputs, or a shorthand list of output names inferred by the authoring compiler.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "array", + "object" + ], + "composed": true + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [] + }, + { + "address": { + "schema": "integration", + "pointer": "/properties/outputs/oneOf/0", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 64 + }, + { + "keyword": "minProperties", + "value": 1 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/properties/outputs/oneOf/0/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Type and optional source pointer for one normalized integration output.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/output", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "type" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/output" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/properties/outputs/oneOf/0/propertyNames", + "path_kind": "map_key" + }, + "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": true + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [] + }, + { + "address": { + "schema": "integration", + "pointer": "/properties/outputs/oneOf/0/propertyNames/allOf/0", + "path_kind": "branch" + }, + "purpose": "Portable lowercase name for an integration input or output.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/inputName", + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9_]{0,63}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/inputName" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/properties/outputs/oneOf/0/propertyNames/allOf/1", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [] + }, + { + "address": { + "schema": "integration", + "pointer": "/properties/outputs/oneOf/0/propertyNames/allOf/1/not", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "matched", + "outcome" + ] + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/properties/outputs/oneOf/1", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 64 + }, + { + "keyword": "minItems", + "value": 1 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/properties/outputs/oneOf/1/items", + "path_kind": "array_item" + }, + "purpose": "Portable lowercase name for an integration input or output.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/inputName", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9_]{0,63}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/inputName" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/properties/revision", + "path_kind": "property" + }, + "purpose": "Monotonically increasing revision of this integration contract.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": true, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "integration", + "pointer": "/properties/source", + "path_kind": "property" + }, + "purpose": "Optional source product metadata and transport policy; capabilities remain product-neutral.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/source", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "auth" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "integration", + "pointer": "/$defs/source" + } + }, + { + "address": { + "schema": "integration", + "pointer": "/properties/version", + "path_kind": "property" + }, + "purpose": "Integration authoring format version.", + "purpose_source": "schema_description", + "semantic_owner": "integration_contract", + "human_owner": "integration_maintainers", + "scope": "A reviewed source contract, bounded adaptation capability, typed inputs and outputs, and offline verification requirements.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "public", + "state": "authored", + "products": [ + "registryctl", + "relay", + "notary", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "fixture_execution", + "product_build" + ], + "diagnostic": "registryctl.authoring.integration.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a bounded synthetic source contract and fixture-safe values that demonstrate behavior without revealing a country endpoint or record.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Update affected fixtures and rebuild the project; re-review authority whenever source access, credentials, or bounds change.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "registry_notary", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "notary_config", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "security", + "privacy", + "relay", + "notary", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": 1 + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "", + "path_kind": "root" + }, + "purpose": "Defines one synthetic, deterministic integration scenario for offline adapter verification.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "environment_independent", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": true, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "name", + "classification", + "input", + "interactions", + "expect" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/expectation/properties/claims", + "path_kind": "property" + }, + "purpose": "States the synthetic Notary claim outcomes expected after the reviewed Relay consultation behavior.", + "purpose_source": "reviewed_override", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 64 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/expectation/properties/error", + "path_kind": "property" + }, + "purpose": "States the bounded error identifier expected from a failing offline fixture.", + "purpose_source": "reviewed_override", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/expectation/properties/outcome", + "path_kind": "property" + }, + "purpose": "States whether the offline fixture is expected to match, find no match, or remain ambiguous.", + "purpose_source": "reviewed_override", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "match", + "no_match", + "ambiguous" + ] + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/expectation/properties/outputs", + "path_kind": "property" + }, + "purpose": "Maps integration output names to the synthetic values expected after fixture execution.", + "purpose_source": "reviewed_override", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 64 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/fixtureBody/oneOf/0", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "environment_independent", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "file" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/fixtureBody/oneOf/0/properties/file", + "path_kind": "property" + }, + "purpose": "Selects a fixture-local synthetic body file beneath the reserved bodies directory.", + "purpose_source": "reviewed_override", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 4096 + }, + { + "keyword": "minLength", + "value": 8 + }, + { + "keyword": "pattern", + "value": "^bodies/(?!\\.\\.?/)(?!.*(?:/)\\.\\.?/)(?!.*//).+$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/fixtureBody/oneOf/1", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "environment_independent", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/fixtureBody/oneOf/1/not", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "environment_independent", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "file" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/governedClaimRef/oneOf/0", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "environment_independent", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/governedClaimRef/oneOf/1", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "environment_independent", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/governedClaimRef/oneOf/1/properties/id", + "path_kind": "property" + }, + "purpose": "Names one authored claim requested by this fixture witness.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/governedClaimRef/oneOf/1/properties/version", + "path_kind": "property" + }, + "purpose": "Pins the requested claim to one authored claim-policy version.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/governedIdentifier/properties/scheme", + "path_kind": "property" + }, + "purpose": "Names the authored identifier scheme selected by a consultation input mapping.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 96 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/governedIdentifier/properties/value", + "path_kind": "property" + }, + "purpose": "Supplies the synthetic string value bound to this identifier scheme.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/governedRequest/properties/claims", + "path_kind": "property" + }, + "purpose": "Lists the authored claims evaluated by this synthetic request witness.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 64 + }, + { + "keyword": "minItems", + "value": 1 + }, + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/governedRequest/properties/claims/items", + "path_kind": "array_item" + }, + "purpose": "A requested claim ID, optionally pinned to one authored claim version.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "object", + "string" + ], + "local_reference": "#/$defs/governedClaimRef", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted", + "array_items_share_element_contract" + ], + "constraints": [], + "local_reference": { + "schema": "fixture", + "pointer": "/$defs/governedClaimRef" + } + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/governedRequest/properties/disclosure", + "path_kind": "property" + }, + "purpose": "Selects the disclosure mode requested from the authored claim policy.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/governedRequest/properties/format", + "path_kind": "property" + }, + "purpose": "Selects the claim-result media type requested from the governed Notary path.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/governedRequest/properties/purpose", + "path_kind": "property" + }, + "purpose": "Names the authored service purpose exercised by this synthetic request witness.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/governedRequest/properties/target", + "path_kind": "property" + }, + "purpose": "The synthetic subject target presented to the same governed request boundary as a live Notary evaluation.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/governedTarget", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "type" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "fixture", + "pointer": "/$defs/governedTarget" + } + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/governedRequest/properties/variables", + "path_kind": "property" + }, + "purpose": "Supplies synthetic date variables to the governed evaluation request.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 16 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/governedRequest/properties/variables/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "format", + "value": "date" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/governedRequest/properties/variables/propertyNames", + "path_kind": "map_key" + }, + "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/governedTarget/properties/attributes", + "path_kind": "property" + }, + "purpose": "Supplies independently authored typed target attributes for consultation input mapping.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 16 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/governedTarget/properties/attributes/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "boolean", + "integer", + "null", + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "boolean", + "integer", + "null" + ] + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/governedTarget/properties/id", + "path_kind": "property" + }, + "purpose": "Supplies an optional synthetic direct target identifier.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/governedTarget/properties/identifiers", + "path_kind": "property" + }, + "purpose": "Supplies independently authored synthetic identifiers for consultation input mapping.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 16 + }, + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/governedTarget/properties/identifiers/items", + "path_kind": "array_item" + }, + "purpose": "One synthetic target identifier with an authored scheme and string value.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/governedIdentifier", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "scheme", + "value" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "fixture", + "pointer": "/$defs/governedIdentifier" + } + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/governedTarget/properties/type", + "path_kind": "property" + }, + "purpose": "Names the authored target entity type used for claim evaluation.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 64 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/interaction/properties/expect", + "path_kind": "property" + }, + "purpose": "Exact HTTP request shape the adapter must produce.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/request", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "method", + "path" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "fixture", + "pointer": "/$defs/request" + } + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/interaction/properties/respond", + "path_kind": "property" + }, + "purpose": "Synthetic HTTP response or timeout returned to the adapter.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/response", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [], + "local_reference": { + "schema": "fixture", + "pointer": "/$defs/response" + } + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/request/properties/body", + "path_kind": "property" + }, + "purpose": "Defines the synthetic request body expectation or fixture-local file reference without reading a source.", + "purpose_source": "reviewed_override", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/fixtureBody", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [], + "local_reference": { + "schema": "fixture", + "pointer": "/$defs/fixtureBody" + } + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/request/properties/headers", + "path_kind": "property" + }, + "purpose": "States the synthetic request headers expected from one offline fixture interaction.", + "purpose_source": "reviewed_override", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 32 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/request/properties/headers/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 8192 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/request/properties/headers/propertyNames", + "path_kind": "map_key" + }, + "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[A-Za-z][A-Za-z0-9-]{0,63}$" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/request/properties/method", + "path_kind": "property" + }, + "purpose": "States the synthetic request method expected from the offline integration fixture.", + "purpose_source": "reviewed_override", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "GET", + "POST" + ] + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/request/properties/path", + "path_kind": "property" + }, + "purpose": "States the synthetic request path expected from the offline integration fixture.", + "purpose_source": "reviewed_override", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 4096 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^/[^?#]*$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/request/properties/query", + "path_kind": "property" + }, + "purpose": "States the synthetic query parameters expected from one offline fixture interaction.", + "purpose_source": "reviewed_override", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 64 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/request/properties/query/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "array", + "boolean", + "integer", + "null", + "string" + ], + "composed": true + }, + "requiredness": "not_applicable", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/request/properties/query/additionalProperties/oneOf/0", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "boolean", + "integer", + "null", + "string" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "environment_independent", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "boolean", + "integer", + "null" + ] + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/request/properties/query/additionalProperties/oneOf/1", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "environment_independent", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 64 + }, + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/request/properties/query/additionalProperties/oneOf/1/items", + "path_kind": "array_item" + }, + "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "boolean", + "integer", + "null", + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "boolean", + "integer", + "null" + ] + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/response/oneOf/0", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "environment_independent", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "status" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/response/oneOf/0/properties/body", + "path_kind": "property" + }, + "purpose": "Defines the synthetic response body returned by the offline fixture harness to the integration.", + "purpose_source": "reviewed_override", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/fixtureBody", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [], + "local_reference": { + "schema": "fixture", + "pointer": "/$defs/fixtureBody" + } + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/response/oneOf/0/properties/headers", + "path_kind": "property" + }, + "purpose": "Defines the synthetic HTTP response headers returned by the offline fixture harness.", + "purpose_source": "reviewed_override", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 32 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/response/oneOf/0/properties/headers/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 8192 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/response/oneOf/0/properties/status", + "path_kind": "property" + }, + "purpose": "Selects the synthetic HTTP status returned by the offline fixture harness.", + "purpose_source": "reviewed_override", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 599 + }, + { + "keyword": "minimum", + "value": 100 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/response/oneOf/1", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "environment_independent", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "timeout" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/$defs/response/oneOf/1/properties/timeout", + "path_kind": "property" + }, + "purpose": "Selects the synthetic timeout duration returned instead of an HTTP response.", + "purpose_source": "reviewed_override", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[1-9][0-9]*(?:ms|s)$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/properties/classification", + "path_kind": "property" + }, + "purpose": "Declares that fixture data is synthetic and safe for offline testing.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "public", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": "synthetic" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/properties/expect", + "path_kind": "property" + }, + "purpose": "Observable adapter result required for the scenario to pass.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/expectation", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "minProperties", + "value": 1 + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "fixture", + "pointer": "/$defs/expectation" + } + }, + { + "address": { + "schema": "fixture", + "pointer": "/properties/input", + "path_kind": "property" + }, + "purpose": "Typed consultation inputs supplied to the adapter under test.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 16 + }, + { + "keyword": "minProperties", + "value": 1 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/properties/input/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "boolean", + "integer", + "null", + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "boolean", + "integer", + "null" + ] + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/properties/input/propertyNames", + "path_kind": "map_key" + }, + "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9_]{0,63}$" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/properties/interactions", + "path_kind": "property" + }, + "purpose": "Ordered upstream request and response exchanges expected during execution.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 16 + }, + { + "keyword": "minItems", + "value": 1 + }, + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/properties/interactions/items", + "path_kind": "array_item" + }, + "purpose": "One expected upstream request paired with its synthetic response.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/interaction", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "expect", + "respond" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "fixture", + "pointer": "/$defs/interaction" + } + }, + { + "address": { + "schema": "fixture", + "pointer": "/properties/name", + "path_kind": "property" + }, + "purpose": "Human-readable scenario name shown in test output.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "public", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": true, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/properties/request", + "path_kind": "property" + }, + "purpose": "Optional independently authored synthetic Notary request used to prove the request-to-consultation binding before Relay access.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/governedRequest", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "target", + "claims", + "purpose" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "fixture", + "pointer": "/$defs/governedRequest" + } + }, + { + "address": { + "schema": "fixture", + "pointer": "/properties/variables", + "path_kind": "property" + }, + "purpose": "Named date values available to deterministic fixture interpolation.", + "purpose_source": "schema_description", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 16 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/properties/variables/additionalProperties", + "path_kind": "map_value" + }, + "purpose": "Defines the contract shared by every author-controlled value in the enclosing typed map.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "format", + "value": "date" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "fixture", + "pointer": "/properties/variables/propertyNames", + "path_kind": "map_key" + }, + "purpose": "Names one author-controlled entry in the enclosing typed map; the key is data, not an extension field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "fixture_harness", + "human_owner": "test_maintainers", + "scope": "An offline synthetic interaction and expected outcome used to verify one integration contract without source access.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "environment_independent", + "sensitivity": "redacted_fixture", + "state": "authored", + "products": [ + "registryctl", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "fixture_execution" + ], + "diagnostic": "registryctl.authoring.fixture.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use unmistakably synthetic inputs, requests, responses, claims, and errors; fixtures must not contain copied personal or source data.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "update_fixtures", + "migration_note": "Update the fixture when the reviewed integration contract changes, while preserving synthetic and non-sensitive test data.", + "consumers": [ + "registryctl_authoring", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "fixture_report", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "compatibility", + "documentation", + "testing" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "synthetic_fixture_value_redacted", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + } + ] + }, + { + "address": { + "schema": "entity", + "pointer": "", + "path_kind": "root" + }, + "purpose": "Defines a bounded, materialized entity that Relay can query without coupling the project to a specific source product.", + "purpose_source": "schema_description", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": true, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "version", + "id", + "revision", + "primary_key", + "schema", + "materialization" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "entity", + "pointer": "/$defs/fieldSchema/properties/const", + "path_kind": "property" + }, + "purpose": "Requires one entity field to equal the single authored value supplied by this schema constraint.", + "purpose_source": "reviewed_override", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [] + }, + { + "address": { + "schema": "entity", + "pointer": "/$defs/fieldSchema/properties/enum", + "path_kind": "property" + }, + "purpose": "Restricts one entity field to the unique authored values listed by this schema constraint.", + "purpose_source": "reviewed_override", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "minItems", + "value": 1 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ] + }, + { + "address": { + "schema": "entity", + "pointer": "/$defs/fieldSchema/properties/format", + "path_kind": "property" + }, + "purpose": "Adds a reviewed semantic format constraint to one string-valued entity field.", + "purpose_source": "reviewed_override", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": "date" + } + ] + }, + { + "address": { + "schema": "entity", + "pointer": "/$defs/fieldSchema/properties/maxLength", + "path_kind": "property" + }, + "purpose": "Caps the character length accepted for one string-valued entity field.", + "purpose_source": "reviewed_override", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 65536 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "entity", + "pointer": "/$defs/fieldSchema/properties/maximum", + "path_kind": "property" + }, + "purpose": "Sets the inclusive upper numeric bound accepted for one entity field.", + "purpose_source": "reviewed_override", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 9223372036854775807 + }, + { + "keyword": "minimum", + "value": -9223372036854775808 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "entity", + "pointer": "/$defs/fieldSchema/properties/minLength", + "path_kind": "property" + }, + "purpose": "Sets the minimum character length accepted for one string-valued entity field.", + "purpose_source": "reviewed_override", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 65536 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "entity", + "pointer": "/$defs/fieldSchema/properties/minimum", + "path_kind": "property" + }, + "purpose": "Sets the inclusive lower numeric bound accepted for one entity field.", + "purpose_source": "reviewed_override", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 9223372036854775807 + }, + { + "keyword": "minimum", + "value": -9223372036854775808 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "entity", + "pointer": "/$defs/fieldSchema/properties/pattern", + "path_kind": "property" + }, + "purpose": "Constrains a string-valued entity field with the authored regular expression.", + "purpose_source": "reviewed_override", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 1024 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "entity", + "pointer": "/$defs/fieldSchema/properties/type", + "path_kind": "property" + }, + "purpose": "Declares the closed scalar, array, or object type accepted for one entity field.", + "purpose_source": "reviewed_override", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [ + "array" + ], + "local_reference": "#/$defs/scalarType", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [], + "local_reference": { + "schema": "entity", + "pointer": "/$defs/scalarType" + } + }, + { + "address": { + "schema": "entity", + "pointer": "/$defs/objectSchema/properties/additionalProperties", + "path_kind": "property" + }, + "purpose": "Controls whether the entity object accepts fields outside its declared closed property set.", + "purpose_source": "reviewed_override", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": false + } + ] + }, + { + "address": { + "schema": "entity", + "pointer": "/$defs/objectSchema/properties/properties", + "path_kind": "property" + }, + "purpose": "Maps every declared entity property name to its closed field schema.", + "purpose_source": "reviewed_override", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxProperties", + "value": 256 + }, + { + "keyword": "minProperties", + "value": 1 + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "entity", + "pointer": "/$defs/objectSchema/properties/properties/additionalProperties", + "path_kind": "property" + }, + "purpose": "Bounded schema keywords supported for one scalar materialized field.", + "purpose_source": "schema_description", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/fieldSchema", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "type" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "entity", + "pointer": "/$defs/fieldSchema" + } + }, + { + "address": { + "schema": "entity", + "pointer": "/$defs/objectSchema/properties/properties/propertyNames", + "path_kind": "property" + }, + "purpose": "Portable lowercase record field name.", + "purpose_source": "schema_description", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/propertyName", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9_]{0,63}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "entity", + "pointer": "/$defs/propertyName" + } + }, + { + "address": { + "schema": "entity", + "pointer": "/$defs/objectSchema/properties/required", + "path_kind": "property" + }, + "purpose": "Lists the entity properties that every validated materialized record must contain.", + "purpose_source": "reviewed_override", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 256 + }, + { + "keyword": "minItems", + "value": 1 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ] + }, + { + "address": { + "schema": "entity", + "pointer": "/$defs/objectSchema/properties/required/items", + "path_kind": "array_item" + }, + "purpose": "Portable lowercase record field name.", + "purpose_source": "schema_description", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/propertyName", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9_]{0,63}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "entity", + "pointer": "/$defs/propertyName" + } + }, + { + "address": { + "schema": "entity", + "pointer": "/$defs/objectSchema/properties/type", + "path_kind": "property" + }, + "purpose": "Declares the materialized entity record schema as an object.", + "purpose_source": "reviewed_override", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": "object" + } + ] + }, + { + "address": { + "schema": "entity", + "pointer": "/$defs/scalarType/oneOf/0", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "string", + "boolean", + "integer" + ] + } + ] + }, + { + "address": { + "schema": "entity", + "pointer": "/$defs/scalarType/oneOf/1", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "maxItems", + "value": 2 + }, + { + "keyword": "minItems", + "value": 2 + }, + { + "keyword": "type", + "value": "array" + }, + { + "keyword": "uniqueItems", + "value": true + } + ] + }, + { + "address": { + "schema": "entity", + "pointer": "/$defs/scalarType/oneOf/1/prefixItems/0", + "path_kind": "array_item" + }, + "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "string", + "boolean", + "integer" + ] + } + ] + }, + { + "address": { + "schema": "entity", + "pointer": "/$defs/scalarType/oneOf/1/prefixItems/1", + "path_kind": "array_item" + }, + "purpose": "Defines the contract shared by each ordered item in the enclosing authored list.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "const", + "value": "null" + } + ] + }, + { + "address": { + "schema": "entity", + "pointer": "/properties/id", + "path_kind": "property" + }, + "purpose": "Stable project-local identifier for the entity.", + "purpose_source": "schema_description", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "entity", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "entity", + "pointer": "/properties/materialization", + "path_kind": "property" + }, + "purpose": "Authored resource, refresh, and bounded recovery-set retention applied while building entity generations.", + "purpose_source": "schema_description", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "max_records", + "max_bytes", + "refresh", + "retain_generations" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "entity", + "pointer": "/properties/materialization/properties/max_bytes", + "path_kind": "property" + }, + "purpose": "Maximum encoded size of one generation, as bytes or a KiB/MiB quantity.", + "purpose_source": "schema_description", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [ + "integer", + "string" + ], + "composed": true + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": true, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [] + }, + { + "address": { + "schema": "entity", + "pointer": "/properties/materialization/properties/max_bytes/oneOf/0", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 18446744073709551615 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "entity", + "pointer": "/properties/materialization/properties/max_bytes/oneOf/1", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[1-9][0-9]*(?:KiB|MiB)$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "entity", + "pointer": "/properties/materialization/properties/max_records", + "path_kind": "property" + }, + "purpose": "Maximum number of records allowed in one generation.", + "purpose_source": "schema_description", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": true, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 18446744073709551615 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "entity", + "pointer": "/properties/materialization/properties/refresh", + "path_kind": "property" + }, + "purpose": "Refresh cadence, or manual when an operator initiates every refresh.", + "purpose_source": "schema_description", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": true + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": true, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [] + }, + { + "address": { + "schema": "entity", + "pointer": "/properties/materialization/properties/refresh/oneOf/0", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "const", + "value": "manual" + } + ] + }, + { + "address": { + "schema": "entity", + "pointer": "/properties/materialization/properties/refresh/oneOf/1", + "path_kind": "branch" + }, + "purpose": "Documents a validation alternative or condition and is not authored as a standalone configuration field.", + "purpose_source": "structural_taxonomy", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "structural", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "branch_has_no_authored_value" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[1-9][0-9]*(?:ms|s|m|h|d)$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "entity", + "pointer": "/properties/materialization/properties/retain_generations", + "path_kind": "property" + }, + "purpose": "Number of completed cache generations, including the active generation, retained as a bounded recovery set after successful publication. This does not make arbitrary retained generations selectable for rollback.", + "purpose_source": "schema_description", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": true, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 16 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "entity", + "pointer": "/properties/primary_key", + "path_kind": "property" + }, + "purpose": "Field whose value uniquely identifies each materialized record.", + "purpose_source": "schema_description", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/stableId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "entity", + "pointer": "/$defs/stableId" + } + }, + { + "address": { + "schema": "entity", + "pointer": "/properties/revision", + "path_kind": "property" + }, + "purpose": "Monotonically increasing revision of this entity definition.", + "purpose_source": "schema_description", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": true, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "entity", + "pointer": "/properties/schema", + "path_kind": "property" + }, + "purpose": "Closed JSON object schema for materialized records.", + "purpose_source": "schema_description", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/objectSchema", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "internal", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "type", + "additionalProperties", + "required", + "properties" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "entity", + "pointer": "/$defs/objectSchema" + } + }, + { + "address": { + "schema": "entity", + "pointer": "/properties/version", + "path_kind": "property" + }, + "purpose": "Entity authoring format version.", + "purpose_source": "schema_description", + "semantic_owner": "entity_contract", + "human_owner": "data_model_maintainers", + "scope": "A materialized entity identity, closed record shape, governance metadata, and refresh or size constraints.", + "field_type": { + "schema_types": [], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "public", + "state": "authored", + "products": [ + "registryctl", + "relay", + "editor", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "cross_file_semantic", + "product_build" + ], + "diagnostic": "registryctl.authoring.entity.invalid", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use a minimal synthetic entity with non-identifying field names and values from a maintained golden workspace.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "rebuild_project", + "migration_note": "Rebuild the project and review storage, disclosure, and compatibility impact when an entity contract changes.", + "consumers": [ + "registryctl_authoring", + "registry_relay", + "editor_tooling", + "docs_generator" + ], + "generated_artifacts": [ + "editor_schemas", + "project_build", + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "privacy", + "relay", + "compatibility", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": 1 + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "", + "key_path": "", + "path_kind": "root" + }, + "purpose": "Root configuration document. Parsed from YAML at startup.", + "purpose_source": "schema_description", + "intent_profile": "relay_root_structural", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "structural", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "server", + "catalog", + "auth", + "audit", + "datasets" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_only_execution", + "key_path": "datasets[].aggregates[].access.aggregate_only_execution", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_only_execution", + "key_path": "datasets[].entities[].aggregates[].access.aggregate_only_execution", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_only_execution", + "key_path": "datasets[].tables[].aggregates[].access.aggregate_only_execution", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_scope", + "key_path": "datasets[].aggregates[].access.aggregate_scope", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_scope", + "key_path": "datasets[].entities[].aggregates[].access.aggregate_scope", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateAccessConfig/properties/aggregate_scope", + "key_path": "datasets[].tables[].aggregates[].access.aggregate_scope", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateAccessConfig/properties/metadata_scope", + "key_path": "datasets[].aggregates[].access.metadata_scope", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateAccessConfig/properties/metadata_scope", + "key_path": "datasets[].entities[].aggregates[].access.metadata_scope", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateAccessConfig/properties/metadata_scope", + "key_path": "datasets[].tables[].aggregates[].access.metadata_scope", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/access", + "key_path": "datasets[].aggregates[].access", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/access", + "key_path": "datasets[].entities[].aggregates[].access", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/access", + "key_path": "datasets[].tables[].aggregates[].access", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/allowed_filters", + "key_path": "datasets[].aggregates[].allowed_filters", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/allowed_filters", + "key_path": "datasets[].entities[].aggregates[].allowed_filters", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/allowed_filters", + "key_path": "datasets[].tables[].aggregates[].allowed_filters", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/allowed_filters/items", + "key_path": "datasets[].aggregates[].allowed_filters[]", + "path_kind": "array_item" + }, + "purpose": "A single allowed filter: field name + permitted operators.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AllowedFilter", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "field", + "ops" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AllowedFilter" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/allowed_filters/items", + "key_path": "datasets[].entities[].aggregates[].allowed_filters[]", + "path_kind": "array_item" + }, + "purpose": "A single allowed filter: field name + permitted operators.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AllowedFilter", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "field", + "ops" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AllowedFilter" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/allowed_filters/items", + "key_path": "datasets[].tables[].aggregates[].allowed_filters[]", + "path_kind": "array_item" + }, + "purpose": "A single allowed filter: field name + permitted operators.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AllowedFilter", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "field", + "ops" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AllowedFilter" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/default_group_by", + "key_path": "datasets[].aggregates[].default_group_by", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/default_group_by", + "key_path": "datasets[].entities[].aggregates[].default_group_by", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/default_group_by", + "key_path": "datasets[].tables[].aggregates[].default_group_by", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/default_group_by/items", + "key_path": "datasets[].aggregates[].default_group_by[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/default_group_by/items", + "key_path": "datasets[].entities[].aggregates[].default_group_by[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/default_group_by/items", + "key_path": "datasets[].tables[].aggregates[].default_group_by[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/description", + "key_path": "datasets[].aggregates[].description", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/description", + "key_path": "datasets[].entities[].aggregates[].description", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/description", + "key_path": "datasets[].tables[].aggregates[].description", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/dimensions", + "key_path": "datasets[].aggregates[].dimensions", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/dimensions", + "key_path": "datasets[].entities[].aggregates[].dimensions", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/dimensions", + "key_path": "datasets[].tables[].aggregates[].dimensions", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/dimensions/items", + "key_path": "datasets[].aggregates[].dimensions[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AggregateDimensionConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id", + "label", + "field" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AggregateDimensionConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/dimensions/items", + "key_path": "datasets[].entities[].aggregates[].dimensions[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AggregateDimensionConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id", + "label", + "field" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AggregateDimensionConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/dimensions/items", + "key_path": "datasets[].tables[].aggregates[].dimensions[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AggregateDimensionConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id", + "label", + "field" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AggregateDimensionConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/disclosure_control", + "key_path": "datasets[].aggregates[].disclosure_control", + "path_kind": "property" + }, + "purpose": "Disclosure control settings per aggregate. Defaults to\n`min_group_size: 5`, `suppression: omit`.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/DisclosureControlConfig", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/disclosure_control", + "key_path": "datasets[].entities[].aggregates[].disclosure_control", + "path_kind": "property" + }, + "purpose": "Disclosure control settings per aggregate. Defaults to\n`min_group_size: 5`, `suppression: omit`.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/DisclosureControlConfig", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/disclosure_control", + "key_path": "datasets[].tables[].aggregates[].disclosure_control", + "path_kind": "property" + }, + "purpose": "Disclosure control settings per aggregate. Defaults to\n`min_group_size: 5`, `suppression: omit`.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/DisclosureControlConfig", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/group_by", + "key_path": "datasets[].aggregates[].group_by", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/group_by", + "key_path": "datasets[].entities[].aggregates[].group_by", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/group_by", + "key_path": "datasets[].tables[].aggregates[].group_by", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/group_by/items", + "key_path": "datasets[].aggregates[].group_by[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/group_by/items", + "key_path": "datasets[].entities[].aggregates[].group_by[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/group_by/items", + "key_path": "datasets[].tables[].aggregates[].group_by[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/id", + "key_path": "datasets[].aggregates[].id", + "path_kind": "property" + }, + "purpose": "Aggregate identifier within a resource.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/AggregateId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9_]*$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AggregateId" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/id", + "key_path": "datasets[].entities[].aggregates[].id", + "path_kind": "property" + }, + "purpose": "Aggregate identifier within a resource.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/AggregateId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9_]*$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AggregateId" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/id", + "key_path": "datasets[].tables[].aggregates[].id", + "path_kind": "property" + }, + "purpose": "Aggregate identifier within a resource.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/AggregateId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9_]*$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AggregateId" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/indicators", + "key_path": "datasets[].aggregates[].indicators", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/indicators", + "key_path": "datasets[].entities[].aggregates[].indicators", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/indicators", + "key_path": "datasets[].tables[].aggregates[].indicators", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/indicators/items", + "key_path": "datasets[].aggregates[].indicators[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AggregateIndicatorConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id", + "label", + "function", + "column", + "unit_measure" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/indicators/items", + "key_path": "datasets[].entities[].aggregates[].indicators[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AggregateIndicatorConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id", + "label", + "function", + "column", + "unit_measure" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/indicators/items", + "key_path": "datasets[].tables[].aggregates[].indicators[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AggregateIndicatorConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id", + "label", + "function", + "column", + "unit_measure" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/joins", + "key_path": "datasets[].aggregates[].joins", + "path_kind": "property" + }, + "purpose": "Legacy entity-local aggregate fields. These stay parseable while\nthe public surface moves to dataset-level aggregates.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/joins", + "key_path": "datasets[].entities[].aggregates[].joins", + "path_kind": "property" + }, + "purpose": "Legacy entity-local aggregate fields. These stay parseable while\nthe public surface moves to dataset-level aggregates.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/joins", + "key_path": "datasets[].tables[].aggregates[].joins", + "path_kind": "property" + }, + "purpose": "Legacy entity-local aggregate fields. These stay parseable while\nthe public surface moves to dataset-level aggregates.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/joins/items", + "key_path": "datasets[].aggregates[].joins[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AggregateJoinConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "relationship" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AggregateJoinConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/joins/items", + "key_path": "datasets[].entities[].aggregates[].joins[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AggregateJoinConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "relationship" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AggregateJoinConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/joins/items", + "key_path": "datasets[].tables[].aggregates[].joins[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AggregateJoinConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "relationship" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AggregateJoinConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/measures", + "key_path": "datasets[].aggregates[].measures", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/measures", + "key_path": "datasets[].entities[].aggregates[].measures", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/measures", + "key_path": "datasets[].tables[].aggregates[].measures", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/measures/items", + "key_path": "datasets[].aggregates[].measures[]", + "path_kind": "array_item" + }, + "purpose": "One measure inside an aggregate.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AggregateMeasure", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "name", + "function", + "column" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AggregateMeasure" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/measures/items", + "key_path": "datasets[].entities[].aggregates[].measures[]", + "path_kind": "array_item" + }, + "purpose": "One measure inside an aggregate.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AggregateMeasure", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "name", + "function", + "column" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AggregateMeasure" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/measures/items", + "key_path": "datasets[].tables[].aggregates[].measures[]", + "path_kind": "array_item" + }, + "purpose": "One measure inside an aggregate.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AggregateMeasure", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "name", + "function", + "column" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AggregateMeasure" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings", + "key_path": "datasets[].aggregates[].required_filter_bindings", + "path_kind": "property" + }, + "purpose": "Principal-derived bindings that both satisfy the required filter gate\nand are applied to the aggregate query.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings", + "key_path": "datasets[].entities[].aggregates[].required_filter_bindings", + "path_kind": "property" + }, + "purpose": "Principal-derived bindings that both satisfy the required filter gate\nand are applied to the aggregate query.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings", + "key_path": "datasets[].tables[].aggregates[].required_filter_bindings", + "path_kind": "property" + }, + "purpose": "Principal-derived bindings that both satisfy the required filter gate\nand are applied to the aggregate query.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings/items", + "key_path": "datasets[].aggregates[].required_filter_bindings[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/RequiredFilterBindingConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "field" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/RequiredFilterBindingConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings/items", + "key_path": "datasets[].entities[].aggregates[].required_filter_bindings[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/RequiredFilterBindingConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "field" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/RequiredFilterBindingConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/required_filter_bindings/items", + "key_path": "datasets[].tables[].aggregates[].required_filter_bindings[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/RequiredFilterBindingConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "field" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/RequiredFilterBindingConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/required_filters", + "key_path": "datasets[].aggregates[].required_filters", + "path_kind": "property" + }, + "purpose": "Alternative fields or dimensions that can satisfy the aggregate gate. A\nprincipal-bound equality filter on any listed field is sufficient, so\nlist multiple fields only when each is an acceptable boundary.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/required_filters", + "key_path": "datasets[].entities[].aggregates[].required_filters", + "path_kind": "property" + }, + "purpose": "Alternative fields or dimensions that can satisfy the aggregate gate. A\nprincipal-bound equality filter on any listed field is sufficient, so\nlist multiple fields only when each is an acceptable boundary.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/required_filters", + "key_path": "datasets[].tables[].aggregates[].required_filters", + "path_kind": "property" + }, + "purpose": "Alternative fields or dimensions that can satisfy the aggregate gate. A\nprincipal-bound equality filter on any listed field is sufficient, so\nlist multiple fields only when each is an acceptable boundary.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/required_filters/items", + "key_path": "datasets[].aggregates[].required_filters[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/required_filters/items", + "key_path": "datasets[].entities[].aggregates[].required_filters[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/required_filters/items", + "key_path": "datasets[].tables[].aggregates[].required_filters[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/source_entity", + "key_path": "datasets[].aggregates[].source_entity", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/source_entity", + "key_path": "datasets[].entities[].aggregates[].source_entity", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/source_entity", + "key_path": "datasets[].tables[].aggregates[].source_entity", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/spatial", + "key_path": "datasets[].aggregates[].spatial", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "mode", + "dimension", + "geometry_entity", + "geometry_id_field", + "geometry_field" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/spatial", + "key_path": "datasets[].entities[].aggregates[].spatial", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "mode", + "dimension", + "geometry_entity", + "geometry_id_field", + "geometry_field" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/spatial", + "key_path": "datasets[].tables[].aggregates[].spatial", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "mode", + "dimension", + "geometry_entity", + "geometry_id_field", + "geometry_field" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/temporal_field", + "key_path": "datasets[].aggregates[].temporal_field", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/temporal_field", + "key_path": "datasets[].entities[].aggregates[].temporal_field", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/temporal_field", + "key_path": "datasets[].tables[].aggregates[].temporal_field", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/title", + "key_path": "datasets[].aggregates[].title", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/title", + "key_path": "datasets[].entities[].aggregates[].title", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig/properties/title", + "key_path": "datasets[].tables[].aggregates[].title", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateDimensionConfig/properties/codelist", + "key_path": "datasets[].aggregates[].dimensions[].codelist", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateDimensionConfig/properties/codelist", + "key_path": "datasets[].entities[].aggregates[].dimensions[].codelist", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateDimensionConfig/properties/codelist", + "key_path": "datasets[].tables[].aggregates[].dimensions[].codelist", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateDimensionConfig/properties/field", + "key_path": "datasets[].aggregates[].dimensions[].field", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateDimensionConfig/properties/field", + "key_path": "datasets[].entities[].aggregates[].dimensions[].field", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateDimensionConfig/properties/field", + "key_path": "datasets[].tables[].aggregates[].dimensions[].field", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateDimensionConfig/properties/id", + "key_path": "datasets[].aggregates[].dimensions[].id", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateDimensionConfig/properties/id", + "key_path": "datasets[].entities[].aggregates[].dimensions[].id", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateDimensionConfig/properties/id", + "key_path": "datasets[].tables[].aggregates[].dimensions[].id", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateDimensionConfig/properties/label", + "key_path": "datasets[].aggregates[].dimensions[].label", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateDimensionConfig/properties/label", + "key_path": "datasets[].entities[].aggregates[].dimensions[].label", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateDimensionConfig/properties/label", + "key_path": "datasets[].tables[].aggregates[].dimensions[].label", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/column", + "key_path": "datasets[].aggregates[].indicators[].column", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/column", + "key_path": "datasets[].entities[].aggregates[].indicators[].column", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/column", + "key_path": "datasets[].tables[].aggregates[].indicators[].column", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/decimals", + "key_path": "datasets[].aggregates[].indicators[].decimals", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer", + "null" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": [ + "integer", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/decimals", + "key_path": "datasets[].entities[].aggregates[].indicators[].decimals", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer", + "null" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": [ + "integer", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/decimals", + "key_path": "datasets[].tables[].aggregates[].indicators[].decimals", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer", + "null" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": [ + "integer", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/definition_uri", + "key_path": "datasets[].aggregates[].indicators[].definition_uri", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/definition_uri", + "key_path": "datasets[].entities[].aggregates[].indicators[].definition_uri", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/definition_uri", + "key_path": "datasets[].tables[].aggregates[].indicators[].definition_uri", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/frequency", + "key_path": "datasets[].aggregates[].indicators[].frequency", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/frequency", + "key_path": "datasets[].entities[].aggregates[].indicators[].frequency", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/frequency", + "key_path": "datasets[].tables[].aggregates[].indicators[].frequency", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/function", + "key_path": "datasets[].aggregates[].indicators[].function", + "path_kind": "property" + }, + "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/AggregateFunction", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "count", + "sum", + "avg", + "min", + "max", + "median", + "count_distinct", + "stddev" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AggregateFunction" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/function", + "key_path": "datasets[].entities[].aggregates[].indicators[].function", + "path_kind": "property" + }, + "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/AggregateFunction", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "count", + "sum", + "avg", + "min", + "max", + "median", + "count_distinct", + "stddev" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AggregateFunction" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/function", + "key_path": "datasets[].tables[].aggregates[].indicators[].function", + "path_kind": "property" + }, + "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/AggregateFunction", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "count", + "sum", + "avg", + "min", + "max", + "median", + "count_distinct", + "stddev" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AggregateFunction" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/id", + "key_path": "datasets[].aggregates[].indicators[].id", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/id", + "key_path": "datasets[].entities[].aggregates[].indicators[].id", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/id", + "key_path": "datasets[].tables[].aggregates[].indicators[].id", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/label", + "key_path": "datasets[].aggregates[].indicators[].label", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/label", + "key_path": "datasets[].entities[].aggregates[].indicators[].label", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/label", + "key_path": "datasets[].tables[].aggregates[].indicators[].label", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_measure", + "key_path": "datasets[].aggregates[].indicators[].unit_measure", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_measure", + "key_path": "datasets[].entities[].aggregates[].indicators[].unit_measure", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_measure", + "key_path": "datasets[].tables[].aggregates[].indicators[].unit_measure", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_mult", + "key_path": "datasets[].aggregates[].indicators[].unit_mult", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer", + "null" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "int32" + }, + { + "keyword": "maximum", + "value": 2147483647 + }, + { + "keyword": "minimum", + "value": -2147483648 + }, + { + "keyword": "type", + "value": [ + "integer", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_mult", + "key_path": "datasets[].entities[].aggregates[].indicators[].unit_mult", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer", + "null" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "int32" + }, + { + "keyword": "maximum", + "value": 2147483647 + }, + { + "keyword": "minimum", + "value": -2147483648 + }, + { + "keyword": "type", + "value": [ + "integer", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateIndicatorConfig/properties/unit_mult", + "key_path": "datasets[].tables[].aggregates[].indicators[].unit_mult", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer", + "null" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "int32" + }, + { + "keyword": "maximum", + "value": 2147483647 + }, + { + "keyword": "minimum", + "value": -2147483648 + }, + { + "keyword": "type", + "value": [ + "integer", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateJoinConfig/properties/relationship", + "key_path": "datasets[].aggregates[].joins[].relationship", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateJoinConfig/properties/relationship", + "key_path": "datasets[].entities[].aggregates[].joins[].relationship", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateJoinConfig/properties/relationship", + "key_path": "datasets[].tables[].aggregates[].joins[].relationship", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateMeasure/properties/column", + "key_path": "datasets[].aggregates[].measures[].column", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateMeasure/properties/column", + "key_path": "datasets[].entities[].aggregates[].measures[].column", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateMeasure/properties/column", + "key_path": "datasets[].tables[].aggregates[].measures[].column", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateMeasure/properties/function", + "key_path": "datasets[].aggregates[].measures[].function", + "path_kind": "property" + }, + "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/AggregateFunction", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "count", + "sum", + "avg", + "min", + "max", + "median", + "count_distinct", + "stddev" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AggregateFunction" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateMeasure/properties/function", + "key_path": "datasets[].entities[].aggregates[].measures[].function", + "path_kind": "property" + }, + "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/AggregateFunction", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "count", + "sum", + "avg", + "min", + "max", + "median", + "count_distinct", + "stddev" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AggregateFunction" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateMeasure/properties/function", + "key_path": "datasets[].tables[].aggregates[].measures[].function", + "path_kind": "property" + }, + "purpose": "Aggregate function. V1 supports the basic set plus the\noptional functions (`median`, `count_distinct`, `stddev`).", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/AggregateFunction", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "count", + "sum", + "avg", + "min", + "max", + "median", + "count_distinct", + "stddev" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AggregateFunction" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateMeasure/properties/name", + "key_path": "datasets[].aggregates[].measures[].name", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateMeasure/properties/name", + "key_path": "datasets[].entities[].aggregates[].measures[].name", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateMeasure/properties/name", + "key_path": "datasets[].tables[].aggregates[].measures[].name", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/bbox_fields", + "key_path": "datasets[].aggregates[].spatial.bbox_fields", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "min_x", + "min_y", + "max_x", + "max_y" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/bbox_fields", + "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "min_x", + "min_y", + "max_x", + "max_y" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/bbox_fields", + "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "min_x", + "min_y", + "max_x", + "max_y" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/collection_id", + "key_path": "datasets[].aggregates[].spatial.collection_id", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/collection_id", + "key_path": "datasets[].entities[].aggregates[].spatial.collection_id", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/collection_id", + "key_path": "datasets[].tables[].aggregates[].spatial.collection_id", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/dimension", + "key_path": "datasets[].aggregates[].spatial.dimension", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/dimension", + "key_path": "datasets[].entities[].aggregates[].spatial.dimension", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/dimension", + "key_path": "datasets[].tables[].aggregates[].spatial.dimension", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_entity", + "key_path": "datasets[].aggregates[].spatial.geometry_entity", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_entity", + "key_path": "datasets[].entities[].aggregates[].spatial.geometry_entity", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_entity", + "key_path": "datasets[].tables[].aggregates[].spatial.geometry_entity", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_field", + "key_path": "datasets[].aggregates[].spatial.geometry_field", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_field", + "key_path": "datasets[].entities[].aggregates[].spatial.geometry_field", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_field", + "key_path": "datasets[].tables[].aggregates[].spatial.geometry_field", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_id_field", + "key_path": "datasets[].aggregates[].spatial.geometry_id_field", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_id_field", + "key_path": "datasets[].entities[].aggregates[].spatial.geometry_id_field", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/geometry_id_field", + "key_path": "datasets[].tables[].aggregates[].spatial.geometry_id_field", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/max_geometry_vertices", + "key_path": "datasets[].aggregates[].spatial.max_geometry_vertices", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/max_geometry_vertices", + "key_path": "datasets[].entities[].aggregates[].spatial.max_geometry_vertices", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/max_geometry_vertices", + "key_path": "datasets[].tables[].aggregates[].spatial.max_geometry_vertices", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/mode", + "key_path": "datasets[].aggregates[].spatial.mode", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "const", + "value": "admin_area" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/mode", + "key_path": "datasets[].entities[].aggregates[].spatial.mode", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "const", + "value": "admin_area" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AggregateSpatialConfig/oneOf/0/properties/mode", + "key_path": "datasets[].tables[].aggregates[].spatial.mode", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "const", + "value": "admin_area" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AllowedFilter/properties/field", + "key_path": "datasets[].aggregates[].allowed_filters[].field", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AllowedFilter/properties/field", + "key_path": "datasets[].entities[].aggregates[].allowed_filters[].field", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AllowedFilter/properties/field", + "key_path": "datasets[].entities[].api.allowed_filters[].field", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AllowedFilter/properties/field", + "key_path": "datasets[].tables[].aggregates[].allowed_filters[].field", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AllowedFilter/properties/field", + "key_path": "datasets[].tables[].api.allowed_filters[].field", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AllowedFilter/properties/ops", + "key_path": "datasets[].aggregates[].allowed_filters[].ops", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AllowedFilter/properties/ops", + "key_path": "datasets[].entities[].aggregates[].allowed_filters[].ops", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AllowedFilter/properties/ops", + "key_path": "datasets[].entities[].api.allowed_filters[].ops", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AllowedFilter/properties/ops", + "key_path": "datasets[].tables[].aggregates[].allowed_filters[].ops", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AllowedFilter/properties/ops", + "key_path": "datasets[].tables[].api.allowed_filters[].ops", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AllowedFilter/properties/ops/items", + "key_path": "datasets[].aggregates[].allowed_filters[].ops[]", + "path_kind": "array_item" + }, + "purpose": "Filter operator opted into per field.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/FilterOp", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "eq", + "in", + "gte", + "lte", + "between" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/FilterOp" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AllowedFilter/properties/ops/items", + "key_path": "datasets[].entities[].aggregates[].allowed_filters[].ops[]", + "path_kind": "array_item" + }, + "purpose": "Filter operator opted into per field.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/FilterOp", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "eq", + "in", + "gte", + "lte", + "between" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/FilterOp" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AllowedFilter/properties/ops/items", + "key_path": "datasets[].entities[].api.allowed_filters[].ops[]", + "path_kind": "array_item" + }, + "purpose": "Filter operator opted into per field.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/FilterOp", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "eq", + "in", + "gte", + "lte", + "between" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/FilterOp" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AllowedFilter/properties/ops/items", + "key_path": "datasets[].tables[].aggregates[].allowed_filters[].ops[]", + "path_kind": "array_item" + }, + "purpose": "Filter operator opted into per field.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/FilterOp", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "eq", + "in", + "gte", + "lte", + "between" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/FilterOp" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AllowedFilter/properties/ops/items", + "key_path": "datasets[].tables[].api.allowed_filters[].ops[]", + "path_kind": "array_item" + }, + "purpose": "Filter operator opted into per field.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/FilterOp", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "eq", + "in", + "gte", + "lte", + "between" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/FilterOp" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ApiKeyConfig/properties/fingerprint", + "key_path": "auth.api_keys[].fingerprint", + "path_kind": "property" + }, + "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_auth_secret_reference", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/CredentialFingerprintSchema", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + [ + "provider", + "name" + ], + [ + "provider", + "path" + ] + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/CredentialFingerprintSchema" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ApiKeyConfig/properties/id", + "key_path": "auth.api_keys[].id", + "path_kind": "property" + }, + "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_auth_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ApiKeyConfig/properties/scopes", + "key_path": "auth.api_keys[].scopes", + "path_kind": "property" + }, + "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_auth_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ApiKeyConfig/properties/scopes/items", + "key_path": "auth.api_keys[].scopes[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_auth_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AttributeReleaseProfile/properties/claims", + "key_path": "datasets[].entities[].attribute_release_profiles[].claims", + "path_kind": "property" + }, + "purpose": "Claims released on success. Non-empty; at least one `required`.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AttributeReleaseProfile/properties/claims/items", + "key_path": "datasets[].entities[].attribute_release_profiles[].claims[]", + "path_kind": "array_item" + }, + "purpose": "A single released claim. Exactly one of `source_field` or `expression`\nmust be set: a claim is either a direct source-field projection or a\nCEL-computed value.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/ReleaseClaimConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "name" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ReleaseClaimConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AttributeReleaseProfile/properties/description", + "key_path": "datasets[].entities[].attribute_release_profiles[].description", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AttributeReleaseProfile/properties/id", + "key_path": "datasets[].entities[].attribute_release_profiles[].id", + "path_kind": "property" + }, + "purpose": "Profile identifier, lower-kebab/snake (`^[a-z][a-z0-9_-]*$`). Globally\nunique with `version`.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AttributeReleaseProfile/properties/purpose", + "key_path": "datasets[].entities[].attribute_release_profiles[].purpose", + "path_kind": "property" + }, + "purpose": "Data-purpose this profile is bound to. When the backing entity declares\n`governed_policy.permitted_purposes`, this must be a member.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AttributeReleaseProfile/properties/release_conditions", + "key_path": "datasets[].entities[].attribute_release_profiles[].release_conditions", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "expression" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AttributeReleaseProfile/properties/release_scope", + "key_path": "datasets[].entities[].attribute_release_profiles[].release_scope", + "path_kind": "property" + }, + "purpose": "Dataset-bound scope a caller must hold to invoke this release. The\nstable profile is exactly `:identity_release`.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AttributeReleaseProfile/properties/response", + "key_path": "datasets[].entities[].attribute_release_profiles[].response", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/ReleaseResponseConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ReleaseResponseConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AttributeReleaseProfile/properties/subject", + "key_path": "datasets[].entities[].attribute_release_profiles[].subject", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/ReleaseSubjectConfig", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "source_field", + "id_type" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ReleaseSubjectConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AttributeReleaseProfile/properties/title", + "key_path": "datasets[].entities[].attribute_release_profiles[].title", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AttributeReleaseProfile/properties/version", + "key_path": "datasets[].entities[].attribute_release_profiles[].version", + "path_kind": "property" + }, + "purpose": "Profile version. Globally unique with `id`; no silent \"latest\".", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AuditConfig/oneOf/0/properties/sink", + "key_path": "audit.sink", + "path_kind": "property" + }, + "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_audit_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": [ + "file", + "stdout", + "syslog" + ] + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AuditConfig/oneOf/1/properties/path", + "key_path": "audit.path", + "path_kind": "property" + }, + "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_audit_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AuditConfig/oneOf/1/properties/rotate", + "key_path": "audit.rotate", + "path_kind": "property" + }, + "purpose": "In-process rotation for the `file` audit sink.", + "purpose_source": "schema_description", + "intent_profile": "relay_audit_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/RotateConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "max_size_mb", + "max_files" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/RotateConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AuditConfig/properties/chain", + "key_path": "audit.chain", + "path_kind": "property" + }, + "purpose": "Retains the compatibility switch in the authored contract; Relay audit envelopes remain integrity-chained regardless of this setting.", + "purpose_source": "reviewed_override", + "intent_profile": "relay_audit_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AuditConfig/properties/format", + "key_path": "audit.format", + "path_kind": "property" + }, + "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_audit_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/AuditFormat", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "const", + "value": "jsonl" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AuditFormat" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AuditConfig/properties/hash_secret_env", + "key_path": "audit.hash_secret_env", + "path_kind": "property" + }, + "purpose": "Name of the environment variable holding the per-deploy secret\nused to HMAC sensitive audit values (single-record primary keys,\nsensitive query parameters). Runtime startup fails closed when\nthis field is unset, empty, or points to a missing, empty, or\nweak secret. Direct middleware tests can opt into the explicit\nunkeyed dev-only hasher without using runtime config.", + "purpose_source": "schema_description", + "intent_profile": "relay_audit_secret_reference", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[^=\\x00]*[^=\\x00\\x09-\\x0D\\x20\\x85\\u00A0\\u1680\\u2000-\\u200A\\u2028\\u2029\\u202F\\u205F\\u3000][^=\\x00]*$" + }, + { + "keyword": "type", + "value": [ + "null", + "string" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AuditConfig/properties/include_health", + "key_path": "audit.include_health", + "path_kind": "property" + }, + "purpose": "Include `/healthz` liveness probes in the audit stream. `/ready` is\nalways excluded because auditing it would advance the chain after its\nzero-backlog shipping check and self-invalidate the next probe.", + "purpose_source": "schema_description", + "intent_profile": "relay_audit_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AuditConfig/properties/write_policy", + "key_path": "audit.write_policy", + "path_kind": "property" + }, + "purpose": "Behavior when an audit record fails to write.\n\n`fail_closed` (default) fails the request with a stable error code so\nthat no request outcome is returned without a durable audit record.\n`availability_first` logs the failure and lets the request succeed for\ndeployments that explicitly accept best-effort audit durability.\nPer-route-family selection is out of scope; this is a single\ndeployment-wide policy.", + "purpose_source": "schema_description", + "intent_profile": "relay_audit_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/AuditWritePolicySchema", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "availability_first", + "fail_closed", + "fail_closed_route_families" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AuditWritePolicySchema" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AuditPseudonymMaterialCatalogConfig/items", + "key_path": "consultation.audit_pseudonym_materials[]", + "path_kind": "array_item" + }, + "purpose": "One public epoch id bound to one secret source reference.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AuditPseudonymMaterialConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "key_id", + "source" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AuditPseudonymMaterialConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AuditPseudonymMaterialConfig/properties/key_id", + "key_path": "consultation.audit_pseudonym_materials[].key_id", + "path_kind": "property" + }, + "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_consultation_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/AuditPseudonymKeyIdSchema", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z0-9][a-z0-9._-]{0,63}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AuditPseudonymKeyIdSchema" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AuditPseudonymMaterialConfig/properties/source", + "key_path": "consultation.audit_pseudonym_materials[].source", + "path_kind": "property" + }, + "purpose": "Closed v1 set of audit-pseudonym secret source providers.\n\nThe configured name is a reference only. Secret values cannot be embedded\nin this model and are loaded exactly once during runtime compilation.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AuditPseudonymSecretSourceConfig", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "provider", + "name" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AuditPseudonymSecretSourceConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AuditPseudonymSecretSourceConfig/oneOf/0/properties/name", + "key_path": "consultation.audit_pseudonym_materials[].source.name", + "path_kind": "property" + }, + "purpose": "Portable environment-variable name used only as a secret reference.\n\nDebug output is redacted even though the name is not itself key material,\npreventing configuration diagnostics from disclosing secret topology.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_secret_reference", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/AuditPseudonymSecretEnvironmentName", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AuditPseudonymSecretEnvironmentName" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AuditPseudonymSecretSourceConfig/oneOf/0/properties/provider", + "key_path": "consultation.audit_pseudonym_materials[].source.provider", + "path_kind": "property" + }, + "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_consultation_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "const", + "value": "environment" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AuthConfig/properties/api_keys", + "key_path": "auth.api_keys", + "path_kind": "property" + }, + "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_auth_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AuthConfig/properties/api_keys/items", + "key_path": "auth.api_keys[]", + "path_kind": "array_item" + }, + "purpose": "One configured API key, identified by an id and a fingerprint reference.\nThe raw key never appears in config.", + "purpose_source": "schema_description", + "intent_profile": "relay_auth_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/ApiKeyConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id", + "fingerprint" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ApiKeyConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AuthConfig/properties/failure_throttle", + "key_path": "auth.failure_throttle", + "path_kind": "property" + }, + "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_auth_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AuthFailureThrottleConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AuthFailureThrottleConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AuthConfig/properties/mode", + "key_path": "auth.mode", + "path_kind": "property" + }, + "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_auth_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/AuthMode", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "const", + "value": [ + "api_key", + "oidc" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AuthMode" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AuthConfig/properties/oidc", + "key_path": "auth.oidc", + "path_kind": "property" + }, + "purpose": "OIDC / OAuth2 resource-server configuration. The relay validates\nincoming bearer JWTs against a configured external IdP. No tokens\nare minted here.", + "purpose_source": "schema_description", + "intent_profile": "relay_auth_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "issuer", + "audiences" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AuthFailureThrottleConfig/properties/enabled", + "key_path": "auth.failure_throttle.enabled", + "path_kind": "property" + }, + "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_auth_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AuthFailureThrottleConfig/properties/max_failures", + "key_path": "auth.failure_throttle.max_failures", + "path_kind": "property" + }, + "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_auth_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/AuthFailureThrottleConfig/properties/window_seconds", + "key_path": "auth.failure_throttle.window_seconds", + "path_kind": "property" + }, + "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_auth_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "maximum", + "value": 18446744073709551615 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/CatalogConfig/properties/authority_type", + "key_path": "catalog.authority_type", + "path_kind": "property" + }, + "purpose": "BRegDCAT-AP: type IRI for the `foaf:Agent` publisher. When set, emits\n`dcterms:type` on the publisher node.\n\nBRegDCAT-AP 2.1.0 SHACL checks publisher type values against the ADMS\npublishertype scheme (`http://purl.org/adms/publishertype/...`).\nThe relay does not enforce a vocabulary: any IRI passes through.", + "purpose_source": "schema_description", + "intent_profile": "relay_catalog_public", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "public", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/CatalogConfig/properties/base_url", + "key_path": "catalog.base_url", + "path_kind": "property" + }, + "purpose": "Controls Relay catalog identity and public metadata exposed for governed discovery.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_catalog_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/CatalogConfig/properties/default_spatial_coverage", + "key_path": "catalog.default_spatial_coverage", + "path_kind": "property" + }, + "purpose": "BRegDCAT-AP: default `dcterms:spatial` IRI applied to datasets that\ndo not declare their own `spatial_coverage`. Typically an EU\nauthority country IRI under\n`http://publications.europa.eu/resource/authority/country/`.", + "purpose_source": "schema_description", + "intent_profile": "relay_catalog_public", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "public", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/CatalogConfig/properties/participant_id", + "key_path": "catalog.participant_id", + "path_kind": "property" + }, + "purpose": "Identifies the participant in catalog output; when omitted, Relay derives the participant identifier from the reviewed catalog base URL.", + "purpose_source": "reviewed_override", + "intent_profile": "relay_catalog_public", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "public", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/CatalogConfig/properties/publisher", + "key_path": "catalog.publisher", + "path_kind": "property" + }, + "purpose": "Publishes the reviewed Relay catalog identity and descriptive metadata used for governed discovery.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_catalog_public", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "public", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/CatalogConfig/properties/publisher_iri", + "key_path": "catalog.publisher_iri", + "path_kind": "property" + }, + "purpose": "BRegDCAT-AP: identifier IRI for the `foaf:Agent` publisher. Use a\ncontrolled-vocabulary corporate body IRI when publishing strict\nBRegDCAT-AP.", + "purpose_source": "schema_description", + "intent_profile": "relay_catalog_public", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "public", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/CatalogConfig/properties/title", + "key_path": "catalog.title", + "path_kind": "property" + }, + "purpose": "Publishes the reviewed Relay catalog identity and descriptive metadata used for governed discovery.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_catalog_public", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "Public catalog metadata emitted by Relay discovery surfaces; this intent catalog records its contract without loading deployment values.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "public", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic public identifiers and non-routable placeholders; never copy country catalog values into generated reference documentation.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate discovery metadata changes with the Relay deployment and review the resulting public catalog before activation.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConfigTrustConfig/properties/antirollback_state_path", + "key_path": "config_trust.antirollback_state_path", + "path_kind": "property" + }, + "purpose": "Controls Relay verification of signed configuration bundles, trust anchors, and rollback protection.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_config_trust_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConfigTrustConfig/properties/break_glass_override_path", + "key_path": "config_trust.break_glass_override_path", + "path_kind": "property" + }, + "purpose": "Controls Relay verification of signed configuration bundles, trust anchors, and rollback protection.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_config_trust_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConfigTrustConfig/properties/bundle_path", + "key_path": "config_trust.bundle_path", + "path_kind": "property" + }, + "purpose": "Controls Relay verification of signed configuration bundles, trust anchors, and rollback protection.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_config_trust_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConfigTrustConfig/properties/trust_anchor_path", + "key_path": "config_trust.trust_anchor_path", + "path_kind": "property" + }, + "purpose": "Controls Relay verification of signed configuration bundles, trust anchors, and rollback protection.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_config_trust_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/evidence", + "key_path": "consultation.artifacts.evidence", + "path_kind": "property" + }, + "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_consultation_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/evidence/items", + "key_path": "consultation.artifacts.evidence[]", + "path_kind": "array_item" + }, + "purpose": "One bounded, hash-pinned integration evidence file.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/ConsultationEvidenceArtifactConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "class", + "path", + "sha256" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ConsultationEvidenceArtifactConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/integration_packs", + "key_path": "consultation.artifacts.integration_packs", + "path_kind": "property" + }, + "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_consultation_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/integration_packs/items", + "key_path": "consultation.artifacts.integration_packs[]", + "path_kind": "array_item" + }, + "purpose": "One hash-pinned public contract or reviewed integration pack.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/ConsultationTypedArtifactReferenceConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "path", + "hash", + "sha256" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/private_bindings", + "key_path": "consultation.artifacts.private_bindings", + "path_kind": "property" + }, + "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_consultation_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/private_bindings/items", + "key_path": "consultation.artifacts.private_bindings[]", + "path_kind": "array_item" + }, + "purpose": "One hash-pinned public contract or reviewed integration pack.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/ConsultationTypedArtifactReferenceConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "path", + "hash", + "sha256" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/public_contracts", + "key_path": "consultation.artifacts.public_contracts", + "path_kind": "property" + }, + "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_consultation_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/public_contracts/items", + "key_path": "consultation.artifacts.public_contracts[]", + "path_kind": "array_item" + }, + "purpose": "One hash-pinned public contract or reviewed integration pack.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/ConsultationTypedArtifactReferenceConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "path", + "hash", + "sha256" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/rhai_scripts", + "key_path": "consultation.artifacts.rhai_scripts", + "path_kind": "property" + }, + "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_consultation_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationArtifactClosureConfig/properties/rhai_scripts/items", + "key_path": "consultation.artifacts.rhai_scripts[]", + "path_kind": "array_item" + }, + "purpose": "One hash-pinned private binding or standalone Rhai script.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/ConsultationArtifactReferenceConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "path", + "sha256" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ConsultationArtifactReferenceConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationArtifactReferenceConfig/properties/path", + "key_path": "consultation.artifacts.rhai_scripts[].path", + "path_kind": "property" + }, + "purpose": "Normalized bundle-root-relative path.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationArtifactReferenceConfig/properties/sha256", + "key_path": "consultation.artifacts.rhai_scripts[].sha256", + "path_kind": "property" + }, + "purpose": "Raw file hash recorded by Registry Config Bundle v1.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^sha256:[0-9a-f]{64}$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationConfig/properties/artifacts", + "key_path": "consultation.artifacts", + "path_kind": "property" + }, + "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_consultation_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "public_contracts", + "integration_packs", + "private_bindings", + "evidence" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationConfig/properties/audit_pseudonym_materials", + "key_path": "consultation.audit_pseudonym_materials", + "path_kind": "property" + }, + "purpose": "Bounded startup catalog of audit-pseudonym material references.\n\nThe 1..=32 bound and cross-entry uniqueness are enforced by config\nvalidation and repeated by the material provider before loading secrets.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "local_reference": "#/$defs/AuditPseudonymMaterialCatalogConfig", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AuditPseudonymMaterialCatalogConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationConfig/properties/authorized_workload", + "key_path": "consultation.authorized_workload", + "path_kind": "property" + }, + "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_consultation_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/ConsultationWorkloadConfig", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "audience", + "client_claim_selector", + "client_value", + "principal_id" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ConsultationWorkloadConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationConfig/properties/source_credentials", + "key_path": "consultation.source_credentials", + "path_kind": "property" + }, + "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_consultation_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "local_reference": "#/$defs/ConsultationSourceCredentialCatalogConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ConsultationSourceCredentialCatalogConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationConfig/properties/state_plane", + "key_path": "consultation.state_plane", + "path_kind": "property" + }, + "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_consultation_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/ConsultationStatePlaneConfig", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "database_url_env", + "chain_key_epoch_id", + "serving_fence_lock_key", + "audit_pseudonym_keyring_lock_key" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ConsultationStatePlaneConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationEvidenceArtifactConfig/properties/class", + "key_path": "consultation.artifacts.evidence[].class", + "path_kind": "property" + }, + "purpose": "Closed evidence classes understood by consultation source-plan v1.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/ConsultationEvidenceClassConfig", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "conformance", + "negative_security", + "minimization" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ConsultationEvidenceClassConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationEvidenceArtifactConfig/properties/path", + "key_path": "consultation.artifacts.evidence[].path", + "path_kind": "property" + }, + "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_consultation_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationEvidenceArtifactConfig/properties/sha256", + "key_path": "consultation.artifacts.evidence[].sha256", + "path_kind": "property" + }, + "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_consultation_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^sha256:[0-9a-f]{64}$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationSourceCredentialCatalogConfig/items", + "key_path": "consultation.source_credentials[]", + "path_kind": "array_item" + }, + "purpose": "Closed V1 source-credential provider configuration.\n\nEnvironment names are opaque references and are redacted from `Debug`.\nThere is deliberately no field capable of carrying an embedded username,\npassword, bearer token, or provider-specific extension.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/ConsultationSourceCredentialConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + [ + "type", + "ref", + "generation", + "client_id_env", + "client_secret_env" + ], + [ + "type", + "ref", + "generation", + "token_env" + ], + [ + "type", + "ref", + "generation", + "username_env", + "password_env" + ], + [ + "type", + "ref", + "generation", + "value_env" + ] + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ConsultationSourceCredentialConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/generation", + "key_path": "consultation.source_credentials[].generation", + "path_kind": "property" + }, + "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_consultation_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "maximum", + "value": 18446744073709551615 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/password_env", + "key_path": "consultation.source_credentials[].password_env", + "path_kind": "property" + }, + "purpose": "Portable environment-variable name used only as a credential reference.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_secret_reference", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/ConsultationCredentialEnvironmentName", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ConsultationCredentialEnvironmentName" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/ref", + "key_path": "consultation.source_credentials[].ref", + "path_kind": "property" + }, + "purpose": "Exact private-binding credential reference grammar.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/ConsultationSourceCredentialReference", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9._-]{0,95}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ConsultationSourceCredentialReference" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/type", + "key_path": "consultation.source_credentials[].type", + "path_kind": "property" + }, + "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_consultation_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "const", + "value": [ + "api_key_header", + "api_key_query", + "basic", + "oauth_client_credentials", + "static_bearer" + ] + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/0/properties/username_env", + "key_path": "consultation.source_credentials[].username_env", + "path_kind": "property" + }, + "purpose": "Portable environment-variable name used only as a credential reference.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_secret_reference", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/ConsultationCredentialEnvironmentName", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ConsultationCredentialEnvironmentName" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/1/properties/token_env", + "key_path": "consultation.source_credentials[].token_env", + "path_kind": "property" + }, + "purpose": "Portable environment-variable name used only as a credential reference.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_secret_reference", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/ConsultationCredentialEnvironmentName", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ConsultationCredentialEnvironmentName" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/2/properties/value_env", + "key_path": "consultation.source_credentials[].value_env", + "path_kind": "property" + }, + "purpose": "Portable environment-variable name used only as a credential reference.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_secret_reference", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/ConsultationCredentialEnvironmentName", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ConsultationCredentialEnvironmentName" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/4/properties/client_id_env", + "key_path": "consultation.source_credentials[].client_id_env", + "path_kind": "property" + }, + "purpose": "Portable environment-variable name used only as a credential reference.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_secret_reference", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/ConsultationCredentialEnvironmentName", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ConsultationCredentialEnvironmentName" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationSourceCredentialConfig/oneOf/4/properties/client_secret_env", + "key_path": "consultation.source_credentials[].client_secret_env", + "path_kind": "property" + }, + "purpose": "Portable environment-variable name used only as a credential reference.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_secret_reference", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/ConsultationCredentialEnvironmentName", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ConsultationCredentialEnvironmentName" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationStatePlaneConfig/properties/audit_pseudonym_keyring_lock_key", + "key_path": "consultation.state_plane.audit_pseudonym_keyring_lock_key", + "path_kind": "property" + }, + "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_consultation_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "int64" + }, + { + "keyword": "maximum", + "value": 9223372036854775807 + }, + { + "keyword": "minimum", + "value": -9223372036854775808 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationStatePlaneConfig/properties/chain_key_epoch_id", + "key_path": "consultation.state_plane.chain_key_epoch_id", + "path_kind": "property" + }, + "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_consultation_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationStatePlaneConfig/properties/database_url_env", + "key_path": "consultation.state_plane.database_url_env", + "path_kind": "property" + }, + "purpose": "Portable environment-variable name that resolves the state-plane URL.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_secret_reference", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/ConsultationDatabaseUrlEnvironmentName", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[A-Za-z_][A-Za-z0-9_]{0,127}$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ConsultationDatabaseUrlEnvironmentName" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationStatePlaneConfig/properties/root_certificate_path", + "key_path": "consultation.state_plane.root_certificate_path", + "path_kind": "property" + }, + "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_consultation_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationStatePlaneConfig/properties/serving_fence_lock_key", + "key_path": "consultation.state_plane.serving_fence_lock_key", + "path_kind": "property" + }, + "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_consultation_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "int64" + }, + { + "keyword": "maximum", + "value": 9223372036854775807 + }, + { + "keyword": "minimum", + "value": -9223372036854775808 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/hash", + "key_path": "consultation.artifacts.integration_packs[].hash", + "path_kind": "property" + }, + "purpose": "Domain-separated typed artifact hash consumed by the source-plan compiler.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^sha256:[0-9a-f]{64}$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/hash", + "key_path": "consultation.artifacts.private_bindings[].hash", + "path_kind": "property" + }, + "purpose": "Domain-separated typed artifact hash consumed by the source-plan compiler.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^sha256:[0-9a-f]{64}$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/hash", + "key_path": "consultation.artifacts.public_contracts[].hash", + "path_kind": "property" + }, + "purpose": "Domain-separated typed artifact hash consumed by the source-plan compiler.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^sha256:[0-9a-f]{64}$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/path", + "key_path": "consultation.artifacts.integration_packs[].path", + "path_kind": "property" + }, + "purpose": "Normalized bundle-root-relative path.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/path", + "key_path": "consultation.artifacts.private_bindings[].path", + "path_kind": "property" + }, + "purpose": "Normalized bundle-root-relative path.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/path", + "key_path": "consultation.artifacts.public_contracts[].path", + "path_kind": "property" + }, + "purpose": "Normalized bundle-root-relative path.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/sha256", + "key_path": "consultation.artifacts.integration_packs[].sha256", + "path_kind": "property" + }, + "purpose": "Raw file hash recorded by Registry Config Bundle v1.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^sha256:[0-9a-f]{64}$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/sha256", + "key_path": "consultation.artifacts.private_bindings[].sha256", + "path_kind": "property" + }, + "purpose": "Raw file hash recorded by Registry Config Bundle v1.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^sha256:[0-9a-f]{64}$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationTypedArtifactReferenceConfig/properties/sha256", + "key_path": "consultation.artifacts.public_contracts[].sha256", + "path_kind": "property" + }, + "purpose": "Raw file hash recorded by Registry Config Bundle v1.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^sha256:[0-9a-f]{64}$" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationWorkloadConfig/properties/audience", + "key_path": "consultation.authorized_workload.audience", + "path_kind": "property" + }, + "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_consultation_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationWorkloadConfig/properties/client_claim_selector", + "key_path": "consultation.authorized_workload.client_claim_selector", + "path_kind": "property" + }, + "purpose": "Closed set of verified OAuth claims that may identify Registry Notary.", + "purpose_source": "schema_description", + "intent_profile": "relay_consultation_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/ConsultationClientClaimSelectorConfig", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "azp", + "client_id" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ConsultationClientClaimSelectorConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationWorkloadConfig/properties/client_value", + "key_path": "consultation.authorized_workload.client_value", + "path_kind": "property" + }, + "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_consultation_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ConsultationWorkloadConfig/properties/principal_id", + "key_path": "consultation.authorized_workload.principal_id", + "path_kind": "property" + }, + "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_consultation_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/CorsConfig/properties/allowed_origins", + "key_path": "server.cors.allowed_origins", + "path_kind": "property" + }, + "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_server_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/CorsConfig/properties/allowed_origins/items", + "key_path": "server.cors.allowed_origins[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_server_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/CredentialFingerprintSchema/oneOf/0/properties/name", + "key_path": "auth.api_keys[].fingerprint.name", + "path_kind": "property" + }, + "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_auth_secret_reference", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/RuntimeEnvironmentNameSchema", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[^=\\x00]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/RuntimeEnvironmentNameSchema" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/CredentialFingerprintSchema/oneOf/0/properties/provider", + "key_path": "auth.api_keys[].fingerprint.provider", + "path_kind": "property" + }, + "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_auth_secret_reference", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "const", + "value": [ + "env", + "file" + ] + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/CredentialFingerprintSchema/oneOf/1/properties/path", + "key_path": "auth.api_keys[].fingerprint.path", + "path_kind": "property" + }, + "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_auth_secret_reference", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/CsvFormatConfig/properties/delimiter", + "key_path": "datasets[].tables[].source.format.csv.delimiter", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer", + "null" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint8" + }, + { + "keyword": "maximum", + "value": 255 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": [ + "integer", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/CsvFormatConfig/properties/header_row", + "key_path": "datasets[].tables[].source.format.csv.header_row", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer", + "null" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": [ + "integer", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/CsvFormatConfig/properties/quote", + "key_path": "datasets[].tables[].source.format.csv.quote", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer", + "null" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint8" + }, + { + "keyword": "maximum", + "value": 255 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": [ + "integer", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/access_rights", + "key_path": "datasets[].access_rights", + "path_kind": "property" + }, + "purpose": "Access rights classification, mirrors DCAT-AP `dcterms:accessRights`.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/AccessRights", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "public", + "restricted", + "non_public" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AccessRights" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/aggregates", + "key_path": "datasets[].aggregates", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/aggregates/items", + "key_path": "datasets[].aggregates[]", + "path_kind": "array_item" + }, + "purpose": "Aggregate declaration: group-by columns, measures, disclosure\ncontrol.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AggregateConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id", + "description", + "disclosure_control" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/applicable_legislation", + "key_path": "datasets[].applicable_legislation", + "path_kind": "property" + }, + "purpose": "DCAT-AP `dcatap:applicableLegislation` IRIs. This is evidence\npublished for standard consumers, not an application-specific\nauthorization or source-of-truth verdict.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/applicable_legislation/items", + "key_path": "datasets[].applicable_legislation[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/conforms_to", + "key_path": "datasets[].conforms_to", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/conforms_to/items", + "key_path": "datasets[].conforms_to[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/defaults", + "key_path": "datasets[].defaults", + "path_kind": "property" + }, + "purpose": "Optional table defaults for reducing repetition within one dataset.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/DatasetDefaultsConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/DatasetDefaultsConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/description", + "key_path": "datasets[].description", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/entities", + "key_path": "datasets[].entities", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/entities/items", + "key_path": "datasets[].entities[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/EntityConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "name", + "table", + "access", + "api" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/EntityConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/id", + "key_path": "datasets[].id", + "path_kind": "property" + }, + "purpose": "Dataset identifier. Lower-snake, starts with a letter.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/DatasetId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9_]*$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/DatasetId" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/owner", + "key_path": "datasets[].owner", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/public_services", + "key_path": "datasets[].public_services", + "path_kind": "property" + }, + "purpose": "CPSV public services that produce this dataset. Registry Relay emits\nthem as standard `cpsv:PublicService` nodes; consumers decide how to\ninterpret that evidence.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/public_services/items", + "key_path": "datasets[].public_services[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/PublicServiceConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "title" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/PublicServiceConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/sensitivity", + "key_path": "datasets[].sensitivity", + "path_kind": "property" + }, + "purpose": "Sensitivity classification. Operator-defined values cover common\npersonal and public dataset classifications in V1.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/Sensitivity", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "public", + "internal", + "personal", + "confidential", + "secret" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/Sensitivity" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/spatial_coverage", + "key_path": "datasets[].spatial_coverage", + "path_kind": "property" + }, + "purpose": "BRegDCAT-AP: `dct:spatial` IRI for this dataset. Overrides the\ncatalog-level `default_spatial_coverage` when set.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/status", + "key_path": "datasets[].status", + "path_kind": "property" + }, + "purpose": "Publishes the dataset lifecycle status; when omitted, Relay emits its weakest lifecycle claim instead of inferring a stronger status.", + "purpose_source": "reviewed_override", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "under_development", + "completed", + "deprecated", + "withdrawn" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "string" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/tables", + "key_path": "datasets[].tables", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/tables/items", + "key_path": "datasets[].tables[]", + "path_kind": "array_item" + }, + "purpose": "One private storage table under a dataset.\n\nThe public API should not expose these ids. Entity config maps one\nresource into one domain resource, with optional field renaming and\nrelationship declarations.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/ResourceConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id", + "source", + "schema" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ResourceConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/title", + "key_path": "datasets[].title", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DatasetConfig/properties/update_frequency", + "key_path": "datasets[].update_frequency", + "path_kind": "property" + }, + "purpose": "Update cadence; mirrors DCAT-AP `dcterms:accrualPeriodicity`. The\nV1 set is the codes used by the example plus the common alternates.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/UpdateFrequency", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "continuous", + "daily", + "weekly", + "termly", + "monthly", + "quarterly", + "annual", + "irregular", + "as_needed", + "unknown" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/UpdateFrequency" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DatasetDefaultsConfig/properties/materialization", + "key_path": "datasets[].defaults.materialization", + "path_kind": "property" + }, + "purpose": "How a configured private table is registered for query planning.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "snapshot" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "string" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DatasetDefaultsConfig/properties/refresh", + "key_path": "datasets[].defaults.refresh", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + [ + "mode", + "interval" + ], + [ + "mode" + ] + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DeploymentConfig/properties/evidence", + "key_path": "deployment.evidence", + "path_kind": "property" + }, + "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_deployment_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/DeploymentEvidenceConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/DeploymentEvidenceConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DeploymentConfig/properties/profile", + "key_path": "deployment.profile", + "path_kind": "property" + }, + "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_deployment_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "local", + "hosted_lab", + "production", + "evidence_grade" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "string" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DeploymentConfig/properties/waivers", + "key_path": "deployment.waivers", + "path_kind": "property" + }, + "purpose": "Per-deployment waivers. Each names one finding id, a required operator\nreference, an optional summary, and a mandatory expiry date. Expired\nwaivers stop suppressing their finding and raise\n`deployment.waiver_expired`.", + "purpose_source": "schema_description", + "intent_profile": "relay_deployment_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DeploymentConfig/properties/waivers/items", + "key_path": "deployment.waivers[]", + "path_kind": "array_item" + }, + "purpose": "One declared waiver. `expires` is an ISO 8601 `YYYY-MM-DD` date; format is\nvalidated at load time. The reference and optional summary are validated by\nthe shared operations contract before either can reach posture or logs.", + "purpose_source": "schema_description", + "intent_profile": "relay_deployment_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/DeploymentWaiverConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "finding", + "reference", + "expires" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/DeploymentWaiverConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DeploymentEvidenceConfig/properties/api_key_rotation", + "key_path": "deployment.evidence.api_key_rotation", + "path_kind": "property" + }, + "purpose": "Operator asserts an API-key rotation process is in place.", + "purpose_source": "schema_description", + "intent_profile": "relay_deployment_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_ack_cursor_path", + "key_path": "deployment.evidence.audit_ack_cursor_path", + "path_kind": "property" + }, + "purpose": "Optional path to a `registry.audit.ack_cursor.v1` file maintained by\nwhatever ships audit events off-host. When set, the runtime reads it to\nobserve shipping freshness and surfaces it as posture shipping health;\nabsent, shipping health stays `unverified` and only the declared\nshipping target is reported.", + "purpose_source": "schema_description", + "intent_profile": "relay_deployment_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_ack_max_age_secs", + "key_path": "deployment.evidence.audit_ack_max_age_secs", + "path_kind": "property" + }, + "purpose": "Optional freshness window in seconds for the ack cursor's `acked_at`\ntimestamp. Defaults to `DEFAULT_AUDIT_ACK_MAX_AGE` (900) when unset. A\nwindow without `audit_ack_cursor_path` is rejected at load, since a\nfreshness window is meaningless without a cursor to observe.", + "purpose_source": "schema_description", + "intent_profile": "relay_deployment_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer", + "null" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "maximum", + "value": 18446744073709551615 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": [ + "integer", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_offhost_shipping", + "key_path": "deployment.evidence.audit_offhost_shipping", + "path_kind": "property" + }, + "purpose": "Operator asserts audit records are shipped off-host (for example to a\nlog collector or SIEM) rather than relying solely on local retention.", + "purpose_source": "schema_description", + "intent_profile": "relay_deployment_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DeploymentEvidenceConfig/properties/ingress_rate_limit", + "key_path": "deployment.evidence.ingress_rate_limit", + "path_kind": "property" + }, + "purpose": "Operator asserts ingress rate limiting is enforced (for example by a\ngateway or reverse proxy in front of the relay).", + "purpose_source": "schema_description", + "intent_profile": "relay_deployment_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DeploymentWaiverConfig/properties/expires", + "key_path": "deployment.waivers[].expires", + "path_kind": "property" + }, + "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_deployment_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DeploymentWaiverConfig/properties/finding", + "key_path": "deployment.waivers[].finding", + "path_kind": "property" + }, + "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_deployment_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DeploymentWaiverConfig/properties/reference", + "key_path": "deployment.waivers[].reference", + "path_kind": "property" + }, + "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_deployment_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/DeploymentWaiverReference", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 128 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^(?!.*\\.\\.)[A-Za-z0-9._:-]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/DeploymentWaiverReference" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DeploymentWaiverConfig/properties/summary", + "key_path": "deployment.waivers[].summary", + "path_kind": "property" + }, + "purpose": "Structurally valid deployment-waiver summary. Contextual authorization-value and private-key marker exclusions require semantic producer validation.", + "purpose_source": "schema_description", + "intent_profile": "relay_deployment_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/DeploymentWaiverSummary", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/DeploymentWaiverSummary" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/method", + "key_path": "datasets[].aggregates[].disclosure_control.method", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/method", + "key_path": "datasets[].entities[].aggregates[].disclosure_control.method", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/method", + "key_path": "datasets[].tables[].aggregates[].disclosure_control.method", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/method/items", + "key_path": "datasets[].aggregates[].disclosure_control.method[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/method/items", + "key_path": "datasets[].entities[].aggregates[].disclosure_control.method[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/method/items", + "key_path": "datasets[].tables[].aggregates[].disclosure_control.method[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/min_cell_size", + "key_path": "datasets[].aggregates[].disclosure_control.min_cell_size", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/min_cell_size", + "key_path": "datasets[].entities[].aggregates[].disclosure_control.min_cell_size", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/min_cell_size", + "key_path": "datasets[].tables[].aggregates[].disclosure_control.min_cell_size", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/min_group_size", + "key_path": "datasets[].aggregates[].disclosure_control.min_group_size", + "path_kind": "property" + }, + "purpose": "Optionally overrides the effective disclosure threshold for grouped results; when omitted, Relay uses the configured cell threshold.", + "purpose_source": "reviewed_override", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer", + "null" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": [ + "integer", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/min_group_size", + "key_path": "datasets[].entities[].aggregates[].disclosure_control.min_group_size", + "path_kind": "property" + }, + "purpose": "Optionally overrides the effective disclosure threshold for grouped results; when omitted, Relay uses the configured cell threshold.", + "purpose_source": "reviewed_override", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer", + "null" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": [ + "integer", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/min_group_size", + "key_path": "datasets[].tables[].aggregates[].disclosure_control.min_group_size", + "path_kind": "property" + }, + "purpose": "Optionally overrides the effective disclosure threshold for grouped results; when omitted, Relay uses the configured cell threshold.", + "purpose_source": "reviewed_override", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer", + "null" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": [ + "integer", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/report_suppressed_rows", + "key_path": "datasets[].aggregates[].disclosure_control.report_suppressed_rows", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/report_suppressed_rows", + "key_path": "datasets[].entities[].aggregates[].disclosure_control.report_suppressed_rows", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/report_suppressed_rows", + "key_path": "datasets[].tables[].aggregates[].disclosure_control.report_suppressed_rows", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/suppression", + "key_path": "datasets[].aggregates[].disclosure_control.suppression", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/Suppression", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "const", + "value": [ + "mask", + "null", + "omit" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/Suppression" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/suppression", + "key_path": "datasets[].entities[].aggregates[].disclosure_control.suppression", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/Suppression", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "const", + "value": [ + "mask", + "null", + "omit" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/Suppression" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/DisclosureControlConfig/properties/suppression", + "key_path": "datasets[].tables[].aggregates[].disclosure_control.suppression", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/Suppression", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "const", + "value": [ + "mask", + "null", + "omit" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/Suppression" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EcosystemBindingSelectorConfig/properties/id", + "key_path": "metadata.ecosystem_binding.id", + "path_kind": "property" + }, + "purpose": "Controls Relay metadata publication and registry-description behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_metadata_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EcosystemBindingSelectorConfig/properties/version", + "key_path": "metadata.ecosystem_binding.version", + "path_kind": "property" + }, + "purpose": "Controls Relay metadata publication and registry-description behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_metadata_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityAccessConfig/properties/aggregate_scope", + "key_path": "datasets[].entities[].access.aggregate_scope", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityAccessConfig/properties/evidence_verification_scope", + "key_path": "datasets[].entities[].access.evidence_verification_scope", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityAccessConfig/properties/metadata_scope", + "key_path": "datasets[].entities[].access.metadata_scope", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityAccessConfig/properties/read_scope", + "key_path": "datasets[].entities[].access.read_scope", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityApiConfig/properties/allowed_expansions", + "key_path": "datasets[].entities[].api.allowed_expansions", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityApiConfig/properties/allowed_expansions/items", + "key_path": "datasets[].entities[].api.allowed_expansions[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityApiConfig/properties/allowed_filters", + "key_path": "datasets[].entities[].api.allowed_filters", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityApiConfig/properties/allowed_filters/items", + "key_path": "datasets[].entities[].api.allowed_filters[]", + "path_kind": "array_item" + }, + "purpose": "A single allowed filter: field name + permitted operators.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AllowedFilter", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "field", + "ops" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AllowedFilter" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityApiConfig/properties/default_limit", + "key_path": "datasets[].entities[].api.default_limit", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityApiConfig/properties/governed_policy", + "key_path": "datasets[].entities[].api.governed_policy", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityApiConfig/properties/max_limit", + "key_path": "datasets[].entities[].api.max_limit", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityApiConfig/properties/require_purpose_header", + "key_path": "datasets[].entities[].api.require_purpose_header", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityApiConfig/properties/required_filter_bindings", + "key_path": "datasets[].entities[].api.required_filter_bindings", + "path_kind": "property" + }, + "purpose": "Principal-derived bindings that both satisfy the required filter gate\nand are applied to the query.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityApiConfig/properties/required_filter_bindings/items", + "key_path": "datasets[].entities[].api.required_filter_bindings[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/RequiredFilterBindingConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "field" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/RequiredFilterBindingConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityApiConfig/properties/required_filters", + "key_path": "datasets[].entities[].api.required_filters", + "path_kind": "property" + }, + "purpose": "Alternative fields that can satisfy the row-scope gate. A\nprincipal-bound equality filter on any listed field is sufficient, so\nlist multiple fields only when each is an acceptable boundary.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityApiConfig/properties/required_filters/items", + "key_path": "datasets[].entities[].api.required_filters[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/access", + "key_path": "datasets[].entities[].access", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/EntityAccessConfig", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "metadata_scope", + "aggregate_scope", + "read_scope" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/EntityAccessConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/aggregates", + "key_path": "datasets[].entities[].aggregates", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/aggregates/items", + "key_path": "datasets[].entities[].aggregates[]", + "path_kind": "array_item" + }, + "purpose": "Aggregate declaration: group-by columns, measures, disclosure\ncontrol.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AggregateConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id", + "description", + "disclosure_control" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/api", + "key_path": "datasets[].entities[].api", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/EntityApiConfig", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "default_limit", + "max_limit" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/EntityApiConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/attribute_release_profiles", + "key_path": "datasets[].entities[].attribute_release_profiles", + "path_kind": "property" + }, + "purpose": "Governed identity attribute-release profiles attached to this entity.\nEach profile resolves exactly one subject and returns only the\nconfigured, minimised claims. Empty by default (feature opt-in).", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/attribute_release_profiles/items", + "key_path": "datasets[].entities[].attribute_release_profiles[]", + "path_kind": "array_item" + }, + "purpose": "A governed identity attribute-release profile. A profile is a\nprojection-limited, exactly-one-subject lookup that maps a configured set of\nsource fields (or CEL-computed expressions) into a minimised\nOIDC/UserInfo-style claim bundle. Every profile is purpose-bound and requires\na matching `data-purpose` at resolve time. Identified globally by the\n`(id, version)` pair; both are required path segments at resolve time.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AttributeReleaseProfile", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id", + "version", + "purpose", + "release_scope", + "subject", + "claims" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AttributeReleaseProfile" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/concept_uri", + "key_path": "datasets[].entities[].concept_uri", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/description", + "key_path": "datasets[].entities[].description", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/fields", + "key_path": "datasets[].entities[].fields", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/fields/items", + "key_path": "datasets[].entities[].fields[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/EntityFieldConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "name" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/EntityFieldConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/name", + "key_path": "datasets[].entities[].name", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/relationships", + "key_path": "datasets[].entities[].relationships", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/relationships/items", + "key_path": "datasets[].entities[].relationships[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/EntityRelationshipConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "name", + "kind", + "target", + "foreign_key" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/EntityRelationshipConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/spatial", + "key_path": "datasets[].entities[].spatial", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "geometry" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/table", + "key_path": "datasets[].entities[].table", + "path_kind": "property" + }, + "purpose": "Resource identifier within a dataset.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/ResourceId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9_]*$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ResourceId" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityConfig/properties/title", + "key_path": "datasets[].entities[].title", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityFieldConfig/properties/codelist", + "key_path": "datasets[].entities[].fields[].codelist", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityFieldConfig/properties/concept_uri", + "key_path": "datasets[].entities[].fields[].concept_uri", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityFieldConfig/properties/from", + "key_path": "datasets[].entities[].fields[].from", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityFieldConfig/properties/language", + "key_path": "datasets[].entities[].fields[].language", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityFieldConfig/properties/name", + "key_path": "datasets[].entities[].fields[].name", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityFieldConfig/properties/sensitive", + "key_path": "datasets[].entities[].fields[].sensitive", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityFieldConfig/properties/unit", + "key_path": "datasets[].entities[].fields[].unit", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityRelationshipConfig/properties/concept_uri", + "key_path": "datasets[].entities[].relationships[].concept_uri", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityRelationshipConfig/properties/foreign_key", + "key_path": "datasets[].entities[].relationships[].foreign_key", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityRelationshipConfig/properties/kind", + "key_path": "datasets[].entities[].relationships[].kind", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/RelationshipKind", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "belongs_to", + "has_many", + "has_one" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/RelationshipKind" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityRelationshipConfig/properties/name", + "key_path": "datasets[].entities[].relationships[].name", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntityRelationshipConfig/properties/target", + "key_path": "datasets[].entities[].relationships[].target", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntitySpatialConfig/properties/bbox_fields", + "key_path": "datasets[].entities[].spatial.bbox_fields", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "min_x", + "min_y", + "max_x", + "max_y" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntitySpatialConfig/properties/collection_id", + "key_path": "datasets[].entities[].spatial.collection_id", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntitySpatialConfig/properties/datetime_field", + "key_path": "datasets[].entities[].spatial.datetime_field", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntitySpatialConfig/properties/description", + "key_path": "datasets[].entities[].spatial.description", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntitySpatialConfig/properties/geometry", + "key_path": "datasets[].entities[].spatial.geometry", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/SpatialGeometryConfig", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + [ + "kind", + "field", + "crs" + ], + [ + "kind", + "longitude_field", + "latitude_field", + "crs" + ] + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/SpatialGeometryConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntitySpatialConfig/properties/max_bbox_degrees", + "key_path": "datasets[].entities[].spatial.max_bbox_degrees", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "number" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "double" + }, + { + "keyword": "type", + "value": "number" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntitySpatialConfig/properties/max_geometry_vertices", + "key_path": "datasets[].entities[].spatial.max_geometry_vertices", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/EntitySpatialConfig/properties/title", + "key_path": "datasets[].entities[].spatial.title", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/FieldConfig/properties/codelist", + "key_path": "datasets[].tables[].schema.fields[].codelist", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/FieldConfig/properties/concept_uri", + "key_path": "datasets[].tables[].schema.fields[].concept_uri", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/FieldConfig/properties/language", + "key_path": "datasets[].tables[].schema.fields[].language", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/FieldConfig/properties/name", + "key_path": "datasets[].tables[].schema.fields[].name", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/FieldConfig/properties/nullable", + "key_path": "datasets[].tables[].schema.fields[].nullable", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/FieldConfig/properties/sensitive", + "key_path": "datasets[].tables[].schema.fields[].sensitive", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/FieldConfig/properties/type", + "key_path": "datasets[].tables[].schema.fields[].type", + "path_kind": "property" + }, + "purpose": "Physical type of a column. The set is fixed in V1; semantic types\nare carried via `concept_uri`.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/FieldType", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "string", + "number", + "integer", + "boolean", + "date", + "timestamp" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/FieldType" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/FieldConfig/properties/unit", + "key_path": "datasets[].tables[].schema.fields[].unit", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/GovernedPolicyConfig/properties/allowed_assurance", + "key_path": "datasets[].entities[].api.governed_policy.allowed_assurance", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/GovernedPolicyConfig/properties/allowed_assurance/items", + "key_path": "datasets[].entities[].api.governed_policy.allowed_assurance[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/GovernedPolicyConfig/properties/max_source_age_seconds", + "key_path": "datasets[].entities[].api.governed_policy.max_source_age_seconds", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer", + "null" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "maximum", + "value": 18446744073709551615 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": [ + "integer", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/GovernedPolicyConfig/properties/minimum_assurance", + "key_path": "datasets[].entities[].api.governed_policy.minimum_assurance", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/GovernedPolicyConfig/properties/permitted_jurisdictions", + "key_path": "datasets[].entities[].api.governed_policy.permitted_jurisdictions", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/GovernedPolicyConfig/properties/permitted_jurisdictions/items", + "key_path": "datasets[].entities[].api.governed_policy.permitted_jurisdictions[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/GovernedPolicyConfig/properties/permitted_purposes", + "key_path": "datasets[].entities[].api.governed_policy.permitted_purposes", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/GovernedPolicyConfig/properties/permitted_purposes/items", + "key_path": "datasets[].entities[].api.governed_policy.permitted_purposes[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/GovernedPolicyConfig/properties/redaction_fields", + "key_path": "datasets[].entities[].api.governed_policy.redaction_fields", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/GovernedPolicyConfig/properties/redaction_fields/items", + "key_path": "datasets[].entities[].api.governed_policy.redaction_fields[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/GovernedPolicyConfig/properties/require_consent", + "key_path": "datasets[].entities[].api.governed_policy.require_consent", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/GovernedPolicyConfig/properties/require_legal_basis", + "key_path": "datasets[].entities[].api.governed_policy.require_legal_basis", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/GovernedPolicyConfig/properties/trusted_context", + "key_path": "datasets[].entities[].api.governed_policy.trusted_context", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/GovernedTrustedContextConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/GovernedTrustedContextConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/GovernedTrustedContextConfig/properties/asserted_assurance", + "key_path": "datasets[].entities[].api.governed_policy.trusted_context.asserted_assurance", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/GovernedTrustedContextConfig/properties/consent_ref", + "key_path": "datasets[].entities[].api.governed_policy.trusted_context.consent_ref", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/GovernedTrustedContextConfig/properties/jurisdiction", + "key_path": "datasets[].entities[].api.governed_policy.trusted_context.jurisdiction", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/GovernedTrustedContextConfig/properties/legal_basis_ref", + "key_path": "datasets[].entities[].api.governed_policy.trusted_context.legal_basis_ref", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/GovernedTrustedContextConfig/properties/source_observed_age_seconds", + "key_path": "datasets[].entities[].api.governed_policy.trusted_context.source_observed_age_seconds", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer", + "null" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "maximum", + "value": 18446744073709551615 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": [ + "integer", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/InstanceConfig/properties/environment", + "key_path": "instance.environment", + "path_kind": "property" + }, + "purpose": "Identifies the public Relay instance labels surfaced by posture and operations tooling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_instance_public", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "Public instance labels surfaced by Relay posture and operations tooling; this intent catalog records their contract without loading deployment values.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "public", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic public labels; never copy a country deployment identity into generated reference documentation.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate changes to public instance identity with the Relay deployment and its operational inventory.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/InstanceConfig/properties/id", + "key_path": "instance.id", + "path_kind": "property" + }, + "purpose": "Identifies the public Relay instance labels surfaced by posture and operations tooling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_instance_public", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "Public instance labels surfaced by Relay posture and operations tooling; this intent catalog records their contract without loading deployment values.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "public", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic public labels; never copy a country deployment identity into generated reference documentation.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate changes to public instance identity with the Relay deployment and its operational inventory.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/InstanceConfig/properties/jurisdiction", + "key_path": "instance.jurisdiction", + "path_kind": "property" + }, + "purpose": "Identifies the public Relay instance labels surfaced by posture and operations tooling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_instance_public", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "Public instance labels surfaced by Relay posture and operations tooling; this intent catalog records their contract without loading deployment values.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "public", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic public labels; never copy a country deployment identity into generated reference documentation.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate changes to public instance identity with the Relay deployment and its operational inventory.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/InstanceConfig/properties/owner", + "key_path": "instance.owner", + "path_kind": "property" + }, + "purpose": "Identifies the public Relay instance labels surfaced by posture and operations tooling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_instance_public", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "Public instance labels surfaced by Relay posture and operations tooling; this intent catalog records their contract without loading deployment values.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "public", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic public labels; never copy a country deployment identity into generated reference documentation.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate changes to public instance identity with the Relay deployment and its operational inventory.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/MetadataConfig/properties/ecosystem_binding", + "key_path": "metadata.ecosystem_binding", + "path_kind": "property" + }, + "purpose": "Controls Relay metadata publication and registry-description behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_metadata_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/MetadataConfig/properties/source", + "key_path": "metadata.source", + "path_kind": "property" + }, + "purpose": "Controls Relay metadata publication and registry-description behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_metadata_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/MetadataSourceConfig", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "path" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/MetadataSourceConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/MetadataSourceConfig/properties/digest", + "key_path": "metadata.source.digest", + "path_kind": "property" + }, + "purpose": "Controls Relay metadata publication and registry-description behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_metadata_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/MetadataSourceConfig/properties/path", + "key_path": "metadata.source.path", + "path_kind": "property" + }, + "purpose": "Controls Relay metadata publication and registry-description behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_metadata_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/allow_dev_insecure_fetch_urls", + "key_path": "auth.oidc.allow_dev_insecure_fetch_urls", + "path_kind": "property" + }, + "purpose": "Development-only escape hatch that permits loopback HTTP issuer,\ndiscovery, and JWKS URLs. Private non-loopback networks and cloud\nmetadata endpoints remain denied by the platform fetch policy.", + "purpose_source": "schema_description", + "intent_profile": "relay_auth_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/allowed_algorithms", + "key_path": "auth.oidc.allowed_algorithms", + "path_kind": "property" + }, + "purpose": "Signature algorithms accepted by the verifier. Defaults to\nRS256, ES256, EdDSA. HS\\* and `none` are intentionally absent\nfrom [`OidcAlgorithm`].", + "purpose_source": "schema_description", + "intent_profile": "relay_auth_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/allowed_algorithms/items", + "key_path": "auth.oidc.allowed_algorithms[]", + "path_kind": "array_item" + }, + "purpose": "JWS signature algorithms accepted by the OIDC verifier. Symmetric\nalgorithms (`HS*`) and `none` are intentionally absent: shared-secret\nJWTs are unsafe between a resource server and an IdP, and `none`\ndisables verification entirely.\n\nYAML values are the canonical JWA `alg` strings (`RS256`, `ES256`,\n`EdDSA`), case-sensitive.", + "purpose_source": "schema_description", + "intent_profile": "relay_auth_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/OidcAlgorithm", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "RS256", + "ES256", + "EdDSA" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/OidcAlgorithm" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/allowed_clients", + "key_path": "auth.oidc.allowed_clients", + "path_kind": "property" + }, + "purpose": "Optional allowlist of client identifiers, matched against the\ntoken's `azp` (preferred) or `client_id` claim. Empty list\nmeans any client is accepted.", + "purpose_source": "schema_description", + "intent_profile": "relay_auth_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/allowed_clients/items", + "key_path": "auth.oidc.allowed_clients[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_auth_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/allowed_token_types", + "key_path": "auth.oidc.allowed_token_types", + "path_kind": "property" + }, + "purpose": "Accepted `typ` JOSE header values. Defaults to `JWT` and\n`at+jwt` (RFC 9068). ID tokens (`id+jwt`) are not access tokens\nand are rejected by default. Tokens without `typ` are rejected by\nthe shared verifier.", + "purpose_source": "schema_description", + "intent_profile": "relay_auth_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/allowed_token_types/items", + "key_path": "auth.oidc.allowed_token_types[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_auth_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/audiences", + "key_path": "auth.oidc.audiences", + "path_kind": "property" + }, + "purpose": "One or more accepted `aud` values. Tokens with no `aud`, or\nwhose `aud` does not intersect this list, are rejected.", + "purpose_source": "schema_description", + "intent_profile": "relay_auth_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/audiences/items", + "key_path": "auth.oidc.audiences[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_auth_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/discovery_url", + "key_path": "auth.oidc.discovery_url", + "path_kind": "property" + }, + "purpose": "OIDC discovery document URL\n(`.well-known/openid-configuration`). The JWKS URL is resolved\nfrom `jwks_uri` in the discovered document.", + "purpose_source": "schema_description", + "intent_profile": "relay_auth_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/issuer", + "key_path": "auth.oidc.issuer", + "path_kind": "property" + }, + "purpose": "Issuer URL. Compared verbatim against the JWT `iss` claim.", + "purpose_source": "schema_description", + "intent_profile": "relay_auth_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/jwks_cache_ttl", + "key_path": "auth.oidc.jwks_cache_ttl", + "path_kind": "property" + }, + "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_auth_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/HumantimeDuration", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 255 + }, + { + "keyword": "pattern", + "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/HumantimeDuration" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/jwks_url", + "key_path": "auth.oidc.jwks_url", + "path_kind": "property" + }, + "purpose": "JWKS endpoint. Either this or `discovery_url` must be set.\n`discovery_url` takes precedence: when both are configured the\nvalidator rejects the document.", + "purpose_source": "schema_description", + "intent_profile": "relay_auth_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/leeway", + "key_path": "auth.oidc.leeway", + "path_kind": "property" + }, + "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_auth_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/HumantimeDuration", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 255 + }, + { + "keyword": "pattern", + "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/HumantimeDuration" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/scope_claim", + "key_path": "auth.oidc.scope_claim", + "path_kind": "property" + }, + "purpose": "JWT claim whose value carries scopes. Defaults to `scope`, the\nRFC 8693 / RFC 9068 space-separated form. Some IdPs use `scp`\nor `permissions`; the value may be a string, an array of strings,\nor an object keyed by scope name.", + "purpose_source": "schema_description", + "intent_profile": "relay_auth_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/scope_map", + "key_path": "auth.oidc.scope_map", + "path_kind": "property" + }, + "purpose": "Optional rename map: `external_scope -> internal_scope`. Applied\nafter parsing the scope claim, before scope-based access checks\nrun. Useful for adapting IdP role names (`role:foo`) to the\nrelay's `:` shape.", + "purpose_source": "schema_description", + "intent_profile": "relay_auth_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/scope_map/additionalProperties", + "key_path": "auth.oidc.scope_map.*", + "path_kind": "map_value" + }, + "purpose": "Each reviewed key is an external token scope and each value is the bounded Relay scope mapping granted for that exact token scope.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_auth_oidc_scope_map_open_map", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "structural", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/scope_object_required_keys", + "key_path": "auth.oidc.scope_object_required_keys", + "path_kind": "property" + }, + "purpose": "Keys that must be present inside object-valued role claim values\nbefore the role key is treated as an active scope. Object-valued\nclaims grant no scopes when this list is empty.\nThis is useful for IdPs such as Zitadel where role values are\nkeyed by organization id.", + "purpose_source": "schema_description", + "intent_profile": "relay_auth_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/OidcConfig/properties/scope_object_required_keys/items", + "key_path": "auth.oidc.scope_object_required_keys[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay caller authentication, authorization scopes, token verification, and abuse throttling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_auth_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/PostgresTableConfig/properties/name", + "key_path": "datasets[].tables[].source.table.name", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/PostgresTableConfig/properties/schema", + "key_path": "datasets[].tables[].source.table.schema", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/PublicServiceConfig/properties/description", + "key_path": "datasets[].public_services[].description", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/PublicServiceConfig/properties/id", + "key_path": "datasets[].public_services[].id", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/PublicServiceConfig/properties/title", + "key_path": "datasets[].public_services[].title", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/RefreshConfig/oneOf/0/properties/interval", + "key_path": "datasets[].defaults.refresh.interval", + "path_kind": "property" + }, + "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/HumantimeDuration", + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 255 + }, + { + "keyword": "pattern", + "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/HumantimeDuration" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/RefreshConfig/oneOf/0/properties/interval", + "key_path": "datasets[].tables[].refresh.interval", + "path_kind": "property" + }, + "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/HumantimeDuration", + "composed": false + }, + "requiredness": "conditional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 255 + }, + { + "keyword": "pattern", + "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/HumantimeDuration" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/RefreshConfig/oneOf/0/properties/mode", + "key_path": "datasets[].defaults.refresh.mode", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "const", + "value": [ + "interval", + "manual", + "mtime" + ] + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/RefreshConfig/oneOf/0/properties/mode", + "key_path": "datasets[].tables[].refresh.mode", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "const", + "value": [ + "interval", + "manual", + "mtime" + ] + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ReleaseClaimConfig/properties/expression", + "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].expression", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "cel" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ReleaseClaimConfig/properties/format", + "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].format", + "path_kind": "property" + }, + "purpose": "Optional value format hint.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ReleaseClaimConfig/properties/locale", + "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].locale", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ReleaseClaimConfig/properties/name", + "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].name", + "path_kind": "property" + }, + "purpose": "Released claim name (lower-snake).", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ReleaseClaimConfig/properties/required", + "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].required", + "path_kind": "property" + }, + "purpose": "Whether the claim must be present; a missing required claim denies.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ReleaseClaimConfig/properties/sensitivity", + "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].sensitivity", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "direct_identifier", + "personal", + "public", + "pseudonymous" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "string" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ReleaseClaimConfig/properties/source_field", + "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].source_field", + "path_kind": "property" + }, + "purpose": "Source field projected into the claim. XOR with `expression`.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ReleaseConditionsConfig/properties/expression", + "key_path": "datasets[].entities[].attribute_release_profiles[].release_conditions.expression", + "path_kind": "property" + }, + "purpose": "A single CEL expression evaluated over the subject's source projection.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/ReleaseExpressionConfig", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "cel" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ReleaseExpressionConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ReleaseExpressionConfig/properties/cel", + "key_path": "datasets[].entities[].attribute_release_profiles[].claims[].expression.cel", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ReleaseExpressionConfig/properties/cel", + "key_path": "datasets[].entities[].attribute_release_profiles[].release_conditions.expression.cel", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ReleaseResponseConfig/properties/include_source_metadata", + "key_path": "datasets[].entities[].attribute_release_profiles[].response.include_source_metadata", + "path_kind": "property" + }, + "purpose": "Whether to include profile-sourced metadata in the response body.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ReleaseSubjectConfig/properties/id_type", + "key_path": "datasets[].entities[].attribute_release_profiles[].subject.id_type", + "path_kind": "property" + }, + "purpose": "Accepted identifier type label.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ReleaseSubjectConfig/properties/source_field", + "key_path": "datasets[].entities[].attribute_release_profiles[].subject.source_field", + "path_kind": "property" + }, + "purpose": "Source field used to match the subject. Must be an exposed entity field.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/RequiredFilterBindingConfig/properties/field", + "key_path": "datasets[].aggregates[].required_filter_bindings[].field", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/RequiredFilterBindingConfig/properties/field", + "key_path": "datasets[].entities[].aggregates[].required_filter_bindings[].field", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/RequiredFilterBindingConfig/properties/field", + "key_path": "datasets[].entities[].api.required_filter_bindings[].field", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/RequiredFilterBindingConfig/properties/field", + "key_path": "datasets[].tables[].aggregates[].required_filter_bindings[].field", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/RequiredFilterBindingConfig/properties/source", + "key_path": "datasets[].aggregates[].required_filter_bindings[].source", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/RequiredFilterBindingSource", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "principal_id" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/RequiredFilterBindingSource" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/RequiredFilterBindingConfig/properties/source", + "key_path": "datasets[].entities[].aggregates[].required_filter_bindings[].source", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/RequiredFilterBindingSource", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "principal_id" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/RequiredFilterBindingSource" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/RequiredFilterBindingConfig/properties/source", + "key_path": "datasets[].entities[].api.required_filter_bindings[].source", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/RequiredFilterBindingSource", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "principal_id" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/RequiredFilterBindingSource" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/RequiredFilterBindingConfig/properties/source", + "key_path": "datasets[].tables[].aggregates[].required_filter_bindings[].source", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/RequiredFilterBindingSource", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "principal_id" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/RequiredFilterBindingSource" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ResourceAccessConfig/properties/aggregate_scope", + "key_path": "datasets[].tables[].access.aggregate_scope", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ResourceAccessConfig/properties/metadata_scope", + "key_path": "datasets[].tables[].access.metadata_scope", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ResourceApiConfig/properties/allowed_filters", + "key_path": "datasets[].tables[].api.allowed_filters", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ResourceApiConfig/properties/allowed_filters/items", + "key_path": "datasets[].tables[].api.allowed_filters[]", + "path_kind": "array_item" + }, + "purpose": "A single allowed filter: field name + permitted operators.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AllowedFilter", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "field", + "ops" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AllowedFilter" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ResourceApiConfig/properties/default_limit", + "key_path": "datasets[].tables[].api.default_limit", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ResourceApiConfig/properties/max_limit", + "key_path": "datasets[].tables[].api.max_limit", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ResourceApiConfig/properties/require_purpose_header", + "key_path": "datasets[].tables[].api.require_purpose_header", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ResourceConfig/properties/access", + "key_path": "datasets[].tables[].access", + "path_kind": "property" + }, + "purpose": "Resource-level scope assignments. Private tables are not exposed as row\nresources in beta; row access is configured on public entities.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/ResourceAccessConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "metadata_scope", + "aggregate_scope" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ResourceAccessConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ResourceConfig/properties/aggregates", + "key_path": "datasets[].tables[].aggregates", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ResourceConfig/properties/aggregates/items", + "key_path": "datasets[].tables[].aggregates[]", + "path_kind": "array_item" + }, + "purpose": "Aggregate declaration: group-by columns, measures, disclosure\ncontrol.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AggregateConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id", + "description", + "disclosure_control" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AggregateConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ResourceConfig/properties/api", + "key_path": "datasets[].tables[].api", + "path_kind": "property" + }, + "purpose": "Resource-level API knobs: per-field filter allowlist, limit caps,\nand the `Data-Purpose` requirement.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/ResourceApiConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "default_limit", + "max_limit" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ResourceApiConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ResourceConfig/properties/id", + "key_path": "datasets[].tables[].id", + "path_kind": "property" + }, + "purpose": "Resource identifier within a dataset.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/ResourceId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9_]*$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ResourceId" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ResourceConfig/properties/materialization", + "key_path": "datasets[].tables[].materialization", + "path_kind": "property" + }, + "purpose": "How a configured private table is registered for query planning.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "snapshot" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "string" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ResourceConfig/properties/primary_key", + "key_path": "datasets[].tables[].primary_key", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ResourceConfig/properties/refresh", + "key_path": "datasets[].tables[].refresh", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + [ + "mode", + "interval" + ], + [ + "mode" + ] + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ResourceConfig/properties/schema", + "key_path": "datasets[].tables[].schema", + "path_kind": "property" + }, + "purpose": "Declared resource schema. `strict` is the spec's `strict_schema`\nflag; on mismatch ingestion refuses to register the resource.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/SchemaConfig", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "fields" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/SchemaConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ResourceConfig/properties/source", + "key_path": "datasets[].tables[].source", + "path_kind": "property" + }, + "purpose": "Source plugin selection. Tagged on `type:` so HTTP, S3, or additional\ndatabase variants can land additively later.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/SourceConfig", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + [ + "type", + "connection_env" + ], + [ + "type", + "path" + ] + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/SourceConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ResourceFormatConfig/properties/csv", + "key_path": "datasets[].tables[].source.format.csv", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ResourceFormatConfig/properties/parquet", + "key_path": "datasets[].tables[].source.format.parquet", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ResourceFormatConfig/properties/xlsx", + "key_path": "datasets[].tables[].source.format.xlsx", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/RotateConfig/properties/max_files", + "key_path": "audit.rotate.max_files", + "path_kind": "property" + }, + "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_audit_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/RotateConfig/properties/max_size_mb", + "key_path": "audit.rotate.max_size_mb", + "path_kind": "property" + }, + "purpose": "Controls Relay audit event delivery, rotation, integrity chaining, and failure behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_audit_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "maximum", + "value": 18446744073709551615 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SchemaConfig/properties/fields", + "key_path": "datasets[].tables[].schema.fields", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SchemaConfig/properties/fields/items", + "key_path": "datasets[].tables[].schema.fields[]", + "path_kind": "array_item" + }, + "purpose": "One column in a resource schema. Physical type and optional\nsemantic annotations used by catalog and schema metadata.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/FieldConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "name", + "type" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/FieldConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SchemaConfig/properties/strict", + "key_path": "datasets[].tables[].schema.strict", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ServerConfig/properties/admin_bind", + "key_path": "server.admin_bind", + "path_kind": "property" + }, + "purpose": "Canonical dotted-decimal IPv4 or bracketed IPv6 plus a decimal port from 0 through 65535", + "purpose_source": "schema_description", + "intent_profile": "relay_server_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "pattern", + "value": [ + "^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9]):(?:0|[1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$", + "^\\[(?:(?:[0-9A-Fa-f]{1,4}:){7}[0-9A-Fa-f]{1,4}|(?:[0-9A-Fa-f]{1,4}:){1,7}:|(?:[0-9A-Fa-f]{1,4}:){1,6}:[0-9A-Fa-f]{1,4}|(?:[0-9A-Fa-f]{1,4}:){1,5}(?::[0-9A-Fa-f]{1,4}){1,2}|(?:[0-9A-Fa-f]{1,4}:){1,4}(?::[0-9A-Fa-f]{1,4}){1,3}|(?:[0-9A-Fa-f]{1,4}:){1,3}(?::[0-9A-Fa-f]{1,4}){1,4}|(?:[0-9A-Fa-f]{1,4}:){1,2}(?::[0-9A-Fa-f]{1,4}){1,5}|[0-9A-Fa-f]{1,4}:(?:(?::[0-9A-Fa-f]{1,4}){1,6})|:(?:(?::[0-9A-Fa-f]{1,4}){1,7}|:))\\]:(?:0|[1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "string" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ServerConfig/properties/bind", + "key_path": "server.bind", + "path_kind": "property" + }, + "purpose": "Canonical dotted-decimal IPv4 or bracketed IPv6 plus a decimal port from 0 through 65535", + "purpose_source": "schema_description", + "intent_profile": "relay_server_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/SocketAddr", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "pattern", + "value": [ + "^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])\\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9]):(?:0|[1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$", + "^\\[(?:(?:[0-9A-Fa-f]{1,4}:){7}[0-9A-Fa-f]{1,4}|(?:[0-9A-Fa-f]{1,4}:){1,7}:|(?:[0-9A-Fa-f]{1,4}:){1,6}:[0-9A-Fa-f]{1,4}|(?:[0-9A-Fa-f]{1,4}:){1,5}(?::[0-9A-Fa-f]{1,4}){1,2}|(?:[0-9A-Fa-f]{1,4}:){1,4}(?::[0-9A-Fa-f]{1,4}){1,3}|(?:[0-9A-Fa-f]{1,4}:){1,3}(?::[0-9A-Fa-f]{1,4}){1,4}|(?:[0-9A-Fa-f]{1,4}:){1,2}(?::[0-9A-Fa-f]{1,4}){1,5}|[0-9A-Fa-f]{1,4}:(?:(?::[0-9A-Fa-f]{1,4}){1,6})|:(?:(?::[0-9A-Fa-f]{1,4}){1,7}|:))\\]:(?:0|[1-9][0-9]{0,3}|[1-5][0-9]{4}|6[0-4][0-9]{3}|65[0-4][0-9]{2}|655[0-2][0-9]|6553[0-5])$" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/SocketAddr" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ServerConfig/properties/cache_dir", + "key_path": "server.cache_dir", + "path_kind": "property" + }, + "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_server_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ServerConfig/properties/cors", + "key_path": "server.cors", + "path_kind": "property" + }, + "purpose": "CORS allowlist; default-deny per Section 17 item 7.", + "purpose_source": "schema_description", + "intent_profile": "relay_server_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/CorsConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/CorsConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ServerConfig/properties/http1_header_read_timeout", + "key_path": "server.http1_header_read_timeout", + "path_kind": "property" + }, + "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w", + "purpose_source": "schema_description", + "intent_profile": "relay_server_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/HumantimeDuration", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 255 + }, + { + "keyword": "pattern", + "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/HumantimeDuration" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ServerConfig/properties/max_connections", + "key_path": "server.max_connections", + "path_kind": "property" + }, + "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_server_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint" + }, + { + "keyword": "maximum", + "value": 18446744073709551615 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ServerConfig/properties/max_source_file_bytes", + "key_path": "server.max_source_file_bytes", + "path_kind": "property" + }, + "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_server_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "maximum", + "value": 18446744073709551615 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ServerConfig/properties/openapi_requires_auth", + "key_path": "server.openapi_requires_auth", + "path_kind": "property" + }, + "purpose": "Keeps the configured OpenAPI document behind Relay authentication unless an operator explicitly accepts unauthenticated contract discovery.", + "purpose_source": "reviewed_override", + "intent_profile": "relay_server_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ServerConfig/properties/request_body_timeout", + "key_path": "server.request_body_timeout", + "path_kind": "property" + }, + "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w", + "purpose_source": "schema_description", + "intent_profile": "relay_server_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/HumantimeDuration", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 255 + }, + { + "keyword": "pattern", + "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/HumantimeDuration" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ServerConfig/properties/request_timeout", + "key_path": "server.request_timeout", + "path_kind": "property" + }, + "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w", + "purpose_source": "schema_description", + "intent_profile": "relay_server_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/HumantimeDuration", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 255 + }, + { + "keyword": "pattern", + "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/HumantimeDuration" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ServerConfig/properties/trust_proxy", + "key_path": "server.trust_proxy", + "path_kind": "property" + }, + "purpose": "`X-Forwarded-For` policy. Until the `ipnet` crate lands in deps we\nkeep CIDR specs as strings and validate format in\n[`validate::run`].", + "purpose_source": "schema_description", + "intent_profile": "relay_server_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/TrustProxyConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/TrustProxyConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/ServerConfig/properties/xlsx_max_file_bytes", + "key_path": "server.xlsx_max_file_bytes", + "path_kind": "property" + }, + "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_server_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "maximum", + "value": 18446744073709551615 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SourceConfig/oneOf/0/properties/format", + "key_path": "datasets[].tables[].source.format", + "path_kind": "property" + }, + "purpose": "Storage table format override. If omitted, ingest infers the format\nfrom the source file extension.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SourceConfig/oneOf/0/properties/path", + "key_path": "datasets[].tables[].source.path", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SourceConfig/oneOf/0/properties/type", + "key_path": "datasets[].tables[].source.type", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "const", + "value": [ + "file", + "postgres" + ] + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SourceConfig/oneOf/1/properties/change_token_sql", + "key_path": "datasets[].tables[].source.change_token_sql", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SourceConfig/oneOf/1/properties/connect_timeout", + "key_path": "datasets[].tables[].source.connect_timeout", + "path_kind": "property" + }, + "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/HumantimeDuration", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 255 + }, + { + "keyword": "pattern", + "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/HumantimeDuration" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SourceConfig/oneOf/1/properties/connection_env", + "key_path": "datasets[].tables[].source.connection_env", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_secret_reference", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/PostgresEnvironmentNameSchema", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[A-Za-z_][A-Za-z0-9_]*$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/PostgresEnvironmentNameSchema" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SourceConfig/oneOf/1/properties/query", + "key_path": "datasets[].tables[].source.query", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SourceConfig/oneOf/1/properties/query_timeout", + "key_path": "datasets[].tables[].source.query_timeout", + "path_kind": "property" + }, + "purpose": "One or more non-negative integer duration components separated by one ASCII space; supported units are ns, us, ms, s, m, h, d, and w", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/HumantimeDuration", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 255 + }, + { + "keyword": "pattern", + "value": "^[0-9]{1,10}(?:ns|us|ms|s|m|h|d|w)(?: [0-9]{1,10}(?:ns|us|ms|s|m|h|d|w))*$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/HumantimeDuration" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SourceConfig/oneOf/1/properties/table", + "key_path": "datasets[].tables[].source.table", + "path_kind": "property" + }, + "purpose": "Structured database table reference. Keeping schema/name separate\navoids parsing dotted identifiers and leaves quoting to connectors.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "schema", + "name" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_x", + "key_path": "datasets[].aggregates[].spatial.bbox_fields.max_x", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_x", + "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields.max_x", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_x", + "key_path": "datasets[].entities[].spatial.bbox_fields.max_x", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_x", + "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields.max_x", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_y", + "key_path": "datasets[].aggregates[].spatial.bbox_fields.max_y", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_y", + "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields.max_y", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_y", + "key_path": "datasets[].entities[].spatial.bbox_fields.max_y", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpatialBboxFieldsConfig/properties/max_y", + "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields.max_y", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_x", + "key_path": "datasets[].aggregates[].spatial.bbox_fields.min_x", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_x", + "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields.min_x", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_x", + "key_path": "datasets[].entities[].spatial.bbox_fields.min_x", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_x", + "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields.min_x", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_y", + "key_path": "datasets[].aggregates[].spatial.bbox_fields.min_y", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_y", + "key_path": "datasets[].entities[].aggregates[].spatial.bbox_fields.min_y", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_y", + "key_path": "datasets[].entities[].spatial.bbox_fields.min_y", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpatialBboxFieldsConfig/properties/min_y", + "key_path": "datasets[].tables[].aggregates[].spatial.bbox_fields.min_y", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpatialGeometryConfig/oneOf/0/properties/crs", + "key_path": "datasets[].entities[].spatial.geometry.crs", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpatialGeometryConfig/oneOf/0/properties/kind", + "key_path": "datasets[].entities[].spatial.geometry.kind", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "const", + "value": [ + "geojson", + "point", + "wkb", + "wkt" + ] + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpatialGeometryConfig/oneOf/0/properties/latitude_field", + "key_path": "datasets[].entities[].spatial.geometry.latitude_field", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpatialGeometryConfig/oneOf/0/properties/longitude_field", + "key_path": "datasets[].entities[].spatial.geometry.longitude_field", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpatialGeometryConfig/oneOf/1/properties/field", + "key_path": "datasets[].entities[].spatial.geometry.field", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/dataset", + "key_path": "standards.spdci.disability_registry.dataset", + "path_kind": "property" + }, + "purpose": "Dataset identifier. Lower-snake, starts with a letter.", + "purpose_source": "schema_description", + "intent_profile": "relay_standards_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/DatasetId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9_]*$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/DatasetId" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/disabled_positive_values", + "key_path": "standards.spdci.disability_registry.disabled_positive_values", + "path_kind": "property" + }, + "purpose": "Case-insensitive values interpreted as disabled.", + "purpose_source": "schema_description", + "intent_profile": "relay_standards_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/disabled_positive_values/items", + "key_path": "standards.spdci.disability_registry.disabled_positive_values[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_standards_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/disabled_status_field", + "key_path": "standards.spdci.disability_registry.disabled_status_field", + "path_kind": "property" + }, + "purpose": "Entity field whose value determines the SP DCI disabled response.", + "purpose_source": "schema_description", + "intent_profile": "relay_standards_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/entity", + "key_path": "standards.spdci.disability_registry.entity", + "path_kind": "property" + }, + "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_standards_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/query_field", + "key_path": "standards.spdci.disability_registry.query_field", + "path_kind": "property" + }, + "purpose": "Entity field filtered when the SP DCI query key is present.", + "purpose_source": "schema_description", + "intent_profile": "relay_standards_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpdciDisabilityRegistryConfig/properties/query_key", + "key_path": "standards.spdci.disability_registry.query_key", + "path_kind": "property" + }, + "purpose": "Query key accepted from SP DCI `disabled_criteria.query`.", + "purpose_source": "schema_description", + "intent_profile": "relay_standards_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpdciRegistryConfig/properties/dataset", + "key_path": "standards.spdci.registries.*.dataset", + "path_kind": "property" + }, + "purpose": "Dataset identifier. Lower-snake, starts with a letter.", + "purpose_source": "schema_description", + "intent_profile": "relay_standards_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/DatasetId", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "pattern", + "value": "^[a-z][a-z0-9_]*$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/DatasetId" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpdciRegistryConfig/properties/default_limit", + "key_path": "standards.spdci.registries.*.default_limit", + "path_kind": "property" + }, + "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_standards_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpdciRegistryConfig/properties/entity", + "key_path": "standards.spdci.registries.*.entity", + "path_kind": "property" + }, + "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_standards_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpdciRegistryConfig/properties/expression_fields", + "key_path": "standards.spdci.registries.*.expression_fields", + "path_kind": "property" + }, + "purpose": "DCI expression or predicate attribute to entity field mappings.", + "purpose_source": "schema_description", + "intent_profile": "relay_standards_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpdciRegistryConfig/properties/expression_fields/additionalProperties", + "key_path": "standards.spdci.registries.*.expression_fields.*", + "path_kind": "map_value" + }, + "purpose": "Each reviewed key names an expression-visible field and each value defines the bounded source expression exposed under that name.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_standards_spdci_registries_expression_fields_open_map", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "structural", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpdciRegistryConfig/properties/identifiers", + "key_path": "standards.spdci.registries.*.identifiers", + "path_kind": "property" + }, + "purpose": "DCI identifier type to entity field mappings for `idtype-value`.", + "purpose_source": "schema_description", + "intent_profile": "relay_standards_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpdciRegistryConfig/properties/identifiers/additionalProperties", + "key_path": "standards.spdci.registries.*.identifiers.*", + "path_kind": "map_value" + }, + "purpose": "Each reviewed key names an identifier role and each value defines the exact request identifier binding for that role.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_standards_spdci_registries_identifiers_open_map", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "structural", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpdciRegistryConfig/properties/record_type", + "key_path": "standards.spdci.registries.*.record_type", + "path_kind": "property" + }, + "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_standards_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpdciRegistryConfig/properties/registry_type", + "key_path": "standards.spdci.registries.*.registry_type", + "path_kind": "property" + }, + "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_standards_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpdciRegistryConfig/properties/response_fields", + "key_path": "standards.spdci.registries.*.response_fields", + "path_kind": "property" + }, + "purpose": "SP DCI output path to entity field mappings for direct response\nprojection. A CEL mapping takes precedence when both are set.", + "purpose_source": "schema_description", + "intent_profile": "relay_standards_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpdciRegistryConfig/properties/response_fields/additionalProperties", + "key_path": "standards.spdci.registries.*.response_fields.*", + "path_kind": "map_value" + }, + "purpose": "Each reviewed key names a response field and each value defines the exact bounded response projection for that field.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_standards_spdci_registries_response_fields_open_map", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "structural", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpdciRegistryConfig/properties/response_mapping_path", + "key_path": "standards.spdci.registries.*.response_mapping_path", + "path_kind": "property" + }, + "purpose": "Optional local CEL mapping document used to shape response records.", + "purpose_source": "schema_description", + "intent_profile": "relay_standards_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpdciRegistryConfig/properties/response_schema_path", + "key_path": "standards.spdci.registries.*.response_schema_path", + "path_kind": "property" + }, + "purpose": "Optional local JSON Schema used to validate shaped response records.", + "purpose_source": "schema_description", + "intent_profile": "relay_standards_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpdciStandardsConfig/properties/disability_registry", + "key_path": "standards.spdci.disability_registry", + "path_kind": "property" + }, + "purpose": "Runtime binding from SP DCI Disability Registry sync APIs to one\nconfigured Registry Relay entity.", + "purpose_source": "schema_description", + "intent_profile": "relay_standards_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "dataset", + "entity" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpdciStandardsConfig/properties/registries", + "key_path": "standards.spdci.registries", + "path_kind": "property" + }, + "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_standards_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/SpdciStandardsConfig/properties/registries/additionalProperties", + "key_path": "standards.spdci.registries.*", + "path_kind": "map_value" + }, + "purpose": "Runtime binding from a DCI registry sync search API to one configured\nRegistry Relay entity.", + "purpose_source": "schema_description", + "intent_profile": "relay_standards_spdci_registries_open_map", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/SpdciRegistryConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "structural", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "dataset", + "entity" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/SpdciRegistryConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/StandardsConfig/properties/spdci", + "key_path": "standards.spdci", + "path_kind": "property" + }, + "purpose": "Social Protection Digital Convergence Initiative (SP DCI) adapter\nconfiguration.", + "purpose_source": "schema_description", + "intent_profile": "relay_standards_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/TrustProxyConfig/properties/enabled", + "key_path": "server.trust_proxy.enabled", + "path_kind": "property" + }, + "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_server_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/TrustProxyConfig/properties/trusted_proxies", + "key_path": "server.trust_proxy.trusted_proxies", + "path_kind": "property" + }, + "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_server_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/TrustProxyConfig/properties/trusted_proxies/items", + "key_path": "server.trust_proxy.trusted_proxies[]", + "path_kind": "array_item" + }, + "purpose": "Controls Relay listener, transport, timeout, request-limit, and administrative endpoint behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_server_sensitive", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/XlsxFormatConfig/properties/data_range", + "key_path": "datasets[].tables[].source.format.xlsx.data_range", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/XlsxFormatConfig/properties/header_row", + "key_path": "datasets[].tables[].source.format.xlsx.header_row", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer", + "null" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "maximum", + "value": 4294967295 + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": [ + "integer", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/$defs/XlsxFormatConfig/properties/sheet", + "key_path": "datasets[].tables[].source.format.xlsx.sheet", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/properties/audit", + "key_path": "audit", + "path_kind": "property" + }, + "purpose": "Audit configuration. Sink choice gates further fields via the\ntagged `AuditSinkConfig` enum. The enum is flattened onto the\ncontaining struct so that the YAML `sink:` key acts as the\ndiscriminator, matching the public example configuration.\n\n`deny_unknown_fields` is deliberately omitted here: `serde` does\nnot support combining it with `#[serde(flatten)]` on an internally\ntagged enum (unknown keys in `audit` are caught by the enum's own\n`deny_unknown_fields`).", + "purpose_source": "schema_description", + "intent_profile": "relay_audit_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AuditConfig", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + [ + "sink", + "path" + ], + [ + "sink" + ] + ] + }, + { + "keyword": "type", + "value": "object" + }, + { + "keyword": "unevaluatedProperties", + "value": false + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AuditConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/properties/auth", + "key_path": "auth", + "path_kind": "property" + }, + "purpose": "Authentication configuration. Exactly one of `api_keys` and `oidc`\nis consumed at startup, gated by `mode`; cross-field validation in\n[`validate`] enforces that only the active block is populated.", + "purpose_source": "schema_description", + "intent_profile": "relay_auth_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AuthConfig", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "mode" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/AuthConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/properties/catalog", + "key_path": "catalog", + "path_kind": "property" + }, + "purpose": "Catalog-level metadata surfaced by `/metadata/*` and DCAT outputs.", + "purpose_source": "schema_description", + "intent_profile": "relay_catalog_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/CatalogConfig", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "title", + "base_url", + "publisher" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/CatalogConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/properties/config_trust", + "key_path": "config_trust", + "path_kind": "property" + }, + "purpose": "Optional signed configuration bundle trust state.\n\nSimple local deployments omit this block. Bundle-aware deployments pin the\nlocal trust anchor, bundle, and anti-rollback state paths explicitly.", + "purpose_source": "schema_description", + "intent_profile": "relay_config_trust_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "trust_anchor_path", + "bundle_path", + "antirollback_state_path" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/properties/consultation", + "key_path": "consultation", + "path_kind": "property" + }, + "purpose": "Controls governed consultation execution, reviewed artifacts, credentials, and result handling.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_consultation_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "authorized_workload", + "state_plane", + "audit_pseudonym_materials" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/properties/datasets", + "key_path": "datasets", + "path_kind": "property" + }, + "purpose": "Controls Relay dataset, entity, aggregate, source, refresh, disclosure, and access contracts.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/properties/datasets/items", + "key_path": "datasets[]", + "path_kind": "array_item" + }, + "purpose": "A single dataset declaration.", + "purpose_source": "schema_description", + "intent_profile": "relay_datasets_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/DatasetConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id", + "title", + "description", + "owner", + "sensitivity", + "access_rights", + "update_frequency" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/DatasetConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/properties/deployment", + "key_path": "deployment", + "path_kind": "property" + }, + "purpose": "Declares Relay deployment posture and reviewed waiver metadata used by operator checks.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_deployment_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/DeploymentConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/DeploymentConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/properties/instance", + "key_path": "instance", + "path_kind": "property" + }, + "purpose": "Stable deployment identity surfaced in redacted operations posture.", + "purpose_source": "schema_description", + "intent_profile": "relay_instance_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/InstanceConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/InstanceConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/properties/metadata", + "key_path": "metadata", + "path_kind": "property" + }, + "purpose": "Optional split metadata manifest loaded alongside the runtime config.", + "purpose_source": "schema_description", + "intent_profile": "relay_metadata_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "source" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/properties/server", + "key_path": "server", + "path_kind": "property" + }, + "purpose": "HTTP listener and adjacent server-wide knobs.", + "purpose_source": "schema_description", + "intent_profile": "relay_server_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/ServerConfig", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "bind" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/ServerConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/properties/standards", + "key_path": "standards", + "path_kind": "property" + }, + "purpose": "Controls Relay standards-specific APIs, protocol mappings, and bounded interoperability behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_standards_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/StandardsConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "relay", + "pointer": "/$defs/StandardsConfig" + } + }, + { + "address": { + "schema": "relay", + "pointer": "/properties/vocabularies", + "key_path": "vocabularies", + "path_kind": "property" + }, + "purpose": "Controls the reviewed vocabulary bindings Relay uses to interpret namespaced terms.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_vocabularies_internal", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "relay", + "pointer": "/properties/vocabularies/additionalProperties", + "key_path": "vocabularies.*", + "path_kind": "map_value" + }, + "purpose": "Each reviewed key is a vocabulary prefix and each value binds that prefix to its operator-approved vocabulary identifier.", + "purpose_source": "reviewed_profile", + "intent_profile": "relay_vocabularies_open_map", + "semantic_owner": "relay_runtime", + "human_owner": "relay_maintainers", + "scope": "The complete product-owned Relay runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "structural", + "state": "runtime", + "products": [ + "relay", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "config.validation_error", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Relay deployment and rollback review before activating changes to runtime bindings, trust, access, or data-serving behavior.", + "consumers": [ + "registry_relay", + "docs_generator" + ], + "generated_artifacts": [ + "relay_config", + "field_reference" + ], + "review_classes": [ + "contract", + "relay", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "", + "key_path": "", + "path_kind": "root" + }, + "purpose": "Defines the complete Notary runtime configuration boundary consumed when a Notary instance starts.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_root_structural", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "not_applicable", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "structural", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "evidence", + "auth" + ] + }, + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/AccessTokenSigningConfig/properties/access_token_ttl_seconds", + "key_path": "auth.access_token_signing.access_token_ttl_seconds", + "path_kind": "property" + }, + "purpose": "Access-token lifetime in seconds.", + "purpose_source": "schema_description", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/AccessTokenSigningConfig/properties/allowed_algorithms", + "key_path": "auth.access_token_signing.allowed_algorithms", + "path_kind": "property" + }, + "purpose": "Allowed signing algorithms. Only EdDSA is supported.", + "purpose_source": "schema_description", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/AccessTokenSigningConfig/properties/allowed_algorithms/items", + "key_path": "auth.access_token_signing.allowed_algorithms[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/AccessTokenSigningConfig/properties/audiences", + "key_path": "auth.access_token_signing.audiences", + "path_kind": "property" + }, + "purpose": "Audiences (`aud`) accepted for Notary-minted access tokens.", + "purpose_source": "schema_description", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/AccessTokenSigningConfig/properties/audiences/items", + "key_path": "auth.access_token_signing.audiences[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/AccessTokenSigningConfig/properties/enabled", + "key_path": "auth.access_token_signing.enabled", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/AccessTokenSigningConfig/properties/issuer", + "key_path": "auth.access_token_signing.issuer", + "path_kind": "property" + }, + "purpose": "Issuer (`iss`) the Notary stamps into its own access tokens.", + "purpose_source": "schema_description", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/AccessTokenSigningConfig/properties/signing_key_id", + "key_path": "auth.access_token_signing.signing_key_id", + "path_kind": "property" + }, + "purpose": "`evidence.signing_keys` entry used to sign access tokens. Must be a\ndedicated key, never a credential-signing key.", + "purpose_source": "schema_description", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/AccessTokenSigningConfig/properties/token_typ", + "key_path": "auth.access_token_signing.token_typ", + "path_kind": "property" + }, + "purpose": "Header `typ` stamped into Notary access tokens, distinct from the\ncredential `typ` so a token cannot be replayed as another class.", + "purpose_source": "schema_description", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/AccessTokenSigningConfig/properties/verification_key_ids", + "key_path": "auth.access_token_signing.verification_key_ids", + "path_kind": "property" + }, + "purpose": "Additional publish-only `evidence.signing_keys` entries accepted for\nverifying previously minted Notary access tokens and pre-authorized\ncodes during a governed key rotation.", + "purpose_source": "schema_description", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/AccessTokenSigningConfig/properties/verification_key_ids/items", + "key_path": "auth.access_token_signing.verification_key_ids[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/BatchOperationConfig/properties/enabled", + "key_path": "evidence.claims[].operations.batch_evaluate.enabled", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/BatchOperationConfig/properties/max_subjects", + "key_path": "evidence.claims[].operations.batch_evaluate.max_subjects", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint" + }, + { + "keyword": "maximum", + "value": 100 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/CccevConfig/properties/evidence_type", + "key_path": "evidence.claims[].cccev.evidence_type", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/CccevConfig/properties/evidence_type_iri", + "key_path": "evidence.claims[].cccev.evidence_type_iri", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/CccevConfig/properties/requirement_type", + "key_path": "evidence.claims[].cccev.requirement_type", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/CelBindingsConfig/properties/claims", + "key_path": "evidence.claims[].rule.bindings.claims", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/CelBindingsConfig/properties/claims/additionalProperties", + "key_path": "evidence.claims[].rule.bindings.claims.*", + "path_kind": "map_value" + }, + "purpose": "Each reviewed key names a CEL claim binding and each value selects the approved evidence claim exposed to that binding.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_claims_rule_bindings_claims_open_map", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/ClaimBindingConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "structural", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "claim" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/ClaimBindingConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/CelBindingsConfig/properties/vars", + "key_path": "evidence.claims[].rule.bindings.vars", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimBindingConfig/properties/binding_type", + "key_path": "evidence.claims[].rule.bindings.claims.*.binding_type", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimBindingConfig/properties/claim", + "key_path": "evidence.claims[].rule.bindings.claims.*.claim", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/cccev", + "key_path": "evidence.claims[].cccev", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/credential_profiles", + "key_path": "evidence.claims[].credential_profiles", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/credential_profiles/items", + "key_path": "evidence.claims[].credential_profiles[]", + "path_kind": "array_item" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/depends_on", + "key_path": "evidence.claims[].depends_on", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/depends_on/items", + "key_path": "evidence.claims[].depends_on[]", + "path_kind": "array_item" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/disclosure", + "key_path": "evidence.claims[].disclosure", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/DisclosureConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/DisclosureConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/evidence_mode", + "key_path": "evidence.claims[].evidence_mode", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/ClaimEvidenceMode", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + [ + "type", + "consultations" + ], + [ + "type" + ] + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/ClaimEvidenceMode" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/formats", + "key_path": "evidence.claims[].formats", + "path_kind": "property" + }, + "purpose": "Omitting this field keeps existing authored claims renderable using the\ncanonical claim-result representation. An explicitly empty list is\nrejected during configuration validation.", + "purpose_source": "schema_description", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/formats/items", + "key_path": "evidence.claims[].formats[]", + "path_kind": "array_item" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/id", + "key_path": "evidence.claims[].id", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/inputs", + "key_path": "evidence.claims[].inputs", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/inputs/items", + "key_path": "evidence.claims[].inputs[]", + "path_kind": "array_item" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/ClaimInputConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "name", + "type" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/ClaimInputConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/oots", + "key_path": "evidence.claims[].oots", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/operations", + "key_path": "evidence.claims[].operations", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/ClaimOperationsConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/ClaimOperationsConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/purpose", + "key_path": "evidence.claims[].purpose", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/required_scopes", + "key_path": "evidence.claims[].required_scopes", + "path_kind": "property" + }, + "purpose": "Caller scopes checked before any registry consultation is dispatched.", + "purpose_source": "schema_description", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/required_scopes/items", + "key_path": "evidence.claims[].required_scopes[]", + "path_kind": "array_item" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/rule", + "key_path": "evidence.claims[].rule", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/RuleConfig", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + [ + "type", + "consultation", + "output" + ], + [ + "type", + "consultation" + ], + [ + "type", + "expression" + ] + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/RuleConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/semantics", + "key_path": "evidence.claims[].semantics", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/subject_type", + "key_path": "evidence.claims[].subject_type", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/title", + "key_path": "evidence.claims[].title", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/value", + "key_path": "evidence.claims[].value", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/ClaimValueConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/ClaimValueConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition/properties/version", + "key_path": "evidence.claims[].version", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimInputConfig/properties/name", + "key_path": "evidence.claims[].inputs[].name", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimInputConfig/properties/type", + "key_path": "evidence.claims[].inputs[].type", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimOperationsConfig/properties/batch_evaluate", + "key_path": "evidence.claims[].operations.batch_evaluate", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/BatchOperationConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/BatchOperationConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimOperationsConfig/properties/evaluate", + "key_path": "evidence.claims[].operations.evaluate", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/OperationConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/OperationConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimRefObject/properties/id", + "key_path": "auth.api_keys[].authorization_details.claims[].id", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimRefObject/properties/id", + "key_path": "auth.bearer_tokens[].authorization_details.claims[].id", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimRefObject/properties/version", + "key_path": "auth.api_keys[].authorization_details.claims[].version", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimRefObject/properties/version", + "key_path": "auth.bearer_tokens[].authorization_details.claims[].version", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimSemanticConfig/properties/concept", + "key_path": "evidence.claims[].semantics.concept", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimSemanticConfig/properties/derived_from", + "key_path": "evidence.claims[].semantics.derived_from", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimSemanticConfig/properties/derived_from/items", + "key_path": "evidence.claims[].semantics.derived_from[]", + "path_kind": "array_item" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimSemanticConfig/properties/predicate", + "key_path": "evidence.claims[].semantics.predicate", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimSemanticConfig/properties/property", + "key_path": "evidence.claims[].semantics.property", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimSemanticConfig/properties/value_mapping", + "key_path": "evidence.claims[].semantics.value_mapping", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimSemanticConfig/properties/vocabulary", + "key_path": "evidence.claims[].semantics.vocabulary", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimValueConfig/properties/nullable", + "key_path": "evidence.claims[].value.nullable", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimValueConfig/properties/type", + "key_path": "evidence.claims[].value.type", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ClaimValueConfig/properties/unit", + "key_path": "evidence.claims[].value.unit", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ConcurrencyConfig/properties/subjects", + "key_path": "evidence.concurrency.subjects", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ConfigTrustConfig/properties/antirollback_state_path", + "key_path": "config_trust.antirollback_state_path", + "path_kind": "property" + }, + "purpose": "Controls Notary verification of signed configuration bundles, trust anchors, and rollback protection.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_config_trust_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ConfigTrustConfig/properties/break_glass_override_path", + "key_path": "config_trust.break_glass_override_path", + "path_kind": "property" + }, + "purpose": "Controls Notary verification of signed configuration bundles, trust anchors, and rollback protection.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_config_trust_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ConfigTrustConfig/properties/bundle_path", + "key_path": "config_trust.bundle_path", + "path_kind": "property" + }, + "purpose": "Controls Notary verification of signed configuration bundles, trust anchors, and rollback protection.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_config_trust_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/ConfigTrustConfig/properties/trust_anchor_path", + "key_path": "config_trust.trust_anchor_path", + "path_kind": "property" + }, + "purpose": "Controls Notary verification of signed configuration bundles, trust anchors, and rollback protection.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_config_trust_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/CredentialDisclosureConfig/properties/allowed", + "key_path": "evidence.credential_profiles.*.disclosure.allowed", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/CredentialDisclosureConfig/properties/allowed/items", + "key_path": "evidence.credential_profiles.*.disclosure.allowed[]", + "path_kind": "array_item" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/CredentialFingerprintRef/properties/name", + "key_path": "auth.api_keys[].fingerprint.name", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_secret_reference", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/CredentialFingerprintRef/properties/name", + "key_path": "auth.bearer_tokens[].fingerprint.name", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_secret_reference", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/CredentialFingerprintRef/properties/path", + "key_path": "auth.api_keys[].fingerprint.path", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_secret_reference", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/CredentialFingerprintRef/properties/path", + "key_path": "auth.bearer_tokens[].fingerprint.path", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_secret_reference", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/CredentialFingerprintRef/properties/provider", + "key_path": "auth.api_keys[].fingerprint.provider", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "env", + "file" + ] + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/CredentialFingerprintRef/properties/provider", + "key_path": "auth.bearer_tokens[].fingerprint.provider", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "env", + "file" + ] + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/CredentialProfileConfig/properties/allowed_claims", + "key_path": "evidence.credential_profiles.*.allowed_claims", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/CredentialProfileConfig/properties/allowed_claims/items", + "key_path": "evidence.credential_profiles.*.allowed_claims[]", + "path_kind": "array_item" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/CredentialProfileConfig/properties/disclosure", + "key_path": "evidence.credential_profiles.*.disclosure", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/CredentialDisclosureConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/CredentialDisclosureConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/CredentialProfileConfig/properties/format", + "key_path": "evidence.credential_profiles.*.format", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/CredentialProfileConfig/properties/holder_binding", + "key_path": "evidence.credential_profiles.*.holder_binding", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/HolderBindingConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/HolderBindingConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/CredentialProfileConfig/properties/issuer", + "key_path": "evidence.credential_profiles.*.issuer", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/CredentialProfileConfig/properties/signing_key", + "key_path": "evidence.credential_profiles.*.signing_key", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/CredentialProfileConfig/properties/validity_seconds", + "key_path": "evidence.credential_profiles.*.validity_seconds", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "int64" + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/CredentialProfileConfig/properties/vct", + "key_path": "evidence.credential_profiles.*.vct", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/CredentialStatusConfig/properties/base_url", + "key_path": "credential_status.base_url", + "path_kind": "property" + }, + "purpose": "Controls Notary credential-status publication and retention behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_credential_status_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/CredentialStatusConfig/properties/enabled", + "key_path": "credential_status.enabled", + "path_kind": "property" + }, + "purpose": "Controls Notary credential-status publication and retention behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_credential_status_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/CredentialStatusConfig/properties/retention_seconds", + "key_path": "credential_status.retention_seconds", + "path_kind": "property" + }, + "purpose": "Controls Notary credential-status publication and retention behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_credential_status_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/DeploymentConfig/properties/evidence", + "key_path": "deployment.evidence", + "path_kind": "property" + }, + "purpose": "Declares Notary deployment posture and reviewed waiver metadata used by operator checks.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_deployment_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/DeploymentEvidenceConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/DeploymentEvidenceConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/DeploymentConfig/properties/multi_instance", + "key_path": "deployment.multi_instance", + "path_kind": "property" + }, + "purpose": "Declares Notary deployment posture and reviewed waiver metadata used by operator checks.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_deployment_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/DeploymentConfig/properties/profile", + "key_path": "deployment.profile", + "path_kind": "property" + }, + "purpose": "The set of deployment profiles an operator can declare.\n\nFrozen at introduction; new profiles may be added but existing ones never\nchange meaning. Deserialization is strict: an unknown profile string fails,\nwhich surfaces as a startup error.", + "purpose_source": "schema_description", + "intent_profile": "notary_deployment_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "local", + "hosted_lab", + "production", + "evidence_grade" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "string" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/DeploymentConfig/properties/waivers", + "key_path": "deployment.waivers", + "path_kind": "property" + }, + "purpose": "Declares Notary deployment posture and reviewed waiver metadata used by operator checks.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_deployment_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/DeploymentConfig/properties/waivers/items", + "key_path": "deployment.waivers[]", + "path_kind": "array_item" + }, + "purpose": "One operator-configured waiver.\n\nA waiver names exactly one finding id, a required operator reference, an\noptional summary, and a mandatory expiry date (`YYYY-MM-DD`). The shared\noperations contract validates metadata before it can reach posture or logs.", + "purpose_source": "schema_description", + "intent_profile": "notary_deployment_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/DeploymentWaiverConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "finding", + "reference", + "expires" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/DeploymentWaiverConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_ack_cursor_path", + "key_path": "deployment.evidence.audit_ack_cursor_path", + "path_kind": "property" + }, + "purpose": "Optional path to a `registry.audit.ack_cursor.v1` file maintained by\nwhatever ships audit events off-host. Runtime health requires both a\nfresh timestamp and a watermark equal to the live keyed audit-chain tail.", + "purpose_source": "schema_description", + "intent_profile": "notary_deployment_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_ack_max_age_secs", + "key_path": "deployment.evidence.audit_ack_max_age_secs", + "path_kind": "property" + }, + "purpose": "Optional freshness window, in seconds, for the off-host ack cursor.\nUnset defaults to [`DEFAULT_AUDIT_ACK_MAX_AGE`] (900s). Meaningless\nwithout `audit_ack_cursor_path`; config load rejects that combination.\n\n[`DEFAULT_AUDIT_ACK_MAX_AGE`]: registry_platform_ops::DEFAULT_AUDIT_ACK_MAX_AGE", + "purpose_source": "schema_description", + "intent_profile": "notary_deployment_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer", + "null" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": [ + "integer", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/DeploymentEvidenceConfig/properties/audit_offhost_shipping", + "key_path": "deployment.evidence.audit_offhost_shipping", + "path_kind": "property" + }, + "purpose": "Operator asserts audit log events are shipped off-host (for example to\na log aggregator or SIEM) so a local file sink does not cap retention.", + "purpose_source": "schema_description", + "intent_profile": "notary_deployment_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/DeploymentEvidenceConfig/properties/signer_custody_approved", + "key_path": "deployment.evidence.signer_custody_approved", + "path_kind": "property" + }, + "purpose": "Operator asserts a production review has approved signer custody for\nthis deployment. Provider kind is not proof of custody: PKCS#11 modules\ncan be backed by either hardware or software tokens.", + "purpose_source": "schema_description", + "intent_profile": "notary_deployment_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/DeploymentWaiverConfig/properties/expires", + "key_path": "deployment.waivers[].expires", + "path_kind": "property" + }, + "purpose": "Declares Notary deployment posture and reviewed waiver metadata used by operator checks.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_deployment_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/DeploymentWaiverConfig/properties/finding", + "key_path": "deployment.waivers[].finding", + "path_kind": "property" + }, + "purpose": "Declares Notary deployment posture and reviewed waiver metadata used by operator checks.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_deployment_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/DeploymentWaiverConfig/properties/reference", + "key_path": "deployment.waivers[].reference", + "path_kind": "property" + }, + "purpose": "Declares Notary deployment posture and reviewed waiver metadata used by operator checks.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_deployment_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/DeploymentWaiverReference", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 128 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "pattern", + "value": "^(?!.*\\.\\.)[A-Za-z0-9._:-]+$" + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/DeploymentWaiverReference" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/DeploymentWaiverConfig/properties/summary", + "key_path": "deployment.waivers[].summary", + "path_kind": "property" + }, + "purpose": "Structurally valid deployment-waiver summary. Contextual authorization-value and private-key marker exclusions require semantic producer validation.", + "purpose_source": "schema_description", + "intent_profile": "notary_deployment_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/DeploymentWaiverSummary", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "maxLength", + "value": 256 + }, + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/DeploymentWaiverSummary" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/DisclosureConfig/properties/allowed", + "key_path": "evidence.claims[].disclosure.allowed", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/DisclosureConfig/properties/allowed/items", + "key_path": "evidence.claims[].disclosure.allowed[]", + "path_kind": "array_item" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/DisclosureConfig/properties/default", + "key_path": "evidence.claims[].disclosure.default", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/DisclosureConfig/properties/downgrade", + "key_path": "evidence.claims[].disclosure.downgrade", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAssistedAccessContext/properties/channel", + "key_path": "auth.api_keys[].authorization_details.assisted_access_context.channel", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAssistedAccessContext/properties/channel", + "key_path": "auth.bearer_tokens[].authorization_details.assisted_access_context.channel", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuditConfig/properties/hash_secret_env", + "key_path": "audit.hash_secret_env", + "path_kind": "property" + }, + "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_audit_secret_reference", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuditConfig/properties/max_files", + "key_path": "audit.max_files", + "path_kind": "property" + }, + "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_audit_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer", + "null" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": [ + "integer", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuditConfig/properties/max_size_mb", + "key_path": "audit.max_size_mb", + "path_kind": "property" + }, + "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_audit_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer", + "null" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": [ + "integer", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuditConfig/properties/path", + "key_path": "audit.path", + "path_kind": "property" + }, + "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_audit_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuditConfig/properties/sink", + "key_path": "audit.sink", + "path_kind": "property" + }, + "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_audit_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuditConfig/properties/syslog_socket_path", + "key_path": "audit.syslog_socket_path", + "path_kind": "property" + }, + "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_audit_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthConfig/properties/access_token_signing", + "key_path": "auth.access_token_signing", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/AccessTokenSigningConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/AccessTokenSigningConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthConfig/properties/api_keys", + "key_path": "auth.api_keys", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthConfig/properties/api_keys/items", + "key_path": "auth.api_keys[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/EvidenceCredentialConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id", + "fingerprint" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/EvidenceCredentialConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthConfig/properties/bearer_tokens", + "key_path": "auth.bearer_tokens", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthConfig/properties/bearer_tokens/items", + "key_path": "auth.bearer_tokens[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/EvidenceCredentialConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id", + "fingerprint" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/EvidenceCredentialConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthConfig/properties/oidc", + "key_path": "auth.oidc", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "issuer", + "jwks_url" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/access_mode", + "key_path": "auth.api_keys[].authorization_details.access_mode", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "unknown", + "machine_client", + "subject_bound", + "delegated_attestation" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "string" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/access_mode", + "key_path": "auth.bearer_tokens[].authorization_details.access_mode", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "unknown", + "machine_client", + "subject_bound", + "delegated_attestation" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "string" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/actions", + "key_path": "auth.api_keys[].authorization_details.actions", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/actions", + "key_path": "auth.bearer_tokens[].authorization_details.actions", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/actions/items", + "key_path": "auth.api_keys[].authorization_details.actions[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/actions/items", + "key_path": "auth.bearer_tokens[].authorization_details.actions[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/assisted_access_context", + "key_path": "auth.api_keys[].authorization_details.assisted_access_context", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "channel" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/assisted_access_context", + "key_path": "auth.bearer_tokens[].authorization_details.assisted_access_context", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "channel" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/assurance_level", + "key_path": "auth.api_keys[].authorization_details.assurance_level", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/assurance_level", + "key_path": "auth.bearer_tokens[].authorization_details.assurance_level", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/claims", + "key_path": "auth.api_keys[].authorization_details.claims", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/claims", + "key_path": "auth.bearer_tokens[].authorization_details.claims", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/claims/items", + "key_path": "auth.api_keys[].authorization_details.claims[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object", + "string" + ], + "local_reference": "#/$defs/ClaimRef", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id" + ] + }, + { + "keyword": "type", + "value": [ + "object", + "string" + ] + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/ClaimRef" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/claims/items", + "key_path": "auth.bearer_tokens[].authorization_details.claims[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object", + "string" + ], + "local_reference": "#/$defs/ClaimRef", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id" + ] + }, + { + "keyword": "type", + "value": [ + "object", + "string" + ] + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/ClaimRef" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/consent_ref", + "key_path": "auth.api_keys[].authorization_details.consent_ref", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/consent_ref", + "key_path": "auth.bearer_tokens[].authorization_details.consent_ref", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/disclosure", + "key_path": "auth.api_keys[].authorization_details.disclosure", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/disclosure", + "key_path": "auth.bearer_tokens[].authorization_details.disclosure", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/format", + "key_path": "auth.api_keys[].authorization_details.format", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/format", + "key_path": "auth.bearer_tokens[].authorization_details.format", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/jurisdiction", + "key_path": "auth.api_keys[].authorization_details.jurisdiction", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/jurisdiction", + "key_path": "auth.bearer_tokens[].authorization_details.jurisdiction", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/legal_basis_ref", + "key_path": "auth.api_keys[].authorization_details.legal_basis_ref", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/legal_basis_ref", + "key_path": "auth.bearer_tokens[].authorization_details.legal_basis_ref", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/locations", + "key_path": "auth.api_keys[].authorization_details.locations", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/locations", + "key_path": "auth.bearer_tokens[].authorization_details.locations", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/locations/items", + "key_path": "auth.api_keys[].authorization_details.locations[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/locations/items", + "key_path": "auth.bearer_tokens[].authorization_details.locations[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/purpose", + "key_path": "auth.api_keys[].authorization_details.purpose", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/purpose", + "key_path": "auth.bearer_tokens[].authorization_details.purpose", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/relationship", + "key_path": "auth.api_keys[].authorization_details.relationship", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "relationship_type", + "proof_claim" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/relationship", + "key_path": "auth.bearer_tokens[].authorization_details.relationship", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "relationship_type", + "proof_claim" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/schema_version", + "key_path": "auth.api_keys[].authorization_details.schema_version", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/schema_version", + "key_path": "auth.bearer_tokens[].authorization_details.schema_version", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/subject", + "key_path": "auth.api_keys[].authorization_details.subject", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "binding_claim", + "id_type" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/subject", + "key_path": "auth.bearer_tokens[].authorization_details.subject", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "binding_claim", + "id_type" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/target", + "key_path": "auth.api_keys[].authorization_details.target", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id_type", + "id" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/target", + "key_path": "auth.bearer_tokens[].authorization_details.target", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id_type", + "id" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/type", + "key_path": "auth.api_keys[].authorization_details.type", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationDetails/properties/type", + "key_path": "auth.bearer_tokens[].authorization_details.type", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationRelationship/properties/proof_claim", + "key_path": "auth.api_keys[].authorization_details.relationship.proof_claim", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationRelationship/properties/proof_claim", + "key_path": "auth.bearer_tokens[].authorization_details.relationship.proof_claim", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationRelationship/properties/relationship_type", + "key_path": "auth.api_keys[].authorization_details.relationship.relationship_type", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationRelationship/properties/relationship_type", + "key_path": "auth.bearer_tokens[].authorization_details.relationship.relationship_type", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationSubject/properties/binding_claim", + "key_path": "auth.api_keys[].authorization_details.subject.binding_claim", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationSubject/properties/binding_claim", + "key_path": "auth.bearer_tokens[].authorization_details.subject.binding_claim", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationSubject/properties/id_type", + "key_path": "auth.api_keys[].authorization_details.subject.id_type", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationSubject/properties/id_type", + "key_path": "auth.bearer_tokens[].authorization_details.subject.id_type", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationTarget/properties/id", + "key_path": "auth.api_keys[].authorization_details.target.id", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationTarget/properties/id", + "key_path": "auth.bearer_tokens[].authorization_details.target.id", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationTarget/properties/id_type", + "key_path": "auth.api_keys[].authorization_details.target.id_type", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthorizationTarget/properties/id_type", + "key_path": "auth.bearer_tokens[].authorization_details.target.id_type", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/allowed_purposes", + "key_path": "evidence.allowed_purposes", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/allowed_purposes/items", + "key_path": "evidence.allowed_purposes[]", + "path_kind": "array_item" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/api_base_url", + "key_path": "evidence.api_base_url", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/api_version", + "key_path": "evidence.api_version", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/claims", + "key_path": "evidence.claims", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/claims/items", + "key_path": "evidence.claims[]", + "path_kind": "array_item" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/ClaimDefinition", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id", + "title", + "version", + "subject_type", + "evidence_mode", + "rule" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/ClaimDefinition" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/claims_url", + "key_path": "evidence.claims_url", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/concurrency", + "key_path": "evidence.concurrency", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/ConcurrencyConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/ConcurrencyConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/credential_profiles", + "key_path": "evidence.credential_profiles", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/credential_profiles/additionalProperties", + "key_path": "evidence.credential_profiles.*", + "path_kind": "map_value" + }, + "purpose": "Each reviewed key names a credential profile and each value defines its exact claims, format, and issuance contract.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_credential_profiles_open_map", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/CredentialProfileConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "format", + "issuer", + "signing_key", + "vct" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/CredentialProfileConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/enabled", + "key_path": "evidence.enabled", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/formats_url", + "key_path": "evidence.formats_url", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/inline_batch_limit", + "key_path": "evidence.inline_batch_limit", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint" + }, + { + "keyword": "maximum", + "value": 100 + }, + { + "keyword": "minimum", + "value": 1 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/machine_quota", + "key_path": "evidence.machine_quota", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/MachineQuotaConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/MachineQuotaConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/max_credential_validity_seconds", + "key_path": "evidence.max_credential_validity_seconds", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/relay", + "key_path": "evidence.relay", + "path_kind": "property" + }, + "purpose": "The one Registry Relay connection available to registry-backed claims.\nAuthentication remains a reloadable local file reference; core never\nloads the bearer token value.", + "purpose_source": "schema_description", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "base_url", + "workload_client_id", + "token_file" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/service_id", + "key_path": "evidence.service_id", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/signing_keys", + "key_path": "evidence.signing_keys", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/signing_keys/additionalProperties", + "key_path": "evidence.signing_keys.*", + "path_kind": "map_value" + }, + "purpose": "Each reviewed key names a signing-key binding and each value references the operator-managed signing material and lifecycle metadata.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_signing_keys_open_map", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/SigningKeyConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "provider", + "alg", + "kid", + "status" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/SigningKeyConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/variables", + "key_path": "evidence.variables", + "path_kind": "property" + }, + "purpose": "Closed union of request variables declared by authored services.", + "purpose_source": "schema_description", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig/properties/variables/additionalProperties", + "key_path": "evidence.variables.*", + "path_kind": "map_value" + }, + "purpose": "Each reviewed key names a Notary evidence variable and each value defines its bounded source and evaluation contract.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_variables_open_map", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/RequestVariableConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "structural", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "from", + "type" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/RequestVariableConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceCredentialConfig/properties/authorization_details", + "key_path": "auth.api_keys[].authorization_details", + "path_kind": "property" + }, + "purpose": "Versioned authorization fields shared by static configuration and token/OIDC JSON.\n\nUnknown metadata is intentionally ignored for forward-compatible interoperability.\nAuthorization decisions consume only the modeled fields and must never infer authority\nfrom an unrecognized extension.", + "purpose_source": "schema_description", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "type", + "schema_version" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceCredentialConfig/properties/authorization_details", + "key_path": "auth.bearer_tokens[].authorization_details", + "path_kind": "property" + }, + "purpose": "Versioned authorization fields shared by static configuration and token/OIDC JSON.\n\nUnknown metadata is intentionally ignored for forward-compatible interoperability.\nAuthorization decisions consume only the modeled fields and must never infer authority\nfrom an unrecognized extension.", + "purpose_source": "schema_description", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "type", + "schema_version" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceCredentialConfig/properties/fingerprint", + "key_path": "auth.api_keys[].fingerprint", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/CredentialFingerprintRef", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "provider" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/CredentialFingerprintRef" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceCredentialConfig/properties/fingerprint", + "key_path": "auth.bearer_tokens[].fingerprint", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/CredentialFingerprintRef", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "provider" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/CredentialFingerprintRef" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceCredentialConfig/properties/id", + "key_path": "auth.api_keys[].id", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceCredentialConfig/properties/id", + "key_path": "auth.bearer_tokens[].id", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceCredentialConfig/properties/scopes", + "key_path": "auth.api_keys[].scopes", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceCredentialConfig/properties/scopes", + "key_path": "auth.bearer_tokens[].scopes", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceCredentialConfig/properties/scopes/items", + "key_path": "auth.api_keys[].scopes[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceCredentialConfig/properties/scopes/items", + "key_path": "auth.bearer_tokens[].scopes[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allow_insecure_localhost", + "key_path": "auth.oidc.allow_insecure_localhost", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_algorithms", + "key_path": "auth.oidc.allowed_algorithms", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_algorithms/items", + "key_path": "auth.oidc.allowed_algorithms[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_clients", + "key_path": "auth.oidc.allowed_clients", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_clients/items", + "key_path": "auth.oidc.allowed_clients[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_token_types", + "key_path": "auth.oidc.allowed_token_types", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/allowed_token_types/items", + "key_path": "auth.oidc.allowed_token_types[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/audiences", + "key_path": "auth.oidc.audiences", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/audiences/items", + "key_path": "auth.oidc.audiences[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/issuer", + "key_path": "auth.oidc.issuer", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/jwks_url", + "key_path": "auth.oidc.jwks_url", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/leeway", + "key_path": "auth.oidc.leeway", + "path_kind": "property" + }, + "purpose": "A humantime duration string. The runtime parser remains authoritative for its complete grammar.", + "purpose_source": "schema_description", + "intent_profile": "notary_auth_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/HumantimeDuration", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/HumantimeDuration" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/principal_claim", + "key_path": "auth.oidc.principal_claim", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/scope_claim", + "key_path": "auth.oidc.scope_claim", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/scope_map", + "key_path": "auth.oidc.scope_map", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/scope_map/additionalProperties", + "key_path": "auth.oidc.scope_map.*", + "path_kind": "map_value" + }, + "purpose": "Each reviewed key is an external token scope and each value is the bounded Notary scope mapping granted for that exact token scope.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_oidc_scope_map_open_map", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "structural", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/scope_map/additionalProperties/items", + "key_path": "auth.oidc.scope_map.*[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/scope_separator", + "key_path": "auth.oidc.scope_separator", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/userinfo_endpoint", + "key_path": "auth.oidc.userinfo_endpoint", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/userinfo_issuers", + "key_path": "auth.oidc.userinfo_issuers", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/EvidenceOidcAuthConfig/properties/userinfo_issuers/items", + "key_path": "auth.oidc.userinfo_issuers[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/clock_leeway_seconds", + "key_path": "federation.clock_leeway_seconds", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/emergency_denylist", + "key_path": "federation.emergency_denylist", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/FederationEmergencyDenylistConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/FederationEmergencyDenylistConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/enabled", + "key_path": "federation.enabled", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/evaluation_profiles", + "key_path": "federation.evaluation_profiles", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/evaluation_profiles/items", + "key_path": "federation.evaluation_profiles[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/FederationEvaluationProfileConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id", + "ruleset", + "claim_id", + "subject_id_type" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/FederationEvaluationProfileConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/federation_api", + "key_path": "federation.federation_api", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/inbound_body_limit_bytes", + "key_path": "federation.inbound_body_limit_bytes", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/issuer", + "key_path": "federation.issuer", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/jwks_uri", + "key_path": "federation.jwks_uri", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/max_request_lifetime_seconds", + "key_path": "federation.max_request_lifetime_seconds", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/node_id", + "key_path": "federation.node_id", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/pairwise_subject_hash", + "key_path": "federation.pairwise_subject_hash", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/FederationPairwiseSubjectHashConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/FederationPairwiseSubjectHashConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/peers", + "key_path": "federation.peers", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/peers/items", + "key_path": "federation.peers[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/FederationPeerConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "node_id", + "issuer", + "jwks_uri" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/FederationPeerConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/response_shaping", + "key_path": "federation.response_shaping", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/FederationResponseShapingConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/FederationResponseShapingConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/signing", + "key_path": "federation.signing", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/FederationSigningConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "signing_key" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/FederationSigningConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/supported_protocol_versions", + "key_path": "federation.supported_protocol_versions", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationConfig/properties/supported_protocol_versions/items", + "key_path": "federation.supported_protocol_versions[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationEmergencyDenylistConfig/properties/kids", + "key_path": "federation.emergency_denylist.kids", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationEmergencyDenylistConfig/properties/kids/items", + "key_path": "federation.emergency_denylist.kids[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationEmergencyDenylistConfig/properties/node_ids", + "key_path": "federation.emergency_denylist.node_ids", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationEmergencyDenylistConfig/properties/node_ids/items", + "key_path": "federation.emergency_denylist.node_ids[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationEvaluationProfileConfig/properties/assurance_level", + "key_path": "federation.evaluation_profiles[].assurance_level", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationEvaluationProfileConfig/properties/claim_id", + "key_path": "federation.evaluation_profiles[].claim_id", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationEvaluationProfileConfig/properties/consent_ref", + "key_path": "federation.evaluation_profiles[].consent_ref", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationEvaluationProfileConfig/properties/disclosure", + "key_path": "federation.evaluation_profiles[].disclosure", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationEvaluationProfileConfig/properties/id", + "key_path": "federation.evaluation_profiles[].id", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationEvaluationProfileConfig/properties/jurisdiction", + "key_path": "federation.evaluation_profiles[].jurisdiction", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationEvaluationProfileConfig/properties/legal_basis_ref", + "key_path": "federation.evaluation_profiles[].legal_basis_ref", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationEvaluationProfileConfig/properties/max_claim_result_age_seconds", + "key_path": "federation.evaluation_profiles[].max_claim_result_age_seconds", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer", + "null" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": [ + "integer", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationEvaluationProfileConfig/properties/ruleset", + "key_path": "federation.evaluation_profiles[].ruleset", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationEvaluationProfileConfig/properties/subject_id_type", + "key_path": "federation.evaluation_profiles[].subject_id_type", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationPairwiseSubjectHashConfig/properties/secret_env", + "key_path": "federation.pairwise_subject_hash.secret_env", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_secret_reference", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationPeerConfig/properties/allow_insecure_localhost", + "key_path": "federation.peers[].allow_insecure_localhost", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationPeerConfig/properties/allow_insecure_private_network", + "key_path": "federation.peers[].allow_insecure_private_network", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationPeerConfig/properties/allowed_profiles", + "key_path": "federation.peers[].allowed_profiles", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationPeerConfig/properties/allowed_profiles/items", + "key_path": "federation.peers[].allowed_profiles[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationPeerConfig/properties/allowed_protocol_versions", + "key_path": "federation.peers[].allowed_protocol_versions", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationPeerConfig/properties/allowed_protocol_versions/items", + "key_path": "federation.peers[].allowed_protocol_versions[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationPeerConfig/properties/allowed_purposes", + "key_path": "federation.peers[].allowed_purposes", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationPeerConfig/properties/allowed_purposes/items", + "key_path": "federation.peers[].allowed_purposes[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationPeerConfig/properties/evaluation_scopes", + "key_path": "federation.peers[].evaluation_scopes", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationPeerConfig/properties/evaluation_scopes/items", + "key_path": "federation.peers[].evaluation_scopes[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationPeerConfig/properties/issuer", + "key_path": "federation.peers[].issuer", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationPeerConfig/properties/jwks_uri", + "key_path": "federation.peers[].jwks_uri", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationPeerConfig/properties/node_id", + "key_path": "federation.peers[].node_id", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationResponseShapingConfig/properties/minimum_denial_latency_ms", + "key_path": "federation.response_shaping.minimum_denial_latency_ms", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/FederationSigningConfig/properties/signing_key", + "key_path": "federation.signing.signing_key", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/HolderBindingConfig/properties/allowed_did_methods", + "key_path": "evidence.credential_profiles.*.holder_binding.allowed_did_methods", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/HolderBindingConfig/properties/allowed_did_methods/items", + "key_path": "evidence.credential_profiles.*.holder_binding.allowed_did_methods[]", + "path_kind": "array_item" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/HolderBindingConfig/properties/mode", + "key_path": "evidence.credential_profiles.*.holder_binding.mode", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/HolderBindingConfig/properties/proof_of_possession", + "key_path": "evidence.credential_profiles.*.holder_binding.proof_of_possession", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/MachineQuotaConfig/properties/enabled", + "key_path": "evidence.machine_quota.enabled", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/MachineQuotaConfig/properties/subjects_per_minute", + "key_path": "evidence.machine_quota.subjects_per_minute", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/NotaryInstanceConfig/properties/environment", + "key_path": "instance.environment", + "path_kind": "property" + }, + "purpose": "Identifies the Notary instance and its deployment environment for operational correlation.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_instance_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/NotaryInstanceConfig/properties/id", + "key_path": "instance.id", + "path_kind": "property" + }, + "purpose": "Identifies the Notary instance and its deployment environment for operational correlation.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_instance_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/NotaryInstanceConfig/properties/jurisdiction", + "key_path": "instance.jurisdiction", + "path_kind": "property" + }, + "purpose": "Identifies the Notary instance and its deployment environment for operational correlation.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_instance_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/NotaryInstanceConfig/properties/owner", + "key_path": "instance.owner", + "path_kind": "property" + }, + "purpose": "Identifies the Notary instance and its deployment environment for operational correlation.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_instance_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/NotaryInstanceConfig/properties/public_base_url", + "key_path": "instance.public_base_url", + "path_kind": "property" + }, + "purpose": "Identifies the Notary instance and its deployment environment for operational correlation.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_instance_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciAuthorizationConfig/properties/require_pkce_method", + "key_path": "oid4vci.authorization.require_pkce_method", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig/properties/accepted_token_audiences", + "key_path": "oid4vci.accepted_token_audiences", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig/properties/accepted_token_audiences/items", + "key_path": "oid4vci.accepted_token_audiences[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig/properties/authorization", + "key_path": "oid4vci.authorization", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/Oid4vciAuthorizationConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/Oid4vciAuthorizationConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig/properties/authorization_servers", + "key_path": "oid4vci.authorization_servers", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig/properties/authorization_servers/items", + "key_path": "oid4vci.authorization_servers[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig/properties/credential_configurations", + "key_path": "oid4vci.credential_configurations", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig/properties/credential_configurations/additionalProperties", + "key_path": "oid4vci.credential_configurations.*", + "path_kind": "map_value" + }, + "purpose": "Each reviewed key names an OpenID4VCI credential configuration and each value defines the advertised and issued credential contract.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_credential_configurations_open_map", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/Oid4vciCredentialConfigurationConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "credential_profile", + "format", + "scope", + "vct", + "display_name" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialConfigurationConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig/properties/credential_endpoint", + "key_path": "oid4vci.credential_endpoint", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig/properties/credential_issuer", + "key_path": "oid4vci.credential_issuer", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig/properties/display", + "key_path": "oid4vci.display", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig/properties/display/items", + "key_path": "oid4vci.display[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/Oid4vciIssuerDisplayConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "name" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/Oid4vciIssuerDisplayConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig/properties/enabled", + "key_path": "oid4vci.enabled", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig/properties/nonce", + "key_path": "oid4vci.nonce", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/Oid4vciNonceConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/Oid4vciNonceConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig/properties/nonce_endpoint", + "key_path": "oid4vci.nonce_endpoint", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig/properties/offer_endpoint", + "key_path": "oid4vci.offer_endpoint", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig/properties/pre_authorized_code", + "key_path": "oid4vci.pre_authorized_code", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/Oid4vciPreAuthorizedCodeConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/Oid4vciPreAuthorizedCodeConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig/properties/proof", + "key_path": "oid4vci.proof", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/Oid4vciProofConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/Oid4vciProofConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialClaimConfig/properties/display_name", + "key_path": "oid4vci.credential_configurations.*.claims[].display_name", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialClaimConfig/properties/id", + "key_path": "oid4vci.credential_configurations.*.claims[].id", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialClaimConfig/properties/output_path", + "key_path": "oid4vci.credential_configurations.*.claims[].output_path", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialClaimConfig/properties/output_path/items", + "key_path": "oid4vci.credential_configurations.*.claims[].output_path[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialClaimConfig/properties/sd", + "key_path": "oid4vci.credential_configurations.*.claims[].sd", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/claim_id", + "key_path": "oid4vci.credential_configurations.*.claim_id", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/claims", + "key_path": "oid4vci.credential_configurations.*.claims", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/claims/items", + "key_path": "oid4vci.credential_configurations.*.claims[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/Oid4vciCredentialClaimConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id", + "output_path", + "display_name", + "sd" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialClaimConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/credential_profile", + "key_path": "oid4vci.credential_configurations.*.credential_profile", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/cryptographic_binding_methods_supported", + "key_path": "oid4vci.credential_configurations.*.cryptographic_binding_methods_supported", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/cryptographic_binding_methods_supported/items", + "key_path": "oid4vci.credential_configurations.*.cryptographic_binding_methods_supported[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/display", + "key_path": "oid4vci.credential_configurations.*.display", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/Oid4vciCredentialDisplayConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialDisplayConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/display_name", + "key_path": "oid4vci.credential_configurations.*.display_name", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/format", + "key_path": "oid4vci.credential_configurations.*.format", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/proof_signing_alg_values_supported", + "key_path": "oid4vci.credential_configurations.*.proof_signing_alg_values_supported", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/proof_signing_alg_values_supported/items", + "key_path": "oid4vci.credential_configurations.*.proof_signing_alg_values_supported[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/scope", + "key_path": "oid4vci.credential_configurations.*.scope", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialConfigurationConfig/properties/vct", + "key_path": "oid4vci.credential_configurations.*.vct", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/background_color", + "key_path": "oid4vci.credential_configurations.*.display.background_color", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/background_image", + "key_path": "oid4vci.credential_configurations.*.display.background_image", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/description", + "key_path": "oid4vci.credential_configurations.*.display.description", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/locale", + "key_path": "oid4vci.credential_configurations.*.display.locale", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/logo", + "key_path": "oid4vci.credential_configurations.*.display.logo", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/secondary_image", + "key_path": "oid4vci.credential_configurations.*.display.secondary_image", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciCredentialDisplayConfig/properties/text_color", + "key_path": "oid4vci.credential_configurations.*.display.text_color", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/alt_text", + "key_path": "oid4vci.credential_configurations.*.display.background_image.alt_text", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/alt_text", + "key_path": "oid4vci.credential_configurations.*.display.logo.alt_text", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/alt_text", + "key_path": "oid4vci.credential_configurations.*.display.secondary_image.alt_text", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/alt_text", + "key_path": "oid4vci.display[].logo.alt_text", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/uri", + "key_path": "oid4vci.credential_configurations.*.display.background_image.uri", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/uri", + "key_path": "oid4vci.credential_configurations.*.display.logo.uri", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/uri", + "key_path": "oid4vci.credential_configurations.*.display.secondary_image.uri", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/uri", + "key_path": "oid4vci.display[].logo.uri", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/url", + "key_path": "oid4vci.credential_configurations.*.display.background_image.url", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/url", + "key_path": "oid4vci.credential_configurations.*.display.logo.url", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/url", + "key_path": "oid4vci.credential_configurations.*.display.secondary_image.url", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciDisplayImageConfig/properties/url", + "key_path": "oid4vci.display[].logo.url", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/allow_insecure_localhost", + "key_path": "oid4vci.pre_authorized_code.esignet.allow_insecure_localhost", + "path_kind": "property" + }, + "purpose": "Allow `http` loopback URLs for the eSignet endpoints and JWKS transport.\nFor local development and tests only.", + "purpose_source": "schema_description", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/authorize_url", + "key_path": "oid4vci.pre_authorized_code.esignet.authorize_url", + "path_kind": "property" + }, + "purpose": "eSignet authorize endpoint.", + "purpose_source": "schema_description", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/client_id", + "key_path": "oid4vci.pre_authorized_code.esignet.client_id", + "path_kind": "property" + }, + "purpose": "Confidential client id the Notary presents to eSignet.", + "purpose_source": "schema_description", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/client_signing_key_id", + "key_path": "oid4vci.pre_authorized_code.esignet.client_signing_key_id", + "path_kind": "property" + }, + "purpose": "`evidence.signing_keys` entry used to sign the eSignet\n`private_key_jwt` client assertion.", + "purpose_source": "schema_description", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/issuer", + "key_path": "oid4vci.pre_authorized_code.esignet.issuer", + "path_kind": "property" + }, + "purpose": "eSignet OIDC issuer, pinned when validating the returned `id_token`.", + "purpose_source": "schema_description", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/jwks_uri", + "key_path": "oid4vci.pre_authorized_code.esignet.jwks_uri", + "path_kind": "property" + }, + "purpose": "eSignet JWKS URI, used to resolve the `id_token` signing key by `kid`.", + "purpose_source": "schema_description", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/login_state_ttl_seconds", + "key_path": "oid4vci.pre_authorized_code.esignet.login_state_ttl_seconds", + "path_kind": "property" + }, + "purpose": "Lifetime of the short-lived login state (PKCE verifier + nonce +\nselection) reserved between `offer/start` and `offer/callback`.", + "purpose_source": "schema_description", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/redirect_uri", + "key_path": "oid4vci.pre_authorized_code.esignet.redirect_uri", + "path_kind": "property" + }, + "purpose": "Notary callback the citizen browser is redirected back to.", + "purpose_source": "schema_description", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/scopes", + "key_path": "oid4vci.pre_authorized_code.esignet.scopes", + "path_kind": "property" + }, + "purpose": "OAuth scopes requested at eSignet.", + "purpose_source": "schema_description", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/scopes/items", + "key_path": "oid4vci.pre_authorized_code.esignet.scopes[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/token_url", + "key_path": "oid4vci.pre_authorized_code.esignet.token_url", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciEsignetRpConfig/properties/userinfo_url", + "key_path": "oid4vci.pre_authorized_code.esignet.userinfo_url", + "path_kind": "property" + }, + "purpose": "eSignet userinfo endpoint. Required when the subject-binding claim is\nsourced from userinfo rather than the `id_token`; the callback fetches\nthe userinfo JWS with the eSignet access token and reads the binding\nclaim from it.", + "purpose_source": "schema_description", + "intent_profile": "notary_oid4vci_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciIssuerDisplayConfig/properties/locale", + "key_path": "oid4vci.display[].locale", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciIssuerDisplayConfig/properties/logo", + "key_path": "oid4vci.display[].logo", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciIssuerDisplayConfig/properties/name", + "key_path": "oid4vci.display[].name", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciNonceConfig/properties/enabled", + "key_path": "oid4vci.nonce.enabled", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciNonceConfig/properties/ttl_seconds", + "key_path": "oid4vci.nonce.ttl_seconds", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciPreAuthorizedCodeConfig/properties/enabled", + "key_path": "oid4vci.pre_authorized_code.enabled", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciPreAuthorizedCodeConfig/properties/esignet", + "key_path": "oid4vci.pre_authorized_code.esignet", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/Oid4vciEsignetRpConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/Oid4vciEsignetRpConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciPreAuthorizedCodeConfig/properties/pre_authorized_code_ttl_seconds", + "key_path": "oid4vci.pre_authorized_code.pre_authorized_code_ttl_seconds", + "path_kind": "property" + }, + "purpose": "Pre-authorized-code lifetime in seconds.", + "purpose_source": "schema_description", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciPreAuthorizedCodeConfig/properties/tx_code", + "key_path": "oid4vci.pre_authorized_code.tx_code", + "path_kind": "property" + }, + "purpose": "`tx_code` (PIN) policy for the pre-authorized-code grant. A `tx_code` is\nrequired by default because a code without a PIN is a bearer credential.", + "purpose_source": "schema_description", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/Oid4vciTxCodeConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/Oid4vciTxCodeConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciProofConfig/properties/max_age_seconds", + "key_path": "oid4vci.proof.max_age_seconds", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciProofConfig/properties/max_clock_skew_seconds", + "key_path": "oid4vci.proof.max_clock_skew_seconds", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciTxCodeConfig/properties/input_mode", + "key_path": "oid4vci.pre_authorized_code.tx_code.input_mode", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciTxCodeConfig/properties/length", + "key_path": "oid4vci.pre_authorized_code.tx_code.length", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/Oid4vciTxCodeConfig/properties/required", + "key_path": "oid4vci.pre_authorized_code.tx_code.required", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/OotsConfig/properties/authentication_level_of_assurance", + "key_path": "evidence.claims[].oots.authentication_level_of_assurance", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/OotsConfig/properties/enabled", + "key_path": "evidence.claims[].oots.enabled", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/OotsConfig/properties/evidence_type_classification", + "key_path": "evidence.claims[].oots.evidence_type_classification", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/OotsConfig/properties/evidence_type_list", + "key_path": "evidence.claims[].oots.evidence_type_list", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/OotsConfig/properties/languages", + "key_path": "evidence.claims[].oots.languages", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/OotsConfig/properties/languages/items", + "key_path": "evidence.claims[].oots.languages[]", + "path_kind": "array_item" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/OotsConfig/properties/reference_framework", + "key_path": "evidence.claims[].oots.reference_framework", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/OotsConfig/properties/requirement", + "key_path": "evidence.claims[].oots.requirement", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/OperationConfig/properties/enabled", + "key_path": "evidence.claims[].operations.evaluate.enabled", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryAdminListenerConfig/properties/bind", + "key_path": "server.admin_listener.bind", + "path_kind": "property" + }, + "purpose": "A Rust SocketAddr string. The runtime parser remains authoritative for address and port validity.", + "purpose_source": "schema_description", + "intent_profile": "notary_server_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/SocketAddr", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/SocketAddr" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryAdminListenerConfig/properties/mode", + "key_path": "server.admin_listener.mode", + "path_kind": "property" + }, + "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_server_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/RegistryNotaryAdminListenerMode", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "shared_with_public", + "dedicated", + "disabled" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryAdminListenerMode" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryCelConfig/properties/allow_regex", + "key_path": "cel.allow_regex", + "path_kind": "property" + }, + "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_cel_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryCelConfig/properties/eval_timeout_ms", + "key_path": "cel.eval_timeout_ms", + "path_kind": "property" + }, + "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_cel_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_binding_json_bytes", + "key_path": "cel.max_binding_json_bytes", + "path_kind": "property" + }, + "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_cel_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_expression_bytes", + "key_path": "cel.max_expression_bytes", + "path_kind": "property" + }, + "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_cel_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_list_items", + "key_path": "cel.max_list_items", + "path_kind": "property" + }, + "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_cel_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_object_depth", + "key_path": "cel.max_object_depth", + "path_kind": "property" + }, + "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_cel_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_object_keys", + "key_path": "cel.max_object_keys", + "path_kind": "property" + }, + "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_cel_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_result_json_bytes", + "key_path": "cel.max_result_json_bytes", + "path_kind": "property" + }, + "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_cel_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryCelConfig/properties/max_string_bytes", + "key_path": "cel.max_string_bytes", + "path_kind": "property" + }, + "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_cel_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryCelConfig/properties/mode", + "key_path": "cel.mode", + "path_kind": "property" + }, + "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_cel_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryCelConfig/properties/worker_count", + "key_path": "cel.worker_count", + "path_kind": "property" + }, + "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_cel_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryCelConfig/properties/worker_memory_bytes", + "key_path": "cel.worker_memory_bytes", + "path_kind": "property" + }, + "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_cel_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryCelConfig/properties/worker_stderr_bytes", + "key_path": "cel.worker_stderr_bytes", + "path_kind": "property" + }, + "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_cel_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryCorsConfig/properties/allowed_origins", + "key_path": "server.cors.allowed_origins", + "path_kind": "property" + }, + "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_server_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryCorsConfig/properties/allowed_origins/items", + "key_path": "server.cors.allowed_origins[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_server_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryHttpConfig/properties/admin_listener", + "key_path": "server.admin_listener", + "path_kind": "property" + }, + "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_server_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/RegistryNotaryAdminListenerConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryAdminListenerConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryHttpConfig/properties/bind", + "key_path": "server.bind", + "path_kind": "property" + }, + "purpose": "A Rust SocketAddr string. The runtime parser remains authoritative for address and port validity.", + "purpose_source": "schema_description", + "intent_profile": "notary_server_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/SocketAddr", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/SocketAddr" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryHttpConfig/properties/cors", + "key_path": "server.cors", + "path_kind": "property" + }, + "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_server_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/RegistryNotaryCorsConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryCorsConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryHttpConfig/properties/http1_header_read_timeout", + "key_path": "server.http1_header_read_timeout", + "path_kind": "property" + }, + "purpose": "A humantime duration string. The runtime parser remains authoritative for its complete grammar.", + "purpose_source": "schema_description", + "intent_profile": "notary_server_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/HumantimeDuration", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/HumantimeDuration" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryHttpConfig/properties/max_connections", + "key_path": "server.max_connections", + "path_kind": "property" + }, + "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_server_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryHttpConfig/properties/openapi_requires_auth", + "key_path": "server.openapi_requires_auth", + "path_kind": "property" + }, + "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_server_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the reviewed product-owned scalar default; its value is omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryHttpConfig/properties/request_body_timeout", + "key_path": "server.request_body_timeout", + "path_kind": "property" + }, + "purpose": "A humantime duration string. The runtime parser remains authoritative for its complete grammar.", + "purpose_source": "schema_description", + "intent_profile": "notary_server_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/HumantimeDuration", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/HumantimeDuration" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryHttpConfig/properties/request_timeout", + "key_path": "server.request_timeout", + "path_kind": "property" + }, + "purpose": "A humantime duration string. The runtime parser remains authoritative for its complete grammar.", + "purpose_source": "schema_description", + "intent_profile": "notary_server_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/HumantimeDuration", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/HumantimeDuration" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryHttpConfig/properties/trusted_proxy_ips", + "key_path": "server.trusted_proxy_ips", + "path_kind": "property" + }, + "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_server_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned empty collection required by this runtime contract." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryHttpConfig/properties/trusted_proxy_ips/items", + "key_path": "server.trusted_proxy_ips[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_server_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "ip" + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RelayConnectionConfig/properties/allow_insecure_localhost", + "key_path": "evidence.relay.allow_insecure_localhost", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RelayConnectionConfig/properties/allowed_private_cidrs", + "key_path": "evidence.relay.allowed_private_cidrs", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RelayConnectionConfig/properties/allowed_private_cidrs/items", + "key_path": "evidence.relay.allowed_private_cidrs[]", + "path_kind": "array_item" + }, + "purpose": "An IP network CIDR string. The runtime parser remains authoritative for address and prefix validity.", + "purpose_source": "schema_description", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/IpNet", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/IpNet" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RelayConnectionConfig/properties/base_url", + "key_path": "evidence.relay.base_url", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RelayConnectionConfig/properties/max_in_flight", + "key_path": "evidence.relay.max_in_flight", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RelayConnectionConfig/properties/token_file", + "key_path": "evidence.relay.token_file", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_secret_reference", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RelayConnectionConfig/properties/workload_client_id", + "key_path": "evidence.relay.workload_client_id", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RelayConsultationConfig/properties/inputs", + "key_path": "evidence.claims[].evidence_mode.consultations.*.inputs", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RelayConsultationConfig/properties/inputs/additionalProperties", + "key_path": "evidence.claims[].evidence_mode.consultations.*.inputs.*", + "path_kind": "map_value" + }, + "purpose": "A supported consultation input path. The runtime parser remains authoritative for exact stable-name bounds.", + "purpose_source": "schema_description", + "intent_profile": "notary_evidence_claims_evidence_mode_consultations_inputs_open_map", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/RelayConsultationInput", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "rejected", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "structural", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "minLength", + "value": 1 + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/RelayConsultationInput" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RelayConsultationConfig/properties/outputs", + "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs", + "path_kind": "property" + }, + "purpose": "Complete closed public output schema expected from the pinned profile.", + "purpose_source": "schema_description", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RelayConsultationConfig/properties/outputs/additionalProperties", + "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*", + "path_kind": "map_value" + }, + "purpose": "Each reviewed key names a consultation output and each value defines its bounded evidence-result interpretation.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_claims_evidence_mode_consultations_outputs_open_map", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/RelayOutputContract", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "structural", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + [ + "type", + "max_bytes" + ], + [ + "type", + "minimum", + "maximum" + ], + [ + "type" + ] + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/RelayOutputContract" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RelayConsultationConfig/properties/profile", + "key_path": "evidence.claims[].evidence_mode.consultations.*.profile", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/RelayConsultationProfileRef", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "id", + "contract_hash" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/RelayConsultationProfileRef" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RelayConsultationProfileRef/properties/contract_hash", + "key_path": "evidence.claims[].evidence_mode.consultations.*.profile.contract_hash", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RelayConsultationProfileRef/properties/id", + "key_path": "evidence.claims[].evidence_mode.consultations.*.profile.id", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RelayOutputContract/oneOf/0/properties/nullable", + "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.nullable", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RelayOutputContract/oneOf/0/properties/type", + "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.type", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "const", + "value": [ + "boolean", + "date", + "integer", + "string" + ] + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RelayOutputContract/oneOf/1/properties/maximum", + "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.maximum", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "int64" + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RelayOutputContract/oneOf/1/properties/minimum", + "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.minimum", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "int64" + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RelayOutputContract/oneOf/2/properties/max_bytes", + "key_path": "evidence.claims[].evidence_mode.consultations.*.outputs.*.max_bytes", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RequestVariableConfig/properties/from", + "key_path": "evidence.variables.*.from", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RequestVariableConfig/properties/type", + "key_path": "evidence.variables.*.type", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/RequestVariableType", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "date" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/RequestVariableType" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RuleConfig/oneOf/0/properties/consultation", + "key_path": "evidence.claims[].rule.consultation", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RuleConfig/oneOf/0/properties/output", + "key_path": "evidence.claims[].rule.output", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RuleConfig/oneOf/0/properties/type", + "key_path": "evidence.claims[].rule.type", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "const", + "value": [ + "cel", + "consultation_matched", + "consultation_output" + ] + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RuleConfig/oneOf/2/properties/bindings", + "key_path": "evidence.claims[].rule.bindings", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/CelBindingsConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/CelBindingsConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/RuleConfig/oneOf/2/properties/expression", + "key_path": "evidence.claims[].rule.expression", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SealedClaimEvidenceMode/oneOf/0/properties/consultations", + "key_path": "evidence.claims[].evidence_mode.consultations", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SealedClaimEvidenceMode/oneOf/0/properties/consultations/additionalProperties", + "key_path": "evidence.claims[].evidence_mode.consultations.*", + "path_kind": "map_value" + }, + "purpose": "Each reviewed key names a Relay consultation and each value defines the bounded consultation contract used to support this evidence claim.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_claims_evidence_mode_consultations_open_map", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/RelayConsultationConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "structural", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "arbitrary_map_keys_not_fixed_properties" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "profile", + "inputs" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/RelayConsultationConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SealedClaimEvidenceMode/oneOf/0/properties/type", + "key_path": "evidence.claims[].evidence_mode.type", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "const", + "value": [ + "registry_backed", + "self_attested" + ] + }, + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SigningKeyConfig/properties/alg", + "key_path": "evidence.signing_keys.*.alg", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SigningKeyConfig/properties/key_id_hex", + "key_path": "evidence.signing_keys.*.key_id_hex", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SigningKeyConfig/properties/key_label", + "key_path": "evidence.signing_keys.*.key_label", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SigningKeyConfig/properties/kid", + "key_path": "evidence.signing_keys.*.kid", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SigningKeyConfig/properties/module_path", + "key_path": "evidence.signing_keys.*.module_path", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SigningKeyConfig/properties/password_env", + "key_path": "evidence.signing_keys.*.password_env", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_secret_reference", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SigningKeyConfig/properties/path", + "key_path": "evidence.signing_keys.*.path", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_secret_reference", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SigningKeyConfig/properties/pin_env", + "key_path": "evidence.signing_keys.*.pin_env", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_secret_reference", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SigningKeyConfig/properties/private_jwk_env", + "key_path": "evidence.signing_keys.*.private_jwk_env", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_secret_reference", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SigningKeyConfig/properties/provider", + "key_path": "evidence.signing_keys.*.provider", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/SigningKeyProviderSchema", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "local_jwk_env", + "file_watch", + "pkcs11", + "local_pkcs12_file", + "kms", + "workload_identity" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/SigningKeyProviderSchema" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SigningKeyConfig/properties/public_jwk_env", + "key_path": "evidence.signing_keys.*.public_jwk_env", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SigningKeyConfig/properties/publish_until_unix_seconds", + "key_path": "evidence.signing_keys.*.publish_until_unix_seconds", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer", + "null" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": [ + "integer", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SigningKeyConfig/properties/status", + "key_path": "evidence.signing_keys.*.status", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/SigningKeyStatusSchema", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "active", + "publish_only", + "disabled" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/SigningKeyStatusSchema" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SigningKeyConfig/properties/token_label", + "key_path": "evidence.signing_keys.*.token_label", + "path_kind": "property" + }, + "purpose": "Controls evidence claims, Relay consultations, disclosure, signing keys, variables, and credential profiles.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_evidence_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/StateConfig/properties/postgresql", + "key_path": "state.postgresql", + "path_kind": "property" + }, + "purpose": "Controls Notary durable state storage, database trust, timeouts, connection limits, and sensitive-state protection.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_state_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/StatePostgresqlConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/StatePostgresqlConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/StateConfig/properties/storage", + "key_path": "state.storage", + "path_kind": "property" + }, + "purpose": "Controls Notary durable state storage, database trust, timeouts, connection limits, and sensitive-state protection.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_state_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/StatePostgresqlConfig/properties/connect_timeout_ms", + "key_path": "state.postgresql.connect_timeout_ms", + "path_kind": "property" + }, + "purpose": "Controls Notary durable state storage, database trust, timeouts, connection limits, and sensitive-state protection.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_state_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/StatePostgresqlConfig/properties/max_connections", + "key_path": "state.postgresql.max_connections", + "path_kind": "property" + }, + "purpose": "Controls Notary durable state storage, database trust, timeouts, connection limits, and sensitive-state protection.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_state_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/StatePostgresqlConfig/properties/operation_timeout_ms", + "key_path": "state.postgresql.operation_timeout_ms", + "path_kind": "property" + }, + "purpose": "Controls Notary durable state storage, database trust, timeouts, connection limits, and sensitive-state protection.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_state_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/StatePostgresqlConfig/properties/root_certificate_path", + "key_path": "state.postgresql.root_certificate_path", + "path_kind": "property" + }, + "purpose": "Controls Notary durable state storage, database trust, timeouts, connection limits, and sensitive-state protection.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_state_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/StatePostgresqlConfig/properties/sensitive_state_key_env", + "key_path": "state.postgresql.sensitive_state_key_env", + "path_kind": "property" + }, + "purpose": "Controls Notary durable state storage, database trust, timeouts, connection limits, and sensitive-state protection.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_state_secret_reference", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/StatePostgresqlConfig/properties/url_env", + "key_path": "state.postgresql.url_env", + "path_kind": "property" + }, + "purpose": "Controls Notary durable state storage, database trust, timeouts, connection limits, and sensitive-state protection.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_state_secret_reference", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "secret_reference", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "secret_never_reportable" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessCitizenClientsConfig/properties/allowed_audiences", + "key_path": "subject_access.citizen_clients.allowed_audiences", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessCitizenClientsConfig/properties/allowed_audiences/items", + "key_path": "subject_access.citizen_clients.allowed_audiences[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessCitizenClientsConfig/properties/allowed_client_ids", + "key_path": "subject_access.citizen_clients.allowed_client_ids", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessCitizenClientsConfig/properties/allowed_client_ids/items", + "key_path": "subject_access.citizen_clients.allowed_client_ids[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/allowed_claims", + "key_path": "subject_access.allowed_claims", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/allowed_claims/items", + "key_path": "subject_access.allowed_claims[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/allowed_disclosures", + "key_path": "subject_access.allowed_disclosures", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/allowed_disclosures/items", + "key_path": "subject_access.allowed_disclosures[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/allowed_formats", + "key_path": "subject_access.allowed_formats", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/allowed_formats/items", + "key_path": "subject_access.allowed_formats[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/allowed_operations", + "key_path": "subject_access.allowed_operations", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/SubjectAccessOperationsConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessOperationsConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/allowed_purposes", + "key_path": "subject_access.allowed_purposes", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/allowed_purposes/items", + "key_path": "subject_access.allowed_purposes[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/allowed_wallet_origins", + "key_path": "subject_access.allowed_wallet_origins", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/allowed_wallet_origins/items", + "key_path": "subject_access.allowed_wallet_origins[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/citizen_clients", + "key_path": "subject_access.citizen_clients", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/SubjectAccessCitizenClientsConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessCitizenClientsConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/credential_profiles", + "key_path": "subject_access.credential_profiles", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/credential_profiles/items", + "key_path": "subject_access.credential_profiles[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/delegation", + "key_path": "subject_access.delegation", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/SubjectAccessDelegationConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessDelegationConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/enabled", + "key_path": "subject_access.enabled", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/rate_limits", + "key_path": "subject_access.rate_limits", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/SubjectAccessRateLimitsConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessRateLimitsConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/required_scopes", + "key_path": "subject_access.required_scopes", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/required_scopes/items", + "key_path": "subject_access.required_scopes[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/scope_policy", + "key_path": "subject_access.scope_policy", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/SubjectAccessScopePolicy", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "required", + "optional", + "disabled" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessScopePolicy" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/subject_binding", + "key_path": "subject_access.subject_binding", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/SubjectAccessSubjectBindingConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessSubjectBindingConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig/properties/token_policy", + "key_path": "subject_access.token_policy", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/SubjectAccessTokenPolicyConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessTokenPolicyConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/allowed_claims", + "key_path": "subject_access.delegation.allowed_relationships[].allowed_claims", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/allowed_claims/items", + "key_path": "subject_access.delegation.allowed_relationships[].allowed_claims[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/allowed_disclosures", + "key_path": "subject_access.delegation.allowed_relationships[].allowed_disclosures", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/allowed_disclosures/items", + "key_path": "subject_access.delegation.allowed_relationships[].allowed_disclosures[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/allowed_formats", + "key_path": "subject_access.delegation.allowed_relationships[].allowed_formats", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/allowed_formats/items", + "key_path": "subject_access.delegation.allowed_relationships[].allowed_formats[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/allowed_purposes", + "key_path": "subject_access.delegation.allowed_relationships[].allowed_purposes", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/allowed_purposes/items", + "key_path": "subject_access.delegation.allowed_relationships[].allowed_purposes[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/credential_profiles", + "key_path": "subject_access.delegation.allowed_relationships[].credential_profiles", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/credential_profiles/items", + "key_path": "subject_access.delegation.allowed_relationships[].credential_profiles[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/proof_claim", + "key_path": "subject_access.delegation.allowed_relationships[].proof_claim", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/relationship_type", + "key_path": "subject_access.delegation.allowed_relationships[].relationship_type", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig/properties/target_id_type", + "key_path": "subject_access.delegation.allowed_relationships[].target_id_type", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": [ + "string", + "null" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessDelegationConfig/properties/allowed_relationships", + "key_path": "subject_access.delegation.allowed_relationships", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessDelegationConfig/properties/allowed_relationships/items", + "key_path": "subject_access.delegation.allowed_relationships[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/SubjectAccessDelegatedRelationshipConfig", + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "relationship_type", + "proof_claim" + ] + }, + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessDelegatedRelationshipConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessDelegationConfig/properties/enabled", + "key_path": "subject_access.delegation.enabled", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessOperationsConfig/properties/batch_evaluate", + "key_path": "subject_access.allowed_operations.batch_evaluate", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessOperationsConfig/properties/evaluate", + "key_path": "subject_access.allowed_operations.evaluate", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessOperationsConfig/properties/issue_credential", + "key_path": "subject_access.allowed_operations.issue_credential", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessOperationsConfig/properties/render", + "key_path": "subject_access.allowed_operations.render", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessRateLimitsConfig/properties/credential_issuance_per_principal_per_hour", + "key_path": "subject_access.rate_limits.credential_issuance_per_principal_per_hour", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessRateLimitsConfig/properties/invalid_token_per_client_address_per_minute", + "key_path": "subject_access.rate_limits.invalid_token_per_client_address_per_minute", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessRateLimitsConfig/properties/per_holder_per_hour", + "key_path": "subject_access.rate_limits.per_holder_per_hour", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessRateLimitsConfig/properties/per_principal_per_minute", + "key_path": "subject_access.rate_limits.per_principal_per_minute", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessRateLimitsConfig/properties/subject_mismatch_per_principal_per_hour", + "key_path": "subject_access.rate_limits.subject_mismatch_per_principal_per_hour", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessRateLimitsConfig/properties/tx_code_attempts_per_code_per_minute", + "key_path": "subject_access.rate_limits.tx_code_attempts_per_code_per_minute", + "path_kind": "property" + }, + "purpose": "Per-minute cap on `tx_code` attempts against a single\n`pre-authorized_code`. Bounds brute force of the numeric PIN at the\npre-authorized-code token endpoint. Defaults to zero so existing\nconfigs that do not enable pre-auth still validate; it must be greater\nthan zero only when the pre-authorized-code flow is enabled.", + "purpose_source": "schema_description", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint32" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessSubjectBindingConfig/properties/allow_sub_as_civil_id", + "key_path": "subject_access.subject_binding.allow_sub_as_civil_id", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "boolean" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "boolean" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessSubjectBindingConfig/properties/claim_source", + "key_path": "subject_access.subject_binding.claim_source", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/SubjectAccessClaimSource", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "access_token", + "userinfo" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessClaimSource" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessSubjectBindingConfig/properties/id_type", + "key_path": "subject_access.subject_binding.id_type", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessSubjectBindingConfig/properties/normalize", + "key_path": "subject_access.subject_binding.normalize", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/SubjectBindingNormalize", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "exact" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/SubjectBindingNormalize" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessSubjectBindingConfig/properties/request_field", + "key_path": "subject_access.subject_binding.request_field", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/SubjectId", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "SubjectId" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/SubjectId" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessSubjectBindingConfig/properties/token_claim", + "key_path": "subject_access.subject_binding.token_claim", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessTokenPolicyConfig/properties/assurance_claim_source", + "key_path": "subject_access.token_policy.assurance_claim_source", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "local_reference": "#/$defs/SubjectAccessAssuranceClaimSource", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "enum", + "value": [ + "access_token", + "id_token" + ] + }, + { + "keyword": "type", + "value": "string" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessAssuranceClaimSource" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessTokenPolicyConfig/properties/max_access_token_lifetime_seconds", + "key_path": "subject_access.token_policy.max_access_token_lifetime_seconds", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessTokenPolicyConfig/properties/max_auth_age_seconds", + "key_path": "subject_access.token_policy.max_auth_age_seconds", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessTokenPolicyConfig/properties/max_clock_leeway_seconds", + "key_path": "subject_access.token_policy.max_clock_leeway_seconds", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessTokenPolicyConfig/properties/max_credential_validity_seconds", + "key_path": "subject_access.token_policy.max_credential_validity_seconds", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessTokenPolicyConfig/properties/max_evaluation_age_seconds", + "key_path": "subject_access.token_policy.max_evaluation_age_seconds", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "integer" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "format", + "value": "uint64" + }, + { + "keyword": "minimum", + "value": 0 + }, + { + "keyword": "type", + "value": "integer" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessTokenPolicyConfig/properties/required_acr_values", + "key_path": "subject_access.token_policy.required_acr_values", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "array" + ], + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "array" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessTokenPolicyConfig/properties/required_acr_values/items", + "key_path": "subject_access.token_policy.required_acr_values[]", + "path_kind": "array_item" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "string" + ], + "composed": false + }, + "requiredness": "not_applicable", + "null_behavior": "rejected", + "empty_behavior": "allowed", + "default": { + "behavior": "not_applicable" + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "string" + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/properties/audit", + "key_path": "audit", + "path_kind": "property" + }, + "purpose": "Controls Notary audit delivery, retention, hashing, and failure behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_audit_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/EvidenceAuditConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuditConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/properties/auth", + "key_path": "auth", + "path_kind": "property" + }, + "purpose": "Controls Notary caller authentication, authorization details, token verification, and access-token signing.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_auth_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/EvidenceAuthConfig", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/EvidenceAuthConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/properties/cel", + "key_path": "cel", + "path_kind": "property" + }, + "purpose": "Controls bounded CEL evaluation limits used by reviewed Notary policy expressions.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_cel_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/RegistryNotaryCelConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryCelConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/properties/config_trust", + "key_path": "config_trust", + "path_kind": "property" + }, + "purpose": "Optional governed-configuration local trust state.\n\nSimple local deployments omit this block. Signed/governed apply requires it\nso anti-rollback state lives in an explicit durable location.", + "purpose_source": "schema_description", + "intent_profile": "notary_config_trust_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "null", + "object" + ], + "composed": true + }, + "requiredness": "optional", + "null_behavior": "conditional", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization preserves the product-owned absence state without materializing a configuration value." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "required", + "value": [ + "trust_anchor_path", + "bundle_path", + "antirollback_state_path" + ] + }, + { + "keyword": "type", + "value": [ + "null", + "object" + ] + } + ] + }, + { + "address": { + "schema": "notary", + "pointer": "/properties/credential_status", + "key_path": "credential_status", + "path_kind": "property" + }, + "purpose": "Controls Notary credential-status publication and retention behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_credential_status_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/CredentialStatusConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/CredentialStatusConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/properties/deployment", + "key_path": "deployment", + "path_kind": "property" + }, + "purpose": "The operator-declared `deployment` config block.\n\nAn absent profile means an undeclared deployment, which refuses startup. The\n`multi_instance` flag is an operator declaration that the instance is one of\nseveral sharing the same workload; it is never inferred.", + "purpose_source": "schema_description", + "intent_profile": "notary_deployment_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/DeploymentConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/DeploymentConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/properties/evidence", + "key_path": "evidence", + "path_kind": "property" + }, + "purpose": "Registry Notary configuration. Disabled by default so existing\nRegistry Relay deployments load unchanged.", + "purpose_source": "schema_description", + "intent_profile": "notary_evidence_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/EvidenceConfig", + "composed": false + }, + "requiredness": "required", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "no_schema_default" + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/EvidenceConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/properties/federation", + "key_path": "federation", + "path_kind": "property" + }, + "purpose": "Controls Notary federation trust, request verification, pairwise identifiers, and bounded peer behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_federation_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/FederationConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/FederationConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/properties/instance", + "key_path": "instance", + "path_kind": "property" + }, + "purpose": "Identifies the Notary instance and its deployment environment for operational correlation.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_instance_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/NotaryInstanceConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/NotaryInstanceConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/properties/oid4vci", + "key_path": "oid4vci", + "path_kind": "property" + }, + "purpose": "Controls Notary OpenID4VCI issuer, client, grant, proof, nonce, and credential-configuration behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_oid4vci_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/Oid4vciConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/Oid4vciConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/properties/server", + "key_path": "server", + "path_kind": "property" + }, + "purpose": "Controls Notary listeners, transport, timeouts, request limits, and administrative endpoints.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_server_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/RegistryNotaryHttpConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "schema_default", + "reviewed_behavior": "The product-owned JSON Schema publishes the default; its value is intentionally omitted from this value-free reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/RegistryNotaryHttpConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/properties/state", + "key_path": "state", + "path_kind": "property" + }, + "purpose": "Controls Notary durable state storage, database trust, timeouts, connection limits, and sensitive-state protection.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_state_internal", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/StateConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + "environment_behavior": "bound_by_environment", + "sensitivity": "internal", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/StateConfig" + } + }, + { + "address": { + "schema": "notary", + "pointer": "/properties/subject_access", + "key_path": "subject_access", + "path_kind": "property" + }, + "purpose": "Controls Notary subject and assisted-access policy, authorization details, and relationship proof behavior.", + "purpose_source": "reviewed_profile", + "intent_profile": "notary_subject_access_sensitive", + "semantic_owner": "notary_runtime", + "human_owner": "notary_maintainers", + "scope": "The complete product-owned Notary runtime configuration accepted by schema validation, Rust deserialization, and operator preflight.", + "field_type": { + "schema_types": [ + "object" + ], + "local_reference": "#/$defs/SubjectAccessConfig", + "composed": false + }, + "requiredness": "optional", + "null_behavior": "rejected", + "empty_behavior": "not_applicable", + "default": { + "behavior": "reviewed_runtime_default", + "reviewed_behavior": "When omitted, Rust deserialization supplies the product-owned nested default contract; no deployment value is copied into this reference." + }, + "environment_behavior": "narrows_reviewed_authority", + "sensitivity": "sensitive", + "state": "runtime", + "products": [ + "notary", + "docs" + ], + "availability": "published", + "stability": "experimental", + "validation_stages": [ + "json_schema", + "rust_deserialization", + "operator_preflight" + ], + "diagnostic": "Notary runtime configuration does not yet publish a closed general diagnostic code; doctor reports the generic failed status.", + "history_status": "not_verified", + "introduced_in": null, + "version_history": [], + "example": { + "guidance": "Use synthetic identifiers and non-routable placeholders; never copy credentials, environment values, deployment paths, or country configuration.", + "schema_examples_available": false, + "contains_country_values": false + }, + "migration": "coordinate_deployment", + "migration_note": "Coordinate Notary deployment, key or trust rotation, and rollback review before activating runtime configuration changes.", + "consumers": [ + "registry_notary", + "docs_generator" + ], + "generated_artifacts": [ + "notary_config", + "field_reference" + ], + "review_classes": [ + "contract", + "notary", + "security", + "privacy", + "documentation" + ], + "semantic_rules": [ + "knowledge_only", + "generated_docs_never_load_country_values", + "sensitive_operational_metadata", + "array_items_share_element_contract" + ], + "constraints": [ + { + "keyword": "type", + "value": "object" + } + ], + "local_reference": { + "schema": "notary", + "pointer": "/$defs/SubjectAccessConfig" + } + } + ] +} diff --git a/docs/site/src/data/generated/diagnostics/authoring.json b/docs/site/src/data/generated/diagnostics/authoring.json new file mode 100644 index 000000000..bc216f055 --- /dev/null +++ b/docs/site/src/data/generated/diagnostics/authoring.json @@ -0,0 +1,311 @@ +{ + "schema_version": "registryctl.authoring_error_reference.v1", + "entries": [ + { + "family": "authoring_validation", + "code": "registryctl.authoring.diagnostics.truncated", + "owner": "registryctl", + "product": "registryctl", + "phase": "aggregation", + "safe_meaning": "At most 64 diagnostics are returned in deterministic order.", + "rule": "diagnostic_limit", + "safe_remediation": "Fix the reported diagnostics and run the check again.", + "field_address_pattern": null, + "evidence_scope": "offline authored project files selected for registryctl check", + "secret_sensitive_value_policy": "no_received_value", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.diagnostics.truncated", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "family": "authoring_validation", + "code": "registryctl.authoring.entity.invalid", + "owner": "registryctl", + "product": "registryctl", + "phase": "semantic_validation", + "safe_meaning": "A declared entity id and shape must match the project contract.", + "rule": "entity_contract", + "safe_remediation": "Correct the entity declaration with the entity schema and its project alias.", + "field_address_pattern": "#", + "evidence_scope": "offline authored project files selected for registryctl check", + "secret_sensitive_value_policy": "no_received_value", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.entity.invalid", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "family": "authoring_validation", + "code": "registryctl.authoring.environment.invalid", + "owner": "registryctl", + "product": "registryctl", + "phase": "semantic_validation", + "safe_meaning": "Environment bindings must match declared products, integrations, identities, origins, and bounded generations.", + "rule": "environment_binding", + "safe_remediation": "Align the selected environment with the declared project contract.", + "field_address_pattern": "environments/.yaml#", + "evidence_scope": "offline authored project files selected for registryctl check", + "secret_sensitive_value_policy": "no_received_value", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.environment.invalid", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "family": "authoring_validation", + "code": "registryctl.authoring.file.too_large", + "owner": "registryctl", + "product": "registryctl", + "phase": "safe_input", + "safe_meaning": "Authored files must remain below their documented fixed byte bound.", + "rule": "authored_file_size", + "safe_remediation": "Reduce the file below its documented maximum size.", + "field_address_pattern": "#", + "evidence_scope": "offline authored project files selected for registryctl check", + "secret_sensitive_value_policy": "no_received_value", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.file.too_large", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "family": "authoring_validation", + "code": "registryctl.authoring.file.unreadable", + "owner": "registryctl", + "product": "registryctl", + "phase": "safe_input", + "safe_meaning": "A regular file inside the project root must be readable.", + "rule": "authored_file_readability", + "safe_remediation": "Restore a readable regular project-relative file.", + "field_address_pattern": "#", + "evidence_scope": "offline authored project files selected for registryctl check", + "secret_sensitive_value_policy": "no_received_value", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.file.unreadable", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "family": "authoring_validation", + "code": "registryctl.authoring.fixture.invalid", + "owner": "registryctl", + "product": "registryctl", + "phase": "semantic_validation", + "safe_meaning": "Fixtures must be deterministic, bounded, and satisfy the integration contract without live values.", + "rule": "fixture_contract", + "safe_remediation": "Correct the fixture declaration and its closed interaction contract.", + "field_address_pattern": "integrations//fixtures/.yaml#", + "evidence_scope": "offline authored project files selected for registryctl check", + "secret_sensitive_value_policy": "no_received_value", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.fixture.invalid", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "family": "authoring_validation", + "code": "registryctl.authoring.fixture.reserved_body_field", + "owner": "registryctl", + "product": "registryctl", + "phase": "syntax", + "safe_meaning": "A fixture body object may use `file` only as the closed body-file reference shape.", + "rule": "fixture_body_file_reference", + "safe_remediation": "Use the documented body-file reference shape or an inline JSON body.", + "field_address_pattern": "integrations//fixtures/.yaml#", + "evidence_scope": "offline authored project files selected for registryctl check", + "secret_sensitive_value_policy": "received_type_only", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.fixture.reserved_body_field", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "family": "authoring_validation", + "code": "registryctl.authoring.integration.invalid", + "owner": "registryctl", + "product": "registryctl", + "phase": "semantic_validation", + "safe_meaning": "An integration alias, capability, and declared contract must be internally consistent.", + "rule": "integration_contract", + "safe_remediation": "Correct the integration declaration with the integration schema.", + "field_address_pattern": "integrations//integration.yaml#", + "evidence_scope": "offline authored project files selected for registryctl check", + "secret_sensitive_value_policy": "no_received_value", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.integration.invalid", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "family": "authoring_validation", + "code": "registryctl.authoring.path.unsafe", + "owner": "registryctl", + "product": "registryctl", + "phase": "safe_input", + "safe_meaning": "Paths must be normalized project-relative paths to regular non-symlink entries.", + "rule": "project_relative_path", + "safe_remediation": "Use a normalized project-relative regular file path.", + "field_address_pattern": "#", + "evidence_scope": "offline authored project files selected for registryctl check", + "secret_sensitive_value_policy": "no_received_value", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.path.unsafe", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "family": "authoring_validation", + "code": "registryctl.authoring.project.invalid", + "owner": "registryctl", + "product": "registryctl", + "phase": "semantic_validation", + "safe_meaning": "Project services, entities, integrations, and references must form a closed valid graph.", + "rule": "project_contract", + "safe_remediation": "Align the project declaration and referenced contracts.", + "field_address_pattern": "registry-stack.yaml#", + "evidence_scope": "offline authored project files selected for registryctl check", + "secret_sensitive_value_policy": "no_received_value", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.project.invalid", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "family": "authoring_validation", + "code": "registryctl.authoring.project.scope_collision", + "owner": "registryctl", + "product": "registryctl", + "phase": "semantic_validation", + "safe_meaning": "Effective authorization scopes must be distinct across records API and attribute-release access.", + "rule": "authorization_scope_uniqueness", + "safe_remediation": "Assign distinct scopes to each authorization purpose.", + "field_address_pattern": "registry-stack.yaml#", + "evidence_scope": "offline authored project files selected for registryctl check", + "secret_sensitive_value_policy": "no_received_value", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.project.scope_collision", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "family": "authoring_validation", + "code": "registryctl.authoring.script.closed_contract_violation", + "owner": "registryctl", + "product": "registryctl", + "phase": "script_validation", + "safe_meaning": "Scripts must use the released bounded Script contract and module rules.", + "rule": "released_script_contract", + "safe_remediation": "Use only the released bounded Script contract.", + "field_address_pattern": "#", + "evidence_scope": "offline authored project files selected for registryctl check", + "secret_sensitive_value_policy": "no_received_value", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.script.closed_contract_violation", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "family": "authoring_validation", + "code": "registryctl.authoring.script.invalid_signature", + "owner": "registryctl", + "product": "registryctl", + "phase": "script_validation", + "safe_meaning": "The Script entrypoint must be exactly `consult(context)`.", + "rule": "script_entrypoint_signature", + "safe_remediation": "Define the exact released entrypoint signature.", + "field_address_pattern": "#", + "evidence_scope": "offline authored project files selected for registryctl check", + "secret_sensitive_value_policy": "no_received_value", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.script.invalid_signature", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "family": "authoring_validation", + "code": "registryctl.authoring.script.syntax_error", + "owner": "registryctl", + "product": "registryctl", + "phase": "script_validation", + "safe_meaning": "The Script source must parse under the released runtime.", + "rule": "script_syntax", + "safe_remediation": "Correct the Script syntax at the reported location.", + "field_address_pattern": "#", + "evidence_scope": "offline authored project files selected for registryctl check", + "secret_sensitive_value_policy": "no_received_value", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.script.syntax_error", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "family": "authoring_validation", + "code": "registryctl.authoring.script.unknown_function", + "owner": "registryctl", + "product": "registryctl", + "phase": "script_validation", + "safe_meaning": "The Script must define the released `consult(context)` entrypoint.", + "rule": "script_entrypoint", + "safe_remediation": "Define consult(context) as the Script entrypoint.", + "field_address_pattern": "#", + "evidence_scope": "offline authored project files selected for registryctl check", + "secret_sensitive_value_policy": "no_received_value", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.script.unknown_function", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "family": "authoring_validation", + "code": "registryctl.authoring.yaml.invalid_syntax", + "owner": "registryctl", + "product": "registryctl", + "phase": "syntax", + "safe_meaning": "YAML must parse as the selected closed authoring document shape.", + "rule": "closed_yaml_document", + "safe_remediation": "Correct the YAML with the matching authoring schema.", + "field_address_pattern": "#", + "evidence_scope": "offline authored project files selected for registryctl check", + "secret_sensitive_value_policy": "received_type_only", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.yaml.invalid_syntax", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "family": "authoring_validation", + "code": "registryctl.authoring.yaml.unknown_field", + "owner": "registryctl", + "product": "registryctl", + "phase": "syntax", + "safe_meaning": "Only documented fields in the closed authoring schema are accepted.", + "rule": "closed_yaml_unknown_field", + "safe_remediation": "Remove the unsupported field or replace it with its documented field.", + "field_address_pattern": "#", + "evidence_scope": "offline authored project files selected for registryctl check", + "secret_sensitive_value_policy": "received_type_only", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.yaml.unknown_field", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + } + ] +} diff --git a/docs/site/src/data/generated/diagnostics/fixture.json b/docs/site/src/data/generated/diagnostics/fixture.json new file mode 100644 index 000000000..8b1349174 --- /dev/null +++ b/docs/site/src/data/generated/diagnostics/fixture.json @@ -0,0 +1,293 @@ +{ + "schema_version": "registryctl.fixture_error_reference.v1", + "entries": [ + { + "family": "fixture_execution", + "code": "authorization.denied", + "owner": "registryctl", + "product": "registryctl_relay_offline_harness", + "phase": "offline_execution", + "safe_meaning": "Authorization denied fixture execution before source access.", + "rule": "authorization_before_source", + "safe_remediation": "Align the fixture identity and authorization expectation with the compiled policy.", + "field_address_pattern": null, + "evidence_scope": "offline synthetic fixture execution", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--authorization.denied", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "family": "fixture_execution", + "code": "failure.subject_mismatch", + "owner": "registryctl", + "product": "registryctl_relay_offline_harness", + "phase": "offline_execution", + "safe_meaning": "The source observation did not preserve the requested subject binding.", + "rule": "subject_binding", + "safe_remediation": "Correct the synthetic subject evidence or the reviewed subject comparison.", + "field_address_pattern": null, + "evidence_scope": "offline synthetic fixture execution", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--failure.subject_mismatch", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "family": "fixture_execution", + "code": "fixture.execution_contract_invalid", + "owner": "registryctl", + "product": "registryctl_relay_offline_harness", + "phase": "offline_execution", + "safe_meaning": "Fixture execution violated the compiled offline plan contract.", + "rule": "compiled_execution_contract", + "safe_remediation": "Align the fixture with the exact compiled integration plan.", + "field_address_pattern": null, + "evidence_scope": "offline synthetic fixture execution", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--fixture.execution_contract_invalid", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "family": "fixture_execution", + "code": "fixture.profile_not_found", + "owner": "registryctl", + "product": "registryctl_relay_offline_harness", + "phase": "offline_execution", + "safe_meaning": "The fixture profile pin did not select one exact compiled plan.", + "rule": "profile_pin", + "safe_remediation": "Select one compiled integration profile.", + "field_address_pattern": null, + "evidence_scope": "offline synthetic fixture execution", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--fixture.profile_not_found", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "family": "fixture_execution", + "code": "fixture.request_mismatch", + "owner": "registryctl", + "product": "registryctl_relay_offline_harness", + "phase": "offline_execution", + "safe_meaning": "The rendered request or call order did not match the fixture expectation.", + "rule": "request_authority_and_order", + "safe_remediation": "Align the fixture request expectation with the compiled plan.", + "field_address_pattern": null, + "evidence_scope": "offline synthetic fixture execution", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--fixture.request_mismatch", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "family": "fixture_execution", + "code": "fixture.source_operation_unknown", + "owner": "registryctl", + "product": "registryctl_relay_offline_harness", + "phase": "offline_execution", + "safe_meaning": "The fixture named a source operation outside the compiled plan.", + "rule": "source_operation_closure", + "safe_remediation": "Use only source operations declared by the compiled plan.", + "field_address_pattern": null, + "evidence_scope": "offline synthetic fixture execution", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--fixture.source_operation_unknown", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "family": "fixture_execution", + "code": "input.pattern_mismatch", + "owner": "registryctl", + "product": "registryctl_relay_offline_harness", + "phase": "offline_execution", + "safe_meaning": "A synthetic fixture input did not satisfy its compiled contract.", + "rule": "compiled_input_contract", + "safe_remediation": "Correct the synthetic input shape.", + "field_address_pattern": null, + "evidence_scope": "offline synthetic fixture execution", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--input.pattern_mismatch", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "family": "fixture_execution", + "code": "redacted_unclassified_error", + "owner": "registryctl", + "product": "registryctl_relay_offline_harness", + "phase": "offline_execution", + "safe_meaning": "An error outside the reviewed safe allow-list was redacted.", + "rule": "safe_error_allow_list", + "safe_remediation": "Use classified fixture evidence or inspect private local logs without publishing values.", + "field_address_pattern": null, + "evidence_scope": "offline synthetic fixture execution", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--redacted_unclassified_error", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "family": "fixture_execution", + "code": "source.call_budget_exceeded", + "owner": "registryctl", + "product": "registryctl_relay_offline_harness", + "phase": "offline_execution", + "safe_meaning": "Fixture execution exceeded the compiled source-call budget.", + "rule": "source_call_budget", + "safe_remediation": "Reduce source calls or revise the reviewed bounded plan.", + "field_address_pattern": null, + "evidence_scope": "offline synthetic fixture execution", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--source.call_budget_exceeded", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "family": "fixture_execution", + "code": "source.cardinality_violation", + "owner": "registryctl", + "product": "registryctl_relay_offline_harness", + "phase": "offline_execution", + "safe_meaning": "The synthetic source response violated the compiled cardinality contract.", + "rule": "source_cardinality", + "safe_remediation": "Correct the synthetic response cardinality.", + "field_address_pattern": null, + "evidence_scope": "offline synthetic fixture execution", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--source.cardinality_violation", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "family": "fixture_execution", + "code": "source.deadline_exceeded", + "owner": "registryctl", + "product": "registryctl_relay_offline_harness", + "phase": "offline_execution", + "safe_meaning": "The synthetic source interaction exceeded its deadline.", + "rule": "source_deadline", + "safe_remediation": "Align the timeout fixture with the compiled deadline behavior.", + "field_address_pattern": null, + "evidence_scope": "offline synthetic fixture execution", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--source.deadline_exceeded", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "family": "fixture_execution", + "code": "source.response_malformed", + "owner": "registryctl", + "product": "registryctl_relay_offline_harness", + "phase": "offline_execution", + "safe_meaning": "The synthetic source response violated its closed response contract.", + "rule": "source_response_contract", + "safe_remediation": "Correct the synthetic response shape.", + "field_address_pattern": null, + "evidence_scope": "offline synthetic fixture execution", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--source.response_malformed", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "family": "fixture_execution", + "code": "source.response_too_large", + "owner": "registryctl", + "product": "registryctl_relay_offline_harness", + "phase": "offline_execution", + "safe_meaning": "The synthetic source response exceeded its compiled byte bound.", + "rule": "source_response_byte_bound", + "safe_remediation": "Reduce the synthetic response below the compiled bound.", + "field_address_pattern": null, + "evidence_scope": "offline synthetic fixture execution", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--source.response_too_large", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "family": "fixture_execution", + "code": "source.status_rejected", + "owner": "registryctl", + "product": "registryctl_relay_offline_harness", + "phase": "offline_execution", + "safe_meaning": "The synthetic source returned a status outside the accepted mapping.", + "rule": "source_status_mapping", + "safe_remediation": "Use a reviewed status mapping or correct the fixture status.", + "field_address_pattern": null, + "evidence_scope": "offline synthetic fixture execution", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--source.status_rejected", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "family": "fixture_execution", + "code": "source.unavailable", + "owner": "registryctl", + "product": "registryctl_relay_offline_harness", + "phase": "offline_execution", + "safe_meaning": "The synthetic source was unavailable.", + "rule": "source_availability", + "safe_remediation": "Correct the offline source observation for the intended availability case.", + "field_address_pattern": null, + "evidence_scope": "offline synthetic fixture execution", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--source.unavailable", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "family": "fixture_execution", + "code": "source_unavailable", + "owner": "registryctl", + "product": "registryctl_relay_offline_harness", + "phase": "offline_execution", + "safe_meaning": "The synthetic source was unavailable under the retained legacy code.", + "rule": "legacy_source_availability", + "safe_remediation": "Prefer source.unavailable for new fixtures while retaining compatible evidence.", + "field_address_pattern": null, + "evidence_scope": "offline synthetic fixture execution", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--source_unavailable", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + } + ] +} diff --git a/docs/site/src/data/generated/diagnostics/operator.json b/docs/site/src/data/generated/diagnostics/operator.json new file mode 100644 index 000000000..2dfd91627 --- /dev/null +++ b/docs/site/src/data/generated/diagnostics/operator.json @@ -0,0 +1,1068 @@ +{ + "schema_version": "registryctl.operator_error_reference.v1", + "entries": [ + { + "family": "bundle_verification", + "code": "rejected_binding", + "owner": "registry_platform_ops", + "product": "registry_platform_ops", + "phase": "bundle_verification", + "safe_meaning": "The bundle binding does not match the intended runtime target.", + "rule": "registry.platform.bundle_verification.binding_matches_target", + "safe_remediation": "Use a bundle issued for the intended runtime binding.", + "field_address_pattern": null, + "evidence_scope": "signed bundle and configured runtime binding", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_platform_ops--rejected-binding", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose received or configured binding values." + }, + { + "family": "bundle_verification", + "code": "rejected_rollback", + "owner": "registry_platform_ops", + "product": "registry_platform_ops", + "phase": "bundle_activation", + "safe_meaning": "The bundle or override does not satisfy local anti-rollback requirements.", + "rule": "registry.platform.bundle_verification.rollback_constraints_satisfied", + "safe_remediation": "Use a monotonic bundle or an authorized break-glass selection.", + "field_address_pattern": null, + "evidence_scope": "local anti-rollback state and bundle or override metadata", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_platform_ops--rejected-rollback", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose stored sequences, content digests, paths, or approval values." + }, + { + "family": "bundle_verification", + "code": "rejected_signature", + "owner": "registry_platform_ops", + "product": "registry_platform_ops", + "phase": "bundle_verification", + "safe_meaning": "Bundle authenticity or declared content integrity verification failed.", + "rule": "registry.platform.bundle_verification.signature_and_integrity_accepted", + "safe_remediation": "Rebuild and sign the complete bundle with an accepted trust configuration.", + "field_address_pattern": null, + "evidence_scope": "bundle trust metadata, signature envelope, file closure, and content digests", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_platform_ops--rejected-signature", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose signer identifiers, file names, or content digests." + }, + { + "family": "bundle_verification", + "code": "rejected_validation", + "owner": "registry_platform_ops", + "product": "registry_platform_ops", + "phase": "bundle_verification", + "safe_meaning": "The bundle or acceptance metadata is missing, unreadable, malformed, or unsupported.", + "rule": "registry.platform.bundle_verification.input_is_valid", + "safe_remediation": "Regenerate the bundle and acceptance metadata using supported formats.", + "field_address_pattern": null, + "evidence_scope": "bundle encoding, manifest, acceptance metadata, and required local inputs", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_platform_ops--rejected-validation", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose parser messages, local paths, or supplied values." + }, + { + "family": "notary_activation", + "code": "notary.configuration.invalid", + "owner": "registry_notary", + "product": "registry_notary", + "phase": "configuration_activation", + "safe_meaning": "Registry Notary runtime configuration is invalid", + "rule": "Runtime activation requires valid product configuration, supported features, and resolvable secret and provider bindings", + "safe_remediation": "run registry-notary doctor, correct the reviewed configuration or binding, and retry activation", + "field_address_pattern": null, + "evidence_scope": "Notary configuration, provider bindings, and compiled feature support", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--configuration-invalid", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + }, + { + "family": "notary_activation", + "code": "notary.deployment.gate_failed", + "owner": "registry_notary", + "product": "registry_notary", + "phase": "deployment_activation", + "safe_meaning": "Registry Notary deployment gates refused startup", + "rule": "Every startup-failing deployment gate must pass before activation", + "safe_remediation": "run registry-notary doctor for the selected deployment profile and resolve its startup-failing findings", + "field_address_pattern": null, + "evidence_scope": "selected deployment profile and startup-failing gate results", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--deployment-gate-failed", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + }, + { + "family": "notary_activation", + "code": "notary.relay.activation_failed", + "owner": "registry_notary", + "product": "registry_notary", + "phase": "relay_activation", + "safe_meaning": "Relay consultation activation failed", + "rule": "Registry-backed claims require the reviewed Relay consultation client to activate before Notary serves", + "safe_remediation": "check the Notary configuration and startup environment", + "field_address_pattern": null, + "evidence_scope": "Notary Relay consultation client activation lifecycle", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--relay-activation-failed", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + }, + { + "family": "notary_activation", + "code": "notary.relay.configuration_invalid", + "owner": "registry_notary", + "product": "registry_notary", + "phase": "relay_activation", + "safe_meaning": "Relay consultation configuration is invalid", + "rule": "The Relay destination, activation plan, and activation lifecycle must form one valid reviewed configuration", + "safe_remediation": "check the evidence.relay connection and Registry-backed consultation configuration", + "field_address_pattern": null, + "evidence_scope": "Relay destination, activation plan, and consultation configuration", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--relay-configuration-invalid", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + }, + { + "family": "notary_activation", + "code": "notary.relay.credential_unavailable", + "owner": "registry_notary", + "product": "registry_notary", + "phase": "relay_activation", + "safe_meaning": "Relay workload credential is unavailable", + "rule": "A current non-empty workload credential must be available before a live Relay consultation", + "safe_remediation": "mount a current readable workload JWT at evidence.relay.token_file", + "field_address_pattern": null, + "evidence_scope": "configured Relay workload credential availability", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--relay-credential-unavailable", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + }, + { + "family": "notary_activation", + "code": "notary.relay.credentials_rejected", + "owner": "registry_notary", + "product": "registry_notary", + "phase": "relay_activation", + "safe_meaning": "Relay rejected the configured workload credential", + "rule": "Relay must accept the configured Notary workload binding, scope, and validity window", + "safe_remediation": "rotate the workload JWT and verify that Relay recognizes its workload binding, required scope, and validity window", + "field_address_pattern": null, + "evidence_scope": "Relay workload binding, scope, and validity acceptance", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--relay-credentials-rejected", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + }, + { + "family": "notary_activation", + "code": "notary.relay.profile_mismatch", + "owner": "registry_notary", + "product": "registry_notary", + "phase": "relay_activation", + "safe_meaning": "Relay consultation profile does not match the configured contract pin", + "rule": "The active Relay profile must match the reviewed Notary consultation contract pin", + "safe_remediation": "reconcile the Notary profile id and contract hash with the reviewed Relay consultation contract", + "field_address_pattern": null, + "evidence_scope": "reviewed Notary profile pin and active Relay consultation contract", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--relay-profile-mismatch", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + }, + { + "family": "notary_activation", + "code": "notary.relay.profile_not_found", + "owner": "registry_notary", + "product": "registry_notary", + "phase": "relay_activation", + "safe_meaning": "Relay consultation profile was not found", + "rule": "Every Registry-backed Notary consultation must resolve to an active Relay profile", + "safe_remediation": "deploy the configured Relay profile id, then retry the live check", + "field_address_pattern": null, + "evidence_scope": "configured consultation profile resolution in Relay", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--relay-profile-not-found", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + }, + { + "family": "notary_activation", + "code": "notary.relay.unavailable", + "owner": "registry_notary", + "product": "registry_notary", + "phase": "relay_activation", + "safe_meaning": "Relay consultation service is unavailable", + "rule": "The reviewed Relay destination must be reachable through the configured transport policy", + "safe_remediation": "check Relay reachability, TLS, destination policy, and service health", + "field_address_pattern": null, + "evidence_scope": "reviewed Relay destination, transport policy, and service availability", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--relay-unavailable", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + }, + { + "family": "notary_activation", + "code": "notary.runtime.activation_failed", + "owner": "registry_notary", + "product": "registry_notary", + "phase": "runtime_activation", + "safe_meaning": "Registry Notary runtime activation failed", + "rule": "Audit, state, sensitive-state, and other runtime dependencies must activate successfully before listeners serve", + "safe_remediation": "restore the governed runtime dependency or integrity condition, then retry activation", + "field_address_pattern": null, + "evidence_scope": "governed audit, state, sensitive-state, and runtime dependencies", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--runtime-activation-failed", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + }, + { + "family": "notary_activation", + "code": "notary.runtime.activation_required", + "owner": "registry_notary", + "product": "registry_notary", + "phase": "runtime_activation", + "safe_meaning": "Registry Notary runtime activation is required before serving", + "rule": "Routers may be built only after the governed audit and state activation lifecycle completes", + "safe_remediation": "run the compiled Registry Notary runtime activation step before building or serving routers", + "field_address_pattern": null, + "evidence_scope": "router assembly and governed audit and state activation lifecycle", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--runtime-activation-required", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + }, + { + "family": "notary_activation", + "code": "notary.state.postgresql.database_read_only", + "owner": "registry_notary", + "product": "registry_notary", + "phase": "runtime_activation", + "safe_meaning": "Registry Notary PostgreSQL state database is read-only or recovering", + "rule": "Serving requires a writable PostgreSQL primary for correctness-state transactions", + "safe_remediation": "restore a writable PostgreSQL primary, run registry-notary state doctor, and retry activation", + "field_address_pattern": null, + "evidence_scope": "PostgreSQL writeability and recovery posture", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--postgresql-database-read-only", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + }, + { + "family": "notary_activation", + "code": "notary.state.postgresql.database_unavailable", + "owner": "registry_notary", + "product": "registry_notary", + "phase": "runtime_activation", + "safe_meaning": "Registry Notary PostgreSQL state database is unavailable", + "rule": "Serving requires a reachable PostgreSQL service with an accepted TLS trust chain", + "safe_remediation": "check PostgreSQL reachability, TLS trust, and service health, then run registry-notary state doctor", + "field_address_pattern": null, + "evidence_scope": "PostgreSQL transport, TLS trust, and service availability", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--postgresql-database-unavailable", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + }, + { + "family": "notary_activation", + "code": "notary.state.postgresql.database_unsupported", + "owner": "registry_notary", + "product": "registry_notary", + "phase": "runtime_activation", + "safe_meaning": "Registry Notary PostgreSQL server major is unsupported", + "rule": "Serving requires a PostgreSQL major covered by the Registry Notary compatibility contract", + "safe_remediation": "move the state database to a supported PostgreSQL major, run registry-notary state doctor, and retry activation", + "field_address_pattern": null, + "evidence_scope": "PostgreSQL server-major compatibility", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--postgresql-database-unsupported", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + }, + { + "family": "notary_activation", + "code": "notary.state.postgresql.durability_unsafe", + "owner": "registry_notary", + "product": "registry_notary", + "phase": "runtime_activation", + "safe_meaning": "Registry Notary PostgreSQL durability settings are unsafe", + "rule": "Serving requires the documented PostgreSQL durability settings for correctness state", + "safe_remediation": "restore the required PostgreSQL durability settings, run registry-notary state doctor, and retry activation", + "field_address_pattern": null, + "evidence_scope": "PostgreSQL durability posture", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--postgresql-durability-unsafe", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + }, + { + "family": "notary_activation", + "code": "notary.state.postgresql.role_incompatible", + "owner": "registry_notary", + "product": "registry_notary", + "phase": "runtime_activation", + "safe_meaning": "Registry Notary PostgreSQL runtime role contract is incompatible", + "rule": "Serving requires the documented restricted runtime role and its attested schema binding", + "safe_remediation": "restore the documented runtime grants and role binding, run registry-notary state doctor, and retry activation", + "field_address_pattern": null, + "evidence_scope": "PostgreSQL runtime-role attributes, grants, and schema binding", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--postgresql-role-incompatible", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + }, + { + "family": "notary_activation", + "code": "notary.state.postgresql.schema_incompatible", + "owner": "registry_notary", + "product": "registry_notary", + "phase": "runtime_activation", + "safe_meaning": "Registry Notary PostgreSQL state schema contract is incompatible", + "rule": "Serving requires the exact product-owned schema, catalog, fingerprint, and privilege contract", + "safe_remediation": "restore or install the matching Registry Notary state schema, run registry-notary state doctor, and retry activation", + "field_address_pattern": null, + "evidence_scope": "PostgreSQL state schema, catalog, fingerprint, and privilege contract", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--postgresql-schema-incompatible", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + }, + { + "family": "operator_preflight", + "code": "registryctl.preflight.product_validator_not_checked", + "owner": "registryctl", + "product": "registryctl", + "phase": "product_capability", + "safe_meaning": "A required linked product validator was not checked locally.", + "rule": "registryctl.preflight.product_validator_locally_available", + "safe_remediation": "Enable the linked product validator.", + "field_address_pattern": null, + "evidence_scope": "offline local operator preflight", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registryctl--registryctl.preflight.product_validator_not_checked", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Preflight does not contact live sources or prove remote availability." + }, + { + "family": "operator_preflight", + "code": "registryctl.preflight.report_capacity_exceeded", + "owner": "registryctl", + "product": "registryctl", + "phase": "report_boundary", + "safe_meaning": "The preflight report reached its deterministic safety cap.", + "rule": "registryctl.preflight.report_capacity", + "safe_remediation": "Reduce declared preflight inputs.", + "field_address_pattern": null, + "evidence_scope": "offline local operator preflight", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registryctl--registryctl.preflight.report_capacity_exceeded", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Preflight does not contact live sources or prove remote availability." + }, + { + "family": "operator_preflight", + "code": "registryctl.preflight.runtime_file_empty", + "owner": "registryctl", + "product": "registryctl", + "phase": "runtime_file_posture", + "safe_meaning": "A declared runtime file is empty.", + "rule": "registryctl.preflight.runtime_file_bounded_regular", + "safe_remediation": "Replace the runtime file.", + "field_address_pattern": "", + "evidence_scope": "offline local operator preflight", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registryctl--registryctl.preflight.runtime_file_empty", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Preflight does not contact live sources or prove remote availability." + }, + { + "family": "operator_preflight", + "code": "registryctl.preflight.runtime_file_missing", + "owner": "registryctl", + "product": "registryctl", + "phase": "runtime_file_posture", + "safe_meaning": "A declared runtime file is missing.", + "rule": "registryctl.preflight.runtime_file_bounded_regular", + "safe_remediation": "Replace the runtime file.", + "field_address_pattern": "", + "evidence_scope": "offline local operator preflight", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registryctl--registryctl.preflight.runtime_file_missing", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Preflight does not contact live sources or prove remote availability." + }, + { + "family": "operator_preflight", + "code": "registryctl.preflight.runtime_file_not_checked", + "owner": "registryctl", + "product": "registryctl", + "phase": "runtime_file_posture", + "safe_meaning": "Runtime file posture could not be checked with the required local invariant.", + "rule": "registryctl.preflight.runtime_file_posture_supported", + "safe_remediation": "Run preflight on a supported Unix platform.", + "field_address_pattern": "", + "evidence_scope": "offline local operator preflight", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registryctl--registryctl.preflight.runtime_file_not_checked", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Preflight does not contact live sources or prove remote availability." + }, + { + "family": "operator_preflight", + "code": "registryctl.preflight.runtime_file_not_regular", + "owner": "registryctl", + "product": "registryctl", + "phase": "runtime_file_posture", + "safe_meaning": "A declared runtime file is not an acceptable bounded regular file.", + "rule": "registryctl.preflight.runtime_file_bounded_regular", + "safe_remediation": "Replace the runtime file.", + "field_address_pattern": "", + "evidence_scope": "offline local operator preflight", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registryctl--registryctl.preflight.runtime_file_not_regular", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Preflight does not contact live sources or prove remote availability." + }, + { + "family": "operator_preflight", + "code": "registryctl.preflight.runtime_file_unsafe_mode", + "owner": "registryctl", + "product": "registryctl", + "phase": "runtime_file_posture", + "safe_meaning": "A declared runtime file has unsafe local access permissions.", + "rule": "registryctl.preflight.runtime_file_safe_mode", + "safe_remediation": "Tighten runtime file permissions.", + "field_address_pattern": "", + "evidence_scope": "offline local operator preflight", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registryctl--registryctl.preflight.runtime_file_unsafe_mode", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Preflight does not contact live sources or prove remote availability." + }, + { + "family": "operator_preflight", + "code": "registryctl.preflight.runtime_file_unsafe_owner", + "owner": "registryctl", + "product": "registryctl", + "phase": "runtime_file_posture", + "safe_meaning": "A declared runtime file has an unsafe owner.", + "rule": "registryctl.preflight.runtime_file_safe_owner", + "safe_remediation": "Set the runtime file owner.", + "field_address_pattern": "", + "evidence_scope": "offline local operator preflight", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registryctl--registryctl.preflight.runtime_file_unsafe_owner", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Preflight does not contact live sources or prove remote availability." + }, + { + "family": "operator_preflight", + "code": "registryctl.preflight.secret_empty", + "owner": "registryctl", + "product": "registryctl", + "phase": "secret_availability", + "safe_meaning": "A required secret reference contains only whitespace.", + "rule": "registryctl.preflight.secret_reference_available", + "safe_remediation": "Provide a non-empty secret to the process environment.", + "field_address_pattern": "", + "evidence_scope": "offline local operator preflight", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registryctl--registryctl.preflight.secret_empty", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Preflight does not contact live sources or prove remote availability." + }, + { + "family": "operator_preflight", + "code": "registryctl.preflight.secret_missing", + "owner": "registryctl", + "product": "registryctl", + "phase": "secret_availability", + "safe_meaning": "A required secret reference is unavailable to this process.", + "rule": "registryctl.preflight.secret_reference_available", + "safe_remediation": "Provide the secret to the process environment.", + "field_address_pattern": "", + "evidence_scope": "offline local operator preflight", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registryctl--registryctl.preflight.secret_missing", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Preflight does not contact live sources or prove remote availability." + }, + { + "family": "operator_preflight", + "code": "registryctl.preflight.static_validation_not_checked", + "owner": "registryctl", + "product": "registryctl", + "phase": "static_validation", + "safe_meaning": "Required authoritative static validation was not completed.", + "rule": "registryctl.preflight.authoritative_static_validation", + "safe_remediation": "Complete authoritative static validation.", + "field_address_pattern": "", + "evidence_scope": "offline local operator preflight", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registryctl--registryctl.preflight.static_validation_not_checked", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "Preflight does not contact live sources or prove remote availability." + }, + { + "family": "relay_activation", + "code": "relay.consultation.activation.artifact_registry_invalid", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "consultation_activation", + "safe_meaning": "Relay could not compile the verified consultation artifact registry.", + "rule": "The verified artifact closure must compile into one closed registry without conflicting public profiles.", + "safe_remediation": "Rebuild and verify the exact consultation artifact closure before restarting Relay.", + "field_address_pattern": null, + "evidence_scope": "verified consultation artifact closure and compiled public profiles", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--artifact-registry-invalid", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose paths, URLs, parser excerpts, hashes, credentials, identifiers, or authored values." + }, + { + "family": "relay_activation", + "code": "relay.consultation.activation.configuration_missing", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "consultation_activation", + "safe_meaning": "Relay consultation activation requires configuration that is not present.", + "rule": "The closed consultation configuration must exist before Relay compiles serving authority.", + "safe_remediation": "Provide a validated Relay consultation configuration and restart Relay.", + "field_address_pattern": null, + "evidence_scope": "Relay consultation configuration and serving authority", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--configuration-missing", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose paths, URLs, parser excerpts, hashes, credentials, identifiers, or authored values." + }, + { + "family": "relay_activation", + "code": "relay.consultation.activation.protected_metadata_invalid", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "consultation_activation", + "safe_meaning": "Relay could not construct bounded protected consultation metadata.", + "rule": "Protected metadata must contain one strict bounded public contract and its reviewed binding.", + "safe_remediation": "Regenerate and verify the consultation artifact closure, then restart Relay.", + "field_address_pattern": null, + "evidence_scope": "protected consultation metadata, public contract, and reviewed binding", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--protected-metadata-invalid", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose paths, URLs, parser excerpts, hashes, credentials, identifiers, or authored values." + }, + { + "family": "relay_activation", + "code": "relay.consultation.activation.pseudonym_material_unavailable", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "consultation_activation", + "safe_meaning": "Relay could not activate the pseudonym material required for consultation audit evidence.", + "rule": "The configured pseudonym material must be valid and bind to the current write authority.", + "safe_remediation": "Restore the reviewed pseudonym material and write authority, then restart Relay.", + "field_address_pattern": null, + "evidence_scope": "consultation pseudonym material and current write authority", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--pseudonym-material-unavailable", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose paths, URLs, parser excerpts, hashes, credentials, identifiers, or authored values." + }, + { + "family": "relay_activation", + "code": "relay.consultation.activation.quota_limits_invalid", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "consultation_activation", + "safe_meaning": "Relay could not activate the bounded consultation quota contract.", + "rule": "Public and effective quota limits must remain representable, positive, and non-widening.", + "safe_remediation": "Correct the reviewed quota limits and rebuild the consultation artifacts.", + "field_address_pattern": null, + "evidence_scope": "public and effective consultation quota limits", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--quota-limits-invalid", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose paths, URLs, parser excerpts, hashes, credentials, identifiers, or authored values." + }, + { + "family": "relay_activation", + "code": "relay.consultation.activation.source_credentials_unavailable", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "consultation_activation", + "safe_meaning": "Relay could not activate the source-credential capability required by the consultation registry.", + "rule": "Every compiled source plan must have exactly the credential capability it declares.", + "safe_remediation": "Restore the reviewed source-credential references and restart Relay.", + "field_address_pattern": null, + "evidence_scope": "compiled consultation source plans and credential capabilities", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--source-credentials-unavailable", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose paths, URLs, parser excerpts, hashes, credentials, identifiers, or authored values." + }, + { + "family": "relay_activation", + "code": "relay.consultation.activation.state_plane_unavailable", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "consultation_activation", + "safe_meaning": "Relay could not activate the consultation state plane and its current authority.", + "rule": "The state plane, durable audit boundary, quota state, and current write authority must activate together.", + "safe_remediation": "Restore the reviewed Relay state-plane dependencies and restart Relay.", + "field_address_pattern": null, + "evidence_scope": "consultation state plane, audit boundary, quota state, and write authority", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--state-plane-unavailable", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose paths, URLs, parser excerpts, hashes, credentials, identifiers, or authored values." + }, + { + "family": "relay_activation", + "code": "relay.consultation.activation.unsupported_plan", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "consultation_activation", + "safe_meaning": "A compiled consultation plan requires a capability this Relay runtime cannot activate.", + "rule": "Every plan, worker, transport, snapshot binding, and dispatch budget must use a compiled supported capability.", + "safe_remediation": "Use a Relay release that supports the reviewed plan or rebuild the plan with supported capabilities.", + "field_address_pattern": null, + "evidence_scope": "compiled consultation plan and Relay runtime capabilities", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--unsupported-plan", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose paths, URLs, parser excerpts, hashes, credentials, identifiers, or authored values." + }, + { + "family": "relay_activation", + "code": "relay.consultation.activation.workload_binding_invalid", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "consultation_activation", + "safe_meaning": "The configured consultation workload binding is incompatible with Relay authentication.", + "rule": "Issuer, audience, client binding, principal, and selector must satisfy the closed Relay workload contract.", + "safe_remediation": "Align the reviewed consultation workload binding with Relay authentication and restart Relay.", + "field_address_pattern": null, + "evidence_scope": "consultation workload binding and Relay authentication contract", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--workload-binding-invalid", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose paths, URLs, parser excerpts, hashes, credentials, identifiers, or authored values." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.admin_listener_address_in_use", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "listener_binding", + "safe_meaning": "Relay could not open the administration listener because its binding is already in use.", + "rule": "registry.relay.startup.admin_listener_binding_is_unused", + "safe_remediation": "Resolve the listener conflict for server.admin_bind in its owning deployment input; if generated, update the authored project and regenerate the Relay input, then retry.", + "field_address_pattern": null, + "evidence_scope": "configured Relay administration listener and closed bind-failure category", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--admin-listener-address-in-use", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category names server.admin_bind and address-in-use status but does not disclose its address, port, or operating-system error." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.admin_listener_permission_denied", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "listener_binding", + "safe_meaning": "Relay lacks permission to open the configured administration listener.", + "rule": "registry.relay.startup.admin_listener_binding_is_permitted", + "safe_remediation": "Choose a permitted server.admin_bind and correct the service account or network policy in its owning deployment input; regenerate generated Relay input, then retry.", + "field_address_pattern": null, + "evidence_scope": "configured Relay administration listener and closed bind-failure category", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--admin-listener-permission-denied", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category names server.admin_bind and permission-denied status but does not disclose its address, port, account identity, or operating-system error." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.admin_listener_unavailable", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "listener_binding", + "safe_meaning": "Relay could not open the configured administration listener.", + "rule": "registry.relay.startup.admin_listener_is_available", + "safe_remediation": "Check interface availability, address-family support, and deployment networking for server.admin_bind in its owning input; regenerate generated Relay input, then retry.", + "field_address_pattern": null, + "evidence_scope": "configured Relay administration listener and closed bind-failure category", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--admin-listener-unavailable", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The fallback category names server.admin_bind but does not disclose its address, port, or operating-system error." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.bundle_binding_rejected", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "bundle_verification", + "safe_meaning": "The governed bundle does not match this Relay runtime target.", + "rule": "registry.relay.startup.bundle_binding_matches_runtime", + "safe_remediation": "Use a governed bundle issued for this Relay runtime target.", + "field_address_pattern": null, + "evidence_scope": "governed bundle and Relay runtime binding", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--bundle-binding-rejected", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose configured or received binding values." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.bundle_rollback_rejected", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "bundle_activation", + "safe_meaning": "The governed bundle or override failed Relay anti-rollback checks.", + "rule": "registry.relay.startup.bundle_antirollback_satisfied", + "safe_remediation": "Use a monotonic governed bundle or an authorized break-glass selection.", + "field_address_pattern": null, + "evidence_scope": "local anti-rollback state and governed bundle or override metadata", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--bundle-rollback-rejected", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose sequences, hashes, paths, operators, or approval values." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.bundle_signature_rejected", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "bundle_verification", + "safe_meaning": "The governed bundle failed authenticity or content-integrity verification.", + "rule": "registry.relay.startup.bundle_authenticity_and_integrity_accepted", + "safe_remediation": "Rebuild and sign the complete bundle with an accepted trust configuration.", + "field_address_pattern": null, + "evidence_scope": "bundle trust metadata, signature envelope, file closure, and content digests", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--bundle-signature-rejected", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose signer identifiers, file names, hashes, or trust-anchor values." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.bundle_validation_rejected", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "bundle_verification", + "safe_meaning": "The governed bundle or local acceptance metadata is invalid.", + "rule": "registry.relay.startup.bundle_inputs_are_valid", + "safe_remediation": "Regenerate the bundle and acceptance metadata using supported formats.", + "field_address_pattern": null, + "evidence_scope": "bundle encoding, manifest, acceptance metadata, and required local inputs", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--bundle-validation-rejected", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose parser excerpts, local paths, hashes, identities, or supplied values." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.config_deprecated_field_rejected", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "config_document_validation", + "safe_meaning": "A Relay configuration document uses a field that the current runtime no longer accepts.", + "rule": "registry.relay.startup.config_uses_current_fields", + "safe_remediation": "Compare the authored input with the current Relay schema and migration guidance, replace deprecated fields, regenerate generated Relay input, then retry.", + "field_address_pattern": null, + "evidence_scope": "Relay configuration field names and the product-owned deprecated-field registry", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--config-deprecated-field-rejected", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose the configured field path, replacement, source path, or supplied values. Run authored-project validation for field-addressed guidance." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.config_document_invalid", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "config_document_validation", + "safe_meaning": "A Relay configuration or metadata document does not match its required syntax or typed schema.", + "rule": "registry.relay.startup.config_document_is_typed", + "safe_remediation": "Compare the authored input with the current Relay schema, run authored-project validation when generated, correct the document, regenerate generated Relay input, then retry.", + "field_address_pattern": null, + "evidence_scope": "Relay configuration and metadata document encoding, syntax, field grammar, and types", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--config-document-invalid", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose parser excerpts, field paths, local paths, or supplied values. It does not claim field-level diagnostics were emitted." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.config_environment_binding_rejected", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "config_environment_expansion", + "safe_meaning": "A required Relay configuration environment binding could not be expanded safely.", + "rule": "registry.relay.startup.config_environment_bindings_expand", + "safe_remediation": "Check the authored environment expressions and required deployment bindings, then run Relay doctor against the same configuration before retrying.", + "field_address_pattern": null, + "evidence_scope": "Relay configuration environment expressions and deployment-provided bindings", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--config-environment-binding-rejected", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose environment names, expansion errors, source paths, or supplied values. It does not claim field-level diagnostics were emitted." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.config_source_unavailable", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "config_loading", + "safe_meaning": "A required Relay configuration or metadata source could not be read.", + "rule": "registry.relay.startup.config_source_is_readable", + "safe_remediation": "Check the --config source and any configured metadata.source.path, restore readable input from its owner, regenerate generated Relay input instead of editing it in place, then retry.", + "field_address_pattern": null, + "evidence_scope": "Relay configuration and metadata sources", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--config-source-unavailable", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose local paths, operating-system errors, or source contents." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.config_validation_rejected", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "config_validation", + "safe_meaning": "The parsed Relay configuration failed product validation.", + "rule": "registry.relay.startup.config_product_invariants_hold", + "safe_remediation": "Run the authored-project validator, correct its field-addressed issues and governed bindings, regenerate the Relay input, then retry.", + "field_address_pattern": null, + "evidence_scope": "parsed Relay configuration and governed runtime bindings", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--config-validation-rejected", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose configured identifiers, URLs, environment names, hashes, or source values." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.consultation_artifacts_rejected", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "consultation_activation", + "safe_meaning": "The governed consultation artifact closure failed startup validation.", + "rule": "registry.relay.startup.consultation_artifact_closure_is_valid", + "safe_remediation": "Rebuild the complete hash-covered consultation artifact closure and retry.", + "field_address_pattern": null, + "evidence_scope": "governed consultation artifact closure and runtime bindings", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--consultation-artifacts-rejected", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose artifact paths, hashes, selectors, identities, or parser excerpts." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.data_listener_address_in_use", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "listener_binding", + "safe_meaning": "Relay could not open the data-plane listener because its binding is already in use.", + "rule": "registry.relay.startup.data_listener_binding_is_unused", + "safe_remediation": "Resolve the listener conflict for server.bind in its owning deployment input; if generated, update the authored project and regenerate the Relay input, then retry.", + "field_address_pattern": null, + "evidence_scope": "configured Relay data-plane listener and closed bind-failure category", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--data-listener-address-in-use", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category names server.bind and address-in-use status but does not disclose its address, port, or operating-system error." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.data_listener_permission_denied", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "listener_binding", + "safe_meaning": "Relay lacks permission to open the configured data-plane listener.", + "rule": "registry.relay.startup.data_listener_binding_is_permitted", + "safe_remediation": "Choose a permitted server.bind and correct the service account or network policy in its owning deployment input; regenerate generated Relay input, then retry.", + "field_address_pattern": null, + "evidence_scope": "configured Relay data-plane listener and closed bind-failure category", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--data-listener-permission-denied", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category names server.bind and permission-denied status but does not disclose its address, port, account identity, or operating-system error." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.data_listener_unavailable", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "listener_binding", + "safe_meaning": "Relay could not open the configured data-plane listener.", + "rule": "registry.relay.startup.data_listener_is_available", + "safe_remediation": "Check interface availability, address-family support, and deployment networking for server.bind in its owning input; regenerate generated Relay input, then retry.", + "field_address_pattern": null, + "evidence_scope": "configured Relay data-plane listener and closed bind-failure category", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--data-listener-unavailable", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The fallback category names server.bind but does not disclose its address, port, or operating-system error." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.doctor_failed", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "operator_diagnostics", + "safe_meaning": "Relay doctor found one or more blocking diagnostics.", + "rule": "registry.relay.startup.doctor_has_no_blocking_diagnostics", + "safe_remediation": "Use the static diagnostic codes and actions in the doctor report.", + "field_address_pattern": null, + "evidence_scope": "offline Relay readiness and deployment diagnostics", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--doctor-failed", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The process failure does not repeat diagnostic source values or report internals." + }, + { + "family": "relay_process_startup", + "code": "relay.startup.runtime_initialization_failed", + "owner": "registry_relay", + "product": "registry_relay", + "phase": "runtime_initialization", + "safe_meaning": "Relay runtime initialization failed.", + "rule": "registry.relay.startup.runtime_initializes", + "safe_remediation": "Review preceding static diagnostic codes, correct the runtime inputs, and retry.", + "field_address_pattern": null, + "evidence_scope": "Relay runtime dependencies and protected startup capabilities", + "secret_sensitive_value_policy": "no_runtime_values", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--runtime-initialization-failed", + "lifecycle": "unreleased", + "introduced_in": null, + "stability": "pre1_stable_code", + "evidence_limitation": "The category does not disclose inner errors, paths, URLs, identities, hashes, or supplied values." + } + ], + "omissions": [] +} diff --git a/docs/site/src/data/generated/docsets.json b/docs/site/src/data/generated/docsets.json index 3720fa428..dd49a5498 100644 --- a/docs/site/src/data/generated/docsets.json +++ b/docs/site/src/data/generated/docsets.json @@ -3,27 +3,28 @@ "docsets": [ { "id": "latest", - "label": "Latest", + "label": "Main source (unreleased)", "path": "/", "status": "current", + "availability": "unreleased", "source": "registry-stack-main", "published_at": "2026-06-24", - "description": "Current RegistryStack monorepo documentation build.", + "description": "Current unreleased RegistryStack source documentation from main; this is not v0.13.0 release proof.", "products": { "registry-stack": { - "version": "v0.13.0", + "version": "main source (unreleased)", "ref": "HEAD" }, "registry-relay": { - "version": "v0.13.0", + "version": "main source (unreleased)", "ref": "HEAD" }, "registry-notary": { - "version": "v0.13.0", + "version": "main source (unreleased)", "ref": "HEAD" }, "registry-manifest": { - "version": "v0.13.0", + "version": "main source (unreleased)", "ref": "HEAD" } } @@ -33,10 +34,11 @@ "label": "v0.13.0", "path": "/v/0.13.0/", "status": "archived", + "availability": "released", "source": "registry-stack-v0.13.0", "repo_docs_source": "monorepo", "published_at": "2026-07-25", - "description": "RegistryStack v0.13.0 beta-17 documentation set.", + "description": "Released RegistryStack v0.13.0 beta-17 documentation set pinned to its immutable source.", "products": { "registry-stack": { "version": "v0.13.0", @@ -73,6 +75,7 @@ "label": "v0.12.2", "path": "/v/0.12.2/", "status": "archived", + "availability": "released", "source": "registry-stack-v0.12.2", "repo_docs_source": "monorepo", "published_at": "2026-07-20", @@ -113,6 +116,7 @@ "label": "v0.12.1", "path": "/v/0.12.1/", "status": "archived", + "availability": "released", "source": "registry-stack-v0.12.1", "repo_docs_source": "monorepo", "published_at": "2026-07-20", @@ -153,6 +157,7 @@ "label": "v0.12.0", "path": "/v/0.12.0/", "status": "archived", + "availability": "released", "source": "registry-stack-v0.12.0", "repo_docs_source": "monorepo", "published_at": "2026-07-19", @@ -193,6 +198,7 @@ "label": "v0.11.0", "path": "/v/0.11.0/", "status": "archived", + "availability": "released", "source": "registry-stack-v0.11.0", "repo_docs_source": "monorepo", "published_at": "2026-07-18", @@ -233,6 +239,7 @@ "label": "v0.10.0", "path": "/v/0.10.0/", "status": "archived", + "availability": "released", "source": "registry-stack-v0.10.0", "repo_docs_source": "monorepo", "published_at": "2026-07-17", @@ -273,6 +280,7 @@ "label": "v0.9.0", "path": "/v/0.9.0/", "status": "archived", + "availability": "released", "source": "registry-stack-v0.9.0", "repo_docs_source": "monorepo", "published_at": "2026-07-10", @@ -325,6 +333,7 @@ "label": "v0.8.4", "path": "/v/0.8.4/", "status": "archived", + "availability": "released", "source": "registry-stack-v0.8.4", "repo_docs_source": "monorepo", "published_at": "2026-07-04", @@ -377,6 +386,7 @@ "label": "v0.8.3", "path": "/v/0.8.3/", "status": "archived", + "availability": "released", "source": "registry-stack-v0.8.3", "repo_docs_source": "monorepo", "published_at": "2026-06-26", @@ -429,6 +439,7 @@ "label": "v0.8.2", "path": "/v/0.8.2/", "status": "archived", + "availability": "released", "source": "registry-stack-v0.8.2", "repo_docs_source": "monorepo", "published_at": "2026-06-25", @@ -481,6 +492,7 @@ "label": "v0.8.1", "path": "/v/0.8.1/", "status": "archived", + "availability": "released", "source": "registry-stack-v0.8.1", "repo_docs_source": "monorepo", "published_at": "2026-06-25", @@ -533,6 +545,7 @@ "label": "Beta 5", "path": "/v/beta-5/", "status": "archived", + "availability": "candidate", "source": "registry-stack-beta-5", "published_at": "2026-06-24", "description": "Beta-5 source-release documentation set prepared for release proof.", @@ -576,6 +589,7 @@ "label": "Beta 4", "path": "/v/beta-4/", "status": "archived", + "availability": "candidate", "source": "registry-stack-beta-4", "published_at": "2026-06-22", "description": "Beta-4 source-release documentation set prepared for release proof.", @@ -619,6 +633,7 @@ "label": "Beta 3", "path": "/v/beta-3/", "status": "archived", + "availability": "candidate", "source": "registry-stack-beta-3", "published_at": "2026-06-21", "description": "Beta-3 candidate documentation set prepared for release proof.", @@ -662,6 +677,7 @@ "label": "Beta 2026-06-12", "path": "/v/beta-2026-06-12/", "status": "archived", + "availability": "candidate", "source": "registry-stack-beta-2026-06-12", "published_at": "2026-06-12", "description": "Frozen public beta documentation set.", diff --git a/docs/site/src/data/generated/project-authoring-journeys.json b/docs/site/src/data/generated/project-authoring-journeys.json index ef4be2220..ef9c276ca 100644 --- a/docs/site/src/data/generated/project-authoring-journeys.json +++ b/docs/site/src/data/generated/project-authoring-journeys.json @@ -15,6 +15,7 @@ "watch", "test", "check", + "compare", "build" ], "integration": "person-record", @@ -26,6 +27,7 @@ "registryctl test --project-dir registry-project --integration person-record --fixture active-person --watch", "registryctl test --project-dir registry-project", "registryctl check --project-dir registry-project --environment local --explain", + "registryctl compare --project-dir registry-project --environment local --from-starter", "registryctl build --project-dir registry-project --environment local" ] }, @@ -89,6 +91,7 @@ "watch", "test", "check", + "compare", "build" ], "integration": "health-record", @@ -100,6 +103,7 @@ "registryctl test --project-dir dhis2-project --integration health-record --fixture complete-child-health-evidence --watch", "registryctl test --project-dir dhis2-project", "registryctl check --project-dir dhis2-project --environment local --explain", + "registryctl compare --project-dir dhis2-project --environment local --from-starter", "registryctl build --project-dir dhis2-project --environment local" ] }, @@ -119,6 +123,7 @@ "watch", "test", "check", + "compare", "build" ], "integration": "coverage", @@ -130,6 +135,7 @@ "registryctl test --project-dir fhir-project --integration coverage --fixture coverage-active --watch", "registryctl test --project-dir fhir-project", "registryctl check --project-dir fhir-project --environment local --explain", + "registryctl compare --project-dir fhir-project --environment local --from-starter", "registryctl build --project-dir fhir-project --environment local" ] }, @@ -167,6 +173,7 @@ "watch", "test", "check", + "compare", "build" ], "integration": "birth-record", @@ -178,6 +185,7 @@ "registryctl test --project-dir opencrvs-project --integration birth-record --fixture birth-record-match --watch", "registryctl test --project-dir opencrvs-project", "registryctl check --project-dir opencrvs-project --environment local --explain", + "registryctl compare --project-dir opencrvs-project --environment local --from-starter", "registryctl build --project-dir opencrvs-project --environment local" ] }, @@ -282,6 +290,7 @@ "watch", "test", "check", + "compare", "build" ], "integration": "person-snapshot", @@ -293,6 +302,7 @@ "registryctl test --project-dir snapshot-project --integration person-snapshot --fixture snapshot-match --watch", "registryctl test --project-dir snapshot-project", "registryctl check --project-dir snapshot-project --environment local --explain", + "registryctl compare --project-dir snapshot-project --environment local --from-starter", "registryctl build --project-dir snapshot-project --environment local" ] }, diff --git a/docs/site/src/data/generated/project-starters.json b/docs/site/src/data/generated/project-starters.json index b9730c018..b43e07a22 100644 --- a/docs/site/src/data/generated/project-starters.json +++ b/docs/site/src/data/generated/project-starters.json @@ -15,6 +15,7 @@ "watch", "test", "check", + "compare", "build" ], "integration": "person-record", @@ -26,6 +27,7 @@ "registryctl test --project-dir registry-project --integration person-record --fixture active-person --watch", "registryctl test --project-dir registry-project", "registryctl check --project-dir registry-project --environment local --explain", + "registryctl compare --project-dir registry-project --environment local --from-starter", "registryctl build --project-dir registry-project --environment local" ] }, @@ -45,6 +47,7 @@ "watch", "test", "check", + "compare", "build" ], "integration": "health-record", @@ -56,6 +59,7 @@ "registryctl test --project-dir dhis2-project --integration health-record --fixture complete-child-health-evidence --watch", "registryctl test --project-dir dhis2-project", "registryctl check --project-dir dhis2-project --environment local --explain", + "registryctl compare --project-dir dhis2-project --environment local --from-starter", "registryctl build --project-dir dhis2-project --environment local" ] }, @@ -75,6 +79,7 @@ "watch", "test", "check", + "compare", "build" ], "integration": "birth-record", @@ -86,6 +91,7 @@ "registryctl test --project-dir opencrvs-project --integration birth-record --fixture birth-record-match --watch", "registryctl test --project-dir opencrvs-project", "registryctl check --project-dir opencrvs-project --environment local --explain", + "registryctl compare --project-dir opencrvs-project --environment local --from-starter", "registryctl build --project-dir opencrvs-project --environment local" ] }, @@ -105,6 +111,7 @@ "watch", "test", "check", + "compare", "build" ], "integration": "coverage", @@ -116,6 +123,7 @@ "registryctl test --project-dir fhir-project --integration coverage --fixture coverage-active --watch", "registryctl test --project-dir fhir-project", "registryctl check --project-dir fhir-project --environment local --explain", + "registryctl compare --project-dir fhir-project --environment local --from-starter", "registryctl build --project-dir fhir-project --environment local" ] }, @@ -135,6 +143,7 @@ "watch", "test", "check", + "compare", "build" ], "integration": "person-snapshot", @@ -146,6 +155,7 @@ "registryctl test --project-dir snapshot-project --integration person-snapshot --fixture snapshot-match --watch", "registryctl test --project-dir snapshot-project", "registryctl check --project-dir snapshot-project --environment local --explain", + "registryctl compare --project-dir snapshot-project --environment local --from-starter", "registryctl build --project-dir snapshot-project --environment local" ] } diff --git a/docs/site/src/data/generated/standard-journeys.json b/docs/site/src/data/generated/standard-journeys.json new file mode 100644 index 000000000..f353c9a99 --- /dev/null +++ b/docs/site/src/data/generated/standard-journeys.json @@ -0,0 +1,2712 @@ +[ + { + "id": "spreadsheet-protected-api", + "slug": "journeys/spreadsheet-protected-api", + "title": "Publish a spreadsheet through a protected API", + "description": "Generate the maintained local spreadsheet scaffold, verify its protected Relay surface, and identify which files become human-owned after generation.", + "outcome": "A synthetic spreadsheet is available through a purpose-limited Relay API, with anonymous and under-scoped requests denied.", + "level": "Beginner, local runtime", + "prerequisites": [ + "A Main-source registryctl binary and image lock built from one recorded commit", + "A Docker Compose provider", + "curl" + ], + "expected_time": "15 to 25 minutes", + "evidence_class": "source_and_generated_contract", + "evidence_lifecycle": "main_unreleased", + "availability": { + "status": "current_unreleased", + "proof": "source_tree", + "release": null + }, + "canonical_sources": [ + "crates/registryctl/src/lib.rs", + "crates/registryctl/src/sample.rs", + "crates/registryctl/src/templates/relay_config.yaml.tmpl", + "crates/registryctl/src/templates/compose.yaml", + "crates/registryctl/tests/init_output.rs" + ], + "canonical_workspace": { + "id": "registry-relay", + "path": "crates/registryctl" + }, + "catalog_references": [ + { + "catalog": "projects", + "id": "registry-relay" + } + ], + "minimal_configuration": { + "files": [ + { + "source": "crates/registryctl/src/templates/relay_config.yaml.tmpl", + "destination": "my-first-api/relay/config.yaml", + "format": "scaffolded", + "public_boundary": "generated_template" + } + ], + "note": "The exact init step emits the complete disposable sample. The template is linked as its canonical source but is not rendered with unresolved generation tokens; review the emitted relay/config.yaml before runtime use." + }, + "artifacts": [ + { + "path": "my-first-api/registryctl.yaml", + "classification": "scaffolded_human_owned", + "owner": "country_author", + "human_edit": true, + "version_control": true, + "note": "Registryctl creates this project manifest, but later edits are human-authored intent. It is not registryctl build output." + }, + { + "path": "my-first-api/relay/config.yaml", + "classification": "scaffolded_human_owned", + "owner": "operator", + "human_edit": true, + "version_control": true, + "note": "Registryctl creates the first Relay runtime configuration. The operator owns subsequent policy, caller, and data-binding review." + }, + { + "path": "my-first-api/data/benefits_casework.xlsx", + "classification": "synthetic_fixture", + "owner": "country_author", + "human_edit": true, + "version_control": true, + "note": "The generated workbook contains synthetic tutorial records only." + }, + { + "path": "my-first-api/secrets/local.env", + "classification": "environment_binding", + "owner": "operator", + "human_edit": true, + "version_control": false, + "note": "Registryctl generates local-only credentials. This file must not be reused or committed." + }, + { + "path": "my-first-api/output/smoke-results.json", + "classification": "runtime_observed", + "owner": "registryctl", + "human_edit": false, + "version_control": false, + "note": "The report records one local runtime observation and is not authored configuration." + } + ], + "fixture": { + "source": "crates/registryctl/src/sample.rs", + "format": "generated_sample", + "expected_trace": [ + "Registryctl generates the synthetic benefits workbook and local-only credentials.", + "Relay starts only after strict configuration and deployment gates pass.", + "Anonymous access is denied, purpose and scope are enforced, and the row reader receives only allowed fields.", + "The smoke report records local statuses without exposing credential values." + ] + }, + "contract": { + "proves": [ + "The source-under-test scaffold can start one local Relay over synthetic tabular data.", + "Protected metadata and record operations enforce configured caller, scope, purpose, and field-release boundaries.", + "Scaffolded runtime files and runtime-observed reports have distinct ownership." + ], + "does_not_prove": [ + "Compatibility with a country spreadsheet, database, identity provider, or network.", + "Production key custody, policy approval, legal approval, or operational resilience.", + "That generated local credentials are suitable outside this disposable journey." + ] + }, + "command_recipe": { + "kind": "spreadsheet_runtime" + }, + "review": [ + "Inspect registryctl.yaml and relay/config.yaml before first start; treat both as human-owned after scaffolding.", + "Confirm secrets/local.env is excluded from version control and contains no real credential.", + "Inspect output/smoke-results.json as runtime evidence, not as configuration or production acceptance." + ], + "gates": [ + { + "name": "Registryctl doctor", + "proves": "The local scaffold, runtime files, and selected local posture pass the product checks reached by doctor.", + "does_not_prove": "Source accuracy, production readiness, or approval of generated credentials." + }, + { + "name": "Relay startup validation", + "proves": "Relay accepted the strict configuration and reached the configured local listener.", + "does_not_prove": "The configuration is authorized for a production environment." + }, + { + "name": "Registryctl smoke", + "proves": "Maintained synthetic allowed and denied requests behaved as expected against the local runtime.", + "does_not_prove": "Live-source interoperability, load behavior, disaster recovery, or external acceptance." + } + ], + "production_delta": { + "environment": "Bind the reviewed candidate to the intended production environment and product instance.", + "secrets": "Provision credentials and trust material through operator-managed references.", + "approval": "Record country-author, product-owner, and operator approval for the reviewed candidate.", + "signing": "Sign each immutable product input with the authorized product-specific identity.", + "activation": "Verify, activate, observe, and retain rollback evidence independently for each product." + }, + "troubleshooting": [ + { + "code": "relay.startup.config_document_invalid", + "family": "relay_process_startup", + "product": "registry_relay", + "meaning": "A Relay configuration or metadata document does not match its required syntax or typed schema.", + "remediation": "Compare the authored input with the current Relay schema, run authored-project validation when generated, correct the document, regenerate generated Relay input, then retry.", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--config-document-invalid", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "The category does not disclose parser excerpts, field paths, local paths, or supplied values. It does not claim field-level diagnostics were emitted." + }, + { + "code": "relay.startup.config_validation_rejected", + "family": "relay_process_startup", + "product": "registry_relay", + "meaning": "The parsed Relay configuration failed product validation.", + "remediation": "Run the authored-project validator, correct its field-addressed issues and governed bindings, regenerate the Relay input, then retry.", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--config-validation-rejected", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "The category does not disclose configured identifiers, URLs, environment names, hashes, or source values." + }, + { + "code": "relay.startup.data_listener_unavailable", + "family": "relay_process_startup", + "product": "registry_relay", + "meaning": "Relay could not open the configured data-plane listener.", + "remediation": "Check interface availability, address-family support, and deployment networking for server.bind in its owning input; regenerate generated Relay input, then retry.", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--data-listener-unavailable", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "The fallback category names server.bind but does not disclose its address, port, or operating-system error." + }, + { + "code": "relay.startup.doctor_failed", + "family": "relay_process_startup", + "product": "registry_relay", + "meaning": "Relay doctor found one or more blocking diagnostics.", + "remediation": "Use the static diagnostic codes and actions in the doctor report.", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--doctor-failed", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "The process failure does not repeat diagnostic source values or report internals." + } + ], + "next_task": { + "label": "Inspect the instance OpenAPI", + "href": "/journeys/instance-openapi/" + }, + "evidence": { + "extraction": { + "status": "verified", + "source_path": "docs/site/scripts/generate-standard-journeys.test.mjs", + "test_id": "extracts every declared complete configuration file from its canonical source", + "command": "node --test scripts/generate-standard-journeys.test.mjs", + "workflow": ".github/workflows/ci.yml#docs", + "revision": "main", + "lifecycle": "current_unreleased" + }, + "execution": { + "status": "verified", + "source_path": "docs/site/scripts/check-registryctl-tutorials.sh", + "test_id": "run_relay_tutorial()", + "command": "npm run check:tutorial:registryctl", + "workflow": ".github/workflows/ci.yml#registryctl-tutorials", + "revision": "main", + "lifecycle": "current_unreleased" + }, + "runtime": { + "status": "verified", + "source_path": "docs/site/scripts/check-registryctl-tutorials.sh", + "test_id": "run_relay_tutorial()", + "command": "npm run check:tutorial:registryctl", + "workflow": ".github/workflows/ci.yml#registryctl-tutorials", + "revision": "main", + "lifecycle": "current_unreleased" + } + }, + "source_label": "Main source (unreleased)", + "section_headings": [ + "Outcome and prerequisites", + "Smallest complete configuration", + "Project tree and artifact ownership", + "Synthetic fixture and expected trace", + "Contract this journey proves", + "Test, explain, compare, and build", + "Review authored and generated artifacts", + "What each gate proves", + "Production delta", + "Troubleshooting and next task" + ], + "configuration_files": [ + { + "source": "crates/registryctl/src/templates/relay_config.yaml.tmpl", + "destination": "my-first-api/relay/config.yaml", + "format": "scaffolded", + "public_boundary": "generated_template", + "language": null, + "content": null + } + ], + "fixture_excerpt": { + "language": "text", + "content": "Generated synthetic sample: crates/registryctl/src/sample.rs\n" + }, + "steps": [ + { + "id": "spreadsheet-init", + "kind": "command", + "label": "Create the disposable spreadsheet scaffold", + "cwd": ".", + "argv": [ + "registryctl", + "init", + "relay", + "my-first-api", + "--sample", + "benefits" + ] + }, + { + "id": "spreadsheet-doctor", + "kind": "alternative", + "label": "Product doctor", + "cwd": "my-first-api", + "argv": [ + "registryctl", + "doctor", + "--profile", + "local" + ], + "note": "Run after the source-built product commands and Docker provider are available." + }, + { + "id": "spreadsheet-start", + "kind": "long_running", + "label": "Start the disposable local runtime", + "cwd": "my-first-api", + "argv": [ + "registryctl", + "start" + ], + "note": "This is a long-running runtime boundary and is exercised by the source tutorial gate, not the clean-temp authoring sequence." + }, + { + "id": "spreadsheet-smoke", + "kind": "alternative", + "label": "Runtime smoke after readiness", + "cwd": "my-first-api", + "argv": [ + "registryctl", + "smoke" + ], + "note": "Run only after the local runtime reports ready." + } + ] + }, + { + "id": "instance-openapi", + "slug": "journeys/instance-openapi", + "title": "Inspect one running instance OpenAPI contract", + "description": "Compare the reviewed Relay API source contract with the document exposed by one configured instance.", + "outcome": "An operator verifies the exact API contract selected by one Relay instance.", + "level": "Beginner", + "prerequisites": [ + "A Main-source registryctl binary and image lock built from one recorded commit", + "A Docker Compose provider for the optional local runtime step", + "An HTTP client that can preserve response bytes at an exact output path" + ], + "expected_time": "10 minutes", + "evidence_class": "source_and_generated_contract", + "evidence_lifecycle": "main_unreleased", + "availability": { + "status": "current_unreleased", + "proof": "source_tree", + "release": null + }, + "canonical_sources": [ + "crates/registry-relay/openapi/registry-relay.openapi.json", + "crates/registry-relay/tests/api_docs.rs", + "crates/registryctl/src/templates/relay_config.yaml.tmpl" + ], + "canonical_workspace": { + "id": "registry-relay", + "path": "crates/registry-relay" + }, + "catalog_references": [ + { + "catalog": "projects", + "id": "registry-relay" + }, + { + "catalog": "contracts", + "id": "registry-relay.openapi" + } + ], + "minimal_configuration": { + "files": [ + { + "source": "crates/registryctl/src/templates/relay_config.yaml.tmpl", + "destination": "openapi-inspection/relay/config.yaml", + "format": "scaffolded", + "public_boundary": "generated_template" + } + ], + "note": "The exact init step emits the complete disposable local configuration. That sample explicitly sets server.openapi_requires_auth to false; the product default remains true." + }, + "artifacts": [ + { + "path": "openapi-inspection/relay/config.yaml", + "classification": "scaffolded_human_owned", + "owner": "operator", + "human_edit": true, + "version_control": true, + "note": "Exact configuration emitted by the disposable init step. It explicitly selects the local public OpenAPI opt-out and becomes operator-owned after scaffolding." + }, + { + "path": "crates/registry-relay/openapi/registry-relay.openapi.json", + "classification": "generated_unsigned", + "owner": "registry_relay", + "human_edit": false, + "version_control": true, + "note": "Committed product-owned source contract used for drift and consumer review." + }, + { + "path": "openapi-inspection/output/instance.openapi.json", + "classification": "runtime_observed", + "owner": "operator", + "human_edit": false, + "version_control": false, + "note": "Exact user-selected capture path for the typed runtime GET interface." + } + ], + "fixture": { + "source": "crates/registry-relay/tests/api_docs.rs", + "format": "source_reference", + "expected_trace": [ + "Registryctl creates a disposable local scaffold whose generated config explicitly sets server.openapi_requires_auth to false.", + "The separately started local instance exposes an unauthenticated GET /openapi.json only because that explicit opt-out is selected.", + "The captured OpenAPI document declares version 3.1.0 and is written to openapi-inspection/output/instance.openapi.json." + ] + }, + "contract": { + "proves": [ + "The cited product source test proves that the explicit local opt-out exposes an OpenAPI 3.1.0 document without authentication.", + "Performing the separate runtime interface captures the generated contract selected by that disposable instance." + ], + "does_not_prove": [ + "Downstream consumers remain compatible with every changed operation.", + "OpenAPI-assisted upstream source authoring; that compiler contract remains deferred.", + "That the product default is public, or that any operation described by the captured document is authorized without its configured credentials." + ] + }, + "command_recipe": { + "kind": "instance_openapi" + }, + "review": [ + "Review the server and catalog configuration selecting the API surface.", + "Confirm the generated disposable config is the intended local-only openapi_requires_auth false opt-out before starting it.", + "Inspect the exact instance document returned through the unauthenticated local route.", + "Record the source revision, instance binding, capture time, and document digest; no credential is required or recorded for this explicit local opt-out." + ], + "gates": [ + { + "name": "source test", + "proves": "The explicit local public opt-out returns an OpenAPI 3.1.0 document in the product source test.", + "does_not_prove": "A particular deployed instance is reachable." + }, + { + "name": "instance inspection", + "proves": "When the operator performs the separate runtime step, the selected disposable instance exposes one concrete generated contract at the exact capture path.", + "does_not_prove": "Every client accepts the selected contract." + }, + { + "name": "consumer comparison", + "proves": "Reviewed consumers accept the candidate contract.", + "does_not_prove": "Runtime health or production data correctness." + } + ], + "production_delta": { + "environment": "Bind the reviewed candidate to the intended production environment and product instance.", + "secrets": "Provision credentials and trust material through operator-managed references.", + "approval": "Record country-author, product-owner, and operator approval for the reviewed candidate.", + "signing": "Sign each immutable product input with the authorized product-specific identity.", + "activation": "Verify, activate, observe, and retain rollback evidence independently for each product." + }, + "troubleshooting": [ + { + "code": "relay.startup.data_listener_unavailable", + "family": "relay_process_startup", + "product": "registry_relay", + "meaning": "Relay could not open the configured data-plane listener.", + "remediation": "Check interface availability, address-family support, and deployment networking for server.bind in its owning input; regenerate generated Relay input, then retry.", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--data-listener-unavailable", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "The fallback category names server.bind but does not disclose its address, port, or operating-system error." + }, + { + "code": "relay.startup.config_validation_rejected", + "family": "relay_process_startup", + "product": "registry_relay", + "meaning": "The parsed Relay configuration failed product validation.", + "remediation": "Run the authored-project validator, correct its field-addressed issues and governed bindings, regenerate the Relay input, then retry.", + "docs_anchor": "/reference/diagnostics/operator/#registry_relay--config-validation-rejected", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "The category does not disclose configured identifiers, URLs, environment names, hashes, or source values." + }, + { + "code": "rejected_binding", + "family": "bundle_verification", + "product": "registry_platform_ops", + "meaning": "The bundle binding does not match the intended runtime target.", + "remediation": "Use a bundle issued for the intended runtime binding.", + "docs_anchor": "/reference/diagnostics/operator/#registry_platform_ops--rejected-binding", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "The category does not disclose received or configured binding values." + } + ], + "next_task": { + "label": "Author a bounded HTTP integration", + "href": "/journeys/bounded-http/" + }, + "evidence": { + "extraction": { + "status": "verified", + "source_path": "docs/site/scripts/generate-standard-journeys.test.mjs", + "test_id": "extracts every declared complete configuration file from its canonical source", + "command": "node --test scripts/generate-standard-journeys.test.mjs", + "workflow": ".github/workflows/ci.yml#docs", + "revision": "main", + "lifecycle": "current_unreleased" + }, + "execution": { + "status": "verified", + "source_path": "crates/registry-relay/tests/api_docs.rs", + "test_id": "openapi_json_can_be_moved_to_public_router_for_local_testing", + "command": "cargo test --locked -p registry-relay --test api_docs openapi_json_can_be_moved_to_public_router_for_local_testing -- --exact", + "workflow": ".github/workflows/ci.yml#relay-contracts", + "revision": "main", + "lifecycle": "current_unreleased" + }, + "runtime": { + "status": "not_claimed", + "source_path": "docs/site/scripts/generate-standard-journeys.test.mjs", + "test_id": "keeps runtime and product activation claims bounded to traceable evidence", + "command": "node --test scripts/generate-standard-journeys.test.mjs", + "workflow": ".github/workflows/ci.yml#docs", + "revision": "main", + "lifecycle": "current_unreleased" + } + }, + "source_label": "Main source (unreleased)", + "section_headings": [ + "Outcome and prerequisites", + "Smallest complete configuration", + "Project tree and artifact ownership", + "Synthetic fixture and expected trace", + "Contract this journey proves", + "Test, explain, compare, and build", + "Review authored and generated artifacts", + "What each gate proves", + "Production delta", + "Troubleshooting and next task" + ], + "configuration_files": [ + { + "source": "crates/registryctl/src/templates/relay_config.yaml.tmpl", + "destination": "openapi-inspection/relay/config.yaml", + "format": "scaffolded", + "public_boundary": "generated_template", + "language": null, + "content": null + } + ], + "fixture_excerpt": { + "language": "text", + "content": "Source-backed proof: crates/registry-relay/tests/api_docs.rs\n" + }, + "steps": [ + { + "id": "openapi-init", + "kind": "command", + "label": "Create the disposable local instance", + "cwd": ".", + "argv": [ + "registryctl", + "init", + "relay", + "openapi-inspection", + "--sample", + "benefits" + ] + }, + { + "id": "openapi-start", + "kind": "long_running", + "label": "Start the disposable local instance", + "cwd": "openapi-inspection", + "argv": [ + "registryctl", + "start" + ], + "note": "The generated local sample explicitly opts out of OpenAPI authentication. Product defaults remain authentication-gated." + }, + { + "id": "openapi-capture", + "kind": "runtime_interface", + "label": "Capture the disposable instance contract", + "method": "GET", + "url": "http://127.0.0.1:4242/openapi.json", + "authentication": "none_disposable_local_opt_out", + "output_path": "openapi-inspection/output/instance.openapi.json", + "note": "Use an HTTP client that preserves the response bytes. This interface is public only because the generated disposable local configuration sets server.openapi_requires_auth to false." + }, + { + "id": "openapi-consumer-review", + "kind": "operator_interface", + "label": "Consumer contract comparison", + "inputs": [ + "Captured openapi-inspection/output/instance.openapi.json", + "Consumer-owned reviewed baseline and compatibility policy" + ], + "outputs": [ + "Consumer-owned compatibility decision" + ], + "procedure": "Compare the captured bytes using the consumer's reviewed compatibility tool. Registry Stack does not turn an external baseline into an executable shell placeholder." + } + ] + }, + { + "id": "bounded-http", + "slug": "journeys/bounded-http", + "title": "Author and test a bounded HTTP integration", + "description": "Normalize one fixed HTTP request into a closed evidence projection with offline fixture proof.", + "outcome": "A bounded HTTP request produces reviewed evidence through deterministic offline fixtures.", + "level": "Intermediate", + "prerequisites": [ + "registryctl built from the current source revision", + "A bounded source API contract", + "Synthetic match and non-match examples" + ], + "expected_time": "30 minutes", + "evidence_class": "maintained_offline_fixture", + "evidence_lifecycle": "main_unreleased", + "availability": { + "status": "current_unreleased", + "proof": "source_tree", + "release": null + }, + "canonical_sources": [ + "crates/registryctl/assets/project-starters/bounded-http/registry-stack.yaml", + "crates/registryctl/assets/project-starters/bounded-http/environments/local.yaml", + "crates/registryctl/assets/project-starters/bounded-http/integrations/person-record/integration.yaml", + "crates/registryctl/assets/project-starters/bounded-http/integrations/person-record/fixtures/active.yaml" + ], + "canonical_workspace": { + "id": "http", + "path": "crates/registryctl/assets/project-starters/bounded-http" + }, + "catalog_references": [ + { + "catalog": "project_authoring", + "id": "http" + }, + { + "catalog": "projects", + "id": "registry-relay" + }, + { + "catalog": "projects", + "id": "registry-notary" + } + ], + "minimal_configuration": { + "files": [ + { + "source": "crates/registryctl/assets/project-starters/bounded-http/registry-stack.yaml", + "destination": "registry-project/registry-stack.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic" + }, + { + "source": "crates/registryctl/assets/project-starters/bounded-http/environments/local.yaml", + "destination": "registry-project/environments/local.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic" + }, + { + "source": "crates/registryctl/assets/project-starters/bounded-http/integrations/person-record/integration.yaml", + "destination": "registry-project/integrations/person-record/integration.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic" + } + ], + "note": "These complete maintained starter files define project topology, synthetic local bindings, and the bounded HTTP integration. No field-range excerpt is presented as a complete configuration." + }, + "artifacts": [ + { + "path": "registry-project/registry-stack.yaml", + "classification": "authored", + "owner": "country_author", + "human_edit": true, + "version_control": true, + "note": "Human-owned registry intent, service policy, consultation, claims, and disclosure." + }, + { + "path": "registry-project/integrations/person-record/integration.yaml", + "classification": "authored", + "owner": "country_author", + "human_edit": true, + "version_control": true, + "note": "Human-owned source and projection contract." + }, + { + "path": "registry-project/integrations/person-record/fixtures/active.yaml", + "classification": "synthetic_fixture", + "owner": "country_author", + "human_edit": true, + "version_control": true, + "note": "Maintained offline match evidence." + }, + { + "path": "registry-project/.registry-stack/build/local/reviewable", + "classification": "generated_unsigned", + "owner": "registryctl", + "human_edit": false, + "version_control": false, + "note": "Exact emitted human-review directory within the local build output." + }, + { + "path": "registry-project/.registry-stack/build/local/private/relay", + "classification": "generated_unsigned", + "owner": "registryctl", + "human_edit": false, + "version_control": false, + "note": "Exact emitted unsigned Relay product input." + }, + { + "path": "registry-project/.registry-stack/build/local/private/notary", + "classification": "generated_unsigned", + "owner": "registryctl", + "human_edit": false, + "version_control": false, + "note": "Exact emitted unsigned Notary product input." + } + ], + "fixture": { + "source": "crates/registryctl/assets/project-starters/bounded-http/integrations/person-record/fixtures/active.yaml", + "format": "yaml", + "expected_trace": [ + "The harness expects one GET request at the templated person path.", + "The synthetic response projects only the declared active output.", + "Expected claims are evaluated without contacting a live source." + ] + }, + "contract": { + "proves": [ + "The bounded request and response projection produce the expected offline result.", + "Authored configuration can pass static check and deterministic build.", + "Service policy, Relay consultation, Notary claims, and separate product inputs remain visible through the canonical workspace and generated reports." + ], + "does_not_prove": [ + "Live authentication, source availability, or production response compatibility." + ] + }, + "command_recipe": { + "kind": "matrix", + "matrix_id": "http" + }, + "review": [ + "Review paths, statuses, output types, and every fixture interaction.", + "Keep credentials as references and out of fixtures.", + "Review explanations and product inputs without editing generated files." + ], + "gates": [ + { + "name": "fixture", + "proves": "The bounded request and projection produce the maintained offline result.", + "does_not_prove": "Live source compatibility or authentication." + }, + { + "name": "check", + "proves": "Authored configuration satisfies current static contracts.", + "does_not_prove": "Runtime files and references are available." + }, + { + "name": "build", + "proves": "Deterministic per-product inputs can be generated.", + "does_not_prove": "Inputs are signed, trusted, or active." + } + ], + "production_delta": { + "environment": "Bind the reviewed candidate to the intended production environment and product instance.", + "secrets": "Provision credentials and trust material through operator-managed references.", + "approval": "Record country-author, product-owner, and operator approval for the reviewed candidate.", + "signing": "Sign each immutable product input with the authorized product-specific identity.", + "activation": "Verify, activate, observe, and retain rollback evidence independently for each product." + }, + "troubleshooting": [ + { + "code": "registryctl.authoring.yaml.unknown_field", + "family": "authoring_validation", + "product": "registryctl", + "meaning": "Only documented fields in the closed authoring schema are accepted.", + "remediation": "Remove the unsupported field or replace it with its documented field.", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.yaml.unknown_field", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "code": "fixture.request_mismatch", + "family": "fixture_execution", + "product": "registryctl_relay_offline_harness", + "meaning": "The rendered request or call order did not match the fixture expectation.", + "remediation": "Align the fixture request expectation with the compiled plan.", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--fixture.request_mismatch", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "code": "source.status_rejected", + "family": "fixture_execution", + "product": "registryctl_relay_offline_harness", + "meaning": "The synthetic source returned a status outside the accepted mapping.", + "remediation": "Use a reviewed status mapping or correct the fixture status.", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--source.status_rejected", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "code": "authorization.denied", + "family": "fixture_execution", + "product": "registryctl_relay_offline_harness", + "meaning": "Authorization denied fixture execution before source access.", + "remediation": "Align the fixture identity and authorization expectation with the compiled policy.", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--authorization.denied", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + } + ], + "next_task": { + "label": "Extend the adapter with bounded FHIR scripting", + "href": "/journeys/bounded-multi-call-script/" + }, + "evidence": { + "extraction": { + "status": "verified", + "source_path": "docs/site/scripts/generate-standard-journeys.test.mjs", + "test_id": "extracts every declared complete configuration file from its canonical source", + "command": "node --test scripts/generate-standard-journeys.test.mjs", + "workflow": ".github/workflows/ci.yml#docs", + "revision": "main", + "lifecycle": "current_unreleased" + }, + "execution": { + "status": "verified", + "source_path": "crates/registryctl/tests/project_authoring.rs", + "test_id": "every_cataloged_supported_project_authoring_command_is_automated", + "command": "cargo build --locked -p registryctl --bin registryctl && cargo test --locked -p registryctl --test project_authoring every_cataloged_supported_project_authoring_command_is_automated -- --exact", + "workflow": ".github/workflows/ci.yml#project-authoring-determinism", + "revision": "main", + "lifecycle": "current_unreleased" + }, + "runtime": { + "status": "not_claimed", + "source_path": "docs/site/scripts/generate-standard-journeys.test.mjs", + "test_id": "keeps runtime and product activation claims bounded to traceable evidence", + "command": "node --test scripts/generate-standard-journeys.test.mjs", + "workflow": ".github/workflows/ci.yml#docs", + "revision": "main", + "lifecycle": "current_unreleased" + } + }, + "source_label": "Main source (unreleased)", + "section_headings": [ + "Outcome and prerequisites", + "Smallest complete configuration", + "Project tree and artifact ownership", + "Synthetic fixture and expected trace", + "Contract this journey proves", + "Test, explain, compare, and build", + "Review authored and generated artifacts", + "What each gate proves", + "Production delta", + "Troubleshooting and next task" + ], + "configuration_files": [ + { + "source": "crates/registryctl/assets/project-starters/bounded-http/registry-stack.yaml", + "destination": "registry-project/registry-stack.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic", + "language": "yaml", + "content": "integrations:\n person-record:\n file: integrations/person-record/integration.yaml\nregistry:\n id: fictional-citizen-registry\nservices:\n person-verification:\n access:\n scopes:\n - evidence:person:read\n claims:\n person-active:\n disclosure: value\n output: person_record.active\n person-record-exists:\n cel: person_record.matched\n disclosure: predicate\n consent: not_required\n consultations:\n person_record:\n input:\n person_id: request.target.identifiers.registry_person_id\n integration: person-record\n credential_profiles:\n person-status:\n claims:\n - person-record-exists\n - person-active\n format: dc+sd-jwt\n type: https://credentials.invalid/person-status/v1\n validity: 10m\n kind: evidence\n legal_basis: public-service-delivery\n purpose: public-service-person-verification\n version: 1\nstarter:\n content_digest: sha256:a4e0263957f3dd7756ef1a270483f4aa5f856102f070c6e0325e8cc9b1413b76\n id: http\n release: 0.13.0\nversion: 1\n" + }, + { + "source": "crates/registryctl/assets/project-starters/bounded-http/environments/local.yaml", + "destination": "registry-project/environments/local.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic", + "language": "yaml", + "content": "callers:\n evidence-client:\n api_key_fingerprint:\n secret: EVIDENCE_CLIENT_TOKEN_HASH\n scopes:\n - evidence:person:read\ndeployment:\n notary:\n service: fictional-registry-notary\n profile: local\n relay:\n service: fictional-registry-relay\nintegrations:\n person-record:\n source:\n credential:\n generation: 1\n token:\n secret: FICTIONAL_REGISTRY_TOKEN\n origin: https://citizen-registry.invalid\nissuance:\n generation: 1\n issuer: did:web:notary.invalid\n signing_key:\n secret: REGISTRY_NOTARY_ISSUER_JWK\n signing_kid: project-issuer-key\nnotary_relay:\n base_url: http://127.0.0.1:8080\n token_file: /run/secrets/relay-workload-token\n workload_client_id: fictional-registry-notary\nrelay:\n allowed_clients:\n - fictional-relay-client\n audience: registry-relay\n issuer: https://workload-issuer.internal.invalid\n jwks_url: https://workload-issuer.internal.invalid/.well-known/jwks.json\n origin: https://relay.internal.invalid\nversion: 1\n" + }, + { + "source": "crates/registryctl/assets/project-starters/bounded-http/integrations/person-record/integration.yaml", + "destination": "registry-project/integrations/person-record/integration.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic", + "language": "yaml", + "content": "capability:\n http:\n request:\n method: GET\n path: /people/{input.person_id}\n query:\n fields: active\n response:\n ambiguous:\n - 409\n no_match:\n - 404\nid: person-record\ninput:\n person_id:\n maxLength: 64\n role: selector\n type: string\nnot_applicable:\n subject_mismatch:\n rationale: The selected response projection contains no identifier that can be compared with the requested person identifier.\n request_fixture: active-person\noutputs:\n active:\n type: boolean\n x-registry-source: /active\nrevision: 1\nsource:\n auth:\n type: static_bearer\n product: replace-with-source-product\n versions:\n unverified:\n - replace-with-source-version\nversion: 1\n" + } + ], + "fixture_excerpt": { + "language": "yaml", + "content": "classification: synthetic\nexpect:\n claims:\n person-active: true\n person-record-exists: true\n outcome: match\n outputs:\n active: true\ninput:\n person_id: AB-123456\ninteractions:\n - expect:\n method: GET\n path: /people/AB-123456\n query:\n fields: active\n respond:\n body:\n active: true\n status: 200\nname: active-person\nrequest:\n claims:\n - person-record-exists\n disclosure: predicate\n format: application/vnd.registry-notary.claim-result+json\n purpose: public-service-person-verification\n target:\n identifiers:\n - scheme: registry_person_id\n value: AB-123456\n type: Person\n" + }, + "steps": [ + { + "id": "bounded-http-init-0", + "kind": "command", + "label": "Required init step", + "cwd": ".", + "argv": [ + "registryctl", + "init", + "--from", + "http", + "--project-dir", + "registry-project" + ] + }, + { + "id": "bounded-http-authoring-editor-1", + "kind": "command", + "label": "Required authoring editor step", + "cwd": ".", + "argv": [ + "registryctl", + "authoring", + "editor", + "--project-dir", + "registry-project" + ] + }, + { + "id": "bounded-http-test-2", + "kind": "command", + "label": "Required test step", + "cwd": ".", + "argv": [ + "registryctl", + "test", + "--project-dir", + "registry-project", + "--integration", + "person-record", + "--fixture", + "active-person", + "--trace" + ] + }, + { + "id": "bounded-http-test", + "kind": "long_running", + "label": "Optional watch loop", + "cwd": ".", + "argv": [ + "registryctl", + "test", + "--project-dir", + "registry-project", + "--integration", + "person-record", + "--fixture", + "active-person", + "--watch" + ], + "note": "This long-running alternative reruns the focused synthetic fixture after authored files change. It is not part of the required noninteractive sequence." + }, + { + "id": "bounded-http-test-3", + "kind": "command", + "label": "Required test step", + "cwd": ".", + "argv": [ + "registryctl", + "test", + "--project-dir", + "registry-project" + ] + }, + { + "id": "bounded-http-check-4", + "kind": "command", + "label": "Required check step", + "cwd": ".", + "argv": [ + "registryctl", + "check", + "--project-dir", + "registry-project", + "--environment", + "local", + "--explain" + ] + }, + { + "id": "bounded-http-semantic-comparison", + "kind": "command", + "label": "Compare authored semantics with the embedded starter", + "cwd": ".", + "argv": [ + "registryctl", + "compare", + "--project-dir", + "registry-project", + "--environment", + "local", + "--from-starter" + ] + }, + { + "id": "bounded-http-build-5", + "kind": "command", + "label": "Required build step", + "cwd": ".", + "argv": [ + "registryctl", + "build", + "--project-dir", + "registry-project", + "--environment", + "local" + ] + } + ] + }, + { + "id": "bounded-multi-call-script", + "slug": "journeys/bounded-multi-call-script", + "title": "Author and test a bounded FHIR R4 multi-call script", + "description": "Review the complete Rhai adapter that bounds Patient, Coverage, and Organization requests.", + "outcome": "A bounded Rhai adapter produces normalized FHIR evidence with maintained offline fixtures.", + "level": "Advanced", + "prerequisites": [ + "Familiarity with FHIR R4 search bundles", + "registryctl built from the current source revision", + "Synthetic Patient, Coverage, and Organization examples" + ], + "expected_time": "45 minutes", + "evidence_class": "maintained_offline_fixture", + "evidence_lifecycle": "main_unreleased", + "availability": { + "status": "current_unreleased", + "proof": "source_tree", + "release": null + }, + "canonical_sources": [ + "crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/registry-stack.yaml", + "crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/environments/local.yaml", + "crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/integration.yaml", + "crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/adapter.rhai", + "crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/fixtures/match.yaml" + ], + "canonical_workspace": { + "id": "fhir-r4-coverage-active", + "path": "crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active" + }, + "catalog_references": [ + { + "catalog": "project_authoring", + "id": "fhir-r4-coverage-active" + }, + { + "catalog": "projects", + "id": "registry-relay" + }, + { + "catalog": "projects", + "id": "registry-notary" + } + ], + "minimal_configuration": { + "files": [ + { + "source": "crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/registry-stack.yaml", + "destination": "fhir-project/registry-stack.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic" + }, + { + "source": "crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/environments/local.yaml", + "destination": "fhir-project/environments/local.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic" + }, + { + "source": "crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/integration.yaml", + "destination": "fhir-project/integrations/coverage/integration.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic" + }, + { + "source": "crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/adapter.rhai", + "destination": "fhir-project/integrations/coverage/adapter.rhai", + "format": "rhai", + "public_boundary": "maintained_synthetic" + } + ], + "note": "The complete maintained set includes project topology, synthetic local bindings, the canonical request limits, and the entire reviewed Rhai adapter without line-range extraction." + }, + "artifacts": [ + { + "path": "fhir-project/integrations/coverage/integration.yaml", + "classification": "authored", + "owner": "country_author", + "human_edit": true, + "version_control": true, + "note": "Human-owned request bounds, selectors, outputs, and limits." + }, + { + "path": "fhir-project/integrations/coverage/adapter.rhai", + "classification": "authored", + "owner": "country_author", + "human_edit": true, + "version_control": true, + "note": "Hash-covered reviewed country implementation code." + }, + { + "path": "fhir-project/integrations/coverage/fixtures/match.yaml", + "classification": "synthetic_fixture", + "owner": "country_author", + "human_edit": true, + "version_control": true, + "note": "Maintained offline FHIR conversation." + }, + { + "path": "fhir-project/.registry-stack/build/local/reviewable", + "classification": "generated_unsigned", + "owner": "registryctl", + "human_edit": false, + "version_control": false, + "note": "Exact emitted human-review directory containing the reviewed integration closure." + }, + { + "path": "fhir-project/.registry-stack/build/local/private/relay", + "classification": "generated_unsigned", + "owner": "registryctl", + "human_edit": false, + "version_control": false, + "note": "Exact emitted unsigned Relay input containing the complete Rhai adapter." + }, + { + "path": "fhir-project/.registry-stack/build/local/private/notary", + "classification": "generated_unsigned", + "owner": "registryctl", + "human_edit": false, + "version_control": false, + "note": "Exact emitted unsigned Notary input for the combined project." + } + ], + "fixture": { + "source": "crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/fixtures/match.yaml", + "format": "yaml", + "expected_trace": [ + "The adapter performs bounded Patient and Coverage searches.", + "The matched payor selects one Organization request.", + "Coverage status and insurer name produce the expected claims." + ] + }, + "contract": { + "proves": [ + "The complete Rhai file parses and satisfies the maintained synthetic FHIR conversation.", + "Host-declared four-call, 512KiB source-byte, 8KiB request-byte, and 12-second deadline limits bound adapter execution." + ], + "does_not_prove": [ + "A live FHIR server conforms to the tested profile." + ] + }, + "command_recipe": { + "kind": "matrix", + "matrix_id": "fhir-r4-coverage-active" + }, + "review": [ + "Review every allowed request, selector, ambiguity branch, and output projection.", + "Confirm fixture ordering and bounded pagination.", + "Confirm the generated closure includes the full reviewed Rhai file." + ], + "gates": [ + { + "name": "script syntax", + "proves": "The complete Rhai file parses under the current authoring contract.", + "does_not_prove": "Every source response yields intended evidence." + }, + { + "name": "fixture", + "proves": "The synthetic FHIR conversation produces expected normalized evidence.", + "does_not_prove": "A live FHIR server conforms to the tested profile." + }, + { + "name": "build", + "proves": "The reviewed script enters deterministic product inputs.", + "does_not_prove": "Product bundles are trusted or active." + } + ], + "production_delta": { + "environment": "Bind the reviewed candidate to the intended production environment and product instance.", + "secrets": "Provision credentials and trust material through operator-managed references.", + "approval": "Record country-author, product-owner, and operator approval for the reviewed candidate.", + "signing": "Sign each immutable product input with the authorized product-specific identity.", + "activation": "Verify, activate, observe, and retain rollback evidence independently for each product." + }, + "troubleshooting": [ + { + "code": "registryctl.authoring.script.syntax_error", + "family": "authoring_validation", + "product": "registryctl", + "meaning": "The Script source must parse under the released runtime.", + "remediation": "Correct the Script syntax at the reported location.", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.script.syntax_error", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "code": "registryctl.authoring.script.unknown_function", + "family": "authoring_validation", + "product": "registryctl", + "meaning": "The Script must define the released `consult(context)` entrypoint.", + "remediation": "Define consult(context) as the Script entrypoint.", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.script.unknown_function", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "code": "source.call_budget_exceeded", + "family": "fixture_execution", + "product": "registryctl_relay_offline_harness", + "meaning": "Fixture execution exceeded the compiled source-call budget.", + "remediation": "Reduce source calls or revise the reviewed bounded plan.", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--source.call_budget_exceeded", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "code": "source.deadline_exceeded", + "family": "fixture_execution", + "product": "registryctl_relay_offline_harness", + "meaning": "The synthetic source interaction exceeded its deadline.", + "remediation": "Align the timeout fixture with the compiled deadline behavior.", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--source.deadline_exceeded", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "code": "source.response_malformed", + "family": "fixture_execution", + "product": "registryctl_relay_offline_harness", + "meaning": "The synthetic source response violated its closed response contract.", + "remediation": "Correct the synthetic response shape.", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--source.response_malformed", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + } + ], + "next_task": { + "label": "Compare with an exact snapshot", + "href": "/journeys/exact-snapshot/" + }, + "evidence": { + "extraction": { + "status": "verified", + "source_path": "docs/site/scripts/generate-standard-journeys.test.mjs", + "test_id": "extracts every declared complete configuration file from its canonical source", + "command": "node --test scripts/generate-standard-journeys.test.mjs", + "workflow": ".github/workflows/ci.yml#docs", + "revision": "main", + "lifecycle": "current_unreleased" + }, + "execution": { + "status": "verified", + "source_path": "crates/registryctl/tests/project_authoring.rs", + "test_id": "every_cataloged_supported_project_authoring_command_is_automated", + "command": "cargo build --locked -p registryctl --bin registryctl && cargo test --locked -p registryctl --test project_authoring every_cataloged_supported_project_authoring_command_is_automated -- --exact", + "workflow": ".github/workflows/ci.yml#project-authoring-determinism", + "revision": "main", + "lifecycle": "current_unreleased" + }, + "runtime": { + "status": "not_claimed", + "source_path": "docs/site/scripts/generate-standard-journeys.test.mjs", + "test_id": "keeps runtime and product activation claims bounded to traceable evidence", + "command": "node --test scripts/generate-standard-journeys.test.mjs", + "workflow": ".github/workflows/ci.yml#docs", + "revision": "main", + "lifecycle": "current_unreleased" + } + }, + "source_label": "Main source (unreleased)", + "section_headings": [ + "Outcome and prerequisites", + "Smallest complete configuration", + "Project tree and artifact ownership", + "Synthetic fixture and expected trace", + "Contract this journey proves", + "Test, explain, compare, and build", + "Review authored and generated artifacts", + "What each gate proves", + "Production delta", + "Troubleshooting and next task" + ], + "configuration_files": [ + { + "source": "crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/registry-stack.yaml", + "destination": "fhir-project/registry-stack.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic", + "language": "yaml", + "content": "integrations:\n coverage:\n file: integrations/coverage/integration.yaml\nregistry:\n id: fictional-fhir-registry\nservices:\n coverage-verification:\n access:\n scopes:\n - evidence:coverage:read\n claims:\n coverage-active:\n cel: |-\n coverage.coverage_status != null\n ? coverage.matched && coverage.coverage_status == \"active\"\n : false\n disclosure: predicate\n insurer-name:\n disclosure: value\n output: coverage.insurer_name\n patient-record-exists:\n cel: coverage.matched\n disclosure: predicate\n consent: not_required\n consultations:\n coverage:\n input:\n birthdate: request.target.identifiers.birthdate\n family: request.target.identifiers.family\n given: request.target.identifiers.given\n integration: coverage\n credential_profiles:\n coverage-status:\n claims:\n - patient-record-exists\n - coverage-active\n - insurer-name\n format: dc+sd-jwt\n type: https://credentials.invalid/coverage-status/v1\n validity: 5m\n kind: evidence\n legal_basis: public-service-delivery\n purpose: coverage-verification\n version: 1\nstarter:\n content_digest: sha256:b99bff37a59c34d90ee6d212b61fd5f50e0ec6995310f574c5020535ebbd4f8d\n id: fhir-r4\n release: 0.13.0\nversion: 1\n" + }, + { + "source": "crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/environments/local.yaml", + "destination": "fhir-project/environments/local.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic", + "language": "yaml", + "content": "callers:\n coverage-service:\n api_key_fingerprint:\n secret: COVERAGE_SERVICE_TOKEN_HASH\n scopes:\n - evidence:coverage:read\ndeployment:\n notary:\n service: fhir-notary\n profile: local\n relay:\n service: fhir-relay\nintegrations:\n coverage:\n source:\n credential:\n generation: 1\n token:\n secret: FHIR_ACCESS_TOKEN\n origin: https://coverage.fixture.invalid\nissuance:\n generation: 1\n issuer: did:web:fhir-notary.invalid\n signing_key:\n secret: REGISTRY_NOTARY_ISSUER_JWK\n signing_kid: project-issuer-key\nnotary_relay:\n base_url: http://127.0.0.1:8080\n token_file: /run/secrets/relay-workload-token\n workload_client_id: fhir-notary\nrelay:\n allowed_clients:\n - fhir-relay-client\n audience: registry-relay\n issuer: https://workload-issuer.internal.invalid\n jwks_url: https://workload-issuer.internal.invalid/.well-known/jwks.json\n origin: https://fhir-relay.internal.invalid\nversion: 1\n" + }, + { + "source": "crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/integration.yaml", + "destination": "fhir-project/integrations/coverage/integration.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic", + "language": "yaml", + "content": "capability:\n script:\n file: adapter.rhai\nid: fhir-r4-coverage-active\ninput:\n birthdate:\n format: date\n maxLength: 10\n role: selector\n type: string\n family:\n maxLength: 80\n role: selector\n type: string\n given:\n maxLength: 80\n role: selector\n type: string\nlimits:\n calls: 4\n deadline: 12s\n request_bytes: 8KiB\n source_bytes: 512KiB\noutputs:\n coverage_status:\n maxLength: 16\n type:\n - string\n - \"null\"\n insurer_name:\n maxLength: 120\n type:\n - string\n - \"null\"\nrevision: 1\nsource:\n allow:\n - method: GET\n path: /fhir/Patient\n - method: GET\n path: /fhir/Coverage\n - method: GET\n path: /fhir/Organization/*\n auth:\n type: static_bearer\n product: project-fhir-server\n response:\n format: json\n max_bytes: 128KiB\n versions:\n unverified:\n - r4-fixture-v1\nversion: 1\n" + }, + { + "source": "crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/adapter.rhai", + "destination": "fhir-project/integrations/coverage/adapter.rhai", + "format": "rhai", + "public_boundary": "maintained_synthetic", + "language": "rhai", + "content": "fn patient_matches_selectors(patient, input) {\n if patient.birthDate != input.birthdate {\n return false;\n }\n for name in patient.name {\n if name.family == input.family {\n for given in name.given {\n if given == input.given {\n return true;\n }\n }\n }\n }\n false\n}\n\nfn consult(ctx) {\n let patient_response = source.get(\"/fhir/Patient\", #{\n query: #{\n _count: 2,\n birthdate: ctx.input.birthdate,\n family: ctx.input.family,\n given: ctx.input.given\n }\n });\n if patient_response.status != 200 {\n return result.fail(failure.source_rejected);\n }\n let page = protocol.fhir.parse_searchset(patient_response, \"Patient\");\n let patients = page.matches;\n if patients.len < 2 && page.next != () {\n let continuation_response = source.get(page.next);\n if continuation_response.status != 200 {\n return result.fail(failure.source_rejected);\n }\n let continuation = protocol.fhir.parse_searchset(continuation_response, \"Patient\");\n for patient in continuation.matches {\n patients.push(patient);\n }\n if continuation.next != () {\n return result.ambiguous();\n }\n }\n if patients.len == 0 {\n return result.no_match();\n }\n if patients.len > 1 {\n return result.ambiguous();\n }\n let patient = patients[0];\n if !patient_matches_selectors(patient, ctx.input) {\n return result.fail(failure.subject_mismatch);\n }\n\n let coverage_response = source.get(\"/fhir/Coverage\", #{\n query: #{ _count: 2, beneficiary: \"Patient/\" + patient.id }\n });\n if coverage_response.status != 200 {\n return result.fail(failure.source_rejected);\n }\n let coverage_search = protocol.fhir.parse_searchset(coverage_response, \"Coverage\");\n if coverage_search.matches.len == 0 {\n return result.no_match();\n }\n if coverage_search.matches.len > 1 || coverage_search.next != () {\n return result.ambiguous();\n }\n let coverage = coverage_search.matches[0];\n let payor_reference = coverage.payor[0].reference;\n let reference_parts = payor_reference.split(\"/\");\n if reference_parts.len != 2 || reference_parts[0] != \"Organization\" {\n return result.fail(failure.source_rejected);\n }\n\n let organization_target = source.path(\n \"/fhir/Organization/{organization_id}\",\n #{ organization_id: reference_parts[1] }\n );\n let organization_response = source.get(organization_target);\n if organization_response.status != 200 || organization_response.body.resourceType != \"Organization\" {\n return result.fail(failure.source_rejected);\n }\n result.match(#{\n coverage_status: coverage.status,\n insurer_name: organization_response.body.name\n })\n}\n" + } + ], + "fixture_excerpt": { + "language": "yaml", + "content": "classification: synthetic\nexpect:\n claims:\n coverage-active: true\n insurer-name: Synthetic Health Fund\n patient-record-exists: true\n outcome: match\n outputs:\n coverage_status: active\n insurer_name: Synthetic Health Fund\ninput:\n birthdate: 2018-05-12\n family: Example\n given: Ada\ninteractions:\n - expect:\n method: GET\n path: /fhir/Patient\n query:\n _count: 2\n birthdate: 2018-05-12\n family: Example\n given: Ada\n respond:\n body:\n entry:\n - resource:\n birthDate: 2018-05-12\n extension:\n - url: https://example.invalid/ignored\n valueString: synthetic-extra\n id: patient-1\n managingOrganization:\n reference: Organization/org-1\n name:\n - family: Example\n given:\n - Ada\n - Synthetic\n use: official\n resourceType: Patient\n search:\n mode: match\n resourceType: Bundle\n total: 1\n type: searchset\n status: 200\n - expect:\n method: GET\n path: /fhir/Coverage\n query:\n _count: 2\n beneficiary: Patient/patient-1\n respond:\n body:\n entry:\n - resource:\n beneficiary:\n reference: Patient/patient-1\n id: coverage-1\n payor:\n - reference: Organization/org-1\n period:\n start: 2026-01-01\n resourceType: Coverage\n status: active\n search:\n mode: match\n resourceType: Bundle\n total: 1\n type: searchset\n status: 200\n - expect:\n method: GET\n path: /fhir/Organization/org-1\n respond:\n body:\n active: true\n id: org-1\n name: Synthetic Health Fund\n resourceType: Organization\n status: 200\nname: coverage-active\nrequest:\n claims:\n - coverage-active\n disclosure: predicate\n format: application/vnd.registry-notary.claim-result+json\n purpose: coverage-verification\n target:\n identifiers:\n - scheme: birthdate\n value: 2018-05-12\n - scheme: family\n value: Example\n - scheme: given\n value: Ada\n type: Person\n" + }, + "steps": [ + { + "id": "bounded-multi-call-script-init-0", + "kind": "command", + "label": "Required init step", + "cwd": ".", + "argv": [ + "registryctl", + "init", + "--from", + "fhir-r4", + "--project-dir", + "fhir-project" + ] + }, + { + "id": "bounded-multi-call-script-authoring-editor-1", + "kind": "command", + "label": "Required authoring editor step", + "cwd": ".", + "argv": [ + "registryctl", + "authoring", + "editor", + "--project-dir", + "fhir-project" + ] + }, + { + "id": "bounded-multi-call-script-test-2", + "kind": "command", + "label": "Required test step", + "cwd": ".", + "argv": [ + "registryctl", + "test", + "--project-dir", + "fhir-project", + "--integration", + "coverage", + "--fixture", + "coverage-active", + "--trace" + ] + }, + { + "id": "bounded-multi-call-script-test", + "kind": "long_running", + "label": "Optional watch loop", + "cwd": ".", + "argv": [ + "registryctl", + "test", + "--project-dir", + "fhir-project", + "--integration", + "coverage", + "--fixture", + "coverage-active", + "--watch" + ], + "note": "This long-running alternative reruns the focused synthetic fixture after authored files change. It is not part of the required noninteractive sequence." + }, + { + "id": "bounded-multi-call-script-test-3", + "kind": "command", + "label": "Required test step", + "cwd": ".", + "argv": [ + "registryctl", + "test", + "--project-dir", + "fhir-project" + ] + }, + { + "id": "bounded-multi-call-script-check-4", + "kind": "command", + "label": "Required check step", + "cwd": ".", + "argv": [ + "registryctl", + "check", + "--project-dir", + "fhir-project", + "--environment", + "local", + "--explain" + ] + }, + { + "id": "bounded-multi-call-script-semantic-comparison", + "kind": "command", + "label": "Compare authored semantics with the embedded starter", + "cwd": ".", + "argv": [ + "registryctl", + "compare", + "--project-dir", + "fhir-project", + "--environment", + "local", + "--from-starter" + ] + }, + { + "id": "bounded-multi-call-script-build-5", + "kind": "command", + "label": "Required build step", + "cwd": ".", + "argv": [ + "registryctl", + "build", + "--project-dir", + "fhir-project", + "--environment", + "local" + ] + } + ] + }, + { + "id": "exact-snapshot", + "slug": "journeys/exact-snapshot", + "title": "Build an exact immutable snapshot lookup", + "description": "Select at most one materialized record by unique key and project only declared evidence.", + "outcome": "An exact selector reads one snapshot record and emits closed evidence.", + "level": "Intermediate", + "prerequisites": [ + "registryctl built from the current source revision", + "An immutable snapshot schema with a unique primary key", + "Synthetic match and non-match records" + ], + "expected_time": "30 minutes", + "evidence_class": "maintained_offline_fixture", + "evidence_lifecycle": "main_unreleased", + "availability": { + "status": "current_unreleased", + "proof": "source_tree", + "release": null + }, + "canonical_sources": [ + "crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/registry-stack.yaml", + "crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/environments/local.yaml", + "crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/entities/people.yaml", + "crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/integrations/person-snapshot/integration.yaml", + "crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/integrations/person-snapshot/fixtures/match.yaml" + ], + "canonical_workspace": { + "id": "snapshot", + "path": "crates/registryctl/tests/fixtures/project-authoring/snapshot-exact" + }, + "catalog_references": [ + { + "catalog": "project_authoring", + "id": "snapshot" + }, + { + "catalog": "projects", + "id": "registry-relay" + }, + { + "catalog": "projects", + "id": "registry-notary" + } + ], + "minimal_configuration": { + "files": [ + { + "source": "crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/registry-stack.yaml", + "destination": "snapshot-project/registry-stack.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic" + }, + { + "source": "crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/environments/local.yaml", + "destination": "snapshot-project/environments/local.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic" + }, + { + "source": "crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/entities/people.yaml", + "destination": "snapshot-project/entities/people.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic" + }, + { + "source": "crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/integrations/person-snapshot/integration.yaml", + "destination": "snapshot-project/integrations/person-snapshot/integration.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic" + } + ], + "note": "The complete maintained set includes the entity and unique-key materialization contract as well as the exact lookup. Ambiguity is structurally not applicable only while that primary-key invariant holds." + }, + "artifacts": [ + { + "path": "snapshot-project/entities/people.yaml", + "classification": "authored", + "owner": "country_author", + "human_edit": true, + "version_control": true, + "note": "Human-owned entity schema and materialization bounds." + }, + { + "path": "snapshot-project/integrations/person-snapshot/integration.yaml", + "classification": "authored", + "owner": "country_author", + "human_edit": true, + "version_control": true, + "note": "Exact selector and evidence projection." + }, + { + "path": "snapshot-project/integrations/person-snapshot/fixtures/match.yaml", + "classification": "synthetic_fixture", + "owner": "country_author", + "human_edit": true, + "version_control": true, + "note": "Maintained offline match evidence." + }, + { + "path": "snapshot-project/.registry-stack/build/local/reviewable", + "classification": "generated_unsigned", + "owner": "registryctl", + "human_edit": false, + "version_control": false, + "note": "Exact emitted human-review directory for snapshot semantics." + }, + { + "path": "snapshot-project/.registry-stack/build/local/private/relay", + "classification": "generated_unsigned", + "owner": "registryctl", + "human_edit": false, + "version_control": false, + "note": "Exact emitted unsigned Relay input containing snapshot materialization requirements." + }, + { + "path": "snapshot-project/.registry-stack/build/local/private/notary", + "classification": "generated_unsigned", + "owner": "registryctl", + "human_edit": false, + "version_control": false, + "note": "Exact emitted unsigned Notary input for the combined project." + } + ], + "fixture": { + "source": "crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/integrations/person-snapshot/fixtures/match.yaml", + "format": "yaml", + "expected_trace": [ + "The unique selector addresses at most one record.", + "The selected record projects only declared outputs.", + "Expected claims are evaluated from normalized snapshot evidence." + ] + }, + "contract": { + "proves": [ + "Exact selection and projection match the maintained synthetic fixture.", + "Authored snapshot and evidence contracts are statically coherent.", + "Ambiguity is not applicable because the exact selector is the materialized unique primary key." + ], + "does_not_prove": [ + "Production snapshot freshness, completeness, or unique-key enforcement." + ] + }, + "command_recipe": { + "kind": "matrix", + "matrix_id": "snapshot" + }, + "review": [ + "Review primary key, materialization bounds, freshness, and output projection.", + "Confirm fixtures contain synthetic data only.", + "Keep ambiguity not applicable only while the unique-key constraint remains enforced.", + "Keep runtime snapshot generations outside version control." + ], + "gates": [ + { + "name": "fixture", + "proves": "Exact selection and projection match the synthetic conversation.", + "does_not_prove": "Production freshness or completeness." + }, + { + "name": "check", + "proves": "Static snapshot and evidence contracts are coherent.", + "does_not_prove": "Runtime snapshot files are available." + }, + { + "name": "build", + "proves": "Unsigned Relay input contains the reviewed snapshot materialization requirements.", + "does_not_prove": "A runtime loaded a concrete snapshot generation or the upstream collection is complete." + } + ], + "production_delta": { + "environment": "Bind the reviewed candidate to the intended production environment and product instance.", + "secrets": "Provision credentials and trust material through operator-managed references.", + "approval": "Record country-author, product-owner, and operator approval for the reviewed candidate.", + "signing": "Sign each immutable product input with the authorized product-specific identity.", + "activation": "Verify, activate, observe, and retain rollback evidence independently for each product." + }, + "troubleshooting": [ + { + "code": "registryctl.authoring.project.invalid", + "family": "authoring_validation", + "product": "registryctl", + "meaning": "Project services, entities, integrations, and references must form a closed valid graph.", + "remediation": "Align the project declaration and referenced contracts.", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.project.invalid", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "code": "fixture.request_mismatch", + "family": "fixture_execution", + "product": "registryctl_relay_offline_harness", + "meaning": "The rendered request or call order did not match the fixture expectation.", + "remediation": "Align the fixture request expectation with the compiled plan.", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--fixture.request_mismatch", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "code": "registryctl.preflight.runtime_file_missing", + "family": "operator_preflight", + "product": "registryctl", + "meaning": "A declared runtime file is missing.", + "remediation": "Replace the runtime file.", + "docs_anchor": "/reference/diagnostics/operator/#registryctl--registryctl.preflight.runtime_file_missing", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "Preflight does not contact live sources or prove remote availability." + } + ], + "next_task": { + "label": "Consume registry-backed evidence in Notary", + "href": "/journeys/registry-backed-notary-claim/" + }, + "evidence": { + "extraction": { + "status": "verified", + "source_path": "docs/site/scripts/generate-standard-journeys.test.mjs", + "test_id": "extracts every declared complete configuration file from its canonical source", + "command": "node --test scripts/generate-standard-journeys.test.mjs", + "workflow": ".github/workflows/ci.yml#docs", + "revision": "main", + "lifecycle": "current_unreleased" + }, + "execution": { + "status": "verified", + "source_path": "crates/registryctl/tests/project_authoring.rs", + "test_id": "every_cataloged_supported_project_authoring_command_is_automated", + "command": "cargo build --locked -p registryctl --bin registryctl && cargo test --locked -p registryctl --test project_authoring every_cataloged_supported_project_authoring_command_is_automated -- --exact", + "workflow": ".github/workflows/ci.yml#project-authoring-determinism", + "revision": "main", + "lifecycle": "current_unreleased" + }, + "runtime": { + "status": "not_claimed", + "source_path": "docs/site/scripts/generate-standard-journeys.test.mjs", + "test_id": "keeps runtime and product activation claims bounded to traceable evidence", + "command": "node --test scripts/generate-standard-journeys.test.mjs", + "workflow": ".github/workflows/ci.yml#docs", + "revision": "main", + "lifecycle": "current_unreleased" + } + }, + "source_label": "Main source (unreleased)", + "section_headings": [ + "Outcome and prerequisites", + "Smallest complete configuration", + "Project tree and artifact ownership", + "Synthetic fixture and expected trace", + "Contract this journey proves", + "Test, explain, compare, and build", + "Review authored and generated artifacts", + "What each gate proves", + "Production delta", + "Troubleshooting and next task" + ], + "configuration_files": [ + { + "source": "crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/registry-stack.yaml", + "destination": "snapshot-project/registry-stack.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic", + "language": "yaml", + "content": "entities:\n people:\n file: entities/people.yaml\nintegrations:\n person-snapshot:\n file: integrations/person-snapshot/integration.yaml\nregistry:\n id: fictional-population-registry\nservices:\n benefits-eligibility:\n access:\n scopes:\n - evidence:population:read\n claims:\n population-record-exists:\n cel: person.matched\n disclosure: predicate\n population-registration-status:\n disclosure: value\n output: person.registration_status\n residency-confirmed:\n disclosure: predicate\n output: person.residency_confirmed\n consent: not_required\n consultations:\n person:\n input:\n person_id: request.target.identifiers.population_person_id\n integration: person-snapshot\n credential_profiles:\n population-evidence:\n claims:\n - population-record-exists\n - population-registration-status\n - residency-confirmed\n format: dc+sd-jwt\n type: https://credentials.invalid/population-evidence/v1\n validity: 10m\n kind: evidence\n legal_basis: public-service-delivery\n purpose: benefits-eligibility\n version: 1\n emergency-assistance:\n access:\n scopes:\n - evidence:population:emergency\n claims:\n emergency-record-exists:\n cel: person.matched\n disclosure: predicate\n emergency-status:\n disclosure: redacted\n output: person.registration_status\n consent: not_required\n consultations:\n person:\n input:\n person_id: request.target.identifiers.population_person_id\n integration: person-snapshot\n credential_profiles:\n emergency-status:\n claims:\n - emergency-record-exists\n - emergency-status\n format: dc+sd-jwt\n type: https://credentials.invalid/emergency-status/v1\n validity: 5m\n kind: evidence\n legal_basis: vital-interests\n purpose: emergency-assistance\n version: 1\nstarter:\n content_digest: sha256:8fb0772e01333fd084974550f76829e829bc43f6e6941ac50d2e92522baadede\n id: snapshot\n release: 0.13.0\nversion: 1\n" + }, + { + "source": "crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/environments/local.yaml", + "destination": "snapshot-project/environments/local.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic", + "language": "yaml", + "content": "callers:\n benefits-service:\n api_key_fingerprint:\n secret: BENEFITS_SERVICE_TOKEN_HASH\n scopes:\n - evidence:population:read\n emergency-service:\n api_key_fingerprint:\n secret: EMERGENCY_SERVICE_TOKEN_HASH\n scopes:\n - evidence:population:emergency\ndeployment:\n notary:\n service: population-notary\n profile: local\n relay:\n service: population-relay\nentities:\n people:\n columns:\n guardian_id: guardian_key\n person_id: subject_key\n registration_status: status_code\n residency_confirmed: residency_flag\n generation: 2026-07-12\n provider:\n header_row: 1\n path: /var/lib/registry/population.csv\n type: csv\n source_revision: population-export-v1\nissuance:\n generation: 1\n issuer: did:web:population-notary.invalid\n signing_key:\n secret: REGISTRY_NOTARY_ISSUER_JWK\n signing_kid: project-issuer-key\nnotary_relay:\n base_url: http://127.0.0.1:8080\n token_file: /run/secrets/relay-workload-token\n workload_client_id: population-notary\nrelay:\n allowed_clients:\n - population-relay-client\n audience: registry-relay\n issuer: https://workload-issuer.internal.invalid\n jwks_url: https://workload-issuer.internal.invalid/.well-known/jwks.json\n origin: https://population-relay.internal.invalid\nversion: 1\n" + }, + { + "source": "crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/entities/people.yaml", + "destination": "snapshot-project/entities/people.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic", + "language": "yaml", + "content": "id: people\nmaterialization:\n max_bytes: 256MiB\n max_records: 1000000\n refresh: manual\n retain_generations: 2\nprimary_key: person_id\nrevision: 1\nschema:\n additionalProperties: false\n properties:\n guardian_id:\n maxLength: 64\n type:\n - string\n - \"null\"\n person_id:\n maxLength: 64\n type: string\n registration_status:\n maxLength: 32\n type:\n - string\n - \"null\"\n residency_confirmed:\n type:\n - boolean\n - \"null\"\n required:\n - person_id\n - registration_status\n - residency_confirmed\n - guardian_id\n type: object\nversion: 1\n" + }, + { + "source": "crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/integrations/person-snapshot/integration.yaml", + "destination": "snapshot-project/integrations/person-snapshot/integration.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic", + "language": "yaml", + "content": "capability:\n snapshot:\n entity: people\n exact:\n person_id:\n input: person_id\n freshness: 24h\nid: population-person-snapshot\ninput:\n person_id:\n maxLength: 12\n pattern: ^PER-[0-9]{8}$\n role: selector\n type: string\nnot_applicable:\n ambiguity:\n rationale: The exact snapshot selector is the entity primary key, whose materialized unique-key constraint permits at most one record.\n request_fixture: snapshot-match\n subject_mismatch:\n rationale: The selected snapshot output projection omits the primary key, so it contains no identifier comparable with the requested person identifier.\n request_fixture: snapshot-match\noutputs:\n - registration_status\n - residency_confirmed\nrevision: 1\nversion: 1\n" + } + ], + "fixture_excerpt": { + "language": "yaml", + "content": "classification: synthetic\nexpect:\n claims:\n emergency-record-exists: true\n emergency-status: redacted\n population-record-exists: true\n population-registration-status: active\n residency-confirmed: true\n outcome: match\n outputs:\n registration_status: active\n residency_confirmed: true\ninput:\n person_id: PER-00000001\ninteractions:\n - expect:\n method: GET\n path: /snapshot\n respond:\n body:\n registration_status: active\n residency_confirmed: true\n status: 200\nname: snapshot-match\nrequest:\n claims:\n - population-record-exists\n disclosure: predicate\n format: application/vnd.registry-notary.claim-result+json\n purpose: benefits-eligibility\n target:\n identifiers:\n - scheme: population_person_id\n value: PER-00000001\n type: Person\n" + }, + "steps": [ + { + "id": "exact-snapshot-init-0", + "kind": "command", + "label": "Required init step", + "cwd": ".", + "argv": [ + "registryctl", + "init", + "--from", + "snapshot", + "--project-dir", + "snapshot-project" + ] + }, + { + "id": "exact-snapshot-authoring-editor-1", + "kind": "command", + "label": "Required authoring editor step", + "cwd": ".", + "argv": [ + "registryctl", + "authoring", + "editor", + "--project-dir", + "snapshot-project" + ] + }, + { + "id": "exact-snapshot-test-2", + "kind": "command", + "label": "Required test step", + "cwd": ".", + "argv": [ + "registryctl", + "test", + "--project-dir", + "snapshot-project", + "--integration", + "person-snapshot", + "--fixture", + "snapshot-match", + "--trace" + ] + }, + { + "id": "exact-snapshot-test", + "kind": "long_running", + "label": "Optional watch loop", + "cwd": ".", + "argv": [ + "registryctl", + "test", + "--project-dir", + "snapshot-project", + "--integration", + "person-snapshot", + "--fixture", + "snapshot-match", + "--watch" + ], + "note": "This long-running alternative reruns the focused synthetic fixture after authored files change. It is not part of the required noninteractive sequence." + }, + { + "id": "exact-snapshot-test-3", + "kind": "command", + "label": "Required test step", + "cwd": ".", + "argv": [ + "registryctl", + "test", + "--project-dir", + "snapshot-project" + ] + }, + { + "id": "exact-snapshot-check-4", + "kind": "command", + "label": "Required check step", + "cwd": ".", + "argv": [ + "registryctl", + "check", + "--project-dir", + "snapshot-project", + "--environment", + "local", + "--explain" + ] + }, + { + "id": "exact-snapshot-semantic-comparison", + "kind": "command", + "label": "Compare authored semantics with the embedded starter", + "cwd": ".", + "argv": [ + "registryctl", + "compare", + "--project-dir", + "snapshot-project", + "--environment", + "local", + "--from-starter" + ] + }, + { + "id": "exact-snapshot-build-5", + "kind": "command", + "label": "Required build step", + "cwd": ".", + "argv": [ + "registryctl", + "build", + "--project-dir", + "snapshot-project", + "--environment", + "local" + ] + } + ] + }, + { + "id": "registry-backed-notary-claim", + "slug": "journeys/registry-backed-notary-claim", + "title": "Evaluate a registry-backed Notary predicate", + "description": "Evaluate one disclosure-minimizing Notary claim from normalized Relay evidence.", + "outcome": "Notary returns the explicit active-registration-exists predicate from registry-backed evidence.", + "level": "Intermediate", + "prerequisites": [ + "A Relay person-demographics integration", + "registryctl and images built from one exact source revision", + "Synthetic match, pending, non-match, and ambiguity fixtures" + ], + "expected_time": "25 minutes", + "evidence_class": "source_and_generated_contract", + "evidence_lifecycle": "main_unreleased", + "availability": { + "status": "current_unreleased", + "proof": "source_tree", + "release": null + }, + "canonical_sources": [ + "crates/registryctl/src/templates/notary_addon/registry-stack.yaml", + "crates/registryctl/src/templates/notary_addon/environments/local.yaml", + "crates/registryctl/src/templates/notary_addon/integrations/person-demographics/integration.yaml", + "crates/registryctl/src/templates/notary_addon/integrations/person-demographics/fixtures/match.yaml" + ], + "canonical_workspace": { + "id": "registry-notary", + "path": "crates/registryctl/src/templates/notary_addon" + }, + "catalog_references": [ + { + "catalog": "projects", + "id": "registry-relay" + }, + { + "catalog": "projects", + "id": "registry-notary" + }, + { + "catalog": "contracts", + "id": "registry-notary.openapi" + } + ], + "minimal_configuration": { + "files": [ + { + "source": "crates/registryctl/src/templates/notary_addon/registry-stack.yaml", + "destination": "my-first-api/notary/project/registry-stack.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic" + }, + { + "source": "crates/registryctl/src/templates/notary_addon/environments/local.yaml", + "destination": "my-first-api/notary/project/environments/local.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic" + }, + { + "source": "crates/registryctl/src/templates/notary_addon/integrations/person-demographics/integration.yaml", + "destination": "my-first-api/notary/project/integrations/person-demographics/integration.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic" + } + ], + "note": "The add-on step emits this complete authored Notary project set. The explicit active-registration-exists predicate remains in the full project file and is checked against the maintained fixture." + }, + "artifacts": [ + { + "path": "my-first-api/notary/project/registry-stack.yaml", + "classification": "authored", + "owner": "country_author", + "human_edit": true, + "version_control": true, + "note": "Human-owned consultation and claim rule." + }, + { + "path": "my-first-api/notary/project/integrations/person-demographics/fixtures/match.yaml", + "classification": "synthetic_fixture", + "owner": "country_author", + "human_edit": true, + "version_control": true, + "note": "Maintained predicate expectation." + }, + { + "path": "my-first-api/notary/project/.registry-stack/build/local/reviewable", + "classification": "generated_unsigned", + "owner": "registryctl", + "human_edit": false, + "version_control": false, + "note": "Exact emitted human-review directory for the Notary project build." + }, + { + "path": "my-first-api/notary/project/.registry-stack/build/local/private/relay", + "classification": "generated_unsigned", + "owner": "registryctl", + "human_edit": false, + "version_control": false, + "note": "Exact emitted unsigned Relay consultation input." + }, + { + "path": "my-first-api/notary/project/.registry-stack/build/local/private/notary", + "classification": "generated_unsigned", + "owner": "registryctl", + "human_edit": false, + "version_control": false, + "note": "Exact emitted unsigned Notary product input." + } + ], + "fixture": { + "source": "crates/registryctl/src/templates/notary_addon/integrations/person-demographics/fixtures/match.yaml", + "format": "yaml", + "expected_trace": [ + "Relay-backed enrollment evidence matches with active status.", + "Notary evaluates active-registration-exists.", + "The response discloses the predicate rather than the source record." + ] + }, + "contract": { + "proves": [ + "The maintained fixture expects active-registration-exists to be true.", + "Relay evidence and the Notary predicate agree in current source.", + "True means the bounded selected source returned exactly one matching active registration." + ], + "does_not_prove": [ + "Live registry data, workload identity, or production policy approval.", + "False does not prove global nonexistence, identity fraud, ineligibility, or a legal negative.", + "The result does not prove that the caller is the matched person." + ] + }, + "command_recipe": { + "kind": "notary_claim" + }, + "review": [ + "Review the consultation mapping, claim identifier, CEL rule, and all fixture claim keys.", + "Confirm the rule discloses no unnecessary attributes.", + "Keep false bounded to no active matching record found by this consultation in the selected source.", + "Review Relay and Notary generated inputs independently." + ], + "gates": [ + { + "name": "fixture", + "proves": "The maintained match produces the explicit predicate.", + "does_not_prove": "Live registry data produces the same result." + }, + { + "name": "cross-product check", + "proves": "Relay outputs and Notary dependencies are statically compatible.", + "does_not_prove": "Runtime trust and network configuration are valid." + }, + { + "name": "smoke", + "proves": "The local combined runtime satisfies its packaged smoke contract.", + "does_not_prove": "Production legal, disclosure, or availability requirements." + } + ], + "production_delta": { + "environment": "Bind the reviewed candidate to the intended production environment and product instance.", + "secrets": "Provision credentials and trust material through operator-managed references.", + "approval": "Record country-author, product-owner, and operator approval for the reviewed candidate.", + "signing": "Sign each immutable product input with the authorized product-specific identity.", + "activation": "Verify, activate, observe, and retain rollback evidence independently for each product." + }, + "troubleshooting": [ + { + "code": "registryctl.authoring.project.invalid", + "family": "authoring_validation", + "product": "registryctl", + "meaning": "Project services, entities, integrations, and references must form a closed valid graph.", + "remediation": "Align the project declaration and referenced contracts.", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.project.invalid", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "code": "fixture.request_mismatch", + "family": "fixture_execution", + "product": "registryctl_relay_offline_harness", + "meaning": "The rendered request or call order did not match the fixture expectation.", + "remediation": "Align the fixture request expectation with the compiled plan.", + "docs_anchor": "/reference/diagnostics/fixture/#registryctl_relay_offline_harness--fixture.request_mismatch", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "Offline synthetic evidence does not prove live source compatibility." + }, + { + "code": "notary.relay.profile_mismatch", + "family": "notary_activation", + "product": "registry_notary", + "meaning": "Relay consultation profile does not match the configured contract pin", + "remediation": "reconcile the Notary profile id and contract hash with the reviewed Relay consultation contract", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--relay-profile-mismatch", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + } + ], + "next_task": { + "label": "Promote generated product inputs", + "href": "/journeys/product-input-lifecycle/" + }, + "evidence": { + "extraction": { + "status": "verified", + "source_path": "docs/site/scripts/generate-standard-journeys.test.mjs", + "test_id": "extracts every declared complete configuration file from its canonical source", + "command": "node --test scripts/generate-standard-journeys.test.mjs", + "workflow": ".github/workflows/ci.yml#docs", + "revision": "main", + "lifecycle": "current_unreleased" + }, + "execution": { + "status": "verified", + "source_path": "docs/site/scripts/check-registryctl-tutorials.sh", + "test_id": "run_notary_tutorial()", + "command": "npm run check:tutorial:registryctl", + "workflow": ".github/workflows/ci.yml#registryctl-tutorials", + "revision": "main", + "lifecycle": "current_unreleased" + }, + "runtime": { + "status": "verified", + "source_path": "docs/site/scripts/check-registryctl-tutorials.sh", + "test_id": "run_notary_tutorial()", + "command": "npm run check:tutorial:registryctl", + "workflow": ".github/workflows/ci.yml#registryctl-tutorials", + "revision": "main", + "lifecycle": "current_unreleased" + } + }, + "source_label": "Main source (unreleased)", + "section_headings": [ + "Outcome and prerequisites", + "Smallest complete configuration", + "Project tree and artifact ownership", + "Synthetic fixture and expected trace", + "Contract this journey proves", + "Test, explain, compare, and build", + "Review authored and generated artifacts", + "What each gate proves", + "Production delta", + "Troubleshooting and next task" + ], + "configuration_files": [ + { + "source": "crates/registryctl/src/templates/notary_addon/registry-stack.yaml", + "destination": "my-first-api/notary/project/registry-stack.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic", + "language": "yaml", + "content": "entities:\n person:\n file: entities/person.yaml\nintegrations:\n person-demographics:\n file: integrations/person-demographics/integration.yaml\nregistry:\n id: tutorial-benefits-registry\nservices:\n registration-verification:\n access:\n scopes:\n - benefits_casework:evidence\n claims:\n active-registration-exists:\n cel: enrollment.matched && enrollment.registration_status == \"active\"\n disclosure: predicate\n consent: not_required\n consultations:\n enrollment:\n input:\n date_of_birth: request.target.attributes.date_of_birth\n family_name: request.target.attributes.family_name\n given_name: request.target.attributes.given_name\n integration: person-demographics\n kind: evidence\n legal_basis: public-service-delivery\n purpose: https://example.local/purpose/tutorial\n version: 1\nversion: 1\n" + }, + { + "source": "crates/registryctl/src/templates/notary_addon/environments/local.yaml", + "destination": "my-first-api/notary/project/environments/local.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic", + "language": "yaml", + "content": "callers:\n tutorial-evaluator:\n api_key_fingerprint:\n secret: TUTORIAL_EVALUATOR_HASH\n scopes:\n - benefits_casework:evidence\ndeployment:\n notary:\n service: registry-notary\n profile: local\n relay:\n service: registry-relay-consultation\nentities:\n person:\n columns:\n date_of_birth: date_of_birth\n family_name: family_name\n given_name: given_name\n household_id: household_id\n national_id: national_id\n person_id: person_id\n registration_status: registration_status\n relationship_to_head: relationship_to_head\n generation: tutorial-local-v1\n provider:\n header_row: 1\n path: /var/lib/registry/benefits_casework.xlsx\n sheet: Persons\n type: xlsx\n source_revision: tutorial-benefits-workbook-v1\nnotary_cel:\n worker_memory_bytes: 1073741824\nnotary_relay:\n base_url: http://127.0.0.1:8082\n token_file: /run/secrets/notary-relay.jwt\n workload_client_id: registry-notary\nrelay:\n allowed_clients:\n - registry-notary\n audience: registry-relay\n issuer: http://127.0.0.1:8081\n jwks_url: http://127.0.0.1:8083/jwks.json\n origin: http://127.0.0.1:8082\nversion: 1\n" + }, + { + "source": "crates/registryctl/src/templates/notary_addon/integrations/person-demographics/integration.yaml", + "destination": "my-first-api/notary/project/integrations/person-demographics/integration.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic", + "language": "yaml", + "content": "capability:\n snapshot:\n entity: person\n exact:\n date_of_birth:\n input: date_of_birth\n family_name:\n input: family_name\n given_name:\n input: given_name\n freshness: 24h\nid: tutorial-person-demographics\ninput:\n date_of_birth:\n format: date\n maxLength: 10\n role: selector\n type: string\n family_name:\n maxLength: 80\n role: selector\n type: string\n given_name:\n maxLength: 80\n role: selector\n type: string\nnot_applicable:\n subject_mismatch:\n rationale: The exact snapshot selector applies name and date of birth before returning registration status; the minimized projection contains no selector-comparable identifier.\n request_fixture: jo-elm-match\noutputs:\n - registration_status\nrevision: 1\nversion: 1\n" + } + ], + "fixture_excerpt": { + "language": "yaml", + "content": "classification: synthetic\nexpect:\n claims:\n active-registration-exists: true\n outcome: match\n outputs:\n registration_status: active\ninput:\n date_of_birth: 2019-02-03\n family_name: Elm\n given_name: Jo\ninteractions:\n - expect:\n method: GET\n path: /snapshot\n respond:\n body:\n registration_status: active\n status: 200\nname: jo-elm-match\n" + }, + "steps": [ + { + "id": "notary-init", + "kind": "command", + "label": "Create the disposable Relay scaffold", + "cwd": ".", + "argv": [ + "registryctl", + "init", + "relay", + "my-first-api", + "--sample", + "benefits" + ] + }, + { + "id": "notary-add", + "kind": "command", + "label": "Add the maintained Notary project", + "cwd": "my-first-api", + "argv": [ + "registryctl", + "add", + "notary" + ] + }, + { + "id": "notary-test", + "kind": "command", + "label": "Execute every Notary project fixture offline", + "cwd": ".", + "argv": [ + "registryctl", + "test", + "--project-dir", + "my-first-api/notary/project" + ] + }, + { + "id": "notary-check", + "kind": "command", + "label": "Check and explain the combined project", + "cwd": ".", + "argv": [ + "registryctl", + "check", + "--project-dir", + "my-first-api/notary/project", + "--environment", + "local", + "--explain" + ] + }, + { + "id": "notary-build", + "kind": "command", + "label": "Build separate unsigned product inputs", + "cwd": ".", + "argv": [ + "registryctl", + "build", + "--project-dir", + "my-first-api/notary/project", + "--environment", + "local" + ] + }, + { + "id": "notary-start", + "kind": "long_running", + "label": "Start the combined disposable runtime", + "cwd": "my-first-api", + "argv": [ + "registryctl", + "start" + ], + "note": "This runtime step is exercised by the source tutorial gate and remains separate from the required clean-temp sequence." + } + ] + }, + { + "id": "product-input-lifecycle", + "slug": "journeys/product-input-lifecycle", + "title": "Review and promote generated product inputs", + "description": "Keep authoring, generation, signing, verification, and activation as separate trust-boundary steps.", + "outcome": "Reviewed authored configuration becomes independently activatable Relay and Notary product inputs.", + "level": "Advanced", + "prerequisites": [ + "A fixture-complete project that passes registryctl check", + "Operator-managed signing identities and product trust anchors", + "Separate Relay and Notary activation authority" + ], + "expected_time": "40 minutes", + "evidence_class": "generated_contract", + "evidence_lifecycle": "main_unreleased", + "availability": { + "status": "current_unreleased", + "proof": "source_tree", + "release": null + }, + "canonical_sources": [ + "docs/site/src/content/docs/reference/registryctl.mdx", + "crates/registryctl/assets/project-starters/bounded-http/registry-stack.yaml", + "crates/registryctl/assets/project-starters/bounded-http/environments/local.yaml", + "crates/registryctl/assets/project-starters/bounded-http/integrations/person-record/integration.yaml", + "crates/registryctl/assets/project-starters/bounded-http/integrations/person-record/fixtures/active.yaml" + ], + "canonical_workspace": { + "id": "http", + "path": "crates/registryctl/assets/project-starters/bounded-http" + }, + "catalog_references": [ + { + "catalog": "project_authoring", + "id": "http" + }, + { + "catalog": "projects", + "id": "registry-relay" + }, + { + "catalog": "projects", + "id": "registry-notary" + } + ], + "minimal_configuration": { + "files": [ + { + "source": "crates/registryctl/assets/project-starters/bounded-http/registry-stack.yaml", + "destination": "registry-project/registry-stack.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic" + }, + { + "source": "crates/registryctl/assets/project-starters/bounded-http/environments/local.yaml", + "destination": "registry-project/environments/local.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic" + }, + { + "source": "crates/registryctl/assets/project-starters/bounded-http/integrations/person-record/integration.yaml", + "destination": "registry-project/integrations/person-record/integration.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic" + } + ], + "note": "The complete maintained source set contains authored intent and synthetic local bindings only. Unsigned product inputs, user-selected bundle outputs, trust anchors, and activation state remain separate." + }, + "artifacts": [ + { + "path": "registry-project/registry-stack.yaml", + "classification": "authored", + "owner": "country_author", + "human_edit": true, + "version_control": true, + "note": "Reviewed authored source of truth." + }, + { + "path": "registry-project/.registry-stack/build/local/reviewable", + "classification": "generated_unsigned", + "owner": "registryctl", + "human_edit": false, + "version_control": false, + "note": "Exact emitted reviewable directory from the deterministic build." + }, + { + "path": "registry-project/.registry-stack/build/local/private/relay", + "classification": "generated_unsigned", + "owner": "registryctl", + "human_edit": false, + "version_control": false, + "note": "Exact emitted unsigned Relay product input." + }, + { + "path": "registry-project/.registry-stack/build/local/private/notary", + "classification": "generated_unsigned", + "owner": "registryctl", + "human_edit": false, + "version_control": false, + "note": "Exact emitted unsigned Notary product input." + }, + { + "path": "journey-output/registry-relay-bundle", + "classification": "generated_signed", + "owner": "operator", + "human_edit": false, + "version_control": false, + "note": "Exact user-selected --out path for the independently signed and verified Relay bundle." + }, + { + "path": "journey-output/registry-notary-bundle", + "classification": "generated_signed", + "owner": "operator", + "human_edit": false, + "version_control": false, + "note": "Exact user-selected --out path for the independently signed and verified Notary bundle." + } + ], + "fixture": { + "source": "crates/registryctl/assets/project-starters/bounded-http/integrations/person-record/fixtures/active.yaml", + "format": "yaml", + "expected_trace": [ + "Fixtures establish authored behavior before build.", + "Check and preflight emit separate value-free reports.", + "Product inputs remain independent through signing, verification, and the product-owned activation handoff." + ] + }, + "contract": { + "proves": [ + "Deterministic unsigned product inputs can be generated from reviewed source.", + "Independently signed Relay and Notary bundles can be verified and made eligible for separate product-owned activation.", + "Relay and Notary inputs, signatures, trust anchors, and anti-rollback sequences remain product-owned and separate." + ], + "does_not_prove": [ + "An unsigned build is trusted, active, healthy, or release-proven.", + "Separate valid product signatures create an atomic project-root activation." + ] + }, + "command_recipe": { + "kind": "product_input_lifecycle", + "matrix_id": "http" + }, + "review": [ + "Review authored semantics and the candidate source commit.", + "Use the build report to locate each product closure.", + "Sign and verify Relay and Notary inputs independently before handing either bundle to its product-owned activation procedure." + ], + "gates": [ + { + "name": "fixture and check", + "proves": "Maintained behavior and static contracts are coherent.", + "does_not_prove": "Runtime readiness or live source compatibility." + }, + { + "name": "preflight diagnostic", + "proves": "A clean workspace reports missing operator files and secret references through the value-free offline contract.", + "does_not_prove": "Operator inputs are provisioned, preflight passes, or the runtime is healthy." + }, + { + "name": "bundle verification", + "proves": "One immutable product closure has accepted signature and target binding.", + "does_not_prove": "The other product is valid or activation succeeds." + }, + { + "name": "activation handoff", + "proves": "Each verified bundle and trust decision is separately identifiable for its product-owned activation procedure.", + "does_not_prove": "Either product activated the bundle, reached readiness, or exercised rollback." + } + ], + "production_delta": { + "environment": "Bind each reviewed product candidate to the intended environment and instance.", + "secrets": "Keep signing keys and trust anchors in operator-managed systems.", + "approval": "Preserve separate author, product-owner, signer, and activator approvals.", + "signing": "Apply product-specific identity, stream, sequence, and bundle bindings.", + "activation": "Exercise readiness, activation, rollback, and last-known-good behavior per product. Relay and Notary activate independently; Registry Stack does not claim atomic project-root activation." + }, + "troubleshooting": [ + { + "code": "registryctl.authoring.project.invalid", + "family": "authoring_validation", + "product": "registryctl", + "meaning": "Project services, entities, integrations, and references must form a closed valid graph.", + "remediation": "Align the project declaration and referenced contracts.", + "docs_anchor": "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.project.invalid", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "Static authoring evidence does not prove live source or deployment compatibility." + }, + { + "code": "registryctl.preflight.secret_missing", + "family": "operator_preflight", + "product": "registryctl", + "meaning": "A required secret reference is unavailable to this process.", + "remediation": "Provide the secret to the process environment.", + "docs_anchor": "/reference/diagnostics/operator/#registryctl--registryctl.preflight.secret_missing", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "Preflight does not contact live sources or prove remote availability." + }, + { + "code": "rejected_signature", + "family": "bundle_verification", + "product": "registry_platform_ops", + "meaning": "Bundle authenticity or declared content integrity verification failed.", + "remediation": "Rebuild and sign the complete bundle with an accepted trust configuration.", + "docs_anchor": "/reference/diagnostics/operator/#registry_platform_ops--rejected-signature", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "The category does not disclose signer identifiers, file names, or content digests." + }, + { + "code": "rejected_binding", + "family": "bundle_verification", + "product": "registry_platform_ops", + "meaning": "The bundle binding does not match the intended runtime target.", + "remediation": "Use a bundle issued for the intended runtime binding.", + "docs_anchor": "/reference/diagnostics/operator/#registry_platform_ops--rejected-binding", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "The category does not disclose received or configured binding values." + }, + { + "code": "rejected_rollback", + "family": "bundle_verification", + "product": "registry_platform_ops", + "meaning": "The bundle or override does not satisfy local anti-rollback requirements.", + "remediation": "Use a monotonic bundle or an authorized break-glass selection.", + "docs_anchor": "/reference/diagnostics/operator/#registry_platform_ops--rejected-rollback", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "The category does not disclose stored sequences, content digests, paths, or approval values." + }, + { + "code": "notary.runtime.activation_required", + "family": "notary_activation", + "product": "registry_notary", + "meaning": "Registry Notary runtime activation is required before serving", + "remediation": "run the compiled Registry Notary runtime activation step before building or serving routers", + "docs_anchor": "/reference/diagnostics/operator/#registry_notary--runtime-activation-required", + "lifecycle": "unreleased", + "introduced_in": null, + "evidence_limitation": "The category confirms only the failed activation boundary; it does not disclose paths, URLs, hashes, credentials, identifiers, parser text, authored values, source responses, or country values." + } + ], + "next_task": { + "label": "Review operator diagnostics", + "href": "/reference/diagnostics/operator/" + }, + "evidence": { + "extraction": { + "status": "verified", + "source_path": "docs/site/scripts/generate-standard-journeys.test.mjs", + "test_id": "extracts every declared complete configuration file from its canonical source", + "command": "node --test scripts/generate-standard-journeys.test.mjs", + "workflow": ".github/workflows/ci.yml#docs", + "revision": "main", + "lifecycle": "current_unreleased" + }, + "execution": { + "status": "verified", + "source_path": "crates/registryctl/tests/project_authoring.rs", + "test_id": "every_cataloged_supported_project_authoring_command_is_automated", + "command": "cargo build --locked -p registryctl --bin registryctl && cargo test --locked -p registryctl --test project_authoring every_cataloged_supported_project_authoring_command_is_automated -- --exact", + "workflow": ".github/workflows/ci.yml#project-authoring-determinism", + "revision": "main", + "lifecycle": "current_unreleased" + }, + "runtime": { + "status": "not_claimed", + "source_path": "docs/site/scripts/generate-standard-journeys.test.mjs", + "test_id": "keeps runtime and product activation claims bounded to traceable evidence", + "command": "node --test scripts/generate-standard-journeys.test.mjs", + "workflow": ".github/workflows/ci.yml#docs", + "revision": "main", + "lifecycle": "current_unreleased" + } + }, + "source_label": "Main source (unreleased)", + "section_headings": [ + "Outcome and prerequisites", + "Smallest complete configuration", + "Project tree and artifact ownership", + "Synthetic fixture and expected trace", + "Contract this journey proves", + "Test, explain, compare, and build", + "Review authored and generated artifacts", + "What each gate proves", + "Production delta", + "Troubleshooting and next task" + ], + "configuration_files": [ + { + "source": "crates/registryctl/assets/project-starters/bounded-http/registry-stack.yaml", + "destination": "registry-project/registry-stack.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic", + "language": "yaml", + "content": "integrations:\n person-record:\n file: integrations/person-record/integration.yaml\nregistry:\n id: fictional-citizen-registry\nservices:\n person-verification:\n access:\n scopes:\n - evidence:person:read\n claims:\n person-active:\n disclosure: value\n output: person_record.active\n person-record-exists:\n cel: person_record.matched\n disclosure: predicate\n consent: not_required\n consultations:\n person_record:\n input:\n person_id: request.target.identifiers.registry_person_id\n integration: person-record\n credential_profiles:\n person-status:\n claims:\n - person-record-exists\n - person-active\n format: dc+sd-jwt\n type: https://credentials.invalid/person-status/v1\n validity: 10m\n kind: evidence\n legal_basis: public-service-delivery\n purpose: public-service-person-verification\n version: 1\nstarter:\n content_digest: sha256:a4e0263957f3dd7756ef1a270483f4aa5f856102f070c6e0325e8cc9b1413b76\n id: http\n release: 0.13.0\nversion: 1\n" + }, + { + "source": "crates/registryctl/assets/project-starters/bounded-http/environments/local.yaml", + "destination": "registry-project/environments/local.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic", + "language": "yaml", + "content": "callers:\n evidence-client:\n api_key_fingerprint:\n secret: EVIDENCE_CLIENT_TOKEN_HASH\n scopes:\n - evidence:person:read\ndeployment:\n notary:\n service: fictional-registry-notary\n profile: local\n relay:\n service: fictional-registry-relay\nintegrations:\n person-record:\n source:\n credential:\n generation: 1\n token:\n secret: FICTIONAL_REGISTRY_TOKEN\n origin: https://citizen-registry.invalid\nissuance:\n generation: 1\n issuer: did:web:notary.invalid\n signing_key:\n secret: REGISTRY_NOTARY_ISSUER_JWK\n signing_kid: project-issuer-key\nnotary_relay:\n base_url: http://127.0.0.1:8080\n token_file: /run/secrets/relay-workload-token\n workload_client_id: fictional-registry-notary\nrelay:\n allowed_clients:\n - fictional-relay-client\n audience: registry-relay\n issuer: https://workload-issuer.internal.invalid\n jwks_url: https://workload-issuer.internal.invalid/.well-known/jwks.json\n origin: https://relay.internal.invalid\nversion: 1\n" + }, + { + "source": "crates/registryctl/assets/project-starters/bounded-http/integrations/person-record/integration.yaml", + "destination": "registry-project/integrations/person-record/integration.yaml", + "format": "yaml", + "public_boundary": "maintained_synthetic", + "language": "yaml", + "content": "capability:\n http:\n request:\n method: GET\n path: /people/{input.person_id}\n query:\n fields: active\n response:\n ambiguous:\n - 409\n no_match:\n - 404\nid: person-record\ninput:\n person_id:\n maxLength: 64\n role: selector\n type: string\nnot_applicable:\n subject_mismatch:\n rationale: The selected response projection contains no identifier that can be compared with the requested person identifier.\n request_fixture: active-person\noutputs:\n active:\n type: boolean\n x-registry-source: /active\nrevision: 1\nsource:\n auth:\n type: static_bearer\n product: replace-with-source-product\n versions:\n unverified:\n - replace-with-source-version\nversion: 1\n" + } + ], + "fixture_excerpt": { + "language": "yaml", + "content": "classification: synthetic\nexpect:\n claims:\n person-active: true\n person-record-exists: true\n outcome: match\n outputs:\n active: true\ninput:\n person_id: AB-123456\ninteractions:\n - expect:\n method: GET\n path: /people/AB-123456\n query:\n fields: active\n respond:\n body:\n active: true\n status: 200\nname: active-person\nrequest:\n claims:\n - person-record-exists\n disclosure: predicate\n format: application/vnd.registry-notary.claim-result+json\n purpose: public-service-person-verification\n target:\n identifiers:\n - scheme: registry_person_id\n value: AB-123456\n type: Person\n" + }, + "steps": [ + { + "id": "product-input-lifecycle-init-0", + "kind": "command", + "label": "Required init step", + "cwd": ".", + "argv": [ + "registryctl", + "init", + "--from", + "http", + "--project-dir", + "registry-project" + ] + }, + { + "id": "product-input-lifecycle-authoring-editor-1", + "kind": "command", + "label": "Required authoring editor step", + "cwd": ".", + "argv": [ + "registryctl", + "authoring", + "editor", + "--project-dir", + "registry-project" + ] + }, + { + "id": "product-input-lifecycle-test-2", + "kind": "command", + "label": "Required test step", + "cwd": ".", + "argv": [ + "registryctl", + "test", + "--project-dir", + "registry-project", + "--integration", + "person-record", + "--fixture", + "active-person", + "--trace" + ] + }, + { + "id": "product-input-lifecycle-test", + "kind": "long_running", + "label": "Optional watch loop", + "cwd": ".", + "argv": [ + "registryctl", + "test", + "--project-dir", + "registry-project", + "--integration", + "person-record", + "--fixture", + "active-person", + "--watch" + ], + "note": "This long-running alternative reruns the focused synthetic fixture after authored files change. It is not part of the required noninteractive sequence." + }, + { + "id": "product-input-lifecycle-test-3", + "kind": "command", + "label": "Required test step", + "cwd": ".", + "argv": [ + "registryctl", + "test", + "--project-dir", + "registry-project" + ] + }, + { + "id": "product-input-lifecycle-check-4", + "kind": "command", + "label": "Required check step", + "cwd": ".", + "argv": [ + "registryctl", + "check", + "--project-dir", + "registry-project", + "--environment", + "local", + "--explain" + ] + }, + { + "id": "product-input-lifecycle-semantic-comparison", + "kind": "command", + "label": "Compare authored semantics with the embedded starter", + "cwd": ".", + "argv": [ + "registryctl", + "compare", + "--project-dir", + "registry-project", + "--environment", + "local", + "--from-starter" + ] + }, + { + "id": "lifecycle-preflight", + "kind": "readiness_gate", + "label": "Inspect missing offline requirements before operator handoff", + "cwd": ".", + "argv": [ + "registryctl", + "preflight", + "--project-dir", + "registry-project", + "--environment", + "local", + "--format", + "json" + ], + "note": "This clean-workspace step is expected to exit 1 with a value-free not_ready report because operator-provisioned runtime files and secret references are absent. It proves the diagnostic boundary, not readiness. Provision the reviewed environment bindings, rerun this command, and require a passing report before signing, verification, promotion, or activation handoff." + }, + { + "id": "lifecycle-capabilities", + "kind": "command", + "label": "Inspect declared and available capabilities", + "cwd": ".", + "argv": [ + "registryctl", + "capabilities", + "--project-dir", + "registry-project", + "--environment", + "local" + ] + }, + { + "id": "product-input-lifecycle-build-5", + "kind": "command", + "label": "Required build step", + "cwd": ".", + "argv": [ + "registryctl", + "build", + "--project-dir", + "registry-project", + "--environment", + "local" + ] + }, + { + "id": "lifecycle-governed-promotion-review", + "kind": "operator_interface", + "label": "Review against governed product baselines", + "inputs": [ + "Separately verified Relay baseline bundle and Relay trust anchor", + "Separately verified Notary baseline bundle and Notary trust anchor" + ], + "outputs": [ + "Value-safe promotion report and required-action review" + ], + "procedure": "Only after operators supply both product-owned baseline paths and trust anchors, use the registryctl promote lifecycle interface for the fixed project directory and local environment. This governed review is separate from the first-time starter comparison and does not authorize activation." + }, + { + "id": "lifecycle-relay-bundle", + "kind": "operator_interface", + "label": "Sign and verify the Relay product input", + "inputs": [ + "registry-project/.registry-stack/build/local/private/relay", + "Operator-selected Relay signing key", + "Operator-selected Relay trust anchor and anti-rollback sequence" + ], + "outputs": [ + "journey-output/registry-relay-bundle" + ], + "procedure": "Use registryctl bundle sign with --out journey-output/registry-relay-bundle, then verify that directory with the product-owned Relay trust anchor. Signing material is never rendered into a shell block." + }, + { + "id": "lifecycle-notary-bundle", + "kind": "operator_interface", + "label": "Sign and verify the Notary product input", + "inputs": [ + "registry-project/.registry-stack/build/local/private/notary", + "Operator-selected Notary signing key", + "Operator-selected Notary trust anchor and anti-rollback sequence" + ], + "outputs": [ + "journey-output/registry-notary-bundle" + ], + "procedure": "Use registryctl bundle sign with --out journey-output/registry-notary-bundle, then verify that directory with the product-owned Notary trust anchor. This does not claim product activation." + } + ] + } +] diff --git a/docs/site/src/data/repo-docs.yaml b/docs/site/src/data/repo-docs.yaml index 24ec0073e..9a2d0d3ce 100644 --- a/docs/site/src/data/repo-docs.yaml +++ b/docs/site/src/data/repo-docs.yaml @@ -8,7 +8,7 @@ repos: registry-relay: remote: https://github.com/registrystack/registry-stack ref: HEAD - version: v0.13.0 + version: main source (unreleased) local: ../.. openapi: crates/registry-relay/openapi/registry-relay.openapi.json archive_remote: https://github.com/jeremi/registry-relay @@ -198,7 +198,7 @@ repos: registry-notary: remote: https://github.com/registrystack/registry-stack ref: HEAD - version: v0.13.0 + version: main source (unreleased) local: ../.. openapi: products/notary/openapi/registry-notary.openapi.json archive_remote: https://github.com/jeremi/registry-notary @@ -454,7 +454,7 @@ repos: registry-manifest: remote: https://github.com/registrystack/registry-stack ref: HEAD - version: v0.13.0 + version: main source (unreleased) local: ../.. archive_remote: https://github.com/jeremi/registry-manifest docs: diff --git a/docs/site/src/data/standard-journeys.yaml b/docs/site/src/data/standard-journeys.yaml new file mode 100644 index 000000000..a4cb8e4b2 --- /dev/null +++ b/docs/site/src/data/standard-journeys.yaml @@ -0,0 +1,874 @@ +schema_version: registry.standard-journeys.v1 +journeys: + - id: spreadsheet-protected-api + slug: journeys/spreadsheet-protected-api + title: Publish a spreadsheet through a protected API + description: Generate the maintained local spreadsheet scaffold, verify its protected Relay surface, and identify which files become human-owned after generation. + outcome: A synthetic spreadsheet is available through a purpose-limited Relay API, with anonymous and under-scoped requests denied. + level: Beginner, local runtime + prerequisites: + - A Main-source registryctl binary and image lock built from one recorded commit + - A Docker Compose provider + - curl + expected_time: 15 to 25 minutes + evidence_class: source_and_generated_contract + evidence_lifecycle: main_unreleased + availability: { status: current_unreleased, proof: source_tree, release: null } + canonical_sources: + - crates/registryctl/src/lib.rs + - crates/registryctl/src/sample.rs + - crates/registryctl/src/templates/relay_config.yaml.tmpl + - crates/registryctl/src/templates/compose.yaml + - crates/registryctl/tests/init_output.rs + canonical_workspace: + id: registry-relay + path: crates/registryctl + catalog_references: + - { catalog: projects, id: registry-relay } + minimal_configuration: + files: + - source: crates/registryctl/src/templates/relay_config.yaml.tmpl + destination: my-first-api/relay/config.yaml + format: scaffolded + public_boundary: generated_template + note: The exact init step emits the complete disposable sample. The template is linked as its canonical source but is not rendered with unresolved generation tokens; review the emitted relay/config.yaml before runtime use. + artifacts: + - path: my-first-api/registryctl.yaml + classification: scaffolded_human_owned + owner: country_author + human_edit: true + version_control: true + note: Registryctl creates this project manifest, but later edits are human-authored intent. It is not registryctl build output. + - path: my-first-api/relay/config.yaml + classification: scaffolded_human_owned + owner: operator + human_edit: true + version_control: true + note: Registryctl creates the first Relay runtime configuration. The operator owns subsequent policy, caller, and data-binding review. + - path: my-first-api/data/benefits_casework.xlsx + classification: synthetic_fixture + owner: country_author + human_edit: true + version_control: true + note: The generated workbook contains synthetic tutorial records only. + - path: my-first-api/secrets/local.env + classification: environment_binding + owner: operator + human_edit: true + version_control: false + note: Registryctl generates local-only credentials. This file must not be reused or committed. + - path: my-first-api/output/smoke-results.json + classification: runtime_observed + owner: registryctl + human_edit: false + version_control: false + note: The report records one local runtime observation and is not authored configuration. + fixture: + source: crates/registryctl/src/sample.rs + format: generated_sample + expected_trace: + - Registryctl generates the synthetic benefits workbook and local-only credentials. + - Relay starts only after strict configuration and deployment gates pass. + - Anonymous access is denied, purpose and scope are enforced, and the row reader receives only allowed fields. + - The smoke report records local statuses without exposing credential values. + contract: + proves: + - The source-under-test scaffold can start one local Relay over synthetic tabular data. + - Protected metadata and record operations enforce configured caller, scope, purpose, and field-release boundaries. + - Scaffolded runtime files and runtime-observed reports have distinct ownership. + does_not_prove: + - Compatibility with a country spreadsheet, database, identity provider, or network. + - Production key custody, policy approval, legal approval, or operational resilience. + - That generated local credentials are suitable outside this disposable journey. + command_recipe: { kind: spreadsheet_runtime } + review: + - Inspect registryctl.yaml and relay/config.yaml before first start; treat both as human-owned after scaffolding. + - Confirm secrets/local.env is excluded from version control and contains no real credential. + - Inspect output/smoke-results.json as runtime evidence, not as configuration or production acceptance. + gates: + - name: Registryctl doctor + proves: The local scaffold, runtime files, and selected local posture pass the product checks reached by doctor. + does_not_prove: Source accuracy, production readiness, or approval of generated credentials. + - name: Relay startup validation + proves: Relay accepted the strict configuration and reached the configured local listener. + does_not_prove: The configuration is authorized for a production environment. + - name: Registryctl smoke + proves: Maintained synthetic allowed and denied requests behaved as expected against the local runtime. + does_not_prove: Live-source interoperability, load behavior, disaster recovery, or external acceptance. + production_delta: &runtime_delta + environment: Bind the reviewed candidate to the intended production environment and product instance. + secrets: Provision credentials and trust material through operator-managed references. + approval: Record country-author, product-owner, and operator approval for the reviewed candidate. + signing: Sign each immutable product input with the authorized product-specific identity. + activation: Verify, activate, observe, and retain rollback evidence independently for each product. + troubleshooting: + - relay.startup.config_document_invalid + - relay.startup.config_validation_rejected + - relay.startup.data_listener_unavailable + - relay.startup.doctor_failed + next_task: + label: Inspect the instance OpenAPI + href: /journeys/instance-openapi/ + evidence: + extraction: &standard_extraction_evidence + status: verified + source_path: docs/site/scripts/generate-standard-journeys.test.mjs + test_id: extracts every declared complete configuration file from its canonical source + command: node --test scripts/generate-standard-journeys.test.mjs + workflow: .github/workflows/ci.yml#docs + revision: main + lifecycle: current_unreleased + execution: &relay_tutorial_evidence + status: verified + source_path: docs/site/scripts/check-registryctl-tutorials.sh + test_id: run_relay_tutorial() + command: npm run check:tutorial:registryctl + workflow: .github/workflows/ci.yml#registryctl-tutorials + revision: main + lifecycle: current_unreleased + runtime: *relay_tutorial_evidence + + - id: instance-openapi + slug: journeys/instance-openapi + title: Inspect one running instance OpenAPI contract + description: Compare the reviewed Relay API source contract with the document exposed by one configured instance. + outcome: An operator verifies the exact API contract selected by one Relay instance. + level: Beginner + prerequisites: + - A Main-source registryctl binary and image lock built from one recorded commit + - A Docker Compose provider for the optional local runtime step + - An HTTP client that can preserve response bytes at an exact output path + expected_time: 10 minutes + evidence_class: source_and_generated_contract + evidence_lifecycle: main_unreleased + availability: { status: current_unreleased, proof: source_tree, release: null } + canonical_sources: + - crates/registry-relay/openapi/registry-relay.openapi.json + - crates/registry-relay/tests/api_docs.rs + - crates/registryctl/src/templates/relay_config.yaml.tmpl + canonical_workspace: + id: registry-relay + path: crates/registry-relay + catalog_references: + - { catalog: projects, id: registry-relay } + - { catalog: contracts, id: registry-relay.openapi } + minimal_configuration: + files: + - source: crates/registryctl/src/templates/relay_config.yaml.tmpl + destination: openapi-inspection/relay/config.yaml + format: scaffolded + public_boundary: generated_template + note: The exact init step emits the complete disposable local configuration. That sample explicitly sets server.openapi_requires_auth to false; the product default remains true. + artifacts: + - path: openapi-inspection/relay/config.yaml + classification: scaffolded_human_owned + owner: operator + human_edit: true + version_control: true + note: Exact configuration emitted by the disposable init step. It explicitly selects the local public OpenAPI opt-out and becomes operator-owned after scaffolding. + - path: crates/registry-relay/openapi/registry-relay.openapi.json + classification: generated_unsigned + owner: registry_relay + human_edit: false + version_control: true + note: Committed product-owned source contract used for drift and consumer review. + - path: openapi-inspection/output/instance.openapi.json + classification: runtime_observed + owner: operator + human_edit: false + version_control: false + note: Exact user-selected capture path for the typed runtime GET interface. + fixture: + source: crates/registry-relay/tests/api_docs.rs + format: source_reference + expected_trace: + - Registryctl creates a disposable local scaffold whose generated config explicitly sets server.openapi_requires_auth to false. + - The separately started local instance exposes an unauthenticated GET /openapi.json only because that explicit opt-out is selected. + - The captured OpenAPI document declares version 3.1.0 and is written to openapi-inspection/output/instance.openapi.json. + contract: + proves: + - The cited product source test proves that the explicit local opt-out exposes an OpenAPI 3.1.0 document without authentication. + - Performing the separate runtime interface captures the generated contract selected by that disposable instance. + does_not_prove: + - Downstream consumers remain compatible with every changed operation. + - OpenAPI-assisted upstream source authoring; that compiler contract remains deferred. + - That the product default is public, or that any operation described by the captured document is authorized without its configured credentials. + command_recipe: { kind: instance_openapi } + review: + - Review the server and catalog configuration selecting the API surface. + - Confirm the generated disposable config is the intended local-only openapi_requires_auth false opt-out before starting it. + - Inspect the exact instance document returned through the unauthenticated local route. + - Record the source revision, instance binding, capture time, and document digest; no credential is required or recorded for this explicit local opt-out. + gates: + - name: source test + proves: The explicit local public opt-out returns an OpenAPI 3.1.0 document in the product source test. + does_not_prove: A particular deployed instance is reachable. + - name: instance inspection + proves: When the operator performs the separate runtime step, the selected disposable instance exposes one concrete generated contract at the exact capture path. + does_not_prove: Every client accepts the selected contract. + - name: consumer comparison + proves: Reviewed consumers accept the candidate contract. + does_not_prove: Runtime health or production data correctness. + production_delta: *runtime_delta + troubleshooting: + - relay.startup.data_listener_unavailable + - relay.startup.config_validation_rejected + - rejected_binding + next_task: + label: Author a bounded HTTP integration + href: /journeys/bounded-http/ + evidence: + extraction: *standard_extraction_evidence + execution: &openapi_contract_evidence + status: verified + source_path: crates/registry-relay/tests/api_docs.rs + test_id: openapi_json_can_be_moved_to_public_router_for_local_testing + command: cargo test --locked -p registry-relay --test api_docs openapi_json_can_be_moved_to_public_router_for_local_testing -- --exact + workflow: .github/workflows/ci.yml#relay-contracts + revision: main + lifecycle: current_unreleased + runtime: &runtime_not_claimed_evidence + status: not_claimed + source_path: docs/site/scripts/generate-standard-journeys.test.mjs + test_id: keeps runtime and product activation claims bounded to traceable evidence + command: node --test scripts/generate-standard-journeys.test.mjs + workflow: .github/workflows/ci.yml#docs + revision: main + lifecycle: current_unreleased + + - id: bounded-http + slug: journeys/bounded-http + title: Author and test a bounded HTTP integration + description: Normalize one fixed HTTP request into a closed evidence projection with offline fixture proof. + outcome: A bounded HTTP request produces reviewed evidence through deterministic offline fixtures. + level: Intermediate + prerequisites: + - registryctl built from the current source revision + - A bounded source API contract + - Synthetic match and non-match examples + expected_time: 30 minutes + evidence_class: maintained_offline_fixture + evidence_lifecycle: main_unreleased + availability: { status: current_unreleased, proof: source_tree, release: null } + canonical_sources: + - crates/registryctl/assets/project-starters/bounded-http/registry-stack.yaml + - crates/registryctl/assets/project-starters/bounded-http/environments/local.yaml + - crates/registryctl/assets/project-starters/bounded-http/integrations/person-record/integration.yaml + - crates/registryctl/assets/project-starters/bounded-http/integrations/person-record/fixtures/active.yaml + canonical_workspace: + id: http + path: crates/registryctl/assets/project-starters/bounded-http + catalog_references: + - { catalog: project_authoring, id: http } + - { catalog: projects, id: registry-relay } + - { catalog: projects, id: registry-notary } + minimal_configuration: + files: + - source: crates/registryctl/assets/project-starters/bounded-http/registry-stack.yaml + destination: registry-project/registry-stack.yaml + format: yaml + public_boundary: maintained_synthetic + - source: crates/registryctl/assets/project-starters/bounded-http/environments/local.yaml + destination: registry-project/environments/local.yaml + format: yaml + public_boundary: maintained_synthetic + - source: crates/registryctl/assets/project-starters/bounded-http/integrations/person-record/integration.yaml + destination: registry-project/integrations/person-record/integration.yaml + format: yaml + public_boundary: maintained_synthetic + note: These complete maintained starter files define project topology, synthetic local bindings, and the bounded HTTP integration. No field-range excerpt is presented as a complete configuration. + artifacts: + - path: registry-project/registry-stack.yaml + classification: authored + owner: country_author + human_edit: true + version_control: true + note: Human-owned registry intent, service policy, consultation, claims, and disclosure. + - path: registry-project/integrations/person-record/integration.yaml + classification: authored + owner: country_author + human_edit: true + version_control: true + note: Human-owned source and projection contract. + - path: registry-project/integrations/person-record/fixtures/active.yaml + classification: synthetic_fixture + owner: country_author + human_edit: true + version_control: true + note: Maintained offline match evidence. + - path: registry-project/.registry-stack/build/local/reviewable + classification: generated_unsigned + owner: registryctl + human_edit: false + version_control: false + note: Exact emitted human-review directory within the local build output. + - path: registry-project/.registry-stack/build/local/private/relay + classification: generated_unsigned + owner: registryctl + human_edit: false + version_control: false + note: Exact emitted unsigned Relay product input. + - path: registry-project/.registry-stack/build/local/private/notary + classification: generated_unsigned + owner: registryctl + human_edit: false + version_control: false + note: Exact emitted unsigned Notary product input. + fixture: + source: crates/registryctl/assets/project-starters/bounded-http/integrations/person-record/fixtures/active.yaml + format: yaml + expected_trace: + - The harness expects one GET request at the templated person path. + - The synthetic response projects only the declared active output. + - Expected claims are evaluated without contacting a live source. + contract: + proves: + - The bounded request and response projection produce the expected offline result. + - Authored configuration can pass static check and deterministic build. + - Service policy, Relay consultation, Notary claims, and separate product inputs remain visible through the canonical workspace and generated reports. + does_not_prove: + - Live authentication, source availability, or production response compatibility. + command_recipe: { kind: matrix, matrix_id: http } + review: + - Review paths, statuses, output types, and every fixture interaction. + - Keep credentials as references and out of fixtures. + - Review explanations and product inputs without editing generated files. + gates: + - name: fixture + proves: The bounded request and projection produce the maintained offline result. + does_not_prove: Live source compatibility or authentication. + - name: check + proves: Authored configuration satisfies current static contracts. + does_not_prove: Runtime files and references are available. + - name: build + proves: Deterministic per-product inputs can be generated. + does_not_prove: Inputs are signed, trusted, or active. + production_delta: *runtime_delta + troubleshooting: + - registryctl.authoring.yaml.unknown_field + - fixture.request_mismatch + - source.status_rejected + - authorization.denied + next_task: + label: Extend the adapter with bounded FHIR scripting + href: /journeys/bounded-multi-call-script/ + evidence: + extraction: *standard_extraction_evidence + execution: &project_authoring_execution_evidence + status: verified + source_path: crates/registryctl/tests/project_authoring.rs + test_id: every_cataloged_supported_project_authoring_command_is_automated + command: cargo build --locked -p registryctl --bin registryctl && cargo test --locked -p registryctl --test project_authoring every_cataloged_supported_project_authoring_command_is_automated -- --exact + workflow: .github/workflows/ci.yml#project-authoring-determinism + revision: main + lifecycle: current_unreleased + runtime: *runtime_not_claimed_evidence + + - id: bounded-multi-call-script + slug: journeys/bounded-multi-call-script + title: Author and test a bounded FHIR R4 multi-call script + description: Review the complete Rhai adapter that bounds Patient, Coverage, and Organization requests. + outcome: A bounded Rhai adapter produces normalized FHIR evidence with maintained offline fixtures. + level: Advanced + prerequisites: + - Familiarity with FHIR R4 search bundles + - registryctl built from the current source revision + - Synthetic Patient, Coverage, and Organization examples + expected_time: 45 minutes + evidence_class: maintained_offline_fixture + evidence_lifecycle: main_unreleased + availability: { status: current_unreleased, proof: source_tree, release: null } + canonical_sources: + - crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/registry-stack.yaml + - crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/environments/local.yaml + - crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/integration.yaml + - crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/adapter.rhai + - crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/fixtures/match.yaml + canonical_workspace: + id: fhir-r4-coverage-active + path: crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active + catalog_references: + - { catalog: project_authoring, id: fhir-r4-coverage-active } + - { catalog: projects, id: registry-relay } + - { catalog: projects, id: registry-notary } + minimal_configuration: + files: + - source: crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/registry-stack.yaml + destination: fhir-project/registry-stack.yaml + format: yaml + public_boundary: maintained_synthetic + - source: crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/environments/local.yaml + destination: fhir-project/environments/local.yaml + format: yaml + public_boundary: maintained_synthetic + - source: crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/integration.yaml + destination: fhir-project/integrations/coverage/integration.yaml + format: yaml + public_boundary: maintained_synthetic + - source: crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/adapter.rhai + destination: fhir-project/integrations/coverage/adapter.rhai + format: rhai + public_boundary: maintained_synthetic + note: The complete maintained set includes project topology, synthetic local bindings, the canonical request limits, and the entire reviewed Rhai adapter without line-range extraction. + artifacts: + - path: fhir-project/integrations/coverage/integration.yaml + classification: authored + owner: country_author + human_edit: true + version_control: true + note: Human-owned request bounds, selectors, outputs, and limits. + - path: fhir-project/integrations/coverage/adapter.rhai + classification: authored + owner: country_author + human_edit: true + version_control: true + note: Hash-covered reviewed country implementation code. + - path: fhir-project/integrations/coverage/fixtures/match.yaml + classification: synthetic_fixture + owner: country_author + human_edit: true + version_control: true + note: Maintained offline FHIR conversation. + - path: fhir-project/.registry-stack/build/local/reviewable + classification: generated_unsigned + owner: registryctl + human_edit: false + version_control: false + note: Exact emitted human-review directory containing the reviewed integration closure. + - path: fhir-project/.registry-stack/build/local/private/relay + classification: generated_unsigned + owner: registryctl + human_edit: false + version_control: false + note: Exact emitted unsigned Relay input containing the complete Rhai adapter. + - path: fhir-project/.registry-stack/build/local/private/notary + classification: generated_unsigned + owner: registryctl + human_edit: false + version_control: false + note: Exact emitted unsigned Notary input for the combined project. + fixture: + source: crates/registryctl/tests/fixtures/project-authoring/fhir-r4-coverage-active/integrations/coverage/fixtures/match.yaml + format: yaml + expected_trace: + - The adapter performs bounded Patient and Coverage searches. + - The matched payor selects one Organization request. + - Coverage status and insurer name produce the expected claims. + contract: + proves: + - The complete Rhai file parses and satisfies the maintained synthetic FHIR conversation. + - Host-declared four-call, 512KiB source-byte, 8KiB request-byte, and 12-second deadline limits bound adapter execution. + does_not_prove: + - A live FHIR server conforms to the tested profile. + command_recipe: { kind: matrix, matrix_id: fhir-r4-coverage-active } + review: + - Review every allowed request, selector, ambiguity branch, and output projection. + - Confirm fixture ordering and bounded pagination. + - Confirm the generated closure includes the full reviewed Rhai file. + gates: + - name: script syntax + proves: The complete Rhai file parses under the current authoring contract. + does_not_prove: Every source response yields intended evidence. + - name: fixture + proves: The synthetic FHIR conversation produces expected normalized evidence. + does_not_prove: A live FHIR server conforms to the tested profile. + - name: build + proves: The reviewed script enters deterministic product inputs. + does_not_prove: Product bundles are trusted or active. + production_delta: *runtime_delta + troubleshooting: + - registryctl.authoring.script.syntax_error + - registryctl.authoring.script.unknown_function + - source.call_budget_exceeded + - source.deadline_exceeded + - source.response_malformed + next_task: + label: Compare with an exact snapshot + href: /journeys/exact-snapshot/ + evidence: + extraction: *standard_extraction_evidence + execution: *project_authoring_execution_evidence + runtime: *runtime_not_claimed_evidence + + - id: exact-snapshot + slug: journeys/exact-snapshot + title: Build an exact immutable snapshot lookup + description: Select at most one materialized record by unique key and project only declared evidence. + outcome: An exact selector reads one snapshot record and emits closed evidence. + level: Intermediate + prerequisites: + - registryctl built from the current source revision + - An immutable snapshot schema with a unique primary key + - Synthetic match and non-match records + expected_time: 30 minutes + evidence_class: maintained_offline_fixture + evidence_lifecycle: main_unreleased + availability: { status: current_unreleased, proof: source_tree, release: null } + canonical_sources: + - crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/registry-stack.yaml + - crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/environments/local.yaml + - crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/entities/people.yaml + - crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/integrations/person-snapshot/integration.yaml + - crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/integrations/person-snapshot/fixtures/match.yaml + canonical_workspace: + id: snapshot + path: crates/registryctl/tests/fixtures/project-authoring/snapshot-exact + catalog_references: + - { catalog: project_authoring, id: snapshot } + - { catalog: projects, id: registry-relay } + - { catalog: projects, id: registry-notary } + minimal_configuration: + files: + - source: crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/registry-stack.yaml + destination: snapshot-project/registry-stack.yaml + format: yaml + public_boundary: maintained_synthetic + - source: crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/environments/local.yaml + destination: snapshot-project/environments/local.yaml + format: yaml + public_boundary: maintained_synthetic + - source: crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/entities/people.yaml + destination: snapshot-project/entities/people.yaml + format: yaml + public_boundary: maintained_synthetic + - source: crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/integrations/person-snapshot/integration.yaml + destination: snapshot-project/integrations/person-snapshot/integration.yaml + format: yaml + public_boundary: maintained_synthetic + note: The complete maintained set includes the entity and unique-key materialization contract as well as the exact lookup. Ambiguity is structurally not applicable only while that primary-key invariant holds. + artifacts: + - path: snapshot-project/entities/people.yaml + classification: authored + owner: country_author + human_edit: true + version_control: true + note: Human-owned entity schema and materialization bounds. + - path: snapshot-project/integrations/person-snapshot/integration.yaml + classification: authored + owner: country_author + human_edit: true + version_control: true + note: Exact selector and evidence projection. + - path: snapshot-project/integrations/person-snapshot/fixtures/match.yaml + classification: synthetic_fixture + owner: country_author + human_edit: true + version_control: true + note: Maintained offline match evidence. + - path: snapshot-project/.registry-stack/build/local/reviewable + classification: generated_unsigned + owner: registryctl + human_edit: false + version_control: false + note: Exact emitted human-review directory for snapshot semantics. + - path: snapshot-project/.registry-stack/build/local/private/relay + classification: generated_unsigned + owner: registryctl + human_edit: false + version_control: false + note: Exact emitted unsigned Relay input containing snapshot materialization requirements. + - path: snapshot-project/.registry-stack/build/local/private/notary + classification: generated_unsigned + owner: registryctl + human_edit: false + version_control: false + note: Exact emitted unsigned Notary input for the combined project. + fixture: + source: crates/registryctl/tests/fixtures/project-authoring/snapshot-exact/integrations/person-snapshot/fixtures/match.yaml + format: yaml + expected_trace: + - The unique selector addresses at most one record. + - The selected record projects only declared outputs. + - Expected claims are evaluated from normalized snapshot evidence. + contract: + proves: + - Exact selection and projection match the maintained synthetic fixture. + - Authored snapshot and evidence contracts are statically coherent. + - Ambiguity is not applicable because the exact selector is the materialized unique primary key. + does_not_prove: + - Production snapshot freshness, completeness, or unique-key enforcement. + command_recipe: { kind: matrix, matrix_id: snapshot } + review: + - Review primary key, materialization bounds, freshness, and output projection. + - Confirm fixtures contain synthetic data only. + - Keep ambiguity not applicable only while the unique-key constraint remains enforced. + - Keep runtime snapshot generations outside version control. + gates: + - name: fixture + proves: Exact selection and projection match the synthetic conversation. + does_not_prove: Production freshness or completeness. + - name: check + proves: Static snapshot and evidence contracts are coherent. + does_not_prove: Runtime snapshot files are available. + - name: build + proves: Unsigned Relay input contains the reviewed snapshot materialization requirements. + does_not_prove: A runtime loaded a concrete snapshot generation or the upstream collection is complete. + production_delta: *runtime_delta + troubleshooting: + - registryctl.authoring.project.invalid + - fixture.request_mismatch + - registryctl.preflight.runtime_file_missing + next_task: + label: Consume registry-backed evidence in Notary + href: /journeys/registry-backed-notary-claim/ + evidence: + extraction: *standard_extraction_evidence + execution: *project_authoring_execution_evidence + runtime: *runtime_not_claimed_evidence + + - id: registry-backed-notary-claim + slug: journeys/registry-backed-notary-claim + title: Evaluate a registry-backed Notary predicate + description: Evaluate one disclosure-minimizing Notary claim from normalized Relay evidence. + outcome: Notary returns the explicit active-registration-exists predicate from registry-backed evidence. + level: Intermediate + prerequisites: + - A Relay person-demographics integration + - registryctl and images built from one exact source revision + - Synthetic match, pending, non-match, and ambiguity fixtures + expected_time: 25 minutes + evidence_class: source_and_generated_contract + evidence_lifecycle: main_unreleased + availability: { status: current_unreleased, proof: source_tree, release: null } + canonical_sources: + - crates/registryctl/src/templates/notary_addon/registry-stack.yaml + - crates/registryctl/src/templates/notary_addon/environments/local.yaml + - crates/registryctl/src/templates/notary_addon/integrations/person-demographics/integration.yaml + - crates/registryctl/src/templates/notary_addon/integrations/person-demographics/fixtures/match.yaml + canonical_workspace: + id: registry-notary + path: crates/registryctl/src/templates/notary_addon + catalog_references: + - { catalog: projects, id: registry-relay } + - { catalog: projects, id: registry-notary } + - { catalog: contracts, id: registry-notary.openapi } + minimal_configuration: + files: + - source: crates/registryctl/src/templates/notary_addon/registry-stack.yaml + destination: my-first-api/notary/project/registry-stack.yaml + format: yaml + public_boundary: maintained_synthetic + - source: crates/registryctl/src/templates/notary_addon/environments/local.yaml + destination: my-first-api/notary/project/environments/local.yaml + format: yaml + public_boundary: maintained_synthetic + - source: crates/registryctl/src/templates/notary_addon/integrations/person-demographics/integration.yaml + destination: my-first-api/notary/project/integrations/person-demographics/integration.yaml + format: yaml + public_boundary: maintained_synthetic + note: The add-on step emits this complete authored Notary project set. The explicit active-registration-exists predicate remains in the full project file and is checked against the maintained fixture. + artifacts: + - path: my-first-api/notary/project/registry-stack.yaml + classification: authored + owner: country_author + human_edit: true + version_control: true + note: Human-owned consultation and claim rule. + - path: my-first-api/notary/project/integrations/person-demographics/fixtures/match.yaml + classification: synthetic_fixture + owner: country_author + human_edit: true + version_control: true + note: Maintained predicate expectation. + - path: my-first-api/notary/project/.registry-stack/build/local/reviewable + classification: generated_unsigned + owner: registryctl + human_edit: false + version_control: false + note: Exact emitted human-review directory for the Notary project build. + - path: my-first-api/notary/project/.registry-stack/build/local/private/relay + classification: generated_unsigned + owner: registryctl + human_edit: false + version_control: false + note: Exact emitted unsigned Relay consultation input. + - path: my-first-api/notary/project/.registry-stack/build/local/private/notary + classification: generated_unsigned + owner: registryctl + human_edit: false + version_control: false + note: Exact emitted unsigned Notary product input. + fixture: + source: crates/registryctl/src/templates/notary_addon/integrations/person-demographics/fixtures/match.yaml + format: yaml + expected_trace: + - Relay-backed enrollment evidence matches with active status. + - Notary evaluates active-registration-exists. + - The response discloses the predicate rather than the source record. + contract: + proves: + - The maintained fixture expects active-registration-exists to be true. + - Relay evidence and the Notary predicate agree in current source. + - True means the bounded selected source returned exactly one matching active registration. + does_not_prove: + - Live registry data, workload identity, or production policy approval. + - False does not prove global nonexistence, identity fraud, ineligibility, or a legal negative. + - The result does not prove that the caller is the matched person. + command_recipe: { kind: notary_claim } + review: + - Review the consultation mapping, claim identifier, CEL rule, and all fixture claim keys. + - Confirm the rule discloses no unnecessary attributes. + - Keep false bounded to no active matching record found by this consultation in the selected source. + - Review Relay and Notary generated inputs independently. + gates: + - name: fixture + proves: The maintained match produces the explicit predicate. + does_not_prove: Live registry data produces the same result. + - name: cross-product check + proves: Relay outputs and Notary dependencies are statically compatible. + does_not_prove: Runtime trust and network configuration are valid. + - name: smoke + proves: The local combined runtime satisfies its packaged smoke contract. + does_not_prove: Production legal, disclosure, or availability requirements. + production_delta: *runtime_delta + troubleshooting: + - registryctl.authoring.project.invalid + - fixture.request_mismatch + - notary.relay.profile_mismatch + next_task: + label: Promote generated product inputs + href: /journeys/product-input-lifecycle/ + evidence: + extraction: *standard_extraction_evidence + execution: ¬ary_tutorial_evidence + status: verified + source_path: docs/site/scripts/check-registryctl-tutorials.sh + test_id: run_notary_tutorial() + command: npm run check:tutorial:registryctl + workflow: .github/workflows/ci.yml#registryctl-tutorials + revision: main + lifecycle: current_unreleased + runtime: *notary_tutorial_evidence + + - id: product-input-lifecycle + slug: journeys/product-input-lifecycle + title: Review and promote generated product inputs + description: Keep authoring, generation, signing, verification, and activation as separate trust-boundary steps. + outcome: Reviewed authored configuration becomes independently activatable Relay and Notary product inputs. + level: Advanced + prerequisites: + - A fixture-complete project that passes registryctl check + - Operator-managed signing identities and product trust anchors + - Separate Relay and Notary activation authority + expected_time: 40 minutes + evidence_class: generated_contract + evidence_lifecycle: main_unreleased + availability: { status: current_unreleased, proof: source_tree, release: null } + canonical_sources: + - docs/site/src/content/docs/reference/registryctl.mdx + - crates/registryctl/assets/project-starters/bounded-http/registry-stack.yaml + - crates/registryctl/assets/project-starters/bounded-http/environments/local.yaml + - crates/registryctl/assets/project-starters/bounded-http/integrations/person-record/integration.yaml + - crates/registryctl/assets/project-starters/bounded-http/integrations/person-record/fixtures/active.yaml + canonical_workspace: + id: http + path: crates/registryctl/assets/project-starters/bounded-http + catalog_references: + - { catalog: project_authoring, id: http } + - { catalog: projects, id: registry-relay } + - { catalog: projects, id: registry-notary } + minimal_configuration: + files: + - source: crates/registryctl/assets/project-starters/bounded-http/registry-stack.yaml + destination: registry-project/registry-stack.yaml + format: yaml + public_boundary: maintained_synthetic + - source: crates/registryctl/assets/project-starters/bounded-http/environments/local.yaml + destination: registry-project/environments/local.yaml + format: yaml + public_boundary: maintained_synthetic + - source: crates/registryctl/assets/project-starters/bounded-http/integrations/person-record/integration.yaml + destination: registry-project/integrations/person-record/integration.yaml + format: yaml + public_boundary: maintained_synthetic + note: The complete maintained source set contains authored intent and synthetic local bindings only. Unsigned product inputs, user-selected bundle outputs, trust anchors, and activation state remain separate. + artifacts: + - path: registry-project/registry-stack.yaml + classification: authored + owner: country_author + human_edit: true + version_control: true + note: Reviewed authored source of truth. + - path: registry-project/.registry-stack/build/local/reviewable + classification: generated_unsigned + owner: registryctl + human_edit: false + version_control: false + note: Exact emitted reviewable directory from the deterministic build. + - path: registry-project/.registry-stack/build/local/private/relay + classification: generated_unsigned + owner: registryctl + human_edit: false + version_control: false + note: Exact emitted unsigned Relay product input. + - path: registry-project/.registry-stack/build/local/private/notary + classification: generated_unsigned + owner: registryctl + human_edit: false + version_control: false + note: Exact emitted unsigned Notary product input. + - path: journey-output/registry-relay-bundle + classification: generated_signed + owner: operator + human_edit: false + version_control: false + note: Exact user-selected --out path for the independently signed and verified Relay bundle. + - path: journey-output/registry-notary-bundle + classification: generated_signed + owner: operator + human_edit: false + version_control: false + note: Exact user-selected --out path for the independently signed and verified Notary bundle. + fixture: + source: crates/registryctl/assets/project-starters/bounded-http/integrations/person-record/fixtures/active.yaml + format: yaml + expected_trace: + - Fixtures establish authored behavior before build. + - Check and preflight emit separate value-free reports. + - Product inputs remain independent through signing, verification, and the product-owned activation handoff. + contract: + proves: + - Deterministic unsigned product inputs can be generated from reviewed source. + - Independently signed Relay and Notary bundles can be verified and made eligible for separate product-owned activation. + - Relay and Notary inputs, signatures, trust anchors, and anti-rollback sequences remain product-owned and separate. + does_not_prove: + - An unsigned build is trusted, active, healthy, or release-proven. + - Separate valid product signatures create an atomic project-root activation. + command_recipe: { kind: product_input_lifecycle, matrix_id: http } + review: + - Review authored semantics and the candidate source commit. + - Use the build report to locate each product closure. + - Sign and verify Relay and Notary inputs independently before handing either bundle to its product-owned activation procedure. + gates: + - name: fixture and check + proves: Maintained behavior and static contracts are coherent. + does_not_prove: Runtime readiness or live source compatibility. + - name: preflight diagnostic + proves: A clean workspace reports missing operator files and secret references through the value-free offline contract. + does_not_prove: Operator inputs are provisioned, preflight passes, or the runtime is healthy. + - name: bundle verification + proves: One immutable product closure has accepted signature and target binding. + does_not_prove: The other product is valid or activation succeeds. + - name: activation handoff + proves: Each verified bundle and trust decision is separately identifiable for its product-owned activation procedure. + does_not_prove: Either product activated the bundle, reached readiness, or exercised rollback. + production_delta: + environment: Bind each reviewed product candidate to the intended environment and instance. + secrets: Keep signing keys and trust anchors in operator-managed systems. + approval: Preserve separate author, product-owner, signer, and activator approvals. + signing: Apply product-specific identity, stream, sequence, and bundle bindings. + activation: Exercise readiness, activation, rollback, and last-known-good behavior per product. Relay and Notary activate independently; Registry Stack does not claim atomic project-root activation. + troubleshooting: + - registryctl.authoring.project.invalid + - registryctl.preflight.secret_missing + - rejected_signature + - rejected_binding + - rejected_rollback + - notary.runtime.activation_required + next_task: + label: Review operator diagnostics + href: /reference/diagnostics/operator/ + evidence: + extraction: *standard_extraction_evidence + execution: *project_authoring_execution_evidence + runtime: *runtime_not_claimed_evidence diff --git a/products/manifest/docs/validate-and-render.md b/products/manifest/docs/validate-and-render.md index b9d6c9de1..d594e2872 100644 --- a/products/manifest/docs/validate-and-render.md +++ b/products/manifest/docs/validate-and-render.md @@ -171,10 +171,11 @@ Render a single evidence offering by ID (substitute the offering ID defined in y `evidence_offerings` list): ```sh +: "${OFFERING_ID:?set OFFERING_ID to one ID from evidence_offerings}" cargo run --bin registry-manifest -- render \ profiles/example-civil-registration/fixtures/metadata.yaml \ --format evidence-offering \ - --offering + --offering "$OFFERING_ID" ``` All `render` output goes to stdout. diff --git a/products/notary/CHANGELOG.md b/products/notary/CHANGELOG.md index cad250198..e3ae76a1b 100644 --- a/products/notary/CHANGELOG.md +++ b/products/notary/CHANGELOG.md @@ -7,6 +7,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +### Added + +- Added product-owned, value-free activation diagnostics and stateful Config + Bundle verification with explicit anti-rollback state. Startup and doctor + boundaries retain stable classifications without exposing sensitive + configuration values or paths. + ## [0.13.0] - 2026-07-25 ### Changed diff --git a/products/notary/docs/configuration-trust-and-integrity.md b/products/notary/docs/configuration-trust-and-integrity.md index 41ba3dac4..8b7406423 100644 --- a/products/notary/docs/configuration-trust-and-integrity.md +++ b/products/notary/docs/configuration-trust-and-integrity.md @@ -29,17 +29,33 @@ diagnostics, logs, audit records, fixture traces, or deployment manifests. ## Deployment activation -A production deployment verifies its generated product configuration through -the repository's signed bundle boot boundary and anti-rollback state. A -combined generation must activate compatible Relay and Notary inputs -atomically. Blue-green switching may stage a complete replacement generation; -smaller deployments may drain, restart both products, verify readiness, and -resume. A mixed contract generation remains unavailable. - -The broader project-root signing workflow is intentionally not documented as -an already shipped operator journey here. Until that project-authoring work is -delivered, use the existing product bundle verification controls and do not -claim coordinated root-signature verification that the runtime cannot prove. +Relay and Notary use separate product bundles. Build, sign, verify, and track +anti-rollback state for each product bundle independently. At boot, each +runtime verifies and activates only its own bundle. Current source does not +produce or verify a signed project-root bundle, and no Registry Stack +coordinator atomically activates both products. + +Use compatible staged activation for a combined topology: + +1. Verify the Relay bundle and the Notary bundle independently, including each + signature, product identity, sequence, and anti-rollback state. +2. Start or stage Relay without admitting caller traffic. Require its health, + readiness, audit, and deployment-posture checks to pass. +3. Start or stage Notary against that Relay. Require Notary startup and + readiness to validate its complete expected Relay consultation contract, + then require Notary health, audit, and deployment-posture checks to pass. +4. Admit caller traffic only after both products are ready and the Notary-to- + Relay contract check succeeds. + +This is not atomic project activation. The deployment platform controls traffic +admission around two product-owned boot boundaries. During execute, Notary +sends the exact `contract_hash`; an execute-time contract mismatch is rejected +by Relay before source access. + +A future project-root packaging or coordination mechanism remains deferred +under [registry-stack issue #361](https://github.com/registrystack/registry-stack/issues/361). +Do not claim root-signature verification or a project activation coordinator +that current runtimes cannot prove. ## Review checklist @@ -47,5 +63,7 @@ claim coordinated root-signature verification that the runtime cannot prove. - Verify Relay and Notary expect the same contract and platform requirements. - Keep service policy and source authority in their owning products. - Verify secret references without reading or printing their values. -- Activate one complete generation and require both products to report ready. +- Keep caller traffic blocked while Relay and Notary are staged separately. +- Admit traffic only after both products report ready and Notary validates its + Relay contract. - Preserve separate Relay and Notary audit keys and chains. diff --git a/products/notary/docs/deployment-hardening-runbook.md b/products/notary/docs/deployment-hardening-runbook.md index b532140ac..6bcf3f0e9 100644 --- a/products/notary/docs/deployment-hardening-runbook.md +++ b/products/notary/docs/deployment-hardening-runbook.md @@ -6,6 +6,9 @@ - Confirm the topology is Relay-only, Notary-only, or combined as intended. - For combined deployments, verify Notary and Relay expect the same semantic consultation contracts and hashes. +- Build, sign, and verify the Relay and Notary product bundles separately. + Preserve separate anti-rollback state and signed-bundle acceptance evidence + for each product. - Keep source destinations and credentials only in Relay's private environment. - Keep the Notary workload token, signing keys, audit secret, and store credentials in mounted secret files or an approved secret manager. @@ -94,10 +97,25 @@ documented same-identity file refresh is specifically supported. ## Rollout -For blue-green rollout, stage a complete Relay and Notary generation without -traffic, verify both products, then switch. For drain-and-restart, stop new -traffic, drain active work, restart both products, verify readiness, and -resume. A mixed semantic contract generation must remain unavailable. +Combined rollout is compatible staging across two product-owned bundle +boundaries, not atomic project activation. Current source has no signed +project-root deployment bundle and no coordinator that activates Relay and +Notary together. + +1. Verify both signed product bundles and their independent anti-rollback + state before starting either replacement. +2. Start or stage Relay without admitting caller traffic. Require Relay health, + readiness, audit, and deployment-posture checks to pass. +3. Start or stage Notary against the ready Relay. Require Notary startup and + readiness to validate its complete expected Relay consultation contract, + then require Notary health, audit, and deployment-posture checks to pass. +4. Admit caller traffic only after both products are ready and the contract + check succeeds. + +For drain-and-restart, stop new traffic and drain active work before the same +ordered restart. A contract mismatch during execute is rejected by Relay +before source access. Do not restore traffic merely because both processes are +live. Run: @@ -115,5 +133,6 @@ Never load secrets through command-line values or retain them in test evidence. If a workload credential, signing key, caller credential, or audit secret may be exposed, revoke or rotate it first, stop affected traffic, preserve redacted -audit evidence, and activate a fully compatible generation. Do not restore a -direct source path as a recovery mechanism. +audit evidence, verify and stage compatible Relay and Notary product bundles, +and restore traffic only after both are ready. Do not restore a direct source +path as a recovery mechanism. diff --git a/products/notary/docs/operator-config-reference.md b/products/notary/docs/operator-config-reference.md index b447b227b..1e1aec272 100644 --- a/products/notary/docs/operator-config-reference.md +++ b/products/notary/docs/operator-config-reference.md @@ -777,10 +777,18 @@ mounted secret files and out of command lines and retained logs. ## Rollout -Activate Relay and Notary as one compatible project generation. For blue-green -rollout, stage a complete generation without traffic, verify readiness, then -switch. For a smaller deployment, drain traffic, restart both products, -verify readiness, and resume. Never serve a mixed semantic contract. +Relay and Notary use separately built, signed, verified, anti-rollback-tracked, +and boot-activated product bundles. A combined rollout is compatible staged +activation, not atomic project activation; current source has no signed +project-root bundle or activation coordinator. + +Verify both product bundles first. Start or stage Relay without admitting +caller traffic and require its health, readiness, audit, and deployment-posture +checks to pass. Then start or stage Notary, require startup and readiness to +validate its Relay contract, and require Notary health, audit, and posture +checks to pass. Admit caller traffic only when both products are ready and the +contract check succeeds. An execute-time contract mismatch fails at Relay +before source access. The complete generated schema, runtime diagnostics, and OpenAPI are authoritative for exact field syntax. diff --git a/products/notary/docs/postgresql-correctness-state-execution-spec.md b/products/notary/docs/postgresql-correctness-state-execution-spec.md index 222754d1b..42983ed8b 100644 --- a/products/notary/docs/postgresql-correctness-state-execution-spec.md +++ b/products/notary/docs/postgresql-correctness-state-execution-spec.md @@ -426,11 +426,23 @@ Startup fails before listener bind for: Every readiness probe performs the complete server, writeability, durability, schema, catalog, and role attestation on a bounded pooled session. Startup -performs the same attestation before listener bind. It reports a stable -component code such as `database_unavailable`, `schema_incompatible`, or -`role_incompatible` without table names, role names, paths, URLs, credentials, -SQL, or stored identifiers. Detailed logs remain value-free and name the -operator action. +performs the same attestation before listener bind. Startup and `state doctor` +report the same stable public classification: + +- `notary.state.postgresql.database_unavailable` for transport, TLS trust, or + service outage; +- `notary.state.postgresql.database_read_only` for a read-only or recovering + database; +- `notary.state.postgresql.database_unsupported` for an unsupported server + major; +- `notary.state.postgresql.durability_unsafe` for unsafe durability settings; +- `notary.state.postgresql.schema_incompatible` for schema, catalog, + fingerprint, or privilege drift; and +- `notary.state.postgresql.role_incompatible` for runtime-role contract drift. + +Each code renders only its static safe meaning and remediation. Diagnostics do +not expose table names, role names, paths, URLs, credentials, SQL, or stored +identifiers. Readiness recovers after database availability is restored and a fresh connection passes complete attestation. Failed or closed sessions are evicted, diff --git a/products/notary/docs/postgresql-state-operations.md b/products/notary/docs/postgresql-state-operations.md index a2a902dd7..d25c5f3a1 100644 --- a/products/notary/docs/postgresql-state-operations.md +++ b/products/notary/docs/postgresql-state-operations.md @@ -509,14 +509,18 @@ or credentials in smoke-test logs. ## Failure diagnostics -| Symptom or component code | Operator action | +Startup and `state doctor` publish the same closed, value-free diagnostic +contract. Each code carries a static safe meaning and next action. Runtime +paths, URLs, credentials, identifiers, SQL, and role names remain private. + +| Public code or symptom | Operator action | | --- | --- | -| `database_unavailable` | Check primary availability, network policy, TLS handshake, connection limits, and the configured connect timeout. Do not print the URL. | -| `schema_incompatible` | Stop all replicas. Use the matching released binary to run `state install`, or restore the matching application and database backup together. | -| `role_incompatible` | Compare role provisioning with the role-separation contract and rerun install and doctor. Do not grant runtime table access. | -| Unsupported database version | Move the database to PostgreSQL 16, 17, or 18, then run install and doctor before admission. | -| Database is read-only or in recovery | Promote the intended recovery target to a writable primary or correct routing. Never serve correctness state from a read-only replica. | -| TLS or root-certificate failure | Verify the mounted certificate, trust chain, permissions, and configured TLS policy without logging its path or contents. | +| `notary.state.postgresql.database_unavailable` | Check primary availability, network policy, TLS trust, connection limits, and the configured connect timeout. Do not print the URL or certificate path. | +| `notary.state.postgresql.database_read_only` | Promote the intended recovery target to a writable primary or correct routing. Never serve correctness state from a read-only replica. | +| `notary.state.postgresql.database_unsupported` | Move the database to PostgreSQL 16, 17, or 18, then run install and doctor before admission. | +| `notary.state.postgresql.durability_unsafe` | Restore the documented durability settings, then rerun doctor before admission. | +| `notary.state.postgresql.schema_incompatible` | Stop all replicas. Use the matching released binary to run `state install`, or restore the matching application and database backup together. | +| `notary.state.postgresql.role_incompatible` | Compare provisioning with the role-separation contract and rerun install and doctor. Do not grant runtime table access. | | Missing URL environment variable | Correct secret injection for the variable name in config. Do not substitute a URL on the command line. | | Missing or wrong sensitive-state key | Stop preauthorization, restore the backup-matched secret version, or follow the 600-second key-loss drain. | | Fingerprint or role-identity mismatch after restore | Keep the database isolated, run the matching `state install`, then rerun doctor and stale-restore checks. | @@ -524,7 +528,7 @@ or credentials in smoke-test logs. | Readiness remains unavailable after recovery | Confirm the database accepts a new TLS connection and has the expected role and schema. The pool evicts failed sessions automatically; if the platform still presents the old endpoint or secret generation, correct that injection and restart the canary before requiring doctor and readiness. | Diagnostics are intentionally value-free. Use redacted database-platform logs -and the stable component code to investigate. Do not add SQL, row values, +and the stable public code to investigate. Do not add SQL, row values, identifiers, secrets, paths, URLs, or role names to application diagnostics. ## Supported PostgreSQL versions diff --git a/products/notary/scripts/postgresql-conformance.sh b/products/notary/scripts/postgresql-conformance.sh index 54a0b4403..cd2b23919 100755 --- a/products/notary/scripts/postgresql-conformance.sh +++ b/products/notary/scripts/postgresql-conformance.sh @@ -477,18 +477,64 @@ while ! grep --fixed-strings --line-regexp --quiet ready "${work_dir}/negative-l sleep 0.1 done -expect_startup_failure() { +assert_postgresql_public_diagnostic() { local label="$1" - local expected_error="$2" + local log_file="$2" + local code="$3" + local meaning="$4" + local remediation="$5" + local expected="${code}: ${meaning}; next action: ${remediation}" + local line_count + line_count="$(wc -l <"${log_file}" | tr -d '[:space:]')" + if [[ "${line_count}" != "1" ]] \ + || ! grep --fixed-strings --line-regexp --quiet -- "ERROR ${expected}" "${log_file}"; then + sed -n '1,120p' "${log_file}" >&2 + fail "${label} did not report the expected public PostgreSQL diagnostic" + fi + local forbidden + for forbidden in \ + "${runtime_database_url}" \ + "${migrator_database_url}" \ + "${runtime_password}" \ + "${migrator_password}" \ + "${admin_password}" \ + "${sensitive_state_key}" \ + "${audit_secret}" \ + "${api_key}" \ + "${config_path}" \ + "${work_dir}" \ + registry_notary_owner \ + registry_notary_runtime \ + registry_notary_migrator; do + if [[ -n "${forbidden}" ]] && grep --fixed-strings --quiet -- "${forbidden}" "${log_file}"; then + sed -n '1,120p' "${log_file}" >&2 + fail "${label} public PostgreSQL diagnostic exposed a governed path or value" + fi + done +} + +expect_postgresql_failure() { + local label="$1" + local code="$2" + local meaning="$3" + local remediation="$4" + local doctor_log="${work_dir}/doctor-${label}.log" local log_file="${work_dir}/startup-${label}.log" - if "${notary_bin}" --config "${config_path}" \ + + if RUST_LOG=off REGISTRY_NOTARY_LOG_FORMAT=text \ + "${notary_bin}" --config "${config_path}" state doctor >"${doctor_log}" 2>&1; then + fail "${label} state doctor accepted the failed PostgreSQL posture" + fi + assert_postgresql_public_diagnostic \ + "${label} state doctor" "${doctor_log}" "${code}" "${meaning}" "${remediation}" + + if RUST_LOG=off REGISTRY_NOTARY_LOG_FORMAT=text \ + "${notary_bin}" --config "${config_path}" \ --bind "127.0.0.1:${notary_negative_port}" >"${log_file}" 2>&1; then fail "${label} state failure allowed startup" fi - if ! grep --fixed-strings --quiet -- "${expected_error}" "${log_file}"; then - sed -n '1,120p' "${log_file}" >&2 - fail "${label} startup did not report the expected closed error" - fi + assert_postgresql_public_diagnostic \ + "${label} startup" "${log_file}" "${code}" "${meaning}" "${remediation}" if grep --extended-regexp --quiet -- 'Address already in use|os error (48|98)' "${log_file}"; then fail "${label} reached listener binding before state activation failed" fi @@ -766,10 +812,11 @@ admin_sql postgres \ WHERE datname = 'registry_notary' AND usename = 'registry_notary_runtime';" wait_not_ready "${url_a}" || fail "read-only PostgreSQL did not fail readiness" -if "${notary_bin}" --config "${config_path}" state doctor >"${work_dir}/doctor-read-only.log" 2>&1; then - fail "state doctor accepted read-only PostgreSQL" -fi -expect_startup_failure read-only "Notary PostgreSQL database is unavailable" +expect_postgresql_failure \ + read-only \ + notary.state.postgresql.database_read_only \ + "Registry Notary PostgreSQL state database is read-only or recovering" \ + "restore a writable PostgreSQL primary, run registry-notary state doctor, and retry activation" admin_sql postgres 'ALTER DATABASE registry_notary RESET default_transaction_read_only;' wait_ready "${url_a}" "${notary_pid_a}" || fail "readiness did not recover after read-only repair" "${notary_bin}" --config "${config_path}" state doctor >"${work_dir}/doctor-read-only-recovered.log" 2>&1 \ @@ -778,10 +825,11 @@ wait_ready "${url_a}" "${notary_pid_a}" || fail "readiness did not recover after admin_sql registry_notary \ 'ALTER FUNCTION registry_notary_api.replay_insert_v1(bytea, bytea, timestamptz) IMMUTABLE;' wait_not_ready "${url_a}" || fail "schema drift did not fail readiness" -if "${notary_bin}" --config "${config_path}" state doctor >"${work_dir}/doctor-schema-drift.log" 2>&1; then - fail "state doctor accepted schema drift" -fi -expect_startup_failure catalog-drift "Notary PostgreSQL state schema is incompatible" +expect_postgresql_failure \ + catalog-drift \ + notary.state.postgresql.schema_incompatible \ + "Registry Notary PostgreSQL state schema contract is incompatible" \ + "restore or install the matching Registry Notary state schema, run registry-notary state doctor, and retry activation" admin_sql registry_notary \ 'ALTER FUNCTION registry_notary_api.replay_insert_v1(bytea, bytea, timestamptz) VOLATILE;' wait_ready "${url_a}" "${notary_pid_a}" || fail "readiness did not recover after schema repair" @@ -797,11 +845,11 @@ admin_sql registry_notary \ SET schema_fingerprint = repeat('0', 64) WHERE singleton = TRUE;" wait_not_ready "${url_a}" || fail "metadata fingerprint drift did not fail readiness" -if "${notary_bin}" --config "${config_path}" state doctor \ - >"${work_dir}/doctor-fingerprint-drift.log" 2>&1; then - fail "state doctor accepted metadata fingerprint drift" -fi -expect_startup_failure fingerprint-drift "Notary PostgreSQL state schema is incompatible" +expect_postgresql_failure \ + fingerprint-drift \ + notary.state.postgresql.schema_incompatible \ + "Registry Notary PostgreSQL state schema contract is incompatible" \ + "restore or install the matching Registry Notary state schema, run registry-notary state doctor, and retry activation" if "${notary_bin}" --config "${config_path}" state install \ --migration-url-env REGISTRY_NOTARY_POSTGRES_MIGRATOR_URL \ --owner-role registry_notary_owner \ @@ -826,10 +874,11 @@ wait_ready "${url_a}" "${notary_pid_a}" \ admin_sql registry_notary \ 'REVOKE EXECUTE ON FUNCTION registry_notary_api.nonce_consume_v1(bytea, bytea, bigint) FROM registry_notary_runtime;' wait_not_ready "${url_a}" || fail "runtime permission drift did not fail readiness" -if "${notary_bin}" --config "${config_path}" state doctor >"${work_dir}/doctor-permission-drift.log" 2>&1; then - fail "state doctor accepted runtime permission drift" -fi -expect_startup_failure permission-drift "Notary PostgreSQL state schema is incompatible" +expect_postgresql_failure \ + permission-drift \ + notary.state.postgresql.schema_incompatible \ + "Registry Notary PostgreSQL state schema contract is incompatible" \ + "restore or install the matching Registry Notary state schema, run registry-notary state doctor, and retry activation" admin_sql registry_notary \ 'GRANT EXECUTE ON FUNCTION registry_notary_api.nonce_consume_v1(bytea, bytea, bigint) TO registry_notary_runtime;' wait_ready "${url_a}" "${notary_pid_a}" || fail "readiness did not recover after permission repair" @@ -845,13 +894,11 @@ admin_sql registry_notary \ SET runtime_role_oid = (SELECT oid FROM pg_catalog.pg_roles WHERE rolname = 'postgres') WHERE singleton = TRUE;" wait_not_ready "${url_a}" || fail "wrong runtime role did not fail readiness" -if "${notary_bin}" --config "${config_path}" state doctor \ - >"${work_dir}/doctor-role-incompatible.log" 2>&1; then - fail "state doctor accepted the wrong runtime role" -fi -grep --fixed-strings --quiet role_incompatible "${work_dir}/doctor-role-incompatible.log" \ - || fail "state doctor did not report the role-incompatible component" -expect_startup_failure role-incompatible "Notary PostgreSQL runtime role is incompatible" +expect_postgresql_failure \ + role-incompatible \ + notary.state.postgresql.role_incompatible \ + "Registry Notary PostgreSQL runtime role contract is incompatible" \ + "restore the documented runtime grants and role binding, run registry-notary state doctor, and retry activation" admin_sql registry_notary \ "UPDATE registry_notary_private.schema_metadata SET runtime_role_oid = ${bound_runtime_role_oid} @@ -889,11 +936,11 @@ if [[ "${postgresql_major}" == "18" ]]; then (( SECONDS < unsupported_deadline )) \ || fail "unsupported PostgreSQL test server did not become ready" wait_not_ready "${url_a}" || fail "unsupported PostgreSQL major did not fail readiness" - if "${notary_bin}" --config "${config_path}" state doctor \ - >"${work_dir}/doctor-unsupported-major.log" 2>&1; then - fail "state doctor accepted an unsupported PostgreSQL major" - fi - expect_startup_failure unsupported-major "Notary PostgreSQL server major is unsupported" + expect_postgresql_failure \ + unsupported-major \ + notary.state.postgresql.database_unsupported \ + "Registry Notary PostgreSQL server major is unsupported" \ + "move the state database to a supported PostgreSQL major, run registry-notary state doctor, and retry activation" docker rm -f "${unsupported_postgres_container}" >/dev/null docker start "${postgres_container}" >/dev/null wait_for_postgres @@ -903,18 +950,20 @@ fi docker stop --time 20 "${postgres_container}" >/dev/null wait_not_ready "${url_a}" || fail "unavailable PostgreSQL did not fail readiness" -if "${notary_bin}" --config "${config_path}" state doctor >"${work_dir}/doctor-unavailable.log" 2>&1; then - fail "state doctor accepted unavailable PostgreSQL" -fi -expect_startup_failure unavailable "Notary PostgreSQL database is unavailable" +expect_postgresql_failure \ + unavailable \ + notary.state.postgresql.database_unavailable \ + "Registry Notary PostgreSQL state database is unavailable" \ + "check PostgreSQL reachability, TLS trust, and service health, then run registry-notary state doctor" install_postgres_certificate untrusted-server docker start "${postgres_container}" >/dev/null wait_for_postgres wait_not_ready "${url_a}" || fail "untrusted PostgreSQL certificate did not fail readiness" -if "${notary_bin}" --config "${config_path}" state doctor >"${work_dir}/doctor-tls.log" 2>&1; then - fail "state doctor accepted an untrusted PostgreSQL certificate" -fi -expect_startup_failure tls "Notary PostgreSQL database is unavailable" +expect_postgresql_failure \ + tls \ + notary.state.postgresql.database_unavailable \ + "Registry Notary PostgreSQL state database is unavailable" \ + "check PostgreSQL reachability, TLS trust, and service health, then run registry-notary state doctor" docker stop --time 20 "${postgres_container}" >/dev/null install_postgres_certificate server docker start "${postgres_container}" >/dev/null diff --git a/release/conformance/first-country/README.md b/release/conformance/first-country/README.md new file mode 100644 index 000000000..5a9fad696 --- /dev/null +++ b/release/conformance/first-country/README.md @@ -0,0 +1,69 @@ +# First-country acceptance evidence + +This directory defines the closed, value-free public record for one bounded +first-country acceptance run. It records hashes, safe classifications, and +owner roles. It does not record country values, source or operator identities, +credentials, secret names, paths, URLs, raw logs, private origins, or source +responses. + +The record covers the complete first-country acceptance matrix: + +- a clean offline authoring journey; +- missing and wrong caller and purpose denials; +- service-policy denial; +- allowed Relay consultation, no-match, ambiguity, and subject mismatch; +- unavailable, rejected, malformed, and late source behavior; +- Notary value, predicate, and redacted claims; +- consultation contract mismatch; +- promotion, rollback or recovery, and teardown. + +Every case repeats the canonical acceptance binding digest. The validator +recomputes that digest from the exact candidate, project semantic digest, +environment digest, and source-profile digests, then checks the case result, +source-call classification, evidence hashes, and owner roles against the closed +case contract. + +## Evidence boundary + +[`acceptance-record.template.json`](acceptance-record.template.json) is a +machine-checked planning aid. It is explicitly marked `is_evidence: false`, +uses reserved zero-digest sentinels, and cannot pass evidence validation. +Copy it only into approved restricted working storage. Do not fill it in +inside this public repository. + +An approved operator may validate a sanitized record without contacting a +source: + +```sh +python3 release/scripts/validate-first-country-acceptance.py validate \ + sanitized-first-country-acceptance.json +``` + +Validate the checked-in schema and template: + +```sh +python3 release/scripts/validate-first-country-acceptance.py check-packet +``` + +The validator checks the public record only. It cannot inspect the restricted +evidence committed by its hashes, verify country-owner authority, or infer +legal or production approval. The publication reviewer must compare the +public hashes and classifications with the restricted evidence. +Evidence digests must commit to reviewed evidence collections or value-free +indexes. Never publish a direct hash of a country value, identifier, secret, +private origin, path, source response, or other low-entropy restricted value. +Public, restricted, source-call, and owner-attestation fields name separate +evidence envelopes and must have distinct digests within a case. One public +summary or one restricted index may cover multiple cases, but a digest cannot +cross the public and restricted evidence domains. + +A passing record is bounded to one exact candidate, project, environment, +source profile, and approved non-production journey. It is not production +authorization, broad interoperability, upstream product certification, or +general country-system conformance. Offline fixtures are not live evidence, +and signing is not country governance approval. + +Failed runs are retained as honest, non-closing records when their public +artifact passes the same redaction, retention, publication-review, and +teardown accounting rules. A structurally valid failed record does not close +Country ready or First-country success. diff --git a/release/conformance/first-country/acceptance-record.schema.json b/release/conformance/first-country/acceptance-record.schema.json new file mode 100644 index 000000000..ee155a5fc --- /dev/null +++ b/release/conformance/first-country/acceptance-record.schema.json @@ -0,0 +1,813 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "https://registrystack.org/schemas/release/first-country-acceptance-record-v1.json", + "title": "Registry Stack first-country acceptance record", + "description": "Closed, value-free evidence for one exact-candidate bounded non-production first-country acceptance run.", + "type": "object", + "additionalProperties": false, + "required": [ + "schema_version", + "record_kind", + "is_evidence", + "evidence_state", + "overall_outcome", + "acceptance_binding_sha256", + "binding", + "scope_claims", + "human_acceptance", + "cases", + "evidence_handling", + "governance", + "publication_review", + "teardown", + "evidence_limitations" + ], + "properties": { + "schema_version": { + "const": "registry.release.first_country_acceptance.v1" + }, + "record_kind": { + "enum": ["template", "candidate_acceptance_evidence"] + }, + "is_evidence": { + "type": "boolean" + }, + "evidence_state": { + "enum": [ + "planned_not_executed", + "passed_non_production", + "failed_non_production" + ] + }, + "overall_outcome": { + "enum": ["not_executed", "passed", "failed"] + }, + "acceptance_binding_sha256": { + "$ref": "#/$defs/sha256" + }, + "binding": { + "$ref": "#/$defs/binding" + }, + "scope_claims": { + "$ref": "#/$defs/scope_claims" + }, + "human_acceptance": { + "$ref": "#/$defs/human_acceptance" + }, + "cases": { + "type": "array", + "minItems": 21, + "maxItems": 21, + "items": { + "$ref": "#/$defs/case" + } + }, + "evidence_handling": { + "$ref": "#/$defs/evidence_handling" + }, + "governance": { + "$ref": "#/$defs/governance" + }, + "publication_review": { + "$ref": "#/$defs/publication_review" + }, + "teardown": { + "$ref": "#/$defs/teardown" + }, + "evidence_limitations": { + "type": "array", + "minItems": 10, + "maxItems": 10, + "uniqueItems": true, + "items": { + "enum": [ + "bounded-non-production-only", + "exact-candidate-only", + "exact-project-environment-source-profile-only", + "no-production-authorization", + "no-broad-interoperability", + "not-upstream-product-certification", + "not-general-country-system-conformance", + "offline-fixtures-not-live-evidence", + "signing-not-governance-approval", + "digests-not-independent-evidence" + ] + } + } + }, + "$defs": { + "sha256": { + "type": "string", + "pattern": "^sha256:[0-9a-f]{64}$" + }, + "commit": { + "type": "string", + "pattern": "^[0-9a-f]{40}$" + }, + "release_tag": { + "type": "string", + "pattern": "^v[0-9]+\\.[0-9]+\\.[0-9]+$" + }, + "role": { + "enum": [ + "approved-operator", + "country-technical-owner", + "independent-country-implementer", + "privacy-legal-owner", + "product-signing-authority", + "publication-reviewer", + "recovery-owner", + "registry-stack-evidence-reviewer", + "source-system-owner" + ] + }, + "binding": { + "type": "object", + "additionalProperties": false, + "required": ["candidate", "project", "environment", "source_profile"], + "properties": { + "candidate": { + "$ref": "#/$defs/candidate" + }, + "project": { + "$ref": "#/$defs/project" + }, + "environment": { + "$ref": "#/$defs/environment" + }, + "source_profile": { + "$ref": "#/$defs/source_profile" + } + } + }, + "candidate": { + "type": "object", + "additionalProperties": false, + "required": [ + "release_tag", + "source_commit", + "registryctl_asset_sha256", + "relay_product_sha256", + "notary_product_sha256", + "worker_set_sha256", + "image_lock_sha256", + "release_capsule_sha256", + "release_provenance_sha256", + "candidate_evidence_sha256", + "candidate_assets_verified", + "authenticity_verified", + "exact_candidate_approved" + ], + "properties": { + "release_tag": { + "$ref": "#/$defs/release_tag" + }, + "source_commit": { + "$ref": "#/$defs/commit" + }, + "registryctl_asset_sha256": { + "$ref": "#/$defs/sha256" + }, + "relay_product_sha256": { + "$ref": "#/$defs/sha256" + }, + "notary_product_sha256": { + "$ref": "#/$defs/sha256" + }, + "worker_set_sha256": { + "$ref": "#/$defs/sha256" + }, + "image_lock_sha256": { + "$ref": "#/$defs/sha256" + }, + "release_capsule_sha256": { + "$ref": "#/$defs/sha256" + }, + "release_provenance_sha256": { + "$ref": "#/$defs/sha256" + }, + "candidate_evidence_sha256": { + "$ref": "#/$defs/sha256" + }, + "candidate_assets_verified": { + "type": "boolean" + }, + "authenticity_verified": { + "type": "boolean" + }, + "exact_candidate_approved": { + "type": "boolean" + } + } + }, + "project": { + "type": "object", + "additionalProperties": false, + "required": [ + "project_semantic_sha256", + "approved_baseline_sha256", + "starter_content_sha256", + "generated_relay_input_sha256", + "generated_notary_input_sha256", + "generated_artifact_manifest_sha256", + "generated_files_unchanged", + "generated_files_edited", + "product_code_changes_required" + ], + "properties": { + "project_semantic_sha256": { + "$ref": "#/$defs/sha256" + }, + "approved_baseline_sha256": { + "$ref": "#/$defs/sha256" + }, + "starter_content_sha256": { + "$ref": "#/$defs/sha256" + }, + "generated_relay_input_sha256": { + "$ref": "#/$defs/sha256" + }, + "generated_notary_input_sha256": { + "$ref": "#/$defs/sha256" + }, + "generated_artifact_manifest_sha256": { + "$ref": "#/$defs/sha256" + }, + "generated_files_unchanged": { + "type": "boolean" + }, + "generated_files_edited": { + "type": "boolean" + }, + "product_code_changes_required": { + "type": "boolean" + } + } + }, + "environment": { + "type": "object", + "additionalProperties": false, + "required": [ + "environment_sha256", + "preflight_evidence_sha256", + "relay_validation_evidence_sha256", + "notary_validation_evidence_sha256", + "secret_values_retained", + "authority_widening_detected" + ], + "properties": { + "environment_sha256": { + "$ref": "#/$defs/sha256" + }, + "preflight_evidence_sha256": { + "$ref": "#/$defs/sha256" + }, + "relay_validation_evidence_sha256": { + "$ref": "#/$defs/sha256" + }, + "notary_validation_evidence_sha256": { + "$ref": "#/$defs/sha256" + }, + "secret_values_retained": { + "type": "boolean" + }, + "authority_widening_detected": { + "type": "boolean" + } + } + }, + "source_profile": { + "type": "object", + "additionalProperties": false, + "required": [ + "source_profile_sha256", + "source_contract_sha256", + "operation_projection_sha256", + "source_limits_sha256", + "source_owner_attestation_sha256", + "exact_version_bound", + "exact_read_operation_bound", + "non_production_only", + "approved_input_class", + "zero_one_call_probe_approved" + ], + "properties": { + "source_profile_sha256": { + "$ref": "#/$defs/sha256" + }, + "source_contract_sha256": { + "$ref": "#/$defs/sha256" + }, + "operation_projection_sha256": { + "$ref": "#/$defs/sha256" + }, + "source_limits_sha256": { + "$ref": "#/$defs/sha256" + }, + "source_owner_attestation_sha256": { + "$ref": "#/$defs/sha256" + }, + "exact_version_bound": { + "type": "boolean" + }, + "exact_read_operation_bound": { + "type": "boolean" + }, + "non_production_only": { + "type": "boolean" + }, + "approved_input_class": { + "enum": [ + "not-selected", + "synthetic", + "owner-approved-non-personal" + ] + }, + "zero_one_call_probe_approved": { + "type": "boolean" + } + } + }, + "scope_claims": { + "type": "object", + "additionalProperties": false, + "required": [ + "platform_complete", + "country_ready", + "first_country_success", + "production_authorized", + "broad_interoperability", + "upstream_product_certification" + ], + "properties": { + "platform_complete": { + "type": "boolean" + }, + "country_ready": { + "type": "boolean" + }, + "first_country_success": { + "type": "boolean" + }, + "production_authorized": { + "const": false + }, + "broad_interoperability": { + "const": false + }, + "upstream_product_certification": { + "const": false + } + } + }, + "human_acceptance": { + "type": "object", + "additionalProperties": false, + "required": [ + "outcome", + "published_candidate_artifacts_only", + "private_maintainer_instructions_used", + "authored_intent_understood", + "environment_binding_understood", + "generated_artifacts_understood", + "signed_product_inputs_understood", + "operator_trust_understood", + "runtime_state_understood", + "country_owner_usability_acceptance", + "maintainability_acceptance", + "public_evidence_sha256", + "restricted_evidence_sha256", + "owner_attestation_sha256", + "owner_roles" + ], + "properties": { + "outcome": { + "enum": ["not_executed", "passed", "failed"] + }, + "published_candidate_artifacts_only": { + "type": "boolean" + }, + "private_maintainer_instructions_used": { + "type": "boolean" + }, + "authored_intent_understood": { + "type": "boolean" + }, + "environment_binding_understood": { + "type": "boolean" + }, + "generated_artifacts_understood": { + "type": "boolean" + }, + "signed_product_inputs_understood": { + "type": "boolean" + }, + "operator_trust_understood": { + "type": "boolean" + }, + "runtime_state_understood": { + "type": "boolean" + }, + "country_owner_usability_acceptance": { + "enum": ["not_reviewed", "accepted", "not_accepted"] + }, + "maintainability_acceptance": { + "enum": ["not_reviewed", "accepted", "not_accepted"] + }, + "public_evidence_sha256": { + "$ref": "#/$defs/sha256" + }, + "restricted_evidence_sha256": { + "$ref": "#/$defs/sha256" + }, + "owner_attestation_sha256": { + "$ref": "#/$defs/sha256" + }, + "owner_roles": { + "$ref": "#/$defs/roles" + } + } + }, + "case": { + "type": "object", + "additionalProperties": false, + "required": [ + "case_id", + "outcome", + "result_class", + "acceptance_binding_sha256", + "source_call_classification", + "source_call_evidence_sha256", + "public_evidence_sha256", + "restricted_evidence_sha256", + "owner_attestation_sha256", + "owner_roles" + ], + "properties": { + "case_id": { + "enum": [ + "offline-clean-journey", + "missing-caller-credential-denial", + "wrong-caller-credential-denial", + "missing-purpose-denial", + "wrong-purpose-denial", + "disallowed-service-policy-denial", + "allowed-relay-consultation", + "no-match", + "ambiguity", + "subject-mismatch", + "source-unavailable", + "source-rejected", + "source-malformed", + "source-late", + "notary-value-claim", + "notary-predicate-claim", + "notary-redacted-claim", + "consultation-contract-mismatch", + "promotion", + "rollback-recovery", + "teardown" + ] + }, + "outcome": { + "enum": ["not_executed", "passed", "failed"] + }, + "result_class": { + "enum": [ + "not-executed", + "execution-failed", + "offline-journey-complete", + "caller-authorization-denied", + "purpose-authorization-denied", + "service-policy-denied", + "allowed-minimized-result", + "no-match", + "ambiguity-without-unsupported-claim", + "subject-mismatch-safe-failure", + "source-unavailable-safe-failure", + "source-rejected-safe-failure", + "source-malformed-safe-failure", + "source-late-safe-failure", + "notary-value-approved-disclosure", + "notary-predicate-true-false-null-without-value", + "notary-redacted-without-hidden-value", + "contract-mismatch-before-access", + "promotion-non-widening", + "rollback-recovery-restored", + "teardown-completed" + ] + }, + "acceptance_binding_sha256": { + "$ref": "#/$defs/sha256" + }, + "source_call_classification": { + "enum": [ + "unknown", + "unexpected-data-operation-contact", + "source-call-bound-breached", + "offline-no-contact", + "denied-before-data-operation", + "consulted-within-profile", + "source-failed-within-profile", + "no-data-operation-operational" + ] + }, + "source_call_evidence_sha256": { + "$ref": "#/$defs/sha256" + }, + "public_evidence_sha256": { + "$ref": "#/$defs/sha256" + }, + "restricted_evidence_sha256": { + "$ref": "#/$defs/sha256" + }, + "owner_attestation_sha256": { + "$ref": "#/$defs/sha256" + }, + "owner_roles": { + "$ref": "#/$defs/roles" + } + } + }, + "roles": { + "type": "array", + "minItems": 1, + "maxItems": 6, + "uniqueItems": true, + "items": { + "$ref": "#/$defs/role" + } + }, + "evidence_handling": { + "type": "object", + "additionalProperties": false, + "required": ["restricted_storage", "retention", "deletion", "redaction"], + "properties": { + "restricted_storage": { + "$ref": "#/$defs/restricted_storage" + }, + "retention": { + "$ref": "#/$defs/retention" + }, + "deletion": { + "$ref": "#/$defs/deletion" + }, + "redaction": { + "$ref": "#/$defs/redaction" + } + } + }, + "restricted_storage": { + "type": "object", + "additionalProperties": false, + "required": [ + "approved", + "storage_policy_sha256", + "access_policy_sha256", + "owner_role" + ], + "properties": { + "approved": { + "type": "boolean" + }, + "storage_policy_sha256": { + "$ref": "#/$defs/sha256" + }, + "access_policy_sha256": { + "$ref": "#/$defs/sha256" + }, + "owner_role": { + "$ref": "#/$defs/role" + } + } + }, + "retention": { + "type": "object", + "additionalProperties": false, + "required": [ + "approved", + "retention_policy_sha256", + "failed_run_retention_approved", + "failed_run_retention_policy_sha256", + "owner_role" + ], + "properties": { + "approved": { + "type": "boolean" + }, + "retention_policy_sha256": { + "$ref": "#/$defs/sha256" + }, + "failed_run_retention_approved": { + "type": "boolean" + }, + "failed_run_retention_policy_sha256": { + "$ref": "#/$defs/sha256" + }, + "owner_role": { + "$ref": "#/$defs/role" + } + } + }, + "deletion": { + "type": "object", + "additionalProperties": false, + "required": [ + "procedure_approved", + "procedure_sha256", + "completion_state", + "evidence_sha256", + "owner_role" + ], + "properties": { + "procedure_approved": { + "type": "boolean" + }, + "procedure_sha256": { + "$ref": "#/$defs/sha256" + }, + "completion_state": { + "enum": [ + "not_scheduled", + "scheduled-within-approved-policy", + "completed" + ] + }, + "evidence_sha256": { + "$ref": "#/$defs/sha256" + }, + "owner_role": { + "$ref": "#/$defs/role" + } + } + }, + "redaction": { + "type": "object", + "additionalProperties": false, + "required": [ + "canary_scan_passed", + "public_private_split_confirmed", + "restricted_values_in_public_record", + "secret_values_in_public_record", + "personal_data_in_public_record", + "private_origins_in_public_record", + "raw_logs_in_public_record", + "public_summary_sha256", + "restricted_index_sha256", + "scan_evidence_sha256" + ], + "properties": { + "canary_scan_passed": { + "type": "boolean" + }, + "public_private_split_confirmed": { + "type": "boolean" + }, + "restricted_values_in_public_record": { + "const": false + }, + "secret_values_in_public_record": { + "const": false + }, + "personal_data_in_public_record": { + "const": false + }, + "private_origins_in_public_record": { + "const": false + }, + "raw_logs_in_public_record": { + "const": false + }, + "public_summary_sha256": { + "$ref": "#/$defs/sha256" + }, + "restricted_index_sha256": { + "$ref": "#/$defs/sha256" + }, + "scan_evidence_sha256": { + "$ref": "#/$defs/sha256" + } + } + }, + "governance": { + "type": "object", + "additionalProperties": false, + "required": [ + "privacy_acceptance", + "legal_acceptance", + "country_technical_acceptance", + "production_authorization" + ], + "properties": { + "privacy_acceptance": { + "$ref": "#/$defs/bounded_acceptance" + }, + "legal_acceptance": { + "$ref": "#/$defs/bounded_acceptance" + }, + "country_technical_acceptance": { + "$ref": "#/$defs/bounded_acceptance" + }, + "production_authorization": { + "const": "not-granted" + } + } + }, + "bounded_acceptance": { + "type": "object", + "additionalProperties": false, + "required": ["scope", "status", "evidence_sha256", "owner_role"], + "properties": { + "scope": { + "const": "bounded-non-production" + }, + "status": { + "enum": ["not_reviewed", "accepted", "not_accepted"] + }, + "evidence_sha256": { + "$ref": "#/$defs/sha256" + }, + "owner_role": { + "$ref": "#/$defs/role" + } + } + }, + "publication_review": { + "type": "object", + "additionalProperties": false, + "required": [ + "status", + "public_restricted_comparison_confirmed", + "forbidden_content_absent", + "review_evidence_sha256", + "owner_role" + ], + "properties": { + "status": { + "enum": ["not_executed", "passed", "failed"] + }, + "public_restricted_comparison_confirmed": { + "type": "boolean" + }, + "forbidden_content_absent": { + "type": "boolean" + }, + "review_evidence_sha256": { + "$ref": "#/$defs/sha256" + }, + "owner_role": { + "$ref": "#/$defs/role" + } + } + }, + "teardown": { + "type": "object", + "additionalProperties": false, + "required": [ + "attempted", + "finally_path", + "outcome", + "within_approved_bound", + "source_call_classification", + "public_evidence_sha256", + "restricted_evidence_sha256", + "owner_attestation_sha256", + "owner_roles" + ], + "properties": { + "attempted": { + "type": "boolean" + }, + "finally_path": { + "type": "boolean" + }, + "outcome": { + "enum": ["not_executed", "completed", "failed"] + }, + "within_approved_bound": { + "type": "boolean" + }, + "source_call_classification": { + "enum": [ + "unknown", + "unexpected-data-operation-contact", + "source-call-bound-breached", + "no-data-operation-operational" + ] + }, + "public_evidence_sha256": { + "$ref": "#/$defs/sha256" + }, + "restricted_evidence_sha256": { + "$ref": "#/$defs/sha256" + }, + "owner_attestation_sha256": { + "$ref": "#/$defs/sha256" + }, + "owner_roles": { + "$ref": "#/$defs/roles" + } + } + } + } +} diff --git a/release/conformance/first-country/acceptance-record.template.json b/release/conformance/first-country/acceptance-record.template.json new file mode 100644 index 000000000..a58cc0c92 --- /dev/null +++ b/release/conformance/first-country/acceptance-record.template.json @@ -0,0 +1,537 @@ +{ + "schema_version": "registry.release.first_country_acceptance.v1", + "record_kind": "template", + "is_evidence": false, + "evidence_state": "planned_not_executed", + "overall_outcome": "not_executed", + "acceptance_binding_sha256": "sha256:a7a73ffa98859ce71ec9dd82c385193c827beea4a98fac5e04a0b7440ad687da", + "binding": { + "candidate": { + "release_tag": "v0.0.0", + "source_commit": "0000000000000000000000000000000000000000", + "registryctl_asset_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "relay_product_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "notary_product_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "worker_set_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "image_lock_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "release_capsule_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "release_provenance_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "candidate_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "candidate_assets_verified": false, + "authenticity_verified": false, + "exact_candidate_approved": false + }, + "project": { + "project_semantic_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "approved_baseline_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "starter_content_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "generated_relay_input_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "generated_notary_input_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "generated_artifact_manifest_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "generated_files_unchanged": false, + "generated_files_edited": false, + "product_code_changes_required": false + }, + "environment": { + "environment_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "preflight_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "relay_validation_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "notary_validation_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "secret_values_retained": false, + "authority_widening_detected": false + }, + "source_profile": { + "source_profile_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "source_contract_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "operation_projection_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "source_limits_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "source_owner_attestation_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "exact_version_bound": false, + "exact_read_operation_bound": false, + "non_production_only": false, + "approved_input_class": "not-selected", + "zero_one_call_probe_approved": false + } + }, + "scope_claims": { + "platform_complete": false, + "country_ready": false, + "first_country_success": false, + "production_authorized": false, + "broad_interoperability": false, + "upstream_product_certification": false + }, + "human_acceptance": { + "outcome": "not_executed", + "published_candidate_artifacts_only": false, + "private_maintainer_instructions_used": false, + "authored_intent_understood": false, + "environment_binding_understood": false, + "generated_artifacts_understood": false, + "signed_product_inputs_understood": false, + "operator_trust_understood": false, + "runtime_state_understood": false, + "country_owner_usability_acceptance": "not_reviewed", + "maintainability_acceptance": "not_reviewed", + "public_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "restricted_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_attestation_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_roles": [ + "independent-country-implementer", + "country-technical-owner", + "approved-operator", + "registry-stack-evidence-reviewer" + ] + }, + "cases": [ + { + "case_id": "offline-clean-journey", + "outcome": "not_executed", + "result_class": "not-executed", + "acceptance_binding_sha256": "sha256:a7a73ffa98859ce71ec9dd82c385193c827beea4a98fac5e04a0b7440ad687da", + "source_call_classification": "unknown", + "source_call_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "public_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "restricted_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_attestation_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_roles": [ + "independent-country-implementer", + "country-technical-owner", + "approved-operator", + "registry-stack-evidence-reviewer" + ] + }, + { + "case_id": "missing-caller-credential-denial", + "outcome": "not_executed", + "result_class": "not-executed", + "acceptance_binding_sha256": "sha256:a7a73ffa98859ce71ec9dd82c385193c827beea4a98fac5e04a0b7440ad687da", + "source_call_classification": "unknown", + "source_call_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "public_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "restricted_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_attestation_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_roles": [ + "approved-operator", + "source-system-owner", + "country-technical-owner", + "registry-stack-evidence-reviewer" + ] + }, + { + "case_id": "wrong-caller-credential-denial", + "outcome": "not_executed", + "result_class": "not-executed", + "acceptance_binding_sha256": "sha256:a7a73ffa98859ce71ec9dd82c385193c827beea4a98fac5e04a0b7440ad687da", + "source_call_classification": "unknown", + "source_call_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "public_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "restricted_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_attestation_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_roles": [ + "approved-operator", + "source-system-owner", + "country-technical-owner", + "registry-stack-evidence-reviewer" + ] + }, + { + "case_id": "missing-purpose-denial", + "outcome": "not_executed", + "result_class": "not-executed", + "acceptance_binding_sha256": "sha256:a7a73ffa98859ce71ec9dd82c385193c827beea4a98fac5e04a0b7440ad687da", + "source_call_classification": "unknown", + "source_call_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "public_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "restricted_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_attestation_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_roles": [ + "approved-operator", + "source-system-owner", + "country-technical-owner", + "registry-stack-evidence-reviewer" + ] + }, + { + "case_id": "wrong-purpose-denial", + "outcome": "not_executed", + "result_class": "not-executed", + "acceptance_binding_sha256": "sha256:a7a73ffa98859ce71ec9dd82c385193c827beea4a98fac5e04a0b7440ad687da", + "source_call_classification": "unknown", + "source_call_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "public_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "restricted_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_attestation_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_roles": [ + "approved-operator", + "source-system-owner", + "country-technical-owner", + "registry-stack-evidence-reviewer" + ] + }, + { + "case_id": "disallowed-service-policy-denial", + "outcome": "not_executed", + "result_class": "not-executed", + "acceptance_binding_sha256": "sha256:a7a73ffa98859ce71ec9dd82c385193c827beea4a98fac5e04a0b7440ad687da", + "source_call_classification": "unknown", + "source_call_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "public_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "restricted_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_attestation_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_roles": [ + "approved-operator", + "source-system-owner", + "country-technical-owner", + "registry-stack-evidence-reviewer" + ] + }, + { + "case_id": "allowed-relay-consultation", + "outcome": "not_executed", + "result_class": "not-executed", + "acceptance_binding_sha256": "sha256:a7a73ffa98859ce71ec9dd82c385193c827beea4a98fac5e04a0b7440ad687da", + "source_call_classification": "unknown", + "source_call_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "public_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "restricted_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_attestation_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_roles": [ + "approved-operator", + "source-system-owner", + "country-technical-owner", + "registry-stack-evidence-reviewer" + ] + }, + { + "case_id": "no-match", + "outcome": "not_executed", + "result_class": "not-executed", + "acceptance_binding_sha256": "sha256:a7a73ffa98859ce71ec9dd82c385193c827beea4a98fac5e04a0b7440ad687da", + "source_call_classification": "unknown", + "source_call_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "public_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "restricted_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_attestation_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_roles": [ + "approved-operator", + "source-system-owner", + "country-technical-owner", + "registry-stack-evidence-reviewer" + ] + }, + { + "case_id": "ambiguity", + "outcome": "not_executed", + "result_class": "not-executed", + "acceptance_binding_sha256": "sha256:a7a73ffa98859ce71ec9dd82c385193c827beea4a98fac5e04a0b7440ad687da", + "source_call_classification": "unknown", + "source_call_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "public_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "restricted_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_attestation_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_roles": [ + "approved-operator", + "source-system-owner", + "country-technical-owner", + "registry-stack-evidence-reviewer" + ] + }, + { + "case_id": "subject-mismatch", + "outcome": "not_executed", + "result_class": "not-executed", + "acceptance_binding_sha256": "sha256:a7a73ffa98859ce71ec9dd82c385193c827beea4a98fac5e04a0b7440ad687da", + "source_call_classification": "unknown", + "source_call_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "public_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "restricted_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_attestation_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_roles": [ + "approved-operator", + "source-system-owner", + "country-technical-owner", + "registry-stack-evidence-reviewer" + ] + }, + { + "case_id": "source-unavailable", + "outcome": "not_executed", + "result_class": "not-executed", + "acceptance_binding_sha256": "sha256:a7a73ffa98859ce71ec9dd82c385193c827beea4a98fac5e04a0b7440ad687da", + "source_call_classification": "unknown", + "source_call_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "public_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "restricted_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_attestation_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_roles": [ + "approved-operator", + "source-system-owner", + "country-technical-owner", + "registry-stack-evidence-reviewer" + ] + }, + { + "case_id": "source-rejected", + "outcome": "not_executed", + "result_class": "not-executed", + "acceptance_binding_sha256": "sha256:a7a73ffa98859ce71ec9dd82c385193c827beea4a98fac5e04a0b7440ad687da", + "source_call_classification": "unknown", + "source_call_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "public_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "restricted_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_attestation_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_roles": [ + "approved-operator", + "source-system-owner", + "country-technical-owner", + "registry-stack-evidence-reviewer" + ] + }, + { + "case_id": "source-malformed", + "outcome": "not_executed", + "result_class": "not-executed", + "acceptance_binding_sha256": "sha256:a7a73ffa98859ce71ec9dd82c385193c827beea4a98fac5e04a0b7440ad687da", + "source_call_classification": "unknown", + "source_call_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "public_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "restricted_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_attestation_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_roles": [ + "approved-operator", + "source-system-owner", + "country-technical-owner", + "registry-stack-evidence-reviewer" + ] + }, + { + "case_id": "source-late", + "outcome": "not_executed", + "result_class": "not-executed", + "acceptance_binding_sha256": "sha256:a7a73ffa98859ce71ec9dd82c385193c827beea4a98fac5e04a0b7440ad687da", + "source_call_classification": "unknown", + "source_call_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "public_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "restricted_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_attestation_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_roles": [ + "approved-operator", + "source-system-owner", + "country-technical-owner", + "registry-stack-evidence-reviewer" + ] + }, + { + "case_id": "notary-value-claim", + "outcome": "not_executed", + "result_class": "not-executed", + "acceptance_binding_sha256": "sha256:a7a73ffa98859ce71ec9dd82c385193c827beea4a98fac5e04a0b7440ad687da", + "source_call_classification": "unknown", + "source_call_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "public_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "restricted_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_attestation_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_roles": [ + "approved-operator", + "source-system-owner", + "country-technical-owner", + "registry-stack-evidence-reviewer" + ] + }, + { + "case_id": "notary-predicate-claim", + "outcome": "not_executed", + "result_class": "not-executed", + "acceptance_binding_sha256": "sha256:a7a73ffa98859ce71ec9dd82c385193c827beea4a98fac5e04a0b7440ad687da", + "source_call_classification": "unknown", + "source_call_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "public_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "restricted_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_attestation_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_roles": [ + "approved-operator", + "source-system-owner", + "country-technical-owner", + "registry-stack-evidence-reviewer" + ] + }, + { + "case_id": "notary-redacted-claim", + "outcome": "not_executed", + "result_class": "not-executed", + "acceptance_binding_sha256": "sha256:a7a73ffa98859ce71ec9dd82c385193c827beea4a98fac5e04a0b7440ad687da", + "source_call_classification": "unknown", + "source_call_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "public_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "restricted_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_attestation_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_roles": [ + "approved-operator", + "source-system-owner", + "country-technical-owner", + "registry-stack-evidence-reviewer" + ] + }, + { + "case_id": "consultation-contract-mismatch", + "outcome": "not_executed", + "result_class": "not-executed", + "acceptance_binding_sha256": "sha256:a7a73ffa98859ce71ec9dd82c385193c827beea4a98fac5e04a0b7440ad687da", + "source_call_classification": "unknown", + "source_call_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "public_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "restricted_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_attestation_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_roles": [ + "approved-operator", + "source-system-owner", + "country-technical-owner", + "registry-stack-evidence-reviewer" + ] + }, + { + "case_id": "promotion", + "outcome": "not_executed", + "result_class": "not-executed", + "acceptance_binding_sha256": "sha256:a7a73ffa98859ce71ec9dd82c385193c827beea4a98fac5e04a0b7440ad687da", + "source_call_classification": "unknown", + "source_call_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "public_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "restricted_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_attestation_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_roles": [ + "approved-operator", + "product-signing-authority", + "country-technical-owner", + "registry-stack-evidence-reviewer" + ] + }, + { + "case_id": "rollback-recovery", + "outcome": "not_executed", + "result_class": "not-executed", + "acceptance_binding_sha256": "sha256:a7a73ffa98859ce71ec9dd82c385193c827beea4a98fac5e04a0b7440ad687da", + "source_call_classification": "unknown", + "source_call_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "public_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "restricted_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_attestation_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_roles": [ + "approved-operator", + "recovery-owner", + "country-technical-owner", + "registry-stack-evidence-reviewer" + ] + }, + { + "case_id": "teardown", + "outcome": "not_executed", + "result_class": "not-executed", + "acceptance_binding_sha256": "sha256:a7a73ffa98859ce71ec9dd82c385193c827beea4a98fac5e04a0b7440ad687da", + "source_call_classification": "unknown", + "source_call_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "public_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "restricted_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_attestation_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_roles": [ + "approved-operator", + "recovery-owner", + "source-system-owner", + "country-technical-owner", + "registry-stack-evidence-reviewer" + ] + } + ], + "evidence_handling": { + "restricted_storage": { + "approved": false, + "storage_policy_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "access_policy_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_role": "approved-operator" + }, + "retention": { + "approved": false, + "retention_policy_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "failed_run_retention_approved": false, + "failed_run_retention_policy_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_role": "privacy-legal-owner" + }, + "deletion": { + "procedure_approved": false, + "procedure_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "completion_state": "not_scheduled", + "evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_role": "privacy-legal-owner" + }, + "redaction": { + "canary_scan_passed": false, + "public_private_split_confirmed": false, + "restricted_values_in_public_record": false, + "secret_values_in_public_record": false, + "personal_data_in_public_record": false, + "private_origins_in_public_record": false, + "raw_logs_in_public_record": false, + "public_summary_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "restricted_index_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "scan_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000" + } + }, + "governance": { + "privacy_acceptance": { + "scope": "bounded-non-production", + "status": "not_reviewed", + "evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_role": "privacy-legal-owner" + }, + "legal_acceptance": { + "scope": "bounded-non-production", + "status": "not_reviewed", + "evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_role": "privacy-legal-owner" + }, + "country_technical_acceptance": { + "scope": "bounded-non-production", + "status": "not_reviewed", + "evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_role": "country-technical-owner" + }, + "production_authorization": "not-granted" + }, + "publication_review": { + "status": "not_executed", + "public_restricted_comparison_confirmed": false, + "forbidden_content_absent": false, + "review_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_role": "publication-reviewer" + }, + "teardown": { + "attempted": false, + "finally_path": false, + "outcome": "not_executed", + "within_approved_bound": false, + "source_call_classification": "unknown", + "public_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "restricted_evidence_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_attestation_sha256": "sha256:0000000000000000000000000000000000000000000000000000000000000000", + "owner_roles": [ + "approved-operator", + "recovery-owner", + "source-system-owner", + "country-technical-owner", + "registry-stack-evidence-reviewer" + ] + }, + "evidence_limitations": [ + "bounded-non-production-only", + "exact-candidate-only", + "exact-project-environment-source-profile-only", + "no-production-authorization", + "no-broad-interoperability", + "not-upstream-product-certification", + "not-general-country-system-conformance", + "offline-fixtures-not-live-evidence", + "signing-not-governance-approval", + "digests-not-independent-evidence" + ] +} diff --git a/release/conformance/integrations/README.md b/release/conformance/integrations/README.md index 2196acac0..3dc7fce81 100644 --- a/release/conformance/integrations/README.md +++ b/release/conformance/integrations/README.md @@ -8,6 +8,8 @@ credentials, infrastructure details, or raw logs. Both profiles are **Registry Stack-supported unofficial integration profiles**. They prove one reviewed read operation against one exact upstream baseline. They are not product certification or general conformance claims. +An integration pilot alone does not close the separate Country ready or +First-country success gates. ## Evidence boundary diff --git a/release/conformance/integrations/pilot-report.template.md b/release/conformance/integrations/pilot-report.template.md index 7af8719e6..497cdfc35 100644 --- a/release/conformance/integrations/pilot-report.template.md +++ b/release/conformance/integrations/pilot-report.template.md @@ -8,6 +8,8 @@ to restricted evidence. Plans, dry runs, fixture runs, and source-built branch runs are not pilot evidence. One completed pilot is not proof of broad production readiness. +An integration pilot alone does not close Country ready or First-country +success. ## Closing evidence diff --git a/release/exercises/README.md b/release/exercises/README.md index 8a7d8895a..4a2c1d55f 100644 --- a/release/exercises/README.md +++ b/release/exercises/README.md @@ -1,14 +1,117 @@ -# Upgrade exercise records +# Candidate exercise records -The files in this directory separate reusable release preparation from evidence -captured against an exact release candidate. +The files in this directory separate reusable preparation from evidence +captured against an exact release candidate. Upgrade evidence and product-input +lifecycle evidence use separate, closed record contracts. Neither kind of +template is evidence. + +## Product-input lifecycle + +`product-input-lifecycle/product-input-lifecycle-v1.template.json` defines the +versioned, machine-validated record for the separate Relay and Notary +product-input lifecycle. It reuses the release candidate and upgrade exercise +coordinate fields: release ID, version, prepare source ref, exact source +commit, release-manifest digest, image-lock digest, release-capsule digest, +candidate-receipt digest, and image digests. The coordinate occurs once and is +bound by its canonical SHA-256. + +`product-input-lifecycle/product-input-lifecycle-v1.schema.json` is the closed +Draft 2020-12 structural contract. The validator applies it before semantic and +cryptographic checks. Runtime/schema drift tests bind the schema version, +fields, evidence groups, check IDs, review classes, template constraints, and +candidate constraints to the validator. + +The template is preparation only. Its `record_kind` is `template`, candidate +attestations are false, trust and activation generations are zero, every result +is `not_run`, and every evidence field is null. Validation never upgrades it to +candidate evidence: + +```sh +python3 release/scripts/validate-product-input-lifecycle.py --template \ + release/exercises/product-input-lifecycle/product-input-lifecycle-v1.template.json +python3 release/scripts/validate-product-input-lifecycle.py \ + --discover release/exercises +``` + +For an exact frozen candidate: + +1. Copy the template within `release/exercises/product-input-lifecycle/`. +2. Set `record_kind` to `candidate_evidence` and replace every placeholder. +3. Bind the one candidate coordinate to the exact committed release manifest + and retained release-candidate receipt. Place the authenticated release + image lock, capsule, signatures, certificates, provenance, checksums, and + receipt in one version-named directory under an operator-supplied candidate + asset root. Do not add those paths, country values, credentials, key + material, or raw evidence to the record. +4. Record separate Relay and Notary unsigned-input, signed-bundle, operator + trust, trust-generation, and anti-rollback-lineage identities. +5. Record a closed `passed` or `failed` result, subject digest, evidence label, + and evidence digest for every authoring, build, verification, staged + activation, traffic-admission, upgrade, recovery, and rollback check. + Authoring subjects bind the candidate and complete product-input set to the + artifact manifest. Bundle-verification subjects also bind the exact trust + generation, trust set, and anti-rollback lineage. Advanced-operation + subjects bind the exact candidate, product-input set, and activation. +6. Preserve an exact zero source-call count for a passing consultation-contract + mismatch check. A nonzero observation must be retained as a failed check and + cannot pass discovery. +7. Add distinct independent correctness, security, maintainability, and + operator reviews after lifecycle evidence has been captured. +8. Keep every limitation false and the evidence grade + `candidate_non_production`. This record cannot prove live country + interoperability, country-owner acceptance, legal approval, or production + authorization. + +Candidate validation reuses the release-owned image-lock, capsule, Cosign, +SLSA, Git-lineage, and annotated-tag receipt binding checks. A digest or boolean +alone cannot make a candidate record pass. The validator intentionally does +not ingest the retained lifecycle logs, reports, or review bodies. Their opaque +digests and labels remain bound by the access-controlled evidence system and +the four independent reviews. The required +`retained_evidence_content_authenticated_by_validator: false` limitation makes +that trust boundary explicit. + +Validate an honest in-progress or failed record structurally with: + +```sh +LIFECYCLE_RECORD=release/exercises/product-input-lifecycle/candidate-record.json +python3 release/scripts/validate-product-input-lifecycle.py \ + --candidate-asset-root "${CANDIDATE_ASSET_ROOT}" \ + "$LIFECYCLE_RECORD" +``` + +Require all checks and reviews to pass with: + +```sh +LIFECYCLE_RECORD=release/exercises/product-input-lifecycle/candidate-record.json +python3 release/scripts/validate-product-input-lifecycle.py --require-pass \ + --candidate-asset-root "${CANDIDATE_ASSET_ROOT}" \ + "$LIFECYCLE_RECORD" +``` + +Discovery accepts the template only as non-evidence. Any discovered real +record must be complete, passing, and authenticated from candidate assets: + +```sh +python3 release/scripts/validate-product-input-lifecycle.py \ + --discover release/exercises \ + --candidate-asset-root "${CANDIDATE_ASSET_ROOT}" +``` + +If the candidate coordinate, manifest, product inputs, trust generation, +activation generation, or retained evidence changes, discard the result and +repeat the lifecycle against the new exact digests. + +## Upgrade lifecycle ## Candidate-neutral preparation `upgrade-exercise-v1.template.json` defines the machine-validated evidence record for a Registry Stack stable upgrade. The template is preparation only. Its `record_kind` is `template`, every result is `not_run`, and both candidate -attestations are `false`. A validated template does not satisfy a release gate. +attestations are `false`. Every result's observation and evidence fields are +null. A validated template contains zero candidate evidence and does not +satisfy a release gate. Validate the template with: @@ -32,8 +135,21 @@ release are frozen and independently verified: is the reviewed prepare commit P and `source_commit` is the finalized target T. The manifest path and hash must identify the manifest stored at T. 4. Hash each committed configuration schema and every complete recovery-set - artifact. Do not copy secret values into the record. -5. Fill the canonical artifact set with the two P and T binary inventories, + artifact. For audited SnapshotExact, capture immutable source inputs, the + Relay ingest cache, and the complete Relay database at one coordinated, + quiesced recovery point. The database artifact includes the active + publication pointer and history. +5. Fill `materialization_recovery` with the exact source-input, ingest-cache, + and Relay-database artifact digests. Bind the private active-publication + tuple as one value-free commitment over its binding, generation, restricted + content digest, source revision, and source-observed fields. Also bind the + coordinated recovery point, exact target release, committed Relay + schema, role-bootstrap identity, recovery metadata, and audit watermark. + Compute `binding_sha256` over the other fields in that closed object as + canonical compact JSON (`sort_keys=True`, separators `,` and `:`). + Do not expose the tuple values, source paths, rows, credentials, or key + material in the public record. +6. Fill the canonical artifact set with the two P and T binary inventories, image-input inventories, retained image-layout-pair identities, target images, manifest, image lock, and P/T release-input identities. Its `sha256` is the SHA-256 of canonical compact JSON for the `artifacts` object @@ -45,23 +161,31 @@ release are frozen and independently verified: provenance. The validator authenticates both releases and requires their signed tag targets and image pins to match the corresponding record. The target image-lock byte digest must also match the canonical artifact set. -6. Exercise every required check against the pinned standalone Solmara +7. Exercise every required check against the pinned standalone Solmara topology. Record `passed` only when the retained evidence proves the check. Honest `failed` and `not_run` records remain structurally valid; a `not_run` - result uses null evidence fields. -7. Set both candidate attestations to `true` only after independent review. -8. Validate the record structure, then require every promotion check to pass: + result uses null evidence fields. Materialization checks cover an exact + restart with zero source calls, missing and mismatched cache failures, + pointer-mutation rejection, and rejection of stale or live fallback. +8. Set both candidate attestations to `true` only after independent review. +9. Compute `record_binding_sha256` over the complete record except that field, + using the same canonical compact JSON encoding. This binds every result and + recovery commitment to the exact authenticated upgrade record, not to a + free-standing evidence digest. +10. Validate the record structure, then require every promotion check to pass: ```sh + UPGRADE_RECORD=release/exercises/candidate-upgrade-record.json + CANDIDATE_ASSET_ROOT=operator-evidence/candidate-release-assets python3 release/scripts/prepare-upgrade-exercise-assets.py \ --discover release/exercises \ - --asset-root /private/path/candidate-release-assets + --asset-root "$CANDIDATE_ASSET_ROOT" python3 release/scripts/validate-upgrade-exercise.py \ - --candidate-asset-root /private/path/candidate-release-assets \ - release/exercises/ + --candidate-asset-root "$CANDIDATE_ASSET_ROOT" \ + "$UPGRADE_RECORD" python3 release/scripts/validate-upgrade-exercise.py --require-pass \ - --candidate-asset-root /private/path/candidate-release-assets \ - release/exercises/ + --candidate-asset-root "$CANDIDATE_ASSET_ROOT" \ + "$UPGRADE_RECORD" ``` The validator authenticates release coordinates and enforces equality among @@ -70,6 +194,12 @@ inventory, layout, Solmara execution, and result evidence remains subject to the candidate-freeze and independent-review attestations; it is not ingested from the public record. +The validator also requires the three materialization artifacts to equal their +complete recovery-set entries, the Relay release and schema commitments to +equal the authenticated target coordinates, the closed materialization binding +to match all recovery commitments, and the record binding to match the complete +upgrade record. + The validator accepts only a bounded schema. It records hashes and labels, not raw commands, logs, database URLs, credentials, tokens, subject identifiers, source rows, audit contents, or key material. Keep the underlying evidence in @@ -87,6 +217,8 @@ The candidate run must prove all of the following before the record validates: - General rollback before target traffic - Fix-forward behavior after target writes or credential issuance - Complete restore, restored readiness, and config anti-rollback rejection +- Exact SnapshotExact restart without source access +- Missing or mismatched cache rejection without pointer mutation or stale/live fallback If any frozen candidate artifact changes, discard the result and repeat the exercise against the new exact digests. diff --git a/release/exercises/product-input-lifecycle/product-input-lifecycle-v1.schema.json b/release/exercises/product-input-lifecycle/product-input-lifecycle-v1.schema.json new file mode 100644 index 000000000..af908cbe8 --- /dev/null +++ b/release/exercises/product-input-lifecycle/product-input-lifecycle-v1.schema.json @@ -0,0 +1,854 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "$id": "https://registrystack.org/schemas/release/product-input-lifecycle-v1.json", + "title": "Registry Stack product-input lifecycle evidence", + "description": "Closed, redaction-safe template and evidence contract for the separate Relay and Notary product-input lifecycle. Candidate evidence requires one authenticated non-production candidate; the template is never evidence.", + "type": "object", + "additionalProperties": false, + "required": [ + "schema_version", + "record_kind", + "exercise_id", + "recorded_at", + "candidate", + "candidate_binding_sha256", + "attestations", + "product_inputs", + "product_input_set_sha256", + "activation", + "evidence", + "reviews", + "evidence_limitations" + ], + "properties": { + "schema_version": { + "const": "registry-stack.product-input-lifecycle.v1" + }, + "record_kind": { + "enum": [ + "template", + "candidate_evidence" + ] + }, + "exercise_id": { + "type": "string" + }, + "recorded_at": { + "type": "string" + }, + "candidate": { + "type": "object" + }, + "candidate_binding_sha256": { + "type": "string" + }, + "attestations": { + "type": "object" + }, + "product_inputs": { + "type": "object" + }, + "product_input_set_sha256": { + "type": "string" + }, + "activation": { + "type": "object" + }, + "evidence": { + "type": "object" + }, + "reviews": { + "type": "array" + }, + "evidence_limitations": { + "$ref": "#/$defs/evidenceLimitations" + } + }, + "allOf": [ + { + "if": { + "type": "object", + "properties": { + "record_kind": { + "const": "template" + } + } + }, + "then": { + "type": "object", + "properties": { + "exercise_id": { + "$ref": "#/$defs/placeholder" + }, + "recorded_at": { + "$ref": "#/$defs/placeholder" + }, + "candidate": { + "$ref": "#/$defs/templateCandidate" + }, + "candidate_binding_sha256": { + "$ref": "#/$defs/placeholder" + }, + "attestations": { + "$ref": "#/$defs/templateAttestations" + }, + "product_inputs": { + "$ref": "#/$defs/templateProductInputs" + }, + "product_input_set_sha256": { + "$ref": "#/$defs/placeholder" + }, + "activation": { + "$ref": "#/$defs/templateActivation" + }, + "evidence": { + "$ref": "#/$defs/templateEvidence" + }, + "reviews": { + "$ref": "#/$defs/templateReviews" + } + } + }, + "else": { + "type": "object", + "properties": { + "exercise_id": { + "$ref": "#/$defs/exerciseId" + }, + "recorded_at": { + "$ref": "#/$defs/timestamp" + }, + "candidate": { + "$ref": "#/$defs/candidateEvidenceCandidate" + }, + "candidate_binding_sha256": { + "$ref": "#/$defs/sha256" + }, + "attestations": { + "$ref": "#/$defs/candidateAttestations" + }, + "product_inputs": { + "$ref": "#/$defs/candidateProductInputs" + }, + "product_input_set_sha256": { + "$ref": "#/$defs/sha256" + }, + "activation": { + "$ref": "#/$defs/candidateActivation" + }, + "evidence": { + "$ref": "#/$defs/candidateEvidence" + }, + "reviews": { + "$ref": "#/$defs/candidateReviews" + } + } + } + } + ], + "x-registry-evidence-groups": { + "authoring_and_build": [ + "authored_revision_closed", + "fixture_coverage_closed", + "preflight_closed", + "capabilities_closed", + "promotion_closed", + "deterministic_artifact_manifest_built", + "relay_unsigned_input_built", + "notary_unsigned_input_built" + ], + "product_lifecycle": [ + "relay_bundle_signed", + "notary_bundle_signed", + "relay_trust_generation_verified", + "notary_trust_generation_verified", + "relay_anti_rollback_lineage_verified", + "notary_anti_rollback_lineage_verified", + "relay_bundle_verified", + "notary_bundle_verified", + "cross_product_compatibility_verified", + "relay_staged_activation", + "notary_staged_activation", + "consultation_contract_mismatch_zero_source_calls", + "redacted_runtime_posture_inspected", + "traffic_admission_after_compatible_activation" + ], + "advanced_operations": [ + "upgrade_exercised", + "recovery_exercised", + "rollback_exercised" + ] + }, + "x-registry-review-classes": [ + "correctness", + "security", + "maintainability", + "operator" + ], + "$defs": { + "placeholder": { + "type": "string", + "pattern": "^<[A-Z0-9_]+>$" + }, + "sha256": { + "type": "string", + "pattern": "^sha256:[0-9a-f]{64}$" + }, + "commit": { + "type": "string", + "pattern": "^[0-9a-f]{40}$" + }, + "slug": { + "type": "string", + "pattern": "^[a-z0-9][a-z0-9._-]{0,127}$" + }, + "version": { + "type": "string", + "pattern": "^v(?:0|[1-9][0-9]*)\\.(?:0|[1-9][0-9]*)\\.(?:0|[1-9][0-9]*)(?:-(?:(?:0|[1-9][0-9]*)|[0-9A-Za-z-]*[A-Za-z-][0-9A-Za-z-]*)(?:\\.(?:(?:0|[1-9][0-9]*)|[0-9A-Za-z-]*[A-Za-z-][0-9A-Za-z-]*))*)?$" + }, + "timestamp": { + "type": "string", + "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$" + }, + "exerciseId": { + "type": "string", + "pattern": "^product-input-lifecycle-[0-9a-f]{16,64}$" + }, + "evidenceLabel": { + "type": "string", + "pattern": "^evidence-[0-9a-f]{16,64}$" + }, + "reviewerLabel": { + "type": "string", + "pattern": "^reviewer-[0-9a-f]{16,64}$" + }, + "templateCandidate": { + "type": "object", + "additionalProperties": false, + "required": [ + "repository", + "release_id", + "version", + "source_ref", + "source_commit", + "release_manifest_sha256", + "image_lock_sha256", + "release_capsule_sha256", + "candidate_receipt_sha256", + "relay_image_digest", + "notary_image_digest" + ], + "properties": { + "repository": { + "const": "registrystack/registry-stack" + }, + "release_id": { + "$ref": "#/$defs/placeholder" + }, + "version": { + "$ref": "#/$defs/placeholder" + }, + "source_ref": { + "$ref": "#/$defs/placeholder" + }, + "source_commit": { + "$ref": "#/$defs/placeholder" + }, + "release_manifest_sha256": { + "$ref": "#/$defs/placeholder" + }, + "image_lock_sha256": { + "$ref": "#/$defs/placeholder" + }, + "release_capsule_sha256": { + "$ref": "#/$defs/placeholder" + }, + "candidate_receipt_sha256": { + "$ref": "#/$defs/placeholder" + }, + "relay_image_digest": { + "$ref": "#/$defs/placeholder" + }, + "notary_image_digest": { + "$ref": "#/$defs/placeholder" + } + } + }, + "candidateEvidenceCandidate": { + "type": "object", + "additionalProperties": false, + "required": [ + "repository", + "release_id", + "version", + "source_ref", + "source_commit", + "release_manifest_sha256", + "image_lock_sha256", + "release_capsule_sha256", + "candidate_receipt_sha256", + "relay_image_digest", + "notary_image_digest" + ], + "properties": { + "repository": { + "const": "registrystack/registry-stack" + }, + "release_id": { + "$ref": "#/$defs/slug" + }, + "version": { + "$ref": "#/$defs/version" + }, + "source_ref": { + "$ref": "#/$defs/commit" + }, + "source_commit": { + "$ref": "#/$defs/commit" + }, + "release_manifest_sha256": { + "$ref": "#/$defs/sha256" + }, + "image_lock_sha256": { + "$ref": "#/$defs/sha256" + }, + "release_capsule_sha256": { + "$ref": "#/$defs/sha256" + }, + "candidate_receipt_sha256": { + "$ref": "#/$defs/sha256" + }, + "relay_image_digest": { + "$ref": "#/$defs/sha256" + }, + "notary_image_digest": { + "$ref": "#/$defs/sha256" + } + } + }, + "templateAttestations": { + "type": "object", + "additionalProperties": false, + "required": [ + "candidate_frozen", + "candidate_independently_verified" + ], + "properties": { + "candidate_frozen": { + "const": false + }, + "candidate_independently_verified": { + "const": false + } + } + }, + "candidateAttestations": { + "type": "object", + "additionalProperties": false, + "required": [ + "candidate_frozen", + "candidate_independently_verified" + ], + "properties": { + "candidate_frozen": { + "const": true + }, + "candidate_independently_verified": { + "const": true + } + } + }, + "templateProduct": { + "type": "object", + "additionalProperties": false, + "required": [ + "unsigned_input_sha256", + "signed_bundle_sha256", + "trust_generation", + "trust_set_sha256", + "anti_rollback_lineage_sha256" + ], + "properties": { + "unsigned_input_sha256": { + "$ref": "#/$defs/placeholder" + }, + "signed_bundle_sha256": { + "$ref": "#/$defs/placeholder" + }, + "trust_generation": { + "const": 0 + }, + "trust_set_sha256": { + "$ref": "#/$defs/placeholder" + }, + "anti_rollback_lineage_sha256": { + "$ref": "#/$defs/placeholder" + } + } + }, + "candidateProduct": { + "type": "object", + "additionalProperties": false, + "required": [ + "unsigned_input_sha256", + "signed_bundle_sha256", + "trust_generation", + "trust_set_sha256", + "anti_rollback_lineage_sha256" + ], + "properties": { + "unsigned_input_sha256": { + "$ref": "#/$defs/sha256" + }, + "signed_bundle_sha256": { + "$ref": "#/$defs/sha256" + }, + "trust_generation": { + "type": "integer", + "minimum": 1 + }, + "trust_set_sha256": { + "$ref": "#/$defs/sha256" + }, + "anti_rollback_lineage_sha256": { + "$ref": "#/$defs/sha256" + } + } + }, + "templateProductInputs": { + "type": "object", + "additionalProperties": false, + "required": [ + "artifact_manifest_sha256", + "relay", + "notary" + ], + "properties": { + "artifact_manifest_sha256": { + "$ref": "#/$defs/placeholder" + }, + "relay": { + "$ref": "#/$defs/templateProduct" + }, + "notary": { + "$ref": "#/$defs/templateProduct" + } + } + }, + "candidateProductInputs": { + "type": "object", + "additionalProperties": false, + "required": [ + "artifact_manifest_sha256", + "relay", + "notary" + ], + "properties": { + "artifact_manifest_sha256": { + "$ref": "#/$defs/sha256" + }, + "relay": { + "$ref": "#/$defs/candidateProduct" + }, + "notary": { + "$ref": "#/$defs/candidateProduct" + } + } + }, + "templateActivation": { + "type": "object", + "additionalProperties": false, + "required": [ + "stack_generation", + "compatibility_report_sha256", + "runtime_posture_sha256", + "consultation_contract_mismatch" + ], + "properties": { + "stack_generation": { + "const": 0 + }, + "compatibility_report_sha256": { + "$ref": "#/$defs/placeholder" + }, + "runtime_posture_sha256": { + "$ref": "#/$defs/placeholder" + }, + "consultation_contract_mismatch": { + "type": "object", + "additionalProperties": false, + "required": [ + "failure_class", + "observed_source_calls", + "report_sha256" + ], + "properties": { + "failure_class": { + "const": "consultation_contract_mismatch" + }, + "observed_source_calls": { + "const": 0 + }, + "report_sha256": { + "$ref": "#/$defs/placeholder" + } + } + } + } + }, + "candidateActivation": { + "type": "object", + "additionalProperties": false, + "required": [ + "stack_generation", + "compatibility_report_sha256", + "runtime_posture_sha256", + "consultation_contract_mismatch" + ], + "properties": { + "stack_generation": { + "type": "integer", + "minimum": 1 + }, + "compatibility_report_sha256": { + "$ref": "#/$defs/sha256" + }, + "runtime_posture_sha256": { + "$ref": "#/$defs/sha256" + }, + "consultation_contract_mismatch": { + "type": "object", + "additionalProperties": false, + "required": [ + "failure_class", + "observed_source_calls", + "report_sha256" + ], + "properties": { + "failure_class": { + "const": "consultation_contract_mismatch" + }, + "observed_source_calls": { + "type": "integer", + "minimum": 0 + }, + "report_sha256": { + "$ref": "#/$defs/sha256" + } + } + } + } + }, + "checkId": { + "enum": [ + "authored_revision_closed", + "fixture_coverage_closed", + "preflight_closed", + "capabilities_closed", + "promotion_closed", + "deterministic_artifact_manifest_built", + "relay_unsigned_input_built", + "notary_unsigned_input_built", + "relay_bundle_signed", + "notary_bundle_signed", + "relay_trust_generation_verified", + "notary_trust_generation_verified", + "relay_anti_rollback_lineage_verified", + "notary_anti_rollback_lineage_verified", + "relay_bundle_verified", + "notary_bundle_verified", + "cross_product_compatibility_verified", + "relay_staged_activation", + "notary_staged_activation", + "consultation_contract_mismatch_zero_source_calls", + "redacted_runtime_posture_inspected", + "traffic_admission_after_compatible_activation", + "upgrade_exercised", + "recovery_exercised", + "rollback_exercised" + ] + }, + "templateResult": { + "type": "object", + "additionalProperties": false, + "required": [ + "check_id", + "outcome", + "subject_sha256", + "observed_at", + "evidence_label", + "evidence_sha256" + ], + "properties": { + "check_id": { + "$ref": "#/$defs/checkId" + }, + "outcome": { + "const": "not_run" + }, + "subject_sha256": { + "type": "null" + }, + "observed_at": { + "type": "null" + }, + "evidence_label": { + "type": "null" + }, + "evidence_sha256": { + "type": "null" + } + } + }, + "candidateResult": { + "type": "object", + "additionalProperties": false, + "required": [ + "check_id", + "outcome", + "subject_sha256", + "observed_at", + "evidence_label", + "evidence_sha256" + ], + "properties": { + "check_id": { + "$ref": "#/$defs/checkId" + }, + "outcome": { + "enum": [ + "passed", + "failed" + ] + }, + "subject_sha256": { + "$ref": "#/$defs/sha256" + }, + "observed_at": { + "$ref": "#/$defs/timestamp" + }, + "evidence_label": { + "$ref": "#/$defs/evidenceLabel" + }, + "evidence_sha256": { + "$ref": "#/$defs/sha256" + } + } + }, + "templateEvidence": { + "type": "object", + "additionalProperties": false, + "required": [ + "authoring_and_build", + "product_lifecycle", + "advanced_operations" + ], + "properties": { + "authoring_and_build": { + "type": "array", + "minItems": 8, + "maxItems": 8, + "items": { + "$ref": "#/$defs/templateResult" + } + }, + "product_lifecycle": { + "type": "array", + "minItems": 14, + "maxItems": 14, + "items": { + "$ref": "#/$defs/templateResult" + } + }, + "advanced_operations": { + "type": "array", + "minItems": 3, + "maxItems": 3, + "items": { + "$ref": "#/$defs/templateResult" + } + } + } + }, + "candidateEvidence": { + "type": "object", + "additionalProperties": false, + "required": [ + "authoring_and_build", + "product_lifecycle", + "advanced_operations" + ], + "properties": { + "authoring_and_build": { + "type": "array", + "minItems": 8, + "maxItems": 8, + "items": { + "$ref": "#/$defs/candidateResult" + } + }, + "product_lifecycle": { + "type": "array", + "minItems": 14, + "maxItems": 14, + "items": { + "$ref": "#/$defs/candidateResult" + } + }, + "advanced_operations": { + "type": "array", + "minItems": 3, + "maxItems": 3, + "items": { + "$ref": "#/$defs/candidateResult" + } + } + } + }, + "templateReview": { + "type": "object", + "additionalProperties": false, + "required": [ + "review_class", + "outcome", + "independence_attested", + "reviewer_label", + "observed_at", + "evidence_label", + "evidence_sha256" + ], + "properties": { + "review_class": { + "enum": [ + "correctness", + "security", + "maintainability", + "operator" + ] + }, + "outcome": { + "const": "not_run" + }, + "independence_attested": { + "const": false + }, + "reviewer_label": { + "type": "null" + }, + "observed_at": { + "type": "null" + }, + "evidence_label": { + "type": "null" + }, + "evidence_sha256": { + "type": "null" + } + } + }, + "candidateReview": { + "type": "object", + "additionalProperties": false, + "required": [ + "review_class", + "outcome", + "independence_attested", + "reviewer_label", + "observed_at", + "evidence_label", + "evidence_sha256" + ], + "properties": { + "review_class": { + "enum": [ + "correctness", + "security", + "maintainability", + "operator" + ] + }, + "outcome": { + "enum": [ + "passed", + "failed" + ] + }, + "independence_attested": { + "const": true + }, + "reviewer_label": { + "$ref": "#/$defs/reviewerLabel" + }, + "observed_at": { + "$ref": "#/$defs/timestamp" + }, + "evidence_label": { + "$ref": "#/$defs/evidenceLabel" + }, + "evidence_sha256": { + "$ref": "#/$defs/sha256" + } + } + }, + "templateReviews": { + "type": "array", + "minItems": 4, + "maxItems": 4, + "items": { + "$ref": "#/$defs/templateReview" + } + }, + "candidateReviews": { + "type": "array", + "minItems": 4, + "maxItems": 4, + "items": { + "$ref": "#/$defs/candidateReview" + } + }, + "evidenceLimitations": { + "type": "object", + "additionalProperties": false, + "required": [ + "evidence_grade", + "retained_evidence_content_authenticated_by_validator", + "live_country_interoperability_proven", + "country_owner_acceptance_recorded", + "legal_approval_recorded", + "production_authorization_recorded", + "production_signing_keys_used", + "country_credentials_used", + "country_personal_data_used" + ], + "properties": { + "evidence_grade": { + "const": "candidate_non_production" + }, + "retained_evidence_content_authenticated_by_validator": { + "const": false + }, + "live_country_interoperability_proven": { + "const": false + }, + "country_owner_acceptance_recorded": { + "const": false + }, + "legal_approval_recorded": { + "const": false + }, + "production_authorization_recorded": { + "const": false + }, + "production_signing_keys_used": { + "const": false + }, + "country_credentials_used": { + "const": false + }, + "country_personal_data_used": { + "const": false + } + } + } + } +} diff --git a/release/exercises/product-input-lifecycle/product-input-lifecycle-v1.template.json b/release/exercises/product-input-lifecycle/product-input-lifecycle-v1.template.json new file mode 100644 index 000000000..de91a0eda --- /dev/null +++ b/release/exercises/product-input-lifecycle/product-input-lifecycle-v1.template.json @@ -0,0 +1,309 @@ +{ + "schema_version": "registry-stack.product-input-lifecycle.v1", + "record_kind": "template", + "exercise_id": "", + "recorded_at": "", + "candidate": { + "repository": "registrystack/registry-stack", + "release_id": "", + "version": "", + "source_ref": "", + "source_commit": "", + "release_manifest_sha256": "", + "image_lock_sha256": "", + "release_capsule_sha256": "", + "candidate_receipt_sha256": "", + "relay_image_digest": "", + "notary_image_digest": "" + }, + "candidate_binding_sha256": "", + "attestations": { + "candidate_frozen": false, + "candidate_independently_verified": false + }, + "product_inputs": { + "artifact_manifest_sha256": "", + "relay": { + "unsigned_input_sha256": "", + "signed_bundle_sha256": "", + "trust_generation": 0, + "trust_set_sha256": "", + "anti_rollback_lineage_sha256": "" + }, + "notary": { + "unsigned_input_sha256": "", + "signed_bundle_sha256": "", + "trust_generation": 0, + "trust_set_sha256": "", + "anti_rollback_lineage_sha256": "" + } + }, + "product_input_set_sha256": "", + "activation": { + "stack_generation": 0, + "compatibility_report_sha256": "", + "runtime_posture_sha256": "", + "consultation_contract_mismatch": { + "failure_class": "consultation_contract_mismatch", + "observed_source_calls": 0, + "report_sha256": "" + } + }, + "evidence": { + "authoring_and_build": [ + { + "check_id": "authored_revision_closed", + "outcome": "not_run", + "subject_sha256": null, + "observed_at": null, + "evidence_label": null, + "evidence_sha256": null + }, + { + "check_id": "fixture_coverage_closed", + "outcome": "not_run", + "subject_sha256": null, + "observed_at": null, + "evidence_label": null, + "evidence_sha256": null + }, + { + "check_id": "preflight_closed", + "outcome": "not_run", + "subject_sha256": null, + "observed_at": null, + "evidence_label": null, + "evidence_sha256": null + }, + { + "check_id": "capabilities_closed", + "outcome": "not_run", + "subject_sha256": null, + "observed_at": null, + "evidence_label": null, + "evidence_sha256": null + }, + { + "check_id": "promotion_closed", + "outcome": "not_run", + "subject_sha256": null, + "observed_at": null, + "evidence_label": null, + "evidence_sha256": null + }, + { + "check_id": "deterministic_artifact_manifest_built", + "outcome": "not_run", + "subject_sha256": null, + "observed_at": null, + "evidence_label": null, + "evidence_sha256": null + }, + { + "check_id": "relay_unsigned_input_built", + "outcome": "not_run", + "subject_sha256": null, + "observed_at": null, + "evidence_label": null, + "evidence_sha256": null + }, + { + "check_id": "notary_unsigned_input_built", + "outcome": "not_run", + "subject_sha256": null, + "observed_at": null, + "evidence_label": null, + "evidence_sha256": null + } + ], + "product_lifecycle": [ + { + "check_id": "relay_bundle_signed", + "outcome": "not_run", + "subject_sha256": null, + "observed_at": null, + "evidence_label": null, + "evidence_sha256": null + }, + { + "check_id": "notary_bundle_signed", + "outcome": "not_run", + "subject_sha256": null, + "observed_at": null, + "evidence_label": null, + "evidence_sha256": null + }, + { + "check_id": "relay_trust_generation_verified", + "outcome": "not_run", + "subject_sha256": null, + "observed_at": null, + "evidence_label": null, + "evidence_sha256": null + }, + { + "check_id": "notary_trust_generation_verified", + "outcome": "not_run", + "subject_sha256": null, + "observed_at": null, + "evidence_label": null, + "evidence_sha256": null + }, + { + "check_id": "relay_anti_rollback_lineage_verified", + "outcome": "not_run", + "subject_sha256": null, + "observed_at": null, + "evidence_label": null, + "evidence_sha256": null + }, + { + "check_id": "notary_anti_rollback_lineage_verified", + "outcome": "not_run", + "subject_sha256": null, + "observed_at": null, + "evidence_label": null, + "evidence_sha256": null + }, + { + "check_id": "relay_bundle_verified", + "outcome": "not_run", + "subject_sha256": null, + "observed_at": null, + "evidence_label": null, + "evidence_sha256": null + }, + { + "check_id": "notary_bundle_verified", + "outcome": "not_run", + "subject_sha256": null, + "observed_at": null, + "evidence_label": null, + "evidence_sha256": null + }, + { + "check_id": "cross_product_compatibility_verified", + "outcome": "not_run", + "subject_sha256": null, + "observed_at": null, + "evidence_label": null, + "evidence_sha256": null + }, + { + "check_id": "relay_staged_activation", + "outcome": "not_run", + "subject_sha256": null, + "observed_at": null, + "evidence_label": null, + "evidence_sha256": null + }, + { + "check_id": "notary_staged_activation", + "outcome": "not_run", + "subject_sha256": null, + "observed_at": null, + "evidence_label": null, + "evidence_sha256": null + }, + { + "check_id": "consultation_contract_mismatch_zero_source_calls", + "outcome": "not_run", + "subject_sha256": null, + "observed_at": null, + "evidence_label": null, + "evidence_sha256": null + }, + { + "check_id": "redacted_runtime_posture_inspected", + "outcome": "not_run", + "subject_sha256": null, + "observed_at": null, + "evidence_label": null, + "evidence_sha256": null + }, + { + "check_id": "traffic_admission_after_compatible_activation", + "outcome": "not_run", + "subject_sha256": null, + "observed_at": null, + "evidence_label": null, + "evidence_sha256": null + } + ], + "advanced_operations": [ + { + "check_id": "upgrade_exercised", + "outcome": "not_run", + "subject_sha256": null, + "observed_at": null, + "evidence_label": null, + "evidence_sha256": null + }, + { + "check_id": "recovery_exercised", + "outcome": "not_run", + "subject_sha256": null, + "observed_at": null, + "evidence_label": null, + "evidence_sha256": null + }, + { + "check_id": "rollback_exercised", + "outcome": "not_run", + "subject_sha256": null, + "observed_at": null, + "evidence_label": null, + "evidence_sha256": null + } + ] + }, + "reviews": [ + { + "review_class": "correctness", + "outcome": "not_run", + "independence_attested": false, + "reviewer_label": null, + "observed_at": null, + "evidence_label": null, + "evidence_sha256": null + }, + { + "review_class": "security", + "outcome": "not_run", + "independence_attested": false, + "reviewer_label": null, + "observed_at": null, + "evidence_label": null, + "evidence_sha256": null + }, + { + "review_class": "maintainability", + "outcome": "not_run", + "independence_attested": false, + "reviewer_label": null, + "observed_at": null, + "evidence_label": null, + "evidence_sha256": null + }, + { + "review_class": "operator", + "outcome": "not_run", + "independence_attested": false, + "reviewer_label": null, + "observed_at": null, + "evidence_label": null, + "evidence_sha256": null + } + ], + "evidence_limitations": { + "evidence_grade": "candidate_non_production", + "retained_evidence_content_authenticated_by_validator": false, + "live_country_interoperability_proven": false, + "country_owner_acceptance_recorded": false, + "legal_approval_recorded": false, + "production_authorization_recorded": false, + "production_signing_keys_used": false, + "country_credentials_used": false, + "country_personal_data_used": false + } +} diff --git a/release/exercises/upgrade-exercise-v1.template.json b/release/exercises/upgrade-exercise-v1.template.json index b6c03f42b..c1dc13acb 100644 --- a/release/exercises/upgrade-exercise-v1.template.json +++ b/release/exercises/upgrade-exercise-v1.template.json @@ -74,6 +74,14 @@ ] }, "recovery_set": [ + { + "item": "relay_source_inputs", + "artifact_sha256": "" + }, + { + "item": "relay_ingest_cache", + "artifact_sha256": "" + }, { "item": "relay_database", "artifact_sha256": "" @@ -103,111 +111,160 @@ "artifact_sha256": "" } ], + "materialization_recovery": { + "source_inputs_sha256": "", + "ingest_cache_sha256": "", + "relay_database_sha256": "", + "coordinated_recovery_point_sha256": "", + "active_publication_tuple_sha256": "", + "target_release_sha256": "", + "relay_config_schema_sha256": "", + "relay_role_bootstrap_identity_sha256": "", + "recovery_metadata_sha256": "", + "audit_watermark_sha256": "", + "binding_sha256": "" + }, "results": [ { "check_id": "candidate_artifacts_independently_verified", "outcome": "not_run", - "observed_at": "", - "evidence_label": "", - "evidence_sha256": "" + "observed_at": null, + "evidence_label": null, + "evidence_sha256": null }, { "check_id": "source_release_ready", "outcome": "not_run", - "observed_at": "", - "evidence_label": "", - "evidence_sha256": "" + "observed_at": null, + "evidence_label": null, + "evidence_sha256": null }, { "check_id": "pre_upgrade_complete_backup", "outcome": "not_run", - "observed_at": "", - "evidence_label": "", - "evidence_sha256": "" + "observed_at": null, + "evidence_label": null, + "evidence_sha256": null }, { "check_id": "notary_forward_schema_upgrade", "outcome": "not_run", - "observed_at": "", - "evidence_label": "", - "evidence_sha256": "" + "observed_at": null, + "evidence_label": null, + "evidence_sha256": null }, { "check_id": "older_notary_rejects_newer_schema", "outcome": "not_run", - "observed_at": "", - "evidence_label": "", - "evidence_sha256": "" + "observed_at": null, + "evidence_label": null, + "evidence_sha256": null }, { "check_id": "target_products_ready_before_traffic", "outcome": "not_run", - "observed_at": "", - "evidence_label": "", - "evidence_sha256": "" + "observed_at": null, + "evidence_label": null, + "evidence_sha256": null }, { "check_id": "one_notary_authority_per_relay_authority", "outcome": "not_run", - "observed_at": "", - "evidence_label": "", - "evidence_sha256": "" + "observed_at": null, + "evidence_label": null, + "evidence_sha256": null }, { "check_id": "registry_backed_direct_issuance", "outcome": "not_run", - "observed_at": "", - "evidence_label": "", - "evidence_sha256": "" + "observed_at": null, + "evidence_label": null, + "evidence_sha256": null }, { "check_id": "registry_backed_oid4vci_issuance", "outcome": "not_run", - "observed_at": "", - "evidence_label": "", - "evidence_sha256": "" + "observed_at": null, + "evidence_label": null, + "evidence_sha256": null }, { "check_id": "target_restart_retains_correctness_state", "outcome": "not_run", - "observed_at": "", - "evidence_label": "", - "evidence_sha256": "" + "observed_at": null, + "evidence_label": null, + "evidence_sha256": null }, { "check_id": "rollback_before_target_traffic", "outcome": "not_run", - "observed_at": "", - "evidence_label": "", - "evidence_sha256": "" + "observed_at": null, + "evidence_label": null, + "evidence_sha256": null }, { "check_id": "post_write_fix_forward_boundary", "outcome": "not_run", - "observed_at": "", - "evidence_label": "", - "evidence_sha256": "" + "observed_at": null, + "evidence_label": null, + "evidence_sha256": null }, { "check_id": "complete_restore", "outcome": "not_run", - "observed_at": "", - "evidence_label": "", - "evidence_sha256": "" + "observed_at": null, + "evidence_label": null, + "evidence_sha256": null }, { "check_id": "restored_products_ready", "outcome": "not_run", - "observed_at": "", - "evidence_label": "", - "evidence_sha256": "" + "observed_at": null, + "evidence_label": null, + "evidence_sha256": null }, { "check_id": "anti_rollback_rejects_older_bundle", "outcome": "not_run", - "observed_at": "", - "evidence_label": "", - "evidence_sha256": "" + "observed_at": null, + "evidence_label": null, + "evidence_sha256": null + }, + { + "check_id": "materialization_exact_restart_zero_source_calls", + "outcome": "not_run", + "observed_at": null, + "evidence_label": null, + "evidence_sha256": null + }, + { + "check_id": "materialization_missing_cache_fail_closed", + "outcome": "not_run", + "observed_at": null, + "evidence_label": null, + "evidence_sha256": null + }, + { + "check_id": "materialization_mismatched_cache_fail_closed", + "outcome": "not_run", + "observed_at": null, + "evidence_label": null, + "evidence_sha256": null + }, + { + "check_id": "materialization_pointer_mutation_rejected", + "outcome": "not_run", + "observed_at": null, + "evidence_label": null, + "evidence_sha256": null + }, + { + "check_id": "materialization_stale_or_live_fallback_rejected", + "outcome": "not_run", + "observed_at": null, + "evidence_label": null, + "evidence_sha256": null } - ] + ], + "record_binding_sha256": "" } diff --git a/release/scripts/check-gates-inventory.py b/release/scripts/check-gates-inventory.py index 424d9f014..2774e36d0 100644 --- a/release/scripts/check-gates-inventory.py +++ b/release/scripts/check-gates-inventory.py @@ -269,20 +269,54 @@ "run: python3 -m unittest release/scripts/test_validate_upgrade_exercise.py", ), ( - "Upgrade exercise asset preparation tests", + "Product-input lifecycle validator tests", + "run: python3 -m unittest release/scripts/test_validate_product_input_lifecycle.py", + ), + ( + "Product-input lifecycle record discovery", + "python3 release/scripts/validate-product-input-lifecycle.py\n" + " --discover release/exercises\n" + " --candidate-asset-root target/candidate-release-assets", + ), + ( + "First-country acceptance validator tests", + "run: python3 -m unittest release/scripts/test_validate_first_country_acceptance.py", + ), + ( + "First-country acceptance source packet", + "run: python3 release/scripts/validate-first-country-acceptance.py check-packet", + ), + ( + "Candidate evidence asset preparation tests", "run: python3 -m unittest release/scripts/test_prepare_upgrade_exercise_assets.py", ), ( - "Upgrade exercise candidate asset preparation", + "Candidate evidence asset preparation", "python3 release/scripts/prepare-upgrade-exercise-assets.py\n" " --discover release/exercises\n" - " --asset-root target/upgrade-exercise-assets", + " --product-input-records " + "release/exercises/product-input-lifecycle\n" + " --asset-root target/candidate-release-assets", + ), + ( + "Product-input lifecycle candidate asset preparation", + "--product-input-records release/exercises/product-input-lifecycle", + ), + ( + "Candidate evidence Cosign installation", + "name: Install cosign for committed candidate evidence\n" + " if: steps.candidate-assets.outputs.has_candidates == 'true'", + ), + ( + "Candidate evidence SLSA verifier installation", + "name: Install SLSA verifier for committed candidate evidence\n" + " if: steps.candidate-assets.outputs.has_candidates == 'true'", ), ( "Upgrade exercise record discovery", - "python3 release/scripts/validate-upgrade-exercise.py --discover " - "release/exercises --candidate-asset-root " - "target/upgrade-exercise-assets", + "python3 release/scripts/validate-upgrade-exercise.py\n" + " --discover release/exercises\n" + " --candidate-asset-root target/candidate-release-assets", ), ( "Base-reference compatibility input", diff --git a/release/scripts/check-stable-surface-compatibility.py b/release/scripts/check-stable-surface-compatibility.py index 338878c6c..d0ef6e2fd 100644 --- a/release/scripts/check-stable-surface-compatibility.py +++ b/release/scripts/check-stable-surface-compatibility.py @@ -21,6 +21,65 @@ "registry-relay": Path("crates/registry-relay/openapi/registry-relay.openapi.json"), "registry-notary": Path("products/notary/openapi/registry-notary.openapi.json"), } +DIAGNOSTIC_CATALOGS = { + "authoring": ( + Path("docs/site/public/generated/diagnostics/authoring.v1.json"), + "registryctl.authoring_error_reference.v1", + frozenset({"authoring_validation"}), + ), + "fixture": ( + Path("docs/site/public/generated/diagnostics/fixture.v1.json"), + "registryctl.fixture_error_reference.v1", + frozenset({"fixture_execution"}), + ), + "operator": ( + Path("docs/site/public/generated/diagnostics/operator.v1.json"), + "registryctl.operator_error_reference.v1", + frozenset( + { + "bundle_verification", + "notary_activation", + "operator_preflight", + "relay_activation", + "relay_process_startup", + } + ), + ), +} +DIAGNOSTIC_ENTRY_FIELDS = { + "family", + "code", + "owner", + "product", + "phase", + "safe_meaning", + "rule", + "safe_remediation", + "field_address_pattern", + "evidence_scope", + "secret_sensitive_value_policy", + "docs_anchor", + "lifecycle", + "introduced_in", + "stability", + "evidence_limitation", +} +DIAGNOSTIC_OWNER_BY_PRODUCT = { + "registry_notary": "registry_notary", + "registry_platform_ops": "registry_platform_ops", + "registry_relay": "registry_relay", + "registryctl": "registryctl", + "registryctl_relay_offline_harness": "registryctl", +} +NUMERIC_RELEASE_VERSION = re.compile( + r"^(?:0|[1-9][0-9]*)\.(?:0|[1-9][0-9]*)\.(?:0|[1-9][0-9]*)$" +) +PRODUCT_OWNED_DOCS_SLUG_FAMILIES = { + "bundle_verification", + "notary_activation", + "relay_activation", + "relay_process_startup", +} MACHINE_CODE = re.compile(r"^[a-z][a-z0-9_]*(?:\.[a-z0-9_]+)+$") ERROR_ROW = re.compile(r"^\| `([^`]+)` \| ([^|]+) \|") HTTP_METHODS = {"delete", "get", "head", "options", "patch", "post", "put", "trace"} @@ -36,6 +95,148 @@ class ErrorContract: products: frozenset[str] +@dataclass(frozen=True) +class DiagnosticContract: + owner: str + safe_meaning: str + rule: str + docs_anchor: str + + +def validate_diagnostic_catalog( + data: Any, + catalog: str, +) -> dict[tuple[str, str, str], DiagnosticContract]: + try: + _, schema_version, families = DIAGNOSTIC_CATALOGS[catalog] + except KeyError as error: + raise ContractError(f"unknown diagnostic catalog: {catalog}") from error + top_level = {"schema_version", "entries", "omissions"} if catalog == "operator" else { + "schema_version", + "entries", + } + if not isinstance(data, dict) or set(data) != top_level: + raise ContractError( + f"{catalog} diagnostic catalog must contain exactly " + f"{', '.join(sorted(top_level))}" + ) + if data["schema_version"] != schema_version: + raise ContractError(f"{catalog} diagnostic catalog has an unsupported schema") + entries = data["entries"] + if not isinstance(entries, list) or not entries: + raise ContractError(f"{catalog} diagnostic catalog must contain entries") + + result: dict[tuple[str, str, str], DiagnosticContract] = {} + previous_key: tuple[str, str, str] | None = None + docs_anchors: set[str] = set() + for index, entry in enumerate(entries): + label = f"{catalog}.entries[{index}]" + if not isinstance(entry, dict) or set(entry) != DIAGNOSTIC_ENTRY_FIELDS: + raise ContractError(f"{label} does not have the strict entry shape") + family = entry["family"] + product = entry["product"] + code = entry["code"] + owner = entry["owner"] + if family not in families: + raise ContractError(f"{label}.family is not part of {catalog}") + if DIAGNOSTIC_OWNER_BY_PRODUCT.get(product) != owner: + raise ContractError(f"{label} has an invalid product-owner mapping") + for field in DIAGNOSTIC_ENTRY_FIELDS - {"field_address_pattern", "introduced_in"}: + if not isinstance(entry[field], str) or not entry[field].strip(): + raise ContractError(f"{label}.{field} must be a non-empty string") + address = entry["field_address_pattern"] + if address is not None and (not isinstance(address, str) or not address.strip()): + raise ContractError(f"{label}.field_address_pattern must be non-empty or null") + lifecycle = entry["lifecycle"] + introduced_in = entry["introduced_in"] + if lifecycle == "unreleased": + if introduced_in is not None: + raise ContractError(f"{label} unreleased lifecycle requires introduced_in: null") + elif lifecycle not in {"active", "deprecated", "released"} or not ( + isinstance(introduced_in, str) + and NUMERIC_RELEASE_VERSION.fullmatch(introduced_in) + ): + raise ContractError(f"{label} released lifecycle requires a numeric introduced_in") + if entry["stability"] != "pre1_stable_code": + raise ContractError(f"{label}.stability is unsupported") + key = (family, product, code) + if key in result: + raise ContractError(f"duplicate diagnostic key: {' '.join(key)}") + if previous_key is not None and key <= previous_key: + raise ContractError(f"{label} is not ordered by family, product, code") + previous_key = key + + if family in PRODUCT_OWNED_DOCS_SLUG_FAMILIES: + anchor_pattern = re.compile( + rf"^/reference/diagnostics/{catalog}/#{product}--" + r"[a-z0-9]+(?:-[a-z0-9]+)*$" + ) + anchor_valid = anchor_pattern.fullmatch(entry["docs_anchor"]) is not None + else: + expected_anchor = f"/reference/diagnostics/{catalog}/#{product}--{code}" + anchor_valid = entry["docs_anchor"] == expected_anchor + if not anchor_valid: + raise ContractError(f"{label}.docs_anchor is not derived from owned metadata") + if entry["docs_anchor"] in docs_anchors: + raise ContractError(f"{label}.docs_anchor is duplicated") + docs_anchors.add(entry["docs_anchor"]) + result[key] = DiagnosticContract( + owner, + entry["safe_meaning"], + entry["rule"], + entry["docs_anchor"], + ) + + if catalog == "operator": + _validate_diagnostic_omissions(data["omissions"], families) + return result + + +def _validate_diagnostic_omissions(omissions: Any, families: frozenset[str]) -> None: + if not isinstance(omissions, list): + raise ContractError("operator.omissions must be an array") + expected_fields = {"family", "product", "reason", "evidence", "required_action"} + previous_key: tuple[str, str] | None = None + for index, omission in enumerate(omissions): + label = f"operator.omissions[{index}]" + if not isinstance(omission, dict) or set(omission) != expected_fields: + raise ContractError(f"{label} does not have the strict omission shape") + if omission["family"] not in families: + raise ContractError(f"{label}.family is not an operator family") + if omission["product"] not in DIAGNOSTIC_OWNER_BY_PRODUCT: + raise ContractError(f"{label}.product is not closed") + if omission["reason"] != "no_complete_public_code_catalog": + raise ContractError(f"{label}.reason is unsupported") + for field in expected_fields: + if not isinstance(omission[field], str) or not omission[field].strip(): + raise ContractError(f"{label}.{field} must be a non-empty string") + key = (omission["family"], omission["product"]) + if previous_key is not None and key <= previous_key: + raise ContractError(f"{label} is duplicated or not lexically ordered") + previous_key = key + + +def compare_diagnostic_contracts( + base: dict[tuple[str, str, str], DiagnosticContract], + current: dict[tuple[str, str, str], DiagnosticContract], +) -> list[str]: + errors: list[str] = [] + for key, old in sorted(base.items()): + family, product, code = key + new = current.get(key) + label = f"{family} {product} {code}" + if new is None: + errors.append(f"diagnostic code removed: {label}") + continue + for field in ("owner", "safe_meaning", "rule", "docs_anchor"): + if getattr(new, field) != getattr(old, field): + errors.append( + f"diagnostic {label} changed {field}: " + f"{getattr(old, field)!r} -> {getattr(new, field)!r}" + ) + return errors + + def parse_error_registry(text: str) -> dict[str, ErrorContract]: product: str | None = None entries: dict[str, tuple[str, set[str]]] = {} @@ -298,6 +499,14 @@ def check(base_ref: str | None, root: Path = ROOT) -> list[str]: for product, path in OPENAPI_SPECS.items(): document = load_json((root / path).read_text(encoding="utf-8"), str(path)) current_mappings.update(openapi_error_mappings(document, product)) + current_diagnostics: dict[ + str, dict[tuple[str, str, str], DiagnosticContract] + ] = {} + for catalog, (path, _, _) in DIAGNOSTIC_CATALOGS.items(): + current_diagnostics[catalog] = validate_diagnostic_catalog( + load_json((root / path).read_text(encoding="utf-8"), str(path)), + catalog, + ) if not base_ref: return errors @@ -331,6 +540,17 @@ def check(base_ref: str | None, root: Path = ROOT) -> list[str]: continue base_mappings.update(openapi_error_mappings(load_json(base_text, f"{base_ref}:{path}"), product)) errors.extend(compare_openapi_mappings(base_mappings, current_mappings)) + for catalog, (path, _, _) in DIAGNOSTIC_CATALOGS.items(): + base_text = git_show(base_ref, path, root) + if base_text is None: + continue + base_diagnostics = validate_diagnostic_catalog( + load_json(base_text, f"{base_ref}:{path}"), + catalog, + ) + errors.extend( + compare_diagnostic_contracts(base_diagnostics, current_diagnostics[catalog]) + ) return errors diff --git a/release/scripts/closed_json_schema.py b/release/scripts/closed_json_schema.py index 89463bcd4..55a3b3745 100644 --- a/release/scripts/closed_json_schema.py +++ b/release/scripts/closed_json_schema.py @@ -15,9 +15,13 @@ class SchemaValidationError(ValueError): """A value does not satisfy the supported closed schema.""" +class SchemaDefinitionError(SchemaValidationError): + """A schema uses an invalid or unsupported rule.""" + + def resolve_ref(schema: dict[str, Any], reference: str) -> dict[str, Any]: if not reference.startswith("#/"): - raise SchemaValidationError( + raise SchemaDefinitionError( f"unsupported external schema reference: {reference}" ) value: Any = schema @@ -25,11 +29,11 @@ def resolve_ref(schema: dict[str, Any], reference: str) -> dict[str, Any]: for component in reference[2:].split("/"): value = value[component] except (KeyError, TypeError): - raise SchemaValidationError( + raise SchemaDefinitionError( f"schema reference does not resolve: {reference}" ) from None if not isinstance(value, dict): - raise SchemaValidationError( + raise SchemaDefinitionError( f"schema reference does not resolve to an object: {reference}" ) return value @@ -51,8 +55,7 @@ def json_value_equal(actual: Any, expected: Any) -> bool: and isinstance(expected, list) and len(actual) == len(expected) and all( - json_value_equal(left, right) - for left, right in zip(actual, expected) + json_value_equal(left, right) for left, right in zip(actual, expected) ) ) if isinstance(actual, dict) or isinstance(expected, dict): @@ -71,7 +74,7 @@ def validate_against_schema( schema: dict[str, Any], label: str = "result", ) -> None: - """Validate the const/enum/closed-object/array/scalar subset used here.""" + """Validate the closed scalar/container and allOf/if/then/else subset.""" if "$ref" in rule: validate_against_schema( value, @@ -80,6 +83,32 @@ def validate_against_schema( label, ) return + for index, child in enumerate(rule.get("allOf", [])): + if not isinstance(child, dict): + raise SchemaDefinitionError(f"{label} has an invalid allOf rule") + validate_against_schema( + value, + child, + schema, + f"{label}.allOf[{index}]", + ) + if "if" in rule: + condition = rule["if"] + if not isinstance(condition, dict): + raise SchemaDefinitionError(f"{label} has an invalid if rule") + try: + validate_against_schema(value, condition, schema, label) + branch = rule.get("then") + except SchemaDefinitionError: + raise + except SchemaValidationError: + branch = rule.get("else") + if branch is not None: + if not isinstance(branch, dict): + raise SchemaDefinitionError( + f"{label} has an invalid conditional branch" + ) + validate_against_schema(value, branch, schema, label) if "const" in rule and not json_value_equal(value, rule["const"]): raise SchemaValidationError(f"{label} must equal {rule['const']!r}") if "enum" in rule and not any( @@ -144,9 +173,7 @@ def validate_against_schema( parsed = urllib.parse.urlsplit(value) parsed.port except ValueError: - raise SchemaValidationError( - f"{label} has an invalid URI" - ) from None + raise SchemaValidationError(f"{label} has an invalid URI") from None if not parsed.scheme or not parsed.netloc: raise SchemaValidationError(f"{label} has an invalid URI") elif kind == "integer": diff --git a/release/scripts/prepare-upgrade-exercise-assets.py b/release/scripts/prepare-upgrade-exercise-assets.py index 3a48989f3..2910e27f2 100644 --- a/release/scripts/prepare-upgrade-exercise-assets.py +++ b/release/scripts/prepare-upgrade-exercise-assets.py @@ -1,5 +1,5 @@ #!/usr/bin/env python3 -"""Download version-keyed release assets for committed upgrade evidence.""" +"""Download version-keyed release assets for committed candidate evidence.""" from __future__ import annotations @@ -22,21 +22,40 @@ rf"(?:-{SEMVER_PRERELEASE_IDENTIFIER}" rf"(?:\.{SEMVER_PRERELEASE_IDENTIFIER})*)?$" ) +PRODUCT_INPUT_SCHEMA_FILENAME = "product-input-lifecycle-v1.schema.json" class PreparationError(RuntimeError): - """Committed upgrade evidence cannot be prepared safely.""" + """Committed candidate evidence cannot be prepared safely.""" + + +def load_closed_json_record(path: Path, label: str) -> object: + def reject_duplicate_fields( + pairs: list[tuple[str, object]], + ) -> dict[str, object]: + value: dict[str, object] = {} + for field, field_value in pairs: + if field in value: + raise PreparationError( + f"{label} contains a duplicate JSON field" + ) + value[field] = field_value + return value + + try: + content = path.read_text(encoding="utf-8") + except OSError: + raise PreparationError(f"{label} could not be read") from None + try: + return json.loads(content, object_pairs_hook=reject_duplicate_fields) + except json.JSONDecodeError: + raise PreparationError(f"{label} could not be read") from None def candidate_versions(records: Path) -> tuple[str, ...]: versions: set[str] = set() for path in sorted(records.glob("*.json")): - try: - value = json.loads(path.read_text(encoding="utf-8")) - except (OSError, json.JSONDecodeError): - raise PreparationError( - "upgrade exercise record could not be read" - ) from None + value = load_closed_json_record(path, "upgrade exercise record") if not isinstance(value, dict) or value.get("record_kind") == "template": continue if value.get("record_kind") != "candidate_evidence": @@ -52,10 +71,36 @@ def candidate_versions(records: Path) -> tuple[str, ...]: return tuple(sorted(versions)) -def required_asset_names(version: str) -> tuple[str, ...]: +def product_input_candidate_versions(records: Path) -> tuple[str, ...]: + versions: set[str] = set() + for path in sorted(records.glob("*.json")): + if path.name == PRODUCT_INPUT_SCHEMA_FILENAME: + continue + value = load_closed_json_record( + path, "product-input lifecycle record" + ) + if not isinstance(value, dict) or value.get("record_kind") == "template": + continue + if value.get("record_kind") != "candidate_evidence": + raise PreparationError( + "product-input lifecycle record kind is invalid" + ) + candidate = value.get("candidate") + version = candidate.get("version") if isinstance(candidate, dict) else None + if not isinstance(version, str) or VERSION.fullmatch(version) is None: + raise PreparationError( + "product-input lifecycle candidate version is invalid" + ) + versions.add(version) + return tuple(sorted(versions)) + + +def required_asset_names( + version: str, *, include_candidate_receipt: bool = False +) -> tuple[str, ...]: image_lock = f"registryctl-{version}-image-lock.json" capsule = f"registry-stack-{version}-release-capsule.json" - return ( + names = ( image_lock, f"{image_lock}.sig", f"{image_lock}.pem", @@ -65,6 +110,9 @@ def required_asset_names(version: str) -> tuple[str, ...]: f"registry-stack-{version}-release-provenance.intoto.jsonl", "SHA256SUMS", ) + if include_candidate_receipt: + return names + (f"registry-stack-{version}-candidate-receipt.json",) + return names def run_download(command: list[str]) -> None: @@ -90,9 +138,16 @@ def prepare_assets( records: Path, asset_root: Path, *, + product_input_records: Path | None = None, downloader: Callable[[list[str]], None] = run_download, ) -> tuple[str, ...]: - versions = candidate_versions(records) + upgrade_versions = set(candidate_versions(records)) + product_input_versions = ( + set() + if product_input_records is None + else set(product_input_candidate_versions(product_input_records)) + ) + versions = tuple(sorted(upgrade_versions | product_input_versions)) if not versions: return versions asset_root.mkdir(parents=True, exist_ok=True) @@ -104,7 +159,10 @@ def prepare_assets( raise PreparationError( "candidate version asset directory must be new" ) from None - names = required_asset_names(version) + include_candidate_receipt = version in product_input_versions + names = required_asset_names( + version, include_candidate_receipt=include_candidate_receipt + ) command = [ "gh", "release", @@ -131,17 +189,31 @@ def prepare_assets( raise PreparationError( "candidate release asset set is incomplete or unsafe" ) + if include_candidate_receipt: + receipt = ( + destination / f"registry-stack-{version}-candidate-receipt.json" + ) + receipt.rename(destination / "release-candidate-receipt.json") return versions def main() -> int: parser = argparse.ArgumentParser(description=__doc__) parser.add_argument("--discover", type=Path, required=True) + parser.add_argument( + "--product-input-records", + type=Path, + help="directory containing product-input lifecycle records", + ) parser.add_argument("--asset-root", type=Path, required=True) parser.add_argument("--github-output", type=Path) args = parser.parse_args() try: - versions = prepare_assets(args.discover, args.asset_root) + versions = prepare_assets( + args.discover, + args.asset_root, + product_input_records=args.product_input_records, + ) if args.github_output is not None: with args.github_output.open("a", encoding="utf-8") as output: output.write( @@ -149,10 +221,10 @@ def main() -> int: ) output.write(f"versions={','.join(versions)}\n") except (PreparationError, OSError) as error: - print(f"upgrade asset preparation failed: {error}", file=sys.stderr) + print(f"candidate asset preparation failed: {error}", file=sys.stderr) return 1 print( - f"prepared upgrade release inputs for {len(versions)} version(s)" + f"prepared candidate release inputs for {len(versions)} version(s)" ) return 0 diff --git a/release/scripts/test_check_gates_inventory.py b/release/scripts/test_check_gates_inventory.py index cd68bb7ca..0e2b0e43f 100644 --- a/release/scripts/test_check_gates_inventory.py +++ b/release/scripts/test_check_gates_inventory.py @@ -768,32 +768,120 @@ def test_missing_openapi_base_reference_is_reported(self) -> None: def test_missing_upgrade_exercise_record_discovery_is_reported(self) -> None: text = self.workflow.replace( - "python3 release/scripts/validate-upgrade-exercise.py --discover release/exercises", + "python3 release/scripts/validate-upgrade-exercise.py", "python3 release/scripts/validate-upgrade-exercise.py --skip-discovery", ) self.assertIn( "Upgrade exercise record discovery", self.module.missing_gates(text) ) + def test_missing_product_input_lifecycle_validator_tests_are_reported( + self, + ) -> None: + text = self.workflow.replace( + "python3 -m unittest release/scripts/test_validate_product_input_lifecycle.py", + "python3 -m unittest release/scripts/skip_validate_product_input_lifecycle.py", + ) + self.assertIn( + "Product-input lifecycle validator tests", + self.module.missing_gates(text), + ) + + def test_missing_product_input_lifecycle_record_discovery_is_reported( + self, + ) -> None: + text = self.workflow.replace( + "--candidate-asset-root target/candidate-release-assets", + "--candidate-asset-root target/unauthenticated-assets", + 1, + ) + self.assertIn( + "Product-input lifecycle record discovery", + self.module.missing_gates(text), + ) + + def test_missing_first_country_acceptance_validator_tests_are_reported( + self, + ) -> None: + text = self.workflow.replace( + "python3 -m unittest release/scripts/test_validate_first_country_acceptance.py", + "python3 -m unittest release/scripts/skip_validate_first_country_acceptance.py", + ) + self.assertIn( + "First-country acceptance validator tests", + self.module.missing_gates(text), + ) + + def test_missing_first_country_acceptance_source_packet_is_reported( + self, + ) -> None: + text = self.workflow.replace( + "python3 release/scripts/validate-first-country-acceptance.py check-packet", + "python3 release/scripts/validate-first-country-acceptance.py skip-packet", + ) + self.assertIn( + "First-country acceptance source packet", + self.module.missing_gates(text), + ) + def test_missing_upgrade_exercise_asset_preparation_is_reported(self) -> None: text = self.workflow.replace( "python3 release/scripts/prepare-upgrade-exercise-assets.py", "python3 release/scripts/skip-upgrade-exercise-assets.py", ) self.assertIn( - "Upgrade exercise candidate asset preparation", + "Candidate evidence asset preparation", + self.module.missing_gates(text), + ) + + def test_product_input_candidates_enable_cosign_installation(self) -> None: + text = self.workflow.replace( + "if: steps.candidate-assets.outputs.has_candidates == 'true'", + "if: steps.upgrade-assets.outputs.has_candidates == 'true'", + 1, + ) + self.assertIn( + "Candidate evidence Cosign installation", + self.module.missing_gates(text), + ) + + def test_product_input_candidates_enable_slsa_verifier_installation( + self, + ) -> None: + marker = "if: steps.candidate-assets.outputs.has_candidates == 'true'" + first = self.workflow.index(marker) + second = self.workflow.index(marker, first + len(marker)) + text = self.workflow[:second] + self.workflow[second:].replace( + marker, + "if: steps.upgrade-assets.outputs.has_candidates == 'true'", + 1, + ) + self.assertIn( + "Candidate evidence SLSA verifier installation", self.module.missing_gates(text), ) def test_missing_upgrade_exercise_asset_root_is_reported(self) -> None: text = self.workflow.replace( - "--candidate-asset-root target/upgrade-exercise-assets", + "--candidate-asset-root target/candidate-release-assets", "--candidate-asset-root target/unauthenticated-assets", ) self.assertIn( "Upgrade exercise record discovery", self.module.missing_gates(text) ) + def test_missing_product_input_lifecycle_asset_preparation_is_reported( + self, + ) -> None: + text = self.workflow.replace( + "--product-input-records release/exercises/product-input-lifecycle", + "--product-input-records release/exercises/removed-lifecycle", + ) + self.assertIn( + "Candidate evidence asset preparation", + self.module.missing_gates(text), + ) + def test_missing_stable_error_registry_path_filter_is_reported(self) -> None: classifier = self.classifier.replace( '"docs/site/src/content/docs/reference/errors.mdx",', diff --git a/release/scripts/test_check_stable_surface_compatibility.py b/release/scripts/test_check_stable_surface_compatibility.py index 88442def5..d907501f0 100644 --- a/release/scripts/test_check_stable_surface_compatibility.py +++ b/release/scripts/test_check_stable_surface_compatibility.py @@ -133,6 +133,115 @@ def test_openapi_error_mapping_removal_is_breaking(self) -> None: self.assertEqual(1, len(errors)) self.assertIn("item.not_found", errors[0]) + def diagnostic_entry(self, code: str = "registryctl.authoring.test") -> dict: + return { + "family": "authoring_validation", + "code": code, + "owner": "registryctl", + "product": "registryctl", + "phase": "static_validation", + "safe_meaning": "The authored project failed a static rule.", + "rule": "authored project must satisfy the closed static rule", + "safe_remediation": "Correct the reviewed authored field and retry.", + "field_address_pattern": None, + "evidence_scope": "offline authored project files", + "secret_sensitive_value_policy": "no_received_value", + "docs_anchor": f"/reference/diagnostics/authoring/#registryctl--{code}", + "lifecycle": "unreleased", + "introduced_in": None, + "stability": "pre1_stable_code", + "evidence_limitation": "Static evidence does not prove live compatibility.", + } + + def diagnostic_catalog(self, *entries: dict) -> dict: + return { + "schema_version": "registryctl.authoring_error_reference.v1", + "entries": list(entries), + } + + def test_diagnostic_additions_are_allowed_but_removal_and_semantic_drift_are_not( + self, + ) -> None: + key = ("authoring_validation", "registryctl", "registryctl.authoring.test") + old = { + key: self.module.DiagnosticContract( + "registryctl", + "The authored project failed a static rule.", + "authored project must satisfy the closed static rule", + "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.test", + ) + } + additive = { + **old, + ( + "authoring_validation", + "registryctl", + "registryctl.authoring.second", + ): self.module.DiagnosticContract( + "registryctl", + "A second static meaning.", + "a second static rule", + "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.second", + ), + } + self.assertEqual([], self.module.compare_diagnostic_contracts(old, additive)) + self.assertTrue(self.module.compare_diagnostic_contracts(old, {})) + for field, value in ( + ("owner", "registry_relay"), + ("safe_meaning", "A changed meaning."), + ("rule", "a changed rule"), + ( + "docs_anchor", + "/reference/diagnostics/authoring/#registryctl--registryctl.authoring.changed", + ), + ): + changed = { + key: self.module.DiagnosticContract( + value if field == "owner" else old[key].owner, + value if field == "safe_meaning" else old[key].safe_meaning, + value if field == "rule" else old[key].rule, + value if field == "docs_anchor" else old[key].docs_anchor, + ) + } + errors = self.module.compare_diagnostic_contracts(old, changed) + self.assertTrue(any(f"changed {field}" in error for error in errors)) + + def test_diagnostic_catalog_rejects_shape_duplicates_reordering_and_lifecycle_drift( + self, + ) -> None: + valid = self.diagnostic_catalog(self.diagnostic_entry()) + result = self.module.validate_diagnostic_catalog(valid, "authoring") + self.assertEqual(1, len(result)) + + malformed = self.diagnostic_catalog(self.diagnostic_entry()) + malformed["entries"][0]["unexpected"] = True + with self.assertRaisesRegex(self.module.ContractError, "strict entry shape"): + self.module.validate_diagnostic_catalog(malformed, "authoring") + + duplicate = self.diagnostic_catalog( + self.diagnostic_entry(), + self.diagnostic_entry(), + ) + with self.assertRaisesRegex(self.module.ContractError, "duplicate"): + self.module.validate_diagnostic_catalog(duplicate, "authoring") + + reordered = self.diagnostic_catalog( + self.diagnostic_entry("registryctl.authoring.z"), + self.diagnostic_entry("registryctl.authoring.a"), + ) + with self.assertRaisesRegex(self.module.ContractError, "not ordered"): + self.module.validate_diagnostic_catalog(reordered, "authoring") + + stale = self.diagnostic_catalog(self.diagnostic_entry()) + stale["entries"][0]["introduced_in"] = "0.13.0" + with self.assertRaisesRegex(self.module.ContractError, "introduced_in: null"): + self.module.validate_diagnostic_catalog(stale, "authoring") + + reassigned = self.diagnostic_catalog(self.diagnostic_entry()) + reassigned["entries"][0]["owner"] = "registry_relay" + with self.assertRaisesRegex(self.module.ContractError, "product-owner"): + self.module.validate_diagnostic_catalog(reassigned, "authoring") + def test_real_current_contract_validates_without_a_base(self) -> None: self.assertEqual([], self.module.check(None, ROOT)) diff --git a/release/scripts/test_prepare_upgrade_exercise_assets.py b/release/scripts/test_prepare_upgrade_exercise_assets.py index 78eb48d75..73eb92d15 100644 --- a/release/scripts/test_prepare_upgrade_exercise_assets.py +++ b/release/scripts/test_prepare_upgrade_exercise_assets.py @@ -48,6 +48,22 @@ def write_record( encoding="utf-8", ) + def write_product_input_record( + self, + directory: Path, + name: str, + version: str, + ) -> None: + (directory / name).write_text( + json.dumps( + { + "record_kind": "candidate_evidence", + "candidate": {"version": version}, + } + ), + encoding="utf-8", + ) + def download_fixture( self, command: list[str], *, omit: str | None = None ) -> None: @@ -68,6 +84,9 @@ def test_current_templates_require_no_download_or_asset_root(self) -> None: versions = self.module.prepare_assets( ROOT / "release" / "exercises", asset_root, + product_input_records=( + ROOT / "release" / "exercises" / "product-input-lifecycle" + ), downloader=downloader, ) @@ -125,6 +144,192 @@ def test_multiple_versions_use_separate_authenticated_directories(self) -> None: self.assertTrue((root / "assets" / "v0.12.1").is_dir()) self.assertTrue((root / "assets" / "v0.12.2").is_dir()) + def test_product_input_candidate_prepares_release_assets_and_receipt( + self, + ) -> None: + with tempfile.TemporaryDirectory() as temporary: + root = Path(temporary) + upgrade_records = root / "upgrades" + product_input_records = root / "product-input-lifecycle" + upgrade_records.mkdir() + product_input_records.mkdir() + ( + product_input_records / "product-input-lifecycle-v1.schema.json" + ).write_text("{}", encoding="utf-8") + self.write_product_input_record( + product_input_records, + "candidate.json", + "v0.12.2", + ) + + versions = self.module.prepare_assets( + upgrade_records, + root / "assets", + product_input_records=product_input_records, + downloader=self.download_fixture, + ) + + self.assertEqual(("v0.12.2",), versions) + prepared = { + path.name for path in (root / "assets" / "v0.12.2").iterdir() + } + self.assertEqual( + set(self.module.required_asset_names("v0.12.2")) + | {"release-candidate-receipt.json"}, + prepared, + ) + self.assertNotIn( + "registry-stack-v0.12.2-candidate-receipt.json", + prepared, + ) + + def test_product_input_candidate_requires_published_receipt(self) -> None: + with tempfile.TemporaryDirectory() as temporary: + root = Path(temporary) + upgrade_records = root / "upgrades" + product_input_records = root / "product-input-lifecycle" + upgrade_records.mkdir() + product_input_records.mkdir() + self.write_product_input_record( + product_input_records, + "candidate.json", + "v0.12.2", + ) + + with self.assertRaisesRegex( + self.module.PreparationError, + "incomplete or unsafe", + ): + self.module.prepare_assets( + upgrade_records, + root / "assets", + product_input_records=product_input_records, + downloader=lambda command: self.download_fixture( + command, + omit="registry-stack-v0.12.2-candidate-receipt.json", + ), + ) + + def test_upgrade_and_product_input_candidate_share_one_asset_download( + self, + ) -> None: + with tempfile.TemporaryDirectory() as temporary: + root = Path(temporary) + upgrade_records = root / "upgrades" + product_input_records = root / "product-input-lifecycle" + upgrade_records.mkdir() + product_input_records.mkdir() + self.write_record( + upgrade_records, + "candidate.json", + "v0.12.2", + source_version="v0.12.2", + ) + self.write_product_input_record( + product_input_records, + "candidate.json", + "v0.12.2", + ) + commands: list[list[str]] = [] + + def download(command: list[str]) -> None: + commands.append(command) + self.download_fixture(command) + + versions = self.module.prepare_assets( + upgrade_records, + root / "assets", + product_input_records=product_input_records, + downloader=download, + ) + + self.assertEqual(("v0.12.2",), versions) + self.assertEqual(1, len(commands)) + self.assertIn( + "registry-stack-v0.12.2-candidate-receipt.json", + commands[0], + ) + + def test_invalid_product_input_candidate_version_is_rejected(self) -> None: + with tempfile.TemporaryDirectory() as temporary: + root = Path(temporary) + upgrade_records = root / "upgrades" + product_input_records = root / "product-input-lifecycle" + upgrade_records.mkdir() + product_input_records.mkdir() + self.write_product_input_record( + product_input_records, + "candidate.json", + "v0.12", + ) + downloader = unittest.mock.Mock() + + with self.assertRaisesRegex( + self.module.PreparationError, + "product-input lifecycle candidate version is invalid", + ): + self.module.prepare_assets( + upgrade_records, + root / "assets", + product_input_records=product_input_records, + downloader=downloader, + ) + + downloader.assert_not_called() + + def test_duplicate_upgrade_field_is_rejected_before_download(self) -> None: + with tempfile.TemporaryDirectory() as temporary: + root = Path(temporary) + records = root / "records" + records.mkdir() + (records / "candidate.json").write_text( + '{"record_kind":"candidate_evidence",' + '"record_kind":"template"}', + encoding="utf-8", + ) + downloader = unittest.mock.Mock() + + with self.assertRaisesRegex( + self.module.PreparationError, + "upgrade exercise record contains a duplicate JSON field", + ): + self.module.prepare_assets( + records, + root / "assets", + downloader=downloader, + ) + + downloader.assert_not_called() + + def test_duplicate_product_input_field_is_rejected_before_download( + self, + ) -> None: + with tempfile.TemporaryDirectory() as temporary: + root = Path(temporary) + upgrade_records = root / "upgrades" + product_input_records = root / "product-input-lifecycle" + upgrade_records.mkdir() + product_input_records.mkdir() + (product_input_records / "candidate.json").write_text( + '{"record_kind":"candidate_evidence",' + '"candidate":{"version":"v0.12.2","version":"v0.12.3"}}', + encoding="utf-8", + ) + downloader = unittest.mock.Mock() + + with self.assertRaisesRegex( + self.module.PreparationError, + "product-input lifecycle record contains a duplicate JSON field", + ): + self.module.prepare_assets( + upgrade_records, + root / "assets", + product_input_records=product_input_records, + downloader=downloader, + ) + + downloader.assert_not_called() + def test_invalid_source_version_is_rejected_before_download(self) -> None: with tempfile.TemporaryDirectory() as temporary: root = Path(temporary) diff --git a/release/scripts/test_validate_first_country_acceptance.py b/release/scripts/test_validate_first_country_acceptance.py new file mode 100644 index 000000000..825674189 --- /dev/null +++ b/release/scripts/test_validate_first_country_acceptance.py @@ -0,0 +1,658 @@ +#!/usr/bin/env python3 +from __future__ import annotations + +import copy +import hashlib +import importlib.util +import json +import subprocess +import sys +import tempfile +from pathlib import Path +from unittest import TestCase, main + + +ROOT = Path(__file__).resolve().parents[2] +SCRIPT = ROOT / "release" / "scripts" / "validate-first-country-acceptance.py" +sys.path.insert(0, str(SCRIPT.parent)) + + +def load_module(): + spec = importlib.util.spec_from_file_location( + "validate_first_country_acceptance", SCRIPT + ) + if spec is None or spec.loader is None: + raise ImportError(f"could not load module spec from {SCRIPT}") + module = importlib.util.module_from_spec(spec) + spec.loader.exec_module(module) + return module + + +class FirstCountryAcceptanceTest(TestCase): + @classmethod + def setUpClass(cls) -> None: + cls.module = load_module() + cls.schema = cls.module.load_schema() + cls.template = cls.module.validate_shape( + cls.module.load_json(cls.module.TEMPLATE_PATH), cls.schema + ) + + @staticmethod + def replace_zero_digests(value: object, label: str = "record") -> object: + if isinstance(value, dict): + return { + key: FirstCountryAcceptanceTest.replace_zero_digests( + item, f"{label}.{key}" + ) + for key, item in value.items() + } + if isinstance(value, list): + return [ + FirstCountryAcceptanceTest.replace_zero_digests( + item, f"{label}[{index}]" + ) + for index, item in enumerate(value) + ] + if value == "sha256:" + "0" * 64: + return "sha256:" + hashlib.sha256(label.encode("utf-8")).hexdigest() + return value + + def make_passing_record(self) -> dict[str, object]: + record = self.replace_zero_digests(copy.deepcopy(self.template)) + assert isinstance(record, dict) + record["record_kind"] = "candidate_acceptance_evidence" + record["is_evidence"] = True + record["evidence_state"] = "passed_non_production" + record["overall_outcome"] = "passed" + + binding = record["binding"] + assert isinstance(binding, dict) + candidate = binding["candidate"] + assert isinstance(candidate, dict) + candidate["release_tag"] = "v1.2.3" + candidate["source_commit"] = "1" * 40 + candidate["candidate_assets_verified"] = True + candidate["authenticity_verified"] = True + candidate["exact_candidate_approved"] = True + + project = binding["project"] + assert isinstance(project, dict) + project["generated_files_unchanged"] = True + project["generated_files_edited"] = False + project["product_code_changes_required"] = False + + environment = binding["environment"] + assert isinstance(environment, dict) + environment["secret_values_retained"] = False + environment["authority_widening_detected"] = False + + source = binding["source_profile"] + assert isinstance(source, dict) + source["exact_version_bound"] = True + source["exact_read_operation_bound"] = True + source["non_production_only"] = True + source["approved_input_class"] = "synthetic" + source["zero_one_call_probe_approved"] = True + + binding_digest = self.module.canonical_binding_sha256(binding) + record["acceptance_binding_sha256"] = binding_digest + cases = record["cases"] + assert isinstance(cases, list) + for case, (_, result_class, source_class, _) in zip( + cases, self.module.CASE_CONTRACT + ): + case["outcome"] = "passed" + case["result_class"] = result_class + case["acceptance_binding_sha256"] = binding_digest + case["source_call_classification"] = source_class + + claims = record["scope_claims"] + assert isinstance(claims, dict) + claims["platform_complete"] = True + claims["country_ready"] = True + claims["first_country_success"] = True + + human = record["human_acceptance"] + assert isinstance(human, dict) + human["outcome"] = "passed" + human["published_candidate_artifacts_only"] = True + human["private_maintainer_instructions_used"] = False + for field in ( + "authored_intent_understood", + "environment_binding_understood", + "generated_artifacts_understood", + "signed_product_inputs_understood", + "operator_trust_understood", + "runtime_state_understood", + ): + human[field] = True + human["country_owner_usability_acceptance"] = "accepted" + human["maintainability_acceptance"] = "accepted" + + handling = record["evidence_handling"] + assert isinstance(handling, dict) + handling["restricted_storage"]["approved"] = True + handling["retention"]["approved"] = True + handling["retention"]["failed_run_retention_approved"] = True + handling["deletion"]["procedure_approved"] = True + handling["deletion"][ + "completion_state" + ] = "scheduled-within-approved-policy" + handling["redaction"]["canary_scan_passed"] = True + handling["redaction"]["public_private_split_confirmed"] = True + + governance = record["governance"] + assert isinstance(governance, dict) + governance["privacy_acceptance"]["status"] = "accepted" + governance["legal_acceptance"]["status"] = "accepted" + governance["country_technical_acceptance"]["status"] = "accepted" + + publication = record["publication_review"] + assert isinstance(publication, dict) + publication["status"] = "passed" + publication["public_restricted_comparison_confirmed"] = True + publication["forbidden_content_absent"] = True + + teardown_case = cases[-1] + teardown = record["teardown"] + assert isinstance(teardown, dict) + teardown["attempted"] = True + teardown["finally_path"] = True + teardown["outcome"] = "completed" + teardown["within_approved_bound"] = True + for field in ( + "source_call_classification", + "public_evidence_sha256", + "restricted_evidence_sha256", + "owner_attestation_sha256", + "owner_roles", + ): + teardown[field] = copy.deepcopy(teardown_case[field]) + return record + + def validate(self, record: dict[str, object]) -> str: + shaped = self.module.validate_shape(record, self.schema) + return self.module.validate_evidence(shaped) + + def test_checked_in_packet_is_closed_and_template_is_non_evidence(self) -> None: + self.module.check_packet() + self.assertFalse(self.template["is_evidence"]) + self.assertEqual("template", self.template["record_kind"]) + self.assertEqual("planned_not_executed", self.template["evidence_state"]) + with self.assertRaisesRegex( + self.module.AcceptanceError, "candidate acceptance record" + ): + self.module.validate_evidence(copy.deepcopy(self.template)) + + def test_packet_rejects_optional_fields_in_closed_objects(self) -> None: + schema = copy.deepcopy(self.schema) + schema["$defs"]["case"]["required"].remove("owner_attestation_sha256") + with self.assertRaisesRegex( + self.module.AcceptanceError, "must require every field" + ): + self.module.assert_closed_schema(schema) + + def test_load_json_rejects_duplicate_provenance_fields(self) -> None: + cases = ( + ( + "acceptance binding", + '{"acceptance_binding_sha256":"sha256:' + + "a" * 64 + + '","acceptance_binding_sha256":"sha256:' + + "b" * 64 + + '"}', + ), + ( + "candidate source commit", + '{"binding":{"candidate":{"source_commit":"' + + "1" * 40 + + '","source_commit":"' + + "2" * 40 + + '"}}}', + ), + ) + with tempfile.TemporaryDirectory() as temporary: + record_path = Path(temporary) / "record.json" + for label, source in cases: + with self.subTest(label=label): + record_path.write_text(source, encoding="utf-8") + with self.assertRaisesRegex( + self.module.AcceptanceError, + "JSON objects must not contain duplicate fields", + ): + self.module.load_json(record_path) + + def test_template_binding_is_canonical_and_repeated_for_every_case(self) -> None: + digest = self.module.canonical_binding_sha256(self.template["binding"]) + self.assertEqual(digest, self.template["acceptance_binding_sha256"]) + self.assertEqual( + {digest}, + { + case["acceptance_binding_sha256"] + for case in self.template["cases"] + }, + ) + + def test_template_rejects_planted_unexecuted_attestations(self) -> None: + mutations = ( + ( + ("binding", "project", "generated_files_edited"), + True, + "unexecuted prerequisites", + ), + ( + ("binding", "environment", "authority_widening_detected"), + True, + "unexecuted prerequisites", + ), + ( + ("human_acceptance", "authored_intent_understood"), + True, + "human acceptance", + ), + ) + for path, value, message in mutations: + with self.subTest(path=path): + record = copy.deepcopy(self.template) + target = record + for part in path[:-1]: + target = target[part] + target[path[-1]] = value + if path[0] == "binding": + digest = self.module.canonical_binding_sha256(record["binding"]) + record["acceptance_binding_sha256"] = digest + for case in record["cases"]: + case["acceptance_binding_sha256"] = digest + with self.assertRaisesRegex(self.module.AcceptanceError, message): + self.module.validate_template(record) + + def test_closed_case_set_covers_every_split_acceptance_requirement(self) -> None: + case_ids = [item[0] for item in self.module.CASE_CONTRACT] + self.assertEqual(21, len(case_ids)) + self.assertEqual(len(case_ids), len(set(case_ids))) + for required in ( + "offline-clean-journey", + "missing-caller-credential-denial", + "wrong-caller-credential-denial", + "missing-purpose-denial", + "wrong-purpose-denial", + "disallowed-service-policy-denial", + "allowed-relay-consultation", + "no-match", + "ambiguity", + "subject-mismatch", + "source-unavailable", + "source-rejected", + "source-malformed", + "source-late", + "notary-value-claim", + "notary-predicate-claim", + "notary-redacted-claim", + "consultation-contract-mismatch", + "promotion", + "rollback-recovery", + "teardown", + ): + self.assertIn(required, case_ids) + + def test_passing_record_closes_only_bounded_states(self) -> None: + record = self.make_passing_record() + self.assertEqual("passed", self.validate(record)) + claims = record["scope_claims"] + self.assertTrue(claims["first_country_success"]) + self.assertFalse(claims["production_authorized"]) + self.assertFalse(claims["broad_interoperability"]) + self.assertFalse(claims["upstream_product_certification"]) + + def test_candidate_binding_tamper_is_rejected(self) -> None: + record = self.make_passing_record() + record["binding"]["environment"]["environment_sha256"] = ( + "sha256:" + "b" * 64 + ) + with self.assertRaisesRegex( + self.module.AcceptanceError, "canonical binding" + ): + self.validate(record) + + def test_passing_record_rejects_digest_reuse_across_evidence_domains(self) -> None: + mutations = ( + ( + lambda record: record["cases"][0], + "restricted_evidence_sha256", + lambda record: record["cases"][0]["public_evidence_sha256"], + "must bind distinct public, restricted", + ), + ( + lambda record: record["human_acceptance"], + "restricted_evidence_sha256", + lambda record: record["human_acceptance"][ + "public_evidence_sha256" + ], + "human acceptance must bind distinct", + ), + ( + lambda record: record["evidence_handling"]["redaction"], + "restricted_index_sha256", + lambda record: record["evidence_handling"]["redaction"][ + "public_summary_sha256" + ], + "redaction must bind distinct", + ), + ( + lambda record: record["publication_review"], + "review_evidence_sha256", + lambda record: record["cases"][0]["public_evidence_sha256"], + "publication review evidence must be distinct", + ), + ) + for owner, field, value, message in mutations: + with self.subTest(field=field, message=message): + record = self.make_passing_record() + owner(record)[field] = value(record) + with self.assertRaisesRegex(self.module.AcceptanceError, message): + self.validate(record) + + def test_passing_record_rejects_candidate_digest_reuse(self) -> None: + record = self.make_passing_record() + candidate = record["binding"]["candidate"] + candidate["notary_product_sha256"] = candidate["relay_product_sha256"] + binding_digest = self.module.canonical_binding_sha256(record["binding"]) + record["acceptance_binding_sha256"] = binding_digest + for case in record["cases"]: + case["acceptance_binding_sha256"] = binding_digest + with self.assertRaisesRegex( + self.module.AcceptanceError, "candidate artifacts.*distinct digests" + ): + self.validate(record) + + def test_case_binding_tamper_is_rejected(self) -> None: + record = self.make_passing_record() + record["cases"][0]["acceptance_binding_sha256"] = "sha256:" + "b" * 64 + with self.assertRaisesRegex( + self.module.AcceptanceError, "not bound to the canonical" + ): + self.validate(record) + + def test_passing_denial_must_prove_pre_source_enforcement(self) -> None: + record = self.make_passing_record() + denial = record["cases"][1] + denial["source_call_classification"] = "consulted-within-profile" + with self.assertRaisesRegex( + self.module.AcceptanceError, "source-call classification" + ): + self.validate(record) + + def test_passing_notary_claim_must_use_reviewed_disclosure_class(self) -> None: + record = self.make_passing_record() + claim = next( + item + for item in record["cases"] + if item["case_id"] == "notary-predicate-claim" + ) + claim["result_class"] = "notary-value-approved-disclosure" + with self.assertRaisesRegex( + self.module.AcceptanceError, "reviewed result class" + ): + self.validate(record) + + def test_schema_rejects_production_or_broad_interoperability_claims(self) -> None: + for field in ("production_authorized", "broad_interoperability"): + with self.subTest(field=field): + record = self.make_passing_record() + record["scope_claims"][field] = True + with self.assertRaisesRegex( + self.module.AcceptanceError, "must equal False" + ): + self.validate(record) + + def test_closed_schema_rejects_raw_or_location_fields(self) -> None: + for owner, field, value in ( + ( + lambda record: record, + "raw_log", + "forbidden", + ), + ( + lambda record: record["binding"]["source_profile"], + "source_url", + "forbidden", + ), + ( + lambda record: record["cases"][0], + "record_identifier", + "forbidden", + ), + ): + with self.subTest(field=field): + record = self.make_passing_record() + owner(record)[field] = value + with self.assertRaisesRegex( + self.module.AcceptanceError, "unknown fields" + ): + self.validate(record) + + def test_failed_run_is_valid_but_must_remain_non_closing(self) -> None: + record = self.make_passing_record() + case = record["cases"][10] + case["outcome"] = "failed" + case["result_class"] = "execution-failed" + case["source_call_classification"] = "unknown" + record["evidence_state"] = "failed_non_production" + record["overall_outcome"] = "failed" + record["scope_claims"]["platform_complete"] = False + record["scope_claims"]["country_ready"] = False + record["scope_claims"]["first_country_success"] = False + self.assertEqual("failed", self.validate(record)) + + record["scope_claims"]["country_ready"] = True + with self.assertRaisesRegex( + self.module.AcceptanceError, "must remain non-closing" + ): + self.validate(record) + + def test_failed_run_can_record_a_source_call_bound_breach(self) -> None: + record = self.make_passing_record() + case = record["cases"][1] + case["outcome"] = "failed" + case["result_class"] = "execution-failed" + case["source_call_classification"] = "source-call-bound-breached" + record["evidence_state"] = "failed_non_production" + record["overall_outcome"] = "failed" + for field in ("platform_complete", "country_ready", "first_country_success"): + record["scope_claims"][field] = False + self.assertEqual("failed", self.validate(record)) + + def test_failed_denial_rejects_safe_consultation_classification(self) -> None: + record = self.make_passing_record() + case = record["cases"][1] + case["outcome"] = "failed" + case["result_class"] = "execution-failed" + case["source_call_classification"] = "consulted-within-profile" + record["evidence_state"] = "failed_non_production" + record["overall_outcome"] = "failed" + for field in ("platform_complete", "country_ready", "first_country_success"): + record["scope_claims"][field] = False + with self.assertRaisesRegex( + self.module.AcceptanceError, "contradictory source-call classification" + ): + self.validate(record) + + def test_passing_record_requires_restricted_evidence_lifecycle(self) -> None: + mutations = ( + ( + ("evidence_handling", "restricted_storage", "approved"), + False, + "storage is not approved", + ), + ( + ("evidence_handling", "retention", "failed_run_retention_approved"), + False, + "retention are not approved", + ), + ( + ("evidence_handling", "deletion", "completion_state"), + "not_scheduled", + "deletion is not approved", + ), + ( + ("evidence_handling", "redaction", "canary_scan_passed"), + False, + "redaction evidence is incomplete", + ), + ) + for path, value, message in mutations: + with self.subTest(path=path): + record = self.make_passing_record() + target = record + for part in path[:-1]: + target = target[part] + target[path[-1]] = value + with self.assertRaisesRegex(self.module.AcceptanceError, message): + self.validate(record) + + def test_evidence_lifecycle_requires_accountable_owner_roles(self) -> None: + mutations = ( + ( + ("evidence_handling", "restricted_storage", "owner_role"), + "product-signing-authority", + "approved operator role", + ), + ( + ("evidence_handling", "retention", "owner_role"), + "approved-operator", + "privacy and legal owner role", + ), + ( + ("evidence_handling", "deletion", "owner_role"), + "approved-operator", + "privacy and legal owner role", + ), + ) + for path, value, message in mutations: + with self.subTest(path=path): + record = self.make_passing_record() + target = record + for part in path[:-1]: + target = target[part] + target[path[-1]] = value + with self.assertRaisesRegex(self.module.AcceptanceError, message): + self.validate(record) + + def test_publication_review_must_compare_restricted_evidence(self) -> None: + record = self.make_passing_record() + record["publication_review"][ + "public_restricted_comparison_confirmed" + ] = False + with self.assertRaisesRegex( + self.module.AcceptanceError, "publication review is not complete" + ): + self.validate(record) + + def test_teardown_summary_must_match_the_case(self) -> None: + record = self.make_passing_record() + record["teardown"]["restricted_evidence_sha256"] = "sha256:" + "b" * 64 + with self.assertRaisesRegex( + self.module.AcceptanceError, "teardown.restricted_evidence_sha256" + ): + self.validate(record) + + def test_failed_teardown_summary_must_match_the_failed_case(self) -> None: + record = self.make_passing_record() + teardown_case = record["cases"][-1] + teardown_case["outcome"] = "failed" + teardown_case["result_class"] = "execution-failed" + teardown_case["source_call_classification"] = "source-call-bound-breached" + record["teardown"]["source_call_classification"] = ( + "source-call-bound-breached" + ) + record["evidence_state"] = "failed_non_production" + record["overall_outcome"] = "failed" + for field in ("platform_complete", "country_ready", "first_country_success"): + record["scope_claims"][field] = False + with self.assertRaisesRegex( + self.module.AcceptanceError, "completed teardown contradicts" + ): + self.validate(record) + + record["teardown"]["outcome"] = "failed" + self.assertEqual("failed", self.validate(record)) + + def test_candidate_evidence_always_records_finally_path_teardown(self) -> None: + record = self.make_passing_record() + record["cases"][0]["outcome"] = "failed" + record["cases"][0]["result_class"] = "execution-failed" + record["cases"][0]["source_call_classification"] = "unknown" + record["evidence_state"] = "failed_non_production" + record["overall_outcome"] = "failed" + for field in ("platform_complete", "country_ready", "first_country_success"): + record["scope_claims"][field] = False + record["teardown"]["finally_path"] = False + with self.assertRaisesRegex( + self.module.AcceptanceError, "teardown attempt from a finally path" + ): + self.validate(record) + + def test_owner_roles_are_closed_and_case_specific(self) -> None: + record = self.make_passing_record() + record["cases"][18]["owner_roles"] = list(self.module.SOURCE_CASE_ROLES) + with self.assertRaisesRegex( + self.module.AcceptanceError, "exact ordered owner-role set" + ): + self.validate(record) + + def test_evidence_rejects_unselected_source_input_class(self) -> None: + record = self.make_passing_record() + record["binding"]["source_profile"]["approved_input_class"] = "not-selected" + binding_digest = self.module.canonical_binding_sha256(record["binding"]) + record["acceptance_binding_sha256"] = binding_digest + for case in record["cases"]: + case["acceptance_binding_sha256"] = binding_digest + with self.assertRaisesRegex( + self.module.AcceptanceError, "approved safe input class" + ): + self.validate(record) + + def test_cli_accepts_pass_and_labels_failed_record_non_closing(self) -> None: + with tempfile.TemporaryDirectory() as temporary: + directory = Path(temporary) + passed_path = directory / "passed.json" + passed_path.write_text( + json.dumps(self.make_passing_record()) + "\n", encoding="utf-8" + ) + passed = subprocess.run( + [sys.executable, str(SCRIPT), "validate", str(passed_path)], + text=True, + capture_output=True, + check=False, + ) + self.assertEqual(0, passed.returncode, passed.stderr) + self.assertIn("bounded non-production only", passed.stdout) + + failed_record = self.make_passing_record() + failed_record["cases"][0]["outcome"] = "failed" + failed_record["cases"][0]["result_class"] = "execution-failed" + failed_record["cases"][0]["source_call_classification"] = "unknown" + failed_record["evidence_state"] = "failed_non_production" + failed_record["overall_outcome"] = "failed" + for field in ( + "platform_complete", + "country_ready", + "first_country_success", + ): + failed_record["scope_claims"][field] = False + failed_path = directory / "failed.json" + failed_path.write_text( + json.dumps(failed_record) + "\n", encoding="utf-8" + ) + failed = subprocess.run( + [sys.executable, str(SCRIPT), "validate", str(failed_path)], + text=True, + capture_output=True, + check=False, + ) + self.assertEqual(0, failed.returncode, failed.stderr) + self.assertIn("valid non-closing evidence", failed.stdout) + + +if __name__ == "__main__": + main() diff --git a/release/scripts/test_validate_product_input_lifecycle.py b/release/scripts/test_validate_product_input_lifecycle.py new file mode 100644 index 000000000..788073af3 --- /dev/null +++ b/release/scripts/test_validate_product_input_lifecycle.py @@ -0,0 +1,1006 @@ +from __future__ import annotations + +import copy +import hashlib +import importlib.util +import json +import subprocess +import sys +import tempfile +import unittest +from pathlib import Path +from unittest import mock + + +ROOT = Path(__file__).resolve().parents[2] +SCRIPT = ROOT / "release" / "scripts" / "validate-product-input-lifecycle.py" +TEMPLATE = ( + ROOT + / "release" + / "exercises" + / "product-input-lifecycle" + / "product-input-lifecycle-v1.template.json" +) +SCHEMA = TEMPLATE.with_name("product-input-lifecycle-v1.schema.json") + + +def load_module(): + spec = importlib.util.spec_from_file_location( + "validate_product_input_lifecycle", + SCRIPT, + ) + if spec is None or spec.loader is None: + raise ImportError(f"could not load module spec from {SCRIPT}") + module = importlib.util.module_from_spec(spec) + sys.modules[spec.name] = module + spec.loader.exec_module(module) + return module + + +def digest(label: str) -> str: + return "sha256:" + hashlib.sha256(label.encode()).hexdigest() + + +class ProductInputLifecycleValidatorTest(unittest.TestCase): + def setUp(self) -> None: + self.module = load_module() + self.template = json.loads(TEMPLATE.read_text(encoding="utf-8")) + self.temporary = tempfile.TemporaryDirectory() + self.root = Path(self.temporary.name) + self.run_git("init", "-q") + self.run_git("config", "user.name", "Registry Stack Test") + self.run_git("config", "user.email", "test@registry.invalid") + (self.root / "source.txt").write_text("prepare\n", encoding="utf-8") + self.run_git("add", "source.txt") + self.run_git("commit", "-q", "-m", "prepare") + self.source_ref = self.git_output("rev-parse", "HEAD") + + manifest_path = ( + self.root / "release" / "manifests" / "registry-stack-beta-20.yaml" + ) + manifest_path.parent.mkdir(parents=True) + manifest_path.write_text( + "\n".join( + ( + "stack:", + " release: beta-20", + " version: 1.2.3", + " source_repo: registrystack/registry-stack", + f" source_ref: {self.source_ref}", + " source_tag: v1.2.3", + "artifacts:", + " registry-relay: 1.2.3", + " registry-notary: 1.2.3", + "", + ) + ), + encoding="utf-8", + ) + self.run_git("add", "release/manifests/registry-stack-beta-20.yaml") + self.run_git("commit", "-q", "-m", "candidate") + self.source_commit = self.git_output("rev-parse", "HEAD") + self.candidate_asset_root = self.root / "candidate-assets" + self.candidate_asset_directory = self.candidate_asset_root / "v1.2.3" + self.candidate_asset_directory.mkdir(parents=True) + ( + self.candidate_asset_directory / "registryctl-v1.2.3-image-lock.json" + ).write_text("{}\n", encoding="utf-8") + self.receipt_path = ( + self.candidate_asset_directory / "release-candidate-receipt.json" + ) + self.receipt_path.write_text("{}\n", encoding="utf-8") + self.receipt_sha256 = self.module.sha256_bytes(self.receipt_path.read_bytes()) + tag_binding = "\n".join( + ( + "registry-stack-release-candidate-v1", + "run_id: 123", + "run_attempt: 2", + f"receipt_sha256: {self.receipt_sha256.removeprefix('sha256:')}", + ) + ) + self.run_git("tag", "-a", "v1.2.3", "-m", tag_binding) + + def tearDown(self) -> None: + self.temporary.cleanup() + + def run_git(self, *args: str) -> None: + subprocess.run( + ("git", *args), + cwd=self.root, + check=True, + capture_output=True, + text=True, + ) + + def git_output(self, *args: str) -> str: + return subprocess.run( + ("git", *args), + cwd=self.root, + check=True, + capture_output=True, + text=True, + ).stdout.strip() + + def candidate(self) -> dict: + replacements = { + "": "product-input-lifecycle-0123456789abcdef", + "": "2026-07-26T12:00:02Z", + "": "beta-20", + "": "v1.2.3", + "": self.source_ref, + "": self.source_commit, + } + + def replace(value): + if isinstance(value, dict): + return {key: replace(item) for key, item in value.items()} + if isinstance(value, list): + return [replace(item) for item in value] + if not isinstance(value, str) or not value.startswith("<"): + return value + if value in replacements: + return replacements[value] + return digest(value) + + record = replace(copy.deepcopy(self.template)) + record["record_kind"] = "candidate_evidence" + record["attestations"] = { + "candidate_frozen": True, + "candidate_independently_verified": True, + } + manifest_path = Path("release/manifests/registry-stack-beta-20.yaml") + record["candidate"]["release_manifest_sha256"] = self.module.sha256_bytes( + self.module.git_bytes(self.root, self.source_commit, manifest_path) + ) + record["candidate"]["candidate_receipt_sha256"] = self.receipt_sha256 + record["candidate_binding_sha256"] = self.module.canonical_sha256( + record["candidate"] + ) + record["product_inputs"]["relay"]["trust_generation"] = 7 + record["product_inputs"]["notary"]["trust_generation"] = 8 + record["product_input_set_sha256"] = self.module.canonical_sha256( + record["product_inputs"] + ) + record["activation"]["stack_generation"] = 9 + + results = [ + result + for group in self.module.EVIDENCE_GROUPS + for result in record["evidence"][group] + ] + for index, result in enumerate(results): + result.update( + { + "outcome": "passed", + "subject_sha256": digest(f"subject-{result['check_id']}"), + "observed_at": "2026-07-26T12:00:00Z", + "evidence_label": f"evidence-{index + 1:016x}", + "evidence_sha256": digest(f"evidence-{result['check_id']}"), + } + ) + bindings = self.module.result_subject_bindings( + record["product_inputs"], + record["activation"], + candidate_binding_sha256=record["candidate_binding_sha256"], + product_input_set_sha256=record["product_input_set_sha256"], + ) + for result in results: + if result["check_id"] in bindings: + result["subject_sha256"] = bindings[result["check_id"]] + + for index, review in enumerate(record["reviews"]): + review.update( + { + "outcome": "passed", + "independence_attested": True, + "reviewer_label": f"reviewer-{index + 1:016x}", + "observed_at": "2026-07-26T12:00:01Z", + "evidence_label": f"evidence-{index + 101:016x}", + "evidence_sha256": digest(f"review-{review['review_class']}"), + } + ) + return record + + def authenticated_candidate(self, _manifest_path: Path, _image_lock_path: Path): + return { + "release_id": "beta-20", + "version": "1.2.3", + "source_repo": "registrystack/registry-stack", + "source_ref": self.source_ref, + "source_tag": "v1.2.3", + "tag_target": self.source_commit, + "manifest_sha256": self.module.sha256_bytes(_manifest_path.read_bytes()), + "image_lock_sha256": digest(""), + "release_capsule_sha256": digest(""), + "relay_image": ( + "ghcr.io/registrystack/registry-relay@" + digest("") + ), + "notary_image": ( + "ghcr.io/registrystack/registry-notary@" + + digest("") + ), + "topology": "release-owned", + "solmara_source_ref": None, + } + + def validated_receipt(self, document, **kwargs): + if document != {}: + raise self.module.CandidateReceiptError("unexpected receipt") + expected = { + "expected_source_sha": self.source_ref, + "expected_version": "1.2.3", + "expected_release_id": "beta-20", + } + for field, value in expected.items(): + if kwargs.get(field) != value: + raise self.module.CandidateReceiptError("receipt binding mismatch") + return { + "workflow": {"run_id": 123, "run_attempt": 2}, + "release": { + "version": "1.2.3", + "release_id": "beta-20", + "source_sha": self.source_ref, + }, + "validity": { + "created_at": "2026-07-26T11:00:00Z", + "expires_at": "2026-07-26T13:00:00Z", + }, + "images": [ + { + "name": "registry-relay", + "index_digest": digest(""), + }, + { + "name": "registry-notary", + "index_digest": digest(""), + }, + ], + } + + def validate(self, record: dict, **kwargs) -> None: + kwargs.setdefault("candidate_asset_root", self.candidate_asset_root) + kwargs.setdefault("candidate_loader", self.authenticated_candidate) + kwargs.setdefault("receipt_validator", self.validated_receipt) + self.module.validate_record(record, root=self.root, **kwargs) + + def discover(self, directory: Path): + return self.module.discover_records( + directory, + root=self.root, + candidate_asset_root=self.candidate_asset_root, + candidate_loader=self.authenticated_candidate, + receipt_validator=self.validated_receipt, + ) + + def prepare_discovery(self, directory: Path) -> Path: + records = directory / self.module.LIFECYCLE_DIRECTORY + records.mkdir(parents=True) + (records / self.module.SCHEMA_FILENAME).write_bytes(SCHEMA.read_bytes()) + (records / self.module.TEMPLATE_FILENAME).write_bytes(TEMPLATE.read_bytes()) + return records + + def result(self, record: dict, check_id: str) -> dict: + for group in self.module.EVIDENCE_GROUPS: + for result in record["evidence"][group]: + if result["check_id"] == check_id: + return result + raise AssertionError(f"missing result {check_id}") + + def refresh_subject_bindings( + self, + record: dict, + *, + exclude: set[str] | None = None, + ) -> None: + bindings = self.module.result_subject_bindings( + record["product_inputs"], + record["activation"], + candidate_binding_sha256=record["candidate_binding_sha256"], + product_input_set_sha256=record["product_input_set_sha256"], + ) + for check_id, subject in bindings.items(): + if exclude is None or check_id not in exclude: + self.result(record, check_id)["subject_sha256"] = subject + + def test_template_is_valid_preparation_but_never_candidate_evidence(self) -> None: + self.validate(self.template, allow_template=True) + with self.assertRaisesRegex( + self.module.LifecycleError, "not candidate evidence" + ): + self.validate(self.template, allow_template=False) + with self.assertRaisesRegex( + self.module.LifecycleError, "never passing evidence" + ): + self.validate( + self.template, + allow_template=True, + require_all_passed=True, + ) + + def test_schema_and_runtime_share_the_exact_versioned_contract(self) -> None: + schema = self.module.lifecycle_schema() + self.assertEqual( + self.module.SCHEMA_VERSION, + schema["properties"]["schema_version"]["const"], + ) + self.assertEqual( + { + group: list(checks) + for group, checks in self.module.EVIDENCE_GROUPS.items() + }, + schema["x-registry-evidence-groups"], + ) + self.assertEqual( + list(self.module.REVIEW_CLASSES), + schema["x-registry-review-classes"], + ) + self.assertEqual( + set(self.module.ALL_CHECKS), + set(schema["$defs"]["checkId"]["enum"]), + ) + candidate = self.candidate() + self.assertEqual( + set(self.module.ALL_CHECKS), + set( + self.module.result_subject_bindings( + candidate["product_inputs"], + candidate["activation"], + candidate_binding_sha256=candidate["candidate_binding_sha256"], + product_input_set_sha256=candidate["product_input_set_sha256"], + ) + ), + ) + self.assertEqual( + set(schema["required"]), + set(schema["properties"]), + ) + self.assertFalse(schema["additionalProperties"]) + + def assert_closed_objects(value, path="$"): + if isinstance(value, dict): + if value.get("type") == "object" and "required" in value: + with self.subTest(schema_path=path): + self.assertIs( + False, + value.get("additionalProperties"), + ) + self.assertEqual( + set(value["required"]), + set(value["properties"]), + ) + for key, item in value.items(): + if key != "if": + assert_closed_objects(item, f"{path}.{key}") + elif isinstance(value, list): + for index, item in enumerate(value): + assert_closed_objects(item, f"{path}[{index}]") + + assert_closed_objects(schema) + + def test_schema_validates_both_template_and_candidate_shapes(self) -> None: + self.module.validate_schema_document(self.template) + self.module.validate_schema_document(self.candidate()) + + def test_schema_rejects_nested_unknowns_and_record_kind_crossovers( + self, + ) -> None: + record = self.candidate() + record["product_inputs"]["relay"]["unknown"] = digest("unknown") + with self.assertRaisesRegex( + self.module.LifecycleError, + "closed product-input lifecycle schema", + ): + self.module.validate_schema_document(record) + + record = self.candidate() + record["candidate"]["candidate_receipt_sha256"] = "" + with self.assertRaisesRegex( + self.module.LifecycleError, + "closed product-input lifecycle schema", + ): + self.module.validate_schema_document(record) + + template = copy.deepcopy(self.template) + template["evidence"]["authoring_and_build"][0]["outcome"] = "passed" + with self.assertRaisesRegex( + self.module.LifecycleError, + "closed product-input lifecycle schema", + ): + self.module.validate_schema_document(template) + + def test_schema_condition_does_not_mask_malformed_rules(self) -> None: + malformed = { + "if": {"allOf": ["not-an-object-rule"]}, + "then": {"const": "then"}, + "else": {"const": "ok"}, + } + with self.assertRaisesRegex( + self.module.SchemaValidationError, + "invalid allOf rule", + ): + self.module.validate_against_schema( + "ok", + malformed, + {}, + "probe", + ) + + def test_complete_candidate_record_passes_the_closed_contract(self) -> None: + self.validate( + self.candidate(), + allow_template=False, + require_all_passed=True, + ) + + def test_candidate_evidence_requires_authenticated_release_assets(self) -> None: + with self.assertRaisesRegex( + self.module.LifecycleError, + "--candidate-asset-root", + ): + self.validate( + self.candidate(), + allow_template=False, + candidate_asset_root=None, + ) + + def test_authenticated_asset_coordinates_must_match_the_record(self) -> None: + def mismatched_loader(manifest_path, image_lock_path): + authenticated = self.authenticated_candidate( + manifest_path, + image_lock_path, + ) + authenticated["relay_image"] = ( + "ghcr.io/registrystack/registry-relay@" + + digest("different-relay-image") + ) + return authenticated + + with self.assertRaisesRegex( + self.module.LifecycleError, + "authenticated release assets do not match", + ): + self.validate( + self.candidate(), + allow_template=False, + candidate_loader=mismatched_loader, + ) + + def test_authenticated_current_manifest_digest_must_match_the_loaded_bytes( + self, + ) -> None: + def mismatched_loader(manifest_path, image_lock_path): + authenticated = self.authenticated_candidate( + manifest_path, + image_lock_path, + ) + authenticated["manifest_sha256"] = digest("different-current-manifest") + return authenticated + + with self.assertRaisesRegex( + self.module.LifecycleError, + "authenticated release assets do not match", + ): + self.validate( + self.candidate(), + allow_template=False, + candidate_loader=mismatched_loader, + ) + + def test_candidate_receipt_bytes_and_annotated_tag_are_exactly_bound( + self, + ) -> None: + record = self.candidate() + self.receipt_path.write_text('{"changed":true}\n', encoding="utf-8") + with self.assertRaisesRegex( + self.module.LifecycleError, + "retained receipt bytes", + ): + self.validate(record, allow_template=False) + + self.receipt_path.write_text("{}\n", encoding="utf-8") + self.run_git("tag", "-d", "v1.2.3") + with self.assertRaisesRegex( + self.module.LifecycleError, + "annotated tag binding is unavailable", + ): + self.validate(record, allow_template=False) + + def test_failed_result_is_honest_closed_evidence_but_not_passing_evidence( + self, + ) -> None: + record = self.candidate() + self.result(record, "rollback_exercised")["outcome"] = "failed" + self.validate(record, allow_template=False) + with self.assertRaisesRegex( + self.module.LifecycleError, + "every lifecycle check", + ): + self.validate( + record, + allow_template=False, + require_all_passed=True, + ) + + def test_incomplete_candidate_record_is_rejected(self) -> None: + record = self.candidate() + record["evidence"]["advanced_operations"].pop() + with self.assertRaisesRegex( + self.module.LifecycleError, + "closed product-input lifecycle schema", + ): + self.validate(record, allow_template=False) + + def test_unknown_fields_are_rejected_at_every_closed_boundary(self) -> None: + mutations = ( + lambda record: record.update({"country": "hidden-country"}), + lambda record: record["candidate"].update({"manifest_path": "undeclared"}), + lambda record: record["product_inputs"]["relay"].update( + {"private_key": "redacted"} + ), + lambda record: self.result( + record, + "authored_revision_closed", + ).update({"raw_output": "redacted"}), + lambda record: record["reviews"][0].update({"review_notes": "redacted"}), + ) + for mutate in mutations: + with self.subTest(mutation=mutate): + record = self.candidate() + mutate(record) + with self.assertRaisesRegex( + self.module.LifecycleError, + "unknown |closed product-input lifecycle schema", + ): + self.validate(record, allow_template=False) + + def test_placeholders_cannot_enter_candidate_evidence(self) -> None: + mutations = ( + ( + lambda record: record["candidate"].update( + {"candidate_receipt_sha256": ""} + ), + "closed product-input lifecycle schema", + ), + ( + lambda record: self.result( + record, + "authored_revision_closed", + ).update({"evidence_label": ""}), + "closed product-input lifecycle schema", + ), + ) + for mutate, message in mutations: + with self.subTest(message=message): + record = self.candidate() + mutate(record) + with self.assertRaisesRegex( + self.module.LifecycleError, + message, + ): + self.validate(record, allow_template=False) + + def test_secret_and_location_sentinels_are_rejected_before_retention(self) -> None: + sentinels = ( + "Bearer abcdef", + "password=correct-horse", + "token=opaque", + "-----BEGIN PRIVATE KEY-----", + "/Users/operator/evidence.json", + "https://country.example/evidence", + "AKIAABCDEFGHIJKLMNOP", + ("eyJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJzdWJqZWN0In0.abcdefghijklmnop"), + ) + for sentinel in sentinels: + with self.subTest(sentinel=sentinel): + record = self.candidate() + self.result(record, "authored_revision_closed")["evidence_label"] = ( + sentinel + ) + with self.assertRaisesRegex( + self.module.LifecycleError, + "forbidden sensitive or location data", + ): + self.validate(record, allow_template=False) + + def test_generation_boundaries_are_positive_and_not_boolean(self) -> None: + locations = ( + lambda record: record["product_inputs"]["relay"].update( + {"trust_generation": 0} + ), + lambda record: record["product_inputs"]["notary"].update( + {"trust_generation": True} + ), + lambda record: record["activation"].update({"stack_generation": 0}), + ) + for mutate in locations: + with self.subTest(mutation=mutate): + record = self.candidate() + mutate(record) + with self.assertRaisesRegex( + self.module.LifecycleError, + "closed product-input lifecycle schema", + ): + self.validate(record, allow_template=False) + + def test_product_input_set_digest_closes_product_input_mutation(self) -> None: + record = self.candidate() + record["product_inputs"]["relay"]["trust_generation"] += 1 + with self.assertRaisesRegex( + self.module.LifecycleError, + "product_input_set_sha256 does not match", + ): + self.validate(record, allow_template=False) + + def test_trust_generation_remains_bound_after_product_set_is_rehashed( + self, + ) -> None: + record = self.candidate() + record["product_inputs"]["relay"]["trust_generation"] += 1 + record["product_input_set_sha256"] = self.module.canonical_sha256( + record["product_inputs"] + ) + with self.assertRaisesRegex( + self.module.LifecycleError, + "does not match its lifecycle object", + ): + self.validate( + record, + allow_template=False, + require_all_passed=True, + ) + + def test_stack_generation_is_bound_to_activation_evidence(self) -> None: + record = self.candidate() + record["activation"]["stack_generation"] += 1 + with self.assertRaisesRegex( + self.module.LifecycleError, + "does not match its lifecycle object", + ): + self.validate( + record, + allow_template=False, + require_all_passed=True, + ) + + def test_authoring_and_advanced_subjects_reject_cross_context_mixing( + self, + ) -> None: + check_ids = ( + "authored_revision_closed", + "fixture_coverage_closed", + "preflight_closed", + "capabilities_closed", + "promotion_closed", + "upgrade_exercised", + "recovery_exercised", + "rollback_exercised", + ) + for check_id in check_ids: + with self.subTest(check_id=check_id): + record = self.candidate() + record["candidate_binding_sha256"] = self.module.canonical_sha256( + record["candidate"] + ) + record["product_input_set_sha256"] = self.module.canonical_sha256( + record["product_inputs"] + ) + self.result(record, check_id)["subject_sha256"] = digest( + f"mixed-context-{check_id}" + ) + with self.assertRaisesRegex( + self.module.LifecycleError, + "does not match its lifecycle object", + ): + self.validate(record, allow_template=False) + + def test_bundle_verification_binds_trust_generation_set_and_lineage( + self, + ) -> None: + fields = ( + "trust_generation", + "trust_set_sha256", + "anti_rollback_lineage_sha256", + ) + for product in ("relay", "notary"): + for field in fields: + with self.subTest(product=product, field=field): + record = self.candidate() + product_input = record["product_inputs"][product] + if field == "trust_generation": + product_input[field] += 1 + else: + product_input[field] = digest(f"different-{product}-{field}") + record["product_input_set_sha256"] = self.module.canonical_sha256( + record["product_inputs"] + ) + target = f"{product}_bundle_verified" + bindings = self.module.result_subject_bindings( + record["product_inputs"], + record["activation"], + candidate_binding_sha256=record["candidate_binding_sha256"], + product_input_set_sha256=record["product_input_set_sha256"], + ) + for check_id, subject in bindings.items(): + if check_id != target: + self.result(record, check_id)["subject_sha256"] = subject + with self.assertRaisesRegex( + self.module.LifecycleError, + "does not match its lifecycle object", + ): + self.validate(record, allow_template=False) + + def test_relay_and_notary_inputs_bundles_trust_and_lineage_are_separate( + self, + ) -> None: + paths = ( + ("unsigned_input_sha256", "unsigned_input_sha256"), + ("signed_bundle_sha256", "signed_bundle_sha256"), + ("trust_set_sha256", "trust_set_sha256"), + ("anti_rollback_lineage_sha256", "anti_rollback_lineage_sha256"), + ) + for relay_field, notary_field in paths: + with self.subTest(field=relay_field): + record = self.candidate() + record["product_inputs"]["notary"][notary_field] = record[ + "product_inputs" + ]["relay"][relay_field] + record["product_input_set_sha256"] = self.module.canonical_sha256( + record["product_inputs"] + ) + with self.assertRaisesRegex( + self.module.LifecycleError, + "must remain separate", + ): + self.validate(record, allow_template=False) + + def test_candidate_coordinate_is_bound_once_by_its_canonical_digest(self) -> None: + record = self.candidate() + record["candidate"]["candidate_receipt_sha256"] = digest( + "different-candidate-receipt" + ) + with self.assertRaisesRegex( + self.module.LifecycleError, + "one exact candidate coordinate", + ): + self.validate(record, allow_template=False) + + def test_candidate_manifest_must_match_the_exact_git_coordinate(self) -> None: + record = self.candidate() + record["candidate"]["release_manifest_sha256"] = digest("wrong-manifest") + record["candidate_binding_sha256"] = self.module.canonical_sha256( + record["candidate"] + ) + with self.assertRaisesRegex( + self.module.LifecycleError, + "does not match the exact candidate", + ): + self.validate(record, allow_template=False) + + def test_passed_contract_mismatch_requires_exactly_zero_source_calls(self) -> None: + record = self.candidate() + record["activation"]["consultation_contract_mismatch"][ + "observed_source_calls" + ] = 1 + self.refresh_subject_bindings(record) + with self.assertRaisesRegex( + self.module.LifecycleError, + "exactly zero source calls", + ): + self.validate(record, allow_template=False) + + def test_failed_zero_source_call_check_can_record_a_nonzero_observation( + self, + ) -> None: + record = self.candidate() + record["activation"]["consultation_contract_mismatch"][ + "observed_source_calls" + ] = 1 + self.refresh_subject_bindings(record) + self.result( + record, + "consultation_contract_mismatch_zero_source_calls", + )["outcome"] = "failed" + self.validate(record, allow_template=False) + with self.assertRaisesRegex( + self.module.LifecycleError, + "every lifecycle check", + ): + self.validate( + record, + allow_template=False, + require_all_passed=True, + ) + + def test_activation_subjects_are_bound_to_the_exact_separate_bundles(self) -> None: + record = self.candidate() + self.result(record, "relay_staged_activation")["subject_sha256"] = record[ + "product_inputs" + ]["notary"]["signed_bundle_sha256"] + with self.assertRaisesRegex( + self.module.LifecycleError, + "does not match its lifecycle object", + ): + self.validate(record, allow_template=False) + + def test_reviews_are_independent_distinct_and_follow_the_lifecycle(self) -> None: + record = self.candidate() + record["reviews"][1]["reviewer_label"] = record["reviews"][0]["reviewer_label"] + with self.assertRaisesRegex( + self.module.LifecycleError, + "distinct independent reviewer labels", + ): + self.validate(record, allow_template=False) + + record = self.candidate() + record["reviews"][0]["observed_at"] = "2026-07-26T11:59:59Z" + with self.assertRaisesRegex( + self.module.LifecycleError, + "must follow lifecycle evidence", + ): + self.validate(record, allow_template=False) + + def test_lifecycle_timestamps_cannot_run_backwards(self) -> None: + record = self.candidate() + self.result(record, "upgrade_exercised")["observed_at"] = "2026-07-26T11:59:59Z" + with self.assertRaisesRegex( + self.module.LifecycleError, + "must follow lifecycle order", + ): + self.validate(record, allow_template=False) + + def test_recorded_at_is_a_real_utc_time_after_evidence_and_reviews( + self, + ) -> None: + record = self.candidate() + record["recorded_at"] = "2026-99-99T12:00:02Z" + with self.assertRaisesRegex( + self.module.LifecycleError, + "not a valid UTC timestamp", + ): + self.validate(record, allow_template=False) + + record = self.candidate() + record["recorded_at"] = "2026-07-26T12:00:00Z" + with self.assertRaisesRegex( + self.module.LifecycleError, + "must not precede", + ): + self.validate(record, allow_template=False) + + def test_duplicate_json_fields_are_rejected_before_schema_validation( + self, + ) -> None: + raw = TEMPLATE.read_text(encoding="utf-8").replace( + '"record_kind": "template"', + '"record_kind": "candidate_evidence", "record_kind": "template"', + 1, + ) + duplicate = self.root / "duplicate.json" + duplicate.write_text(raw, encoding="utf-8") + result = subprocess.run( + ("python3", str(SCRIPT), "--template", str(duplicate)), + cwd=ROOT, + capture_output=True, + text=True, + check=False, + ) + self.assertEqual(1, result.returncode) + self.assertIn("must not contain duplicate fields", result.stderr) + + def test_evidence_limitations_cannot_be_upgraded_by_a_local_record(self) -> None: + record = self.candidate() + record["evidence_limitations"]["live_country_interoperability_proven"] = True + with self.assertRaisesRegex( + self.module.LifecycleError, + "closed product-input lifecycle schema", + ): + self.validate(record, allow_template=False) + + def test_discovery_counts_template_as_non_evidence(self) -> None: + discovery_root = self.root / "discovery" + self.prepare_discovery(discovery_root) + self.assertEqual( + (1, 0), + self.discover(discovery_root), + ) + + def test_discovery_requires_real_records_to_be_complete_and_passing(self) -> None: + discovery_root = self.root / "discovery" + records = self.prepare_discovery(discovery_root) + candidate_path = records / "product-input-lifecycle-beta-20.json" + candidate = self.candidate() + candidate_path.write_text(json.dumps(candidate), encoding="utf-8") + self.assertEqual( + (1, 1), + self.discover(discovery_root), + ) + + candidate["evidence"]["advanced_operations"].pop() + candidate_path.write_text(json.dumps(candidate), encoding="utf-8") + with self.assertRaisesRegex( + self.module.LifecycleError, + "closed product-input lifecycle schema", + ): + self.discover(discovery_root) + + candidate = self.candidate() + self.result(candidate, "recovery_exercised")["outcome"] = "failed" + candidate_path.write_text(json.dumps(candidate), encoding="utf-8") + with self.assertRaisesRegex( + self.module.LifecycleError, + "every lifecycle check", + ): + self.discover(discovery_root) + + def test_discovery_rejects_unrecognized_json_and_symlink_records(self) -> None: + unrecognized_root = self.root / "discovery-unrecognized" + records = self.prepare_discovery(unrecognized_root) + (records / "unexpected.json").write_text( + json.dumps(self.template), + encoding="utf-8", + ) + with self.assertRaisesRegex( + self.module.LifecycleError, + "unrecognized JSON filename", + ): + self.discover(unrecognized_root) + + symlink_root = self.root / "discovery-symlink" + records = self.prepare_discovery(symlink_root) + (records / "product-input-lifecycle-beta-20.json").symlink_to(TEMPLATE) + with self.assertRaisesRegex( + self.module.LifecycleError, + "bounded regular non-symlink", + ): + self.discover(symlink_root) + + def test_record_loader_uses_one_no_follow_file_descriptor_snapshot(self) -> None: + record = self.root / "record.json" + record.write_text(json.dumps(self.template), encoding="utf-8") + with mock.patch.object( + self.module, + "read_regular_file_no_follow", + side_effect=self.module.CandidateAssetError("concurrent replacement"), + ) as safe_read: + with self.assertRaisesRegex( + self.module.LifecycleError, + "bounded regular non-symlink JSON file", + ): + self.module.load_closed_json_file(record) + safe_read.assert_called_once_with( + record, + max_bytes=self.module.MAX_RECORD_BYTES, + ) + + def test_cli_validates_the_committed_template_and_discovery_directory(self) -> None: + single = subprocess.run( + ("python3", str(SCRIPT), "--template", str(TEMPLATE)), + cwd=ROOT, + capture_output=True, + text=True, + check=False, + ) + self.assertEqual(0, single.returncode, single.stderr) + self.assertIn("template preparation validation passed", single.stdout) + + discovered = subprocess.run( + ( + "python3", + str(SCRIPT), + "--discover", + str(ROOT / "release" / "exercises"), + ), + cwd=ROOT, + capture_output=True, + text=True, + check=False, + ) + self.assertEqual(0, discovered.returncode, discovered.stderr) + self.assertIn( + "1 non-evidence template(s), 0 candidate evidence record(s)", + discovered.stdout, + ) + + +if __name__ == "__main__": + unittest.main() diff --git a/release/scripts/test_validate_upgrade_exercise.py b/release/scripts/test_validate_upgrade_exercise.py index fdd76418d..6fea431c3 100644 --- a/release/scripts/test_validate_upgrade_exercise.py +++ b/release/scripts/test_validate_upgrade_exercise.py @@ -84,6 +84,27 @@ def authenticated_candidate(self, _manifest_path, lock_path): return self.source_candidate.copy() return self.target_candidate.copy() + def rebind_record(self, record): + items = { + item["item"]: item["artifact_sha256"] + for item in record["recovery_set"] + } + recovery = record["materialization_recovery"] + recovery["source_inputs_sha256"] = items["relay_source_inputs"] + recovery["ingest_cache_sha256"] = items["relay_ingest_cache"] + recovery["relay_database_sha256"] = items["relay_database"] + recovery["target_release_sha256"] = self.module.canonical_sha256( + record["target_release"] + ) + recovery["relay_config_schema_sha256"] = record["config_schemas"][ + "registry-relay" + ]["sha256"] + recovery["binding_sha256"] = ( + self.module.materialization_recovery_binding_sha256(recovery) + ) + record["record_binding_sha256"] = self.module.record_binding_sha256(record) + return record + def candidate(self): def replace(value): if isinstance(value, dict): @@ -124,6 +145,9 @@ def replace(value): record["candidate_independently_verified"] = True for result in record["results"]: result["outcome"] = "passed" + result["observed_at"] = "2026-07-19T12:00:00Z" + result["evidence_label"] = f"{result['check_id']}-evidence" + result["evidence_sha256"] = "sha256:" + "b" * 64 record["source_release"]["source_commit"] = SOURCE_COMMIT record["target_release"]["source_commit"] = TARGET_COMMIT manifest = self.module.git_bytes(ROOT, TARGET_COMMIT, TARGET_MANIFEST) @@ -143,10 +167,19 @@ def replace(value): ROOT, TARGET_COMMIT ) record["candidate_artifact_set"]["sha256"] = self.module.canonical_sha256(artifacts) - return record + return self.rebind_record(record) def test_template_is_valid_preparation_but_not_candidate_evidence(self) -> None: self.validate_record(self.template, allow_template=True) + self.assertFalse(self.template["candidate_frozen"]) + self.assertFalse(self.template["candidate_independently_verified"]) + self.assertTrue(all( + result["outcome"] == "not_run" + and result["observed_at"] is None + and result["evidence_label"] is None + and result["evidence_sha256"] is None + for result in self.template["results"] + )) with self.assertRaisesRegex(self.module.ExerciseError, "not candidate evidence"): self.validate_record(self.template, allow_template=False) @@ -184,6 +217,7 @@ def test_artifact_coordinate_digest_prefixes_are_equivalent(self) -> None: record["candidate_artifact_set"]["sha256"] = self.module.canonical_sha256( artifacts ) + self.rebind_record(record) self.validate_record( record, allow_template=False, require_all_passed=True @@ -194,6 +228,7 @@ def test_artifact_set_digest_prefixes_are_equivalent(self) -> None: record["candidate_artifact_set"]["sha256"] = record[ "candidate_artifact_set" ]["sha256"].removeprefix("sha256:") + self.rebind_record(record) self.validate_record( record, allow_template=False, require_all_passed=True @@ -211,6 +246,7 @@ def test_release_input_digest_prefixes_are_equivalent(self) -> None: record["candidate_artifact_set"]["sha256"] = self.module.canonical_sha256( artifacts ) + self.rebind_record(record) self.validate_record( record, allow_template=False, require_all_passed=True @@ -230,6 +266,7 @@ def test_promotion_digest_prefixes_are_equivalent_for_all_pt_sets(self) -> None: record["candidate_artifact_set"]["sha256"] = self.module.canonical_sha256( artifacts ) + self.rebind_record(record) self.validate_record( record, allow_template=False, require_all_passed=True @@ -382,6 +419,7 @@ def test_failed_and_not_run_results_are_recordable_but_fail_promotion(self) -> N record["results"][1].update( {"outcome": "not_run", "observed_at": None, "evidence_label": None, "evidence_sha256": None} ) + self.rebind_record(record) self.validate_record(record, allow_template=False) with self.assertRaisesRegex(self.module.ExerciseError, "--require-pass"): self.validate_record( @@ -403,6 +441,7 @@ def test_discovery_requires_candidate_passes_and_preserves_templates(self) -> No candidate = self.candidate() candidate["results"][0]["outcome"] = "failed" + self.rebind_record(candidate) (records / "candidate.json").write_text( json.dumps(candidate), encoding="utf-8" ) @@ -432,6 +471,7 @@ def test_promotion_rejects_product_oci_layout_drift(self) -> None: record["candidate_artifact_set"]["sha256"] = ( self.module.canonical_sha256(artifacts) ) + self.rebind_record(record) with self.assertRaisesRegex( self.module.ExerciseError, f"--require-pass rejects P/T {product} OCI layout drift", @@ -446,6 +486,113 @@ def test_complete_release_specific_recovery_set_is_required(self) -> None: with self.assertRaisesRegex(self.module.ExerciseError, "complete release-specific"): self.validate_record(record, allow_template=False) + def test_materialization_recovery_binds_one_closed_coordinated_set(self) -> None: + record = self.candidate() + recovery = record["materialization_recovery"] + items = { + item["item"]: item["artifact_sha256"] + for item in record["recovery_set"] + } + + self.assertEqual( + items["relay_source_inputs"], + recovery["source_inputs_sha256"], + ) + self.assertEqual( + items["relay_ingest_cache"], + recovery["ingest_cache_sha256"], + ) + self.assertEqual( + items["relay_database"], + recovery["relay_database_sha256"], + ) + self.assertEqual( + self.module.canonical_sha256(record["target_release"]), + recovery["target_release_sha256"], + ) + self.assertEqual( + record["config_schemas"]["registry-relay"]["sha256"], + recovery["relay_config_schema_sha256"], + ) + + def test_materialization_recovery_rejects_unbound_artifacts_and_coordinates( + self, + ) -> None: + mutations = ( + ( + "source_inputs_sha256", + "does not match recovery_set", + ), + ( + "ingest_cache_sha256", + "does not match recovery_set", + ), + ( + "relay_database_sha256", + "does not match recovery_set", + ), + ( + "target_release_sha256", + "does not match the exact target release", + ), + ( + "relay_config_schema_sha256", + "does not match the exact target schema", + ), + ) + for field, message in mutations: + with self.subTest(field=field): + record = self.candidate() + record["materialization_recovery"][field] = "sha256:" + "0" * 64 + with self.assertRaisesRegex(self.module.ExerciseError, message): + self.validate_record(record, allow_template=False) + + def test_materialization_recovery_binding_rejects_commitment_substitution( + self, + ) -> None: + record = self.candidate() + record["materialization_recovery"][ + "active_publication_tuple_sha256" + ] = "sha256:" + "0" * 64 + with self.assertRaisesRegex( + self.module.ExerciseError, + "does not bind the closed recovery coordinate", + ): + self.validate_record(record, allow_template=False) + + def test_record_binding_rejects_result_or_recovery_substitution(self) -> None: + for mutate in ( + lambda record: record["results"][0].update({"outcome": "failed"}), + lambda record: record["materialization_recovery"].update( + {"recovery_metadata_sha256": "sha256:" + "0" * 64} + ), + ): + with self.subTest(mutation=mutate): + record = self.candidate() + mutate(record) + if ( + record["materialization_recovery"]["recovery_metadata_sha256"] + == "sha256:" + "0" * 64 + ): + record["materialization_recovery"]["binding_sha256"] = ( + self.module.materialization_recovery_binding_sha256( + record["materialization_recovery"] + ) + ) + with self.assertRaisesRegex( + self.module.ExerciseError, + "record_binding_sha256 does not bind", + ): + self.validate_record(record, allow_template=False) + + def test_materialization_recovery_rejects_raw_location_fields(self) -> None: + record = self.candidate() + record["materialization_recovery"]["source_path"] = ( + "/private/country/source.csv" + ) + with self.assertRaisesRegex(self.module.ExerciseError, "unknown source_path"): + self.validate_record(record, allow_template=False) + def test_candidate_uses_historical_schema_not_ambient_checkout(self) -> None: record = self.candidate() notary_schema = self.module.CONFIG_SCHEMAS["registry-notary"] @@ -492,6 +639,7 @@ def test_manifest_hash_ref_and_artifact_set_drift_are_rejected(self) -> None: record["candidate_artifact_set"]["sha256"] = self.module.canonical_sha256( record["candidate_artifact_set"]["artifacts"] ) + self.rebind_record(record) with self.assertRaisesRegex(self.module.ExerciseError, "identity does not match"): self.validate_record(record, allow_template=False) record = self.candidate() @@ -516,6 +664,7 @@ def test_candidate_image_lock_digest_matches_authenticated_asset_bytes( record["candidate_artifact_set"]["sha256"] = ( self.module.canonical_sha256(artifacts) ) + self.rebind_record(record) def authenticated_candidate(_manifest_path, lock_path): metadata = self.authenticated_candidate( _manifest_path, lock_path @@ -628,6 +777,7 @@ def test_upgrade_consumer_enforces_candidate_to_released_closeout( record["candidate_artifact_set"]["sha256"] = ( self.module.canonical_sha256(artifacts) ) + self.rebind_record(record) @contextlib.contextmanager def snapshot(_image_lock_path): @@ -722,6 +872,7 @@ def test_real_v0122_release_image_lock_authenticates(self) -> None: record["candidate_artifact_set"]["sha256"] = ( self.module.canonical_sha256(artifacts) ) + self.rebind_record(record) with mock.patch.object( self.module, "load_candidate", self.real_load_candidate diff --git a/release/scripts/validate-first-country-acceptance.py b/release/scripts/validate-first-country-acceptance.py new file mode 100644 index 000000000..252157d1a --- /dev/null +++ b/release/scripts/validate-first-country-acceptance.py @@ -0,0 +1,945 @@ +#!/usr/bin/env python3 +# SPDX-License-Identifier: Apache-2.0 +"""Validate redaction-safe first-country acceptance records. + +The validator checks only the closed public record. Restricted evidence, +authority, and the facts committed by evidence digests remain the +responsibility of the named owner roles and publication reviewer. +""" + +from __future__ import annotations + +import argparse +import hashlib +import json +import stat +import sys +from pathlib import Path +from typing import Any + +from closed_json_schema import ( + SchemaValidationError, + validate_against_schema as validate_closed_schema, +) + + +ROOT = Path(__file__).resolve().parents[2] +PACKET_DIR = ROOT / "release" / "conformance" / "first-country" +SCHEMA_PATH = PACKET_DIR / "acceptance-record.schema.json" +TEMPLATE_PATH = PACKET_DIR / "acceptance-record.template.json" +SCHEMA_VERSION = "registry.release.first_country_acceptance.v1" +ZERO_SHA256 = "sha256:" + "0" * 64 +ZERO_COMMIT = "0" * 40 +MAX_RECORD_BYTES = 512 * 1024 + +LIMITATIONS = ( + "bounded-non-production-only", + "exact-candidate-only", + "exact-project-environment-source-profile-only", + "no-production-authorization", + "no-broad-interoperability", + "not-upstream-product-certification", + "not-general-country-system-conformance", + "offline-fixtures-not-live-evidence", + "signing-not-governance-approval", + "digests-not-independent-evidence", +) + +IMPLEMENTER_ROLES = ( + "independent-country-implementer", + "country-technical-owner", + "approved-operator", + "registry-stack-evidence-reviewer", +) +SOURCE_CASE_ROLES = ( + "approved-operator", + "source-system-owner", + "country-technical-owner", + "registry-stack-evidence-reviewer", +) +PROMOTION_ROLES = ( + "approved-operator", + "product-signing-authority", + "country-technical-owner", + "registry-stack-evidence-reviewer", +) +RECOVERY_ROLES = ( + "approved-operator", + "recovery-owner", + "country-technical-owner", + "registry-stack-evidence-reviewer", +) +TEARDOWN_ROLES = ( + "approved-operator", + "recovery-owner", + "source-system-owner", + "country-technical-owner", + "registry-stack-evidence-reviewer", +) + +# The ordered set deliberately separates combined requirements from the +# readiness packet. A pass therefore proves both missing and wrong denials, +# and each safe source-failure class, rather than accepting one sample. +CASE_CONTRACT: tuple[tuple[str, str, str, tuple[str, ...]], ...] = ( + ( + "offline-clean-journey", + "offline-journey-complete", + "offline-no-contact", + IMPLEMENTER_ROLES, + ), + ( + "missing-caller-credential-denial", + "caller-authorization-denied", + "denied-before-data-operation", + SOURCE_CASE_ROLES, + ), + ( + "wrong-caller-credential-denial", + "caller-authorization-denied", + "denied-before-data-operation", + SOURCE_CASE_ROLES, + ), + ( + "missing-purpose-denial", + "purpose-authorization-denied", + "denied-before-data-operation", + SOURCE_CASE_ROLES, + ), + ( + "wrong-purpose-denial", + "purpose-authorization-denied", + "denied-before-data-operation", + SOURCE_CASE_ROLES, + ), + ( + "disallowed-service-policy-denial", + "service-policy-denied", + "denied-before-data-operation", + SOURCE_CASE_ROLES, + ), + ( + "allowed-relay-consultation", + "allowed-minimized-result", + "consulted-within-profile", + SOURCE_CASE_ROLES, + ), + ( + "no-match", + "no-match", + "consulted-within-profile", + SOURCE_CASE_ROLES, + ), + ( + "ambiguity", + "ambiguity-without-unsupported-claim", + "consulted-within-profile", + SOURCE_CASE_ROLES, + ), + ( + "subject-mismatch", + "subject-mismatch-safe-failure", + "consulted-within-profile", + SOURCE_CASE_ROLES, + ), + ( + "source-unavailable", + "source-unavailable-safe-failure", + "source-failed-within-profile", + SOURCE_CASE_ROLES, + ), + ( + "source-rejected", + "source-rejected-safe-failure", + "source-failed-within-profile", + SOURCE_CASE_ROLES, + ), + ( + "source-malformed", + "source-malformed-safe-failure", + "source-failed-within-profile", + SOURCE_CASE_ROLES, + ), + ( + "source-late", + "source-late-safe-failure", + "source-failed-within-profile", + SOURCE_CASE_ROLES, + ), + ( + "notary-value-claim", + "notary-value-approved-disclosure", + "consulted-within-profile", + SOURCE_CASE_ROLES, + ), + ( + "notary-predicate-claim", + "notary-predicate-true-false-null-without-value", + "consulted-within-profile", + SOURCE_CASE_ROLES, + ), + ( + "notary-redacted-claim", + "notary-redacted-without-hidden-value", + "consulted-within-profile", + SOURCE_CASE_ROLES, + ), + ( + "consultation-contract-mismatch", + "contract-mismatch-before-access", + "denied-before-data-operation", + SOURCE_CASE_ROLES, + ), + ( + "promotion", + "promotion-non-widening", + "no-data-operation-operational", + PROMOTION_ROLES, + ), + ( + "rollback-recovery", + "rollback-recovery-restored", + "no-data-operation-operational", + RECOVERY_ROLES, + ), + ( + "teardown", + "teardown-completed", + "no-data-operation-operational", + TEARDOWN_ROLES, + ), +) + + +class AcceptanceError(RuntimeError): + """A first-country acceptance record is invalid or unsafe.""" + + +def require_regular_file(path: Path, *, max_bytes: int) -> None: + try: + info = path.lstat() + except OSError as exc: + raise AcceptanceError(f"required file is unavailable: {exc}") from exc + if stat.S_ISLNK(info.st_mode) or not stat.S_ISREG(info.st_mode): + raise AcceptanceError("required path must be a regular, non-symlink file") + if info.st_size <= 0 or info.st_size > max_bytes: + raise AcceptanceError( + f"file size must be between 1 and {max_bytes} bytes" + ) + + +def closed_object(pairs: list[tuple[str, Any]]) -> dict[str, Any]: + """Build a JSON object without accepting ambiguous duplicate fields.""" + value: dict[str, Any] = {} + for key, item in pairs: + if key in value: + raise AcceptanceError("JSON objects must not contain duplicate fields") + value[key] = item + return value + + +def load_json(path: Path, *, max_bytes: int = MAX_RECORD_BYTES) -> Any: + require_regular_file(path, max_bytes=max_bytes) + try: + return json.loads( + path.read_text(encoding="utf-8"), object_pairs_hook=closed_object + ) + except (OSError, UnicodeDecodeError, json.JSONDecodeError) as exc: + raise AcceptanceError(f"could not read valid JSON: {exc}") from exc + + +def assert_closed_schema(value: Any, label: str = "schema") -> None: + if isinstance(value, dict): + if ( + value.get("type") == "object" + and value.get("additionalProperties") is not False + ): + raise AcceptanceError(f"{label} contains an open object schema") + if value.get("type") == "object": + properties = set(value.get("properties", {})) + required = set(value.get("required", [])) + if properties != required: + raise AcceptanceError( + f"{label} must require every field in its closed object schema" + ) + for name, item in value.items(): + assert_closed_schema(item, f"{label}.{name}") + elif isinstance(value, list): + for index, item in enumerate(value): + assert_closed_schema(item, f"{label}[{index}]") + + +def load_schema() -> dict[str, Any]: + value = load_json(SCHEMA_PATH) + if not isinstance(value, dict): + raise AcceptanceError("acceptance schema must be an object") + if value.get("$schema") != "https://json-schema.org/draft/2020-12/schema": + raise AcceptanceError("acceptance schema must use JSON Schema draft 2020-12") + if value.get("additionalProperties") is not False: + raise AcceptanceError("acceptance schema must be closed") + assert_closed_schema(value) + return value + + +def validate_shape(record: Any, schema: dict[str, Any]) -> dict[str, Any]: + try: + validate_closed_schema(record, schema, schema, "record") + except SchemaValidationError as exc: + raise AcceptanceError(str(exc)) from None + if not isinstance(record, dict): + raise AcceptanceError("record must be an object") + return record + + +def canonical_binding_sha256(binding: dict[str, Any]) -> str: + encoded = json.dumps( + binding, + ensure_ascii=True, + separators=(",", ":"), + sort_keys=True, + ).encode("ascii") + return "sha256:" + hashlib.sha256(encoded).hexdigest() + + +def digest_fields(value: Any, label: str = "record") -> list[tuple[str, str]]: + found: list[tuple[str, str]] = [] + if isinstance(value, dict): + for name, item in value.items(): + child = f"{label}.{name}" + if name.endswith("_sha256") and isinstance(item, str): + found.append((child, item)) + found.extend(digest_fields(item, child)) + elif isinstance(value, list): + for index, item in enumerate(value): + found.extend(digest_fields(item, f"{label}[{index}]")) + return found + + +def require_exact_roles( + actual: list[str], expected: tuple[str, ...], label: str +) -> None: + if actual != list(expected): + raise AcceptanceError(f"{label} must use the exact ordered owner-role set") + + +def validate_common(record: dict[str, Any]) -> None: + if record["schema_version"] != SCHEMA_VERSION: + raise AcceptanceError("record has an unsupported schema version") + computed = canonical_binding_sha256(record["binding"]) + if record["acceptance_binding_sha256"] != computed: + raise AcceptanceError( + "acceptance_binding_sha256 does not match the canonical binding" + ) + if list(record["evidence_limitations"]) != list(LIMITATIONS): + raise AcceptanceError( + "record must retain the exact ordered evidence limitation set" + ) + cases = record["cases"] + if [item["case_id"] for item in cases] != [ + contract[0] for contract in CASE_CONTRACT + ]: + raise AcceptanceError("record cases must use the closed ordered case set") + for case, (_, _, _, roles) in zip(cases, CASE_CONTRACT): + if case["acceptance_binding_sha256"] != computed: + raise AcceptanceError( + f"{case['case_id']} is not bound to the canonical acceptance identity" + ) + require_exact_roles( + case["owner_roles"], roles, f"{case['case_id']}.owner_roles" + ) + require_exact_roles( + record["human_acceptance"]["owner_roles"], + IMPLEMENTER_ROLES, + "human_acceptance.owner_roles", + ) + teardown_case = cases[-1] + teardown = record["teardown"] + for field in ( + "source_call_classification", + "public_evidence_sha256", + "restricted_evidence_sha256", + "owner_attestation_sha256", + "owner_roles", + ): + if teardown[field] != teardown_case[field]: + raise AcceptanceError( + f"teardown.{field} must match the closed teardown case" + ) + + +def validate_template(record: dict[str, Any]) -> None: + validate_common(record) + if ( + record["record_kind"] != "template" + or record["is_evidence"] is not False + or record["evidence_state"] != "planned_not_executed" + or record["overall_outcome"] != "not_executed" + ): + raise AcceptanceError("template must remain explicit non-evidence") + if record["binding"]["candidate"]["release_tag"] != "v0.0.0": + raise AcceptanceError("template must retain the reserved release sentinel") + if record["binding"]["candidate"]["source_commit"] != ZERO_COMMIT: + raise AcceptanceError("template must retain the reserved commit sentinel") + if ( + record["binding"]["source_profile"]["approved_input_class"] + != "not-selected" + ): + raise AcceptanceError("template must retain the unselected input sentinel") + for label, digest in digest_fields(record["binding"]): + if digest != ZERO_SHA256: + raise AcceptanceError(f"{label} must retain the zero-digest sentinel") + for label, digest in digest_fields(record): + if label in { + "record.acceptance_binding_sha256", + *( + f"record.cases[{index}].acceptance_binding_sha256" + for index in range(len(CASE_CONTRACT)) + ), + }: + continue + if digest != ZERO_SHA256: + raise AcceptanceError(f"{label} must retain the zero-digest sentinel") + candidate = record["binding"]["candidate"] + if any( + candidate[field] is not False + for field in ( + "candidate_assets_verified", + "authenticity_verified", + "exact_candidate_approved", + ) + ): + raise AcceptanceError("template must not attest candidate verification") + for section, fields in ( + ( + record["binding"]["project"], + ( + "generated_files_unchanged", + "generated_files_edited", + "product_code_changes_required", + ), + ), + ( + record["binding"]["environment"], + ("secret_values_retained", "authority_widening_detected"), + ), + ( + record["binding"]["source_profile"], + ( + "exact_version_bound", + "exact_read_operation_bound", + "non_production_only", + "zero_one_call_probe_approved", + ), + ), + ): + if any(section[field] is not False for field in fields): + raise AcceptanceError("template must not attest unexecuted prerequisites") + if any(record["scope_claims"].values()): + raise AcceptanceError("template must not make acceptance or scope claims") + human = record["human_acceptance"] + if ( + human["outcome"] != "not_executed" + or human["published_candidate_artifacts_only"] + or human["private_maintainer_instructions_used"] + or any( + human[field] + for field in ( + "authored_intent_understood", + "environment_binding_understood", + "generated_artifacts_understood", + "signed_product_inputs_understood", + "operator_trust_understood", + "runtime_state_understood", + ) + ) + or human["country_owner_usability_acceptance"] != "not_reviewed" + or human["maintainability_acceptance"] != "not_reviewed" + ): + raise AcceptanceError("template must not claim human acceptance") + for case in record["cases"]: + if ( + case["outcome"] != "not_executed" + or case["result_class"] != "not-executed" + or case["source_call_classification"] != "unknown" + ): + raise AcceptanceError("template cases must remain unexecuted") + storage = record["evidence_handling"]["restricted_storage"] + retention = record["evidence_handling"]["retention"] + deletion = record["evidence_handling"]["deletion"] + redaction = record["evidence_handling"]["redaction"] + if ( + storage["approved"] + or retention["approved"] + or retention["failed_run_retention_approved"] + or deletion["procedure_approved"] + or deletion["completion_state"] != "not_scheduled" + or redaction["canary_scan_passed"] + or redaction["public_private_split_confirmed"] + ): + raise AcceptanceError("template must not claim evidence-handling approval") + for acceptance in ( + record["governance"]["privacy_acceptance"], + record["governance"]["legal_acceptance"], + record["governance"]["country_technical_acceptance"], + ): + if acceptance["status"] != "not_reviewed": + raise AcceptanceError("template must not claim governance acceptance") + publication = record["publication_review"] + if ( + publication["status"] != "not_executed" + or publication["public_restricted_comparison_confirmed"] + or publication["forbidden_content_absent"] + ): + raise AcceptanceError("template must not claim publication review") + teardown = record["teardown"] + if ( + teardown["attempted"] + or teardown["finally_path"] + or teardown["outcome"] != "not_executed" + or teardown["within_approved_bound"] + or teardown["source_call_classification"] != "unknown" + ): + raise AcceptanceError("template must not claim teardown evidence") + + +def require_non_sentinel_evidence(record: dict[str, Any]) -> None: + candidate = record["binding"]["candidate"] + if ( + candidate["release_tag"] == "v0.0.0" + or candidate["source_commit"] == ZERO_COMMIT + ): + raise AcceptanceError("evidence must bind a non-sentinel exact candidate") + for label, digest in digest_fields(record): + if digest == ZERO_SHA256: + raise AcceptanceError(f"{label} uses the reserved non-evidence digest") + + +def require_distinct_evidence_domains(record: dict[str, Any]) -> None: + candidate = record["binding"]["candidate"] + candidate_digests = [ + candidate[field] + for field in ( + "registryctl_asset_sha256", + "relay_product_sha256", + "notary_product_sha256", + "worker_set_sha256", + "image_lock_sha256", + "release_capsule_sha256", + "release_provenance_sha256", + "candidate_evidence_sha256", + ) + ] + if len(set(candidate_digests)) != len(candidate_digests): + raise AcceptanceError( + "candidate artifacts and candidate verification evidence must have " + "distinct digests" + ) + + public_digests: set[str] = set() + restricted_digests: set[str] = set() + for case in record["cases"]: + evidence_digests = [ + case[field] + for field in ( + "source_call_evidence_sha256", + "public_evidence_sha256", + "restricted_evidence_sha256", + "owner_attestation_sha256", + ) + ] + if len(set(evidence_digests)) != len(evidence_digests): + raise AcceptanceError( + f"{case['case_id']} must bind distinct public, restricted, " + "source-call, and owner-attestation evidence" + ) + public_digests.add(case["public_evidence_sha256"]) + restricted_digests.update( + { + case["restricted_evidence_sha256"], + case["source_call_evidence_sha256"], + case["owner_attestation_sha256"], + } + ) + + human = record["human_acceptance"] + human_digests = [ + human[field] + for field in ( + "public_evidence_sha256", + "restricted_evidence_sha256", + "owner_attestation_sha256", + ) + ] + if len(set(human_digests)) != len(human_digests): + raise AcceptanceError( + "human acceptance must bind distinct public, restricted, and owner evidence" + ) + public_digests.add(human["public_evidence_sha256"]) + restricted_digests.update( + { + human["restricted_evidence_sha256"], + human["owner_attestation_sha256"], + } + ) + + redaction = record["evidence_handling"]["redaction"] + redaction_digests = [ + redaction[field] + for field in ( + "public_summary_sha256", + "restricted_index_sha256", + "scan_evidence_sha256", + ) + ] + if len(set(redaction_digests)) != len(redaction_digests): + raise AcceptanceError( + "redaction must bind distinct public summary, restricted index, " + "and scan evidence" + ) + public_digests.add(redaction["public_summary_sha256"]) + restricted_digests.update( + { + redaction["restricted_index_sha256"], + redaction["scan_evidence_sha256"], + } + ) + + if public_digests & restricted_digests: + raise AcceptanceError( + "public and restricted evidence domains must use distinct digests" + ) + if record["publication_review"]["review_evidence_sha256"] in ( + public_digests | restricted_digests + ): + raise AcceptanceError( + "publication review evidence must be distinct from reviewed evidence" + ) + + +def validate_evidence(record: dict[str, Any]) -> str: + validate_common(record) + if record["record_kind"] != "candidate_acceptance_evidence": + raise AcceptanceError("validate requires a candidate acceptance record") + if record["is_evidence"] is not True: + raise AcceptanceError("candidate acceptance record must set is_evidence true") + if record["evidence_state"] not in { + "passed_non_production", + "failed_non_production", + }: + raise AcceptanceError("candidate evidence has an invalid evidence state") + require_non_sentinel_evidence(record) + require_distinct_evidence_domains(record) + + candidate = record["binding"]["candidate"] + if any( + candidate[field] is not True + for field in ( + "candidate_assets_verified", + "authenticity_verified", + "exact_candidate_approved", + ) + ): + raise AcceptanceError("candidate identity is not fully verified and approved") + project = record["binding"]["project"] + if ( + project["generated_files_unchanged"] is not True + or project["generated_files_edited"] is not False + or project["product_code_changes_required"] is not False + ): + raise AcceptanceError( + "project must retain reviewed generated files and require no " + "product-code change" + ) + environment = record["binding"]["environment"] + if ( + environment["secret_values_retained"] is not False + or environment["authority_widening_detected"] is not False + ): + raise AcceptanceError( + "environment evidence must retain no secret values or widened authority" + ) + profile = record["binding"]["source_profile"] + if any( + profile[field] is not True + for field in ( + "exact_version_bound", + "exact_read_operation_bound", + "non_production_only", + "zero_one_call_probe_approved", + ) + ): + raise AcceptanceError("source profile is not fully bounded and approved") + if profile["approved_input_class"] not in { + "synthetic", + "owner-approved-non-personal", + }: + raise AcceptanceError("source profile lacks an approved safe input class") + + storage = record["evidence_handling"]["restricted_storage"] + retention = record["evidence_handling"]["retention"] + deletion = record["evidence_handling"]["deletion"] + redaction = record["evidence_handling"]["redaction"] + if storage["approved"] is not True: + raise AcceptanceError("restricted evidence storage is not approved") + if storage["owner_role"] != "approved-operator": + raise AcceptanceError( + "restricted evidence storage lacks the approved operator role" + ) + if ( + retention["approved"] is not True + or retention["failed_run_retention_approved"] is not True + ): + raise AcceptanceError("run and failed-run retention are not approved") + if retention["owner_role"] != "privacy-legal-owner": + raise AcceptanceError("retention lacks the privacy and legal owner role") + if ( + deletion["procedure_approved"] is not True + or deletion["completion_state"] + not in {"scheduled-within-approved-policy", "completed"} + ): + raise AcceptanceError("evidence deletion is not approved and accounted for") + if deletion["owner_role"] != "privacy-legal-owner": + raise AcceptanceError("deletion lacks the privacy and legal owner role") + if ( + redaction["canary_scan_passed"] is not True + or redaction["public_private_split_confirmed"] is not True + ): + raise AcceptanceError("public/private redaction evidence is incomplete") + + governance = record["governance"] + expected_governance_roles = { + "privacy_acceptance": "privacy-legal-owner", + "legal_acceptance": "privacy-legal-owner", + "country_technical_acceptance": "country-technical-owner", + } + for name, role in expected_governance_roles.items(): + acceptance = governance[name] + if acceptance["status"] != "accepted" or acceptance["owner_role"] != role: + raise AcceptanceError( + f"governance.{name} lacks bounded acceptance by the required role" + ) + if governance["production_authorization"] != "not-granted": + raise AcceptanceError("record must not claim production authorization") + + publication = record["publication_review"] + if ( + publication["status"] != "passed" + or publication["public_restricted_comparison_confirmed"] is not True + or publication["forbidden_content_absent"] is not True + or publication["owner_role"] != "publication-reviewer" + ): + raise AcceptanceError("publication review is not complete") + + all_cases_passed = True + for case, (_, result_class, source_class, _) in zip( + record["cases"], CASE_CONTRACT + ): + if case["outcome"] == "passed": + if case["result_class"] != result_class: + raise AcceptanceError( + f"{case['case_id']} does not use its reviewed result class" + ) + if case["source_call_classification"] != source_class: + raise AcceptanceError( + f"{case['case_id']} does not use its reviewed source-call " + "classification" + ) + elif case["outcome"] == "failed": + all_cases_passed = False + if case["result_class"] != "execution-failed": + raise AcceptanceError( + f"{case['case_id']} failed without the failure result class" + ) + if case["source_call_classification"] not in { + source_class, + "unknown", + "unexpected-data-operation-contact", + "source-call-bound-breached", + }: + raise AcceptanceError( + f"{case['case_id']} failed with a contradictory source-call " + "classification" + ) + else: + all_cases_passed = False + if ( + case["result_class"] != "not-executed" + or case["source_call_classification"] != "unknown" + ): + raise AcceptanceError( + f"{case['case_id']} is unexecuted but claims an observed result" + ) + + human = record["human_acceptance"] + human_success_facts = ( + human["published_candidate_artifacts_only"] is True + and human["private_maintainer_instructions_used"] is False + and all( + human[field] is True + for field in ( + "authored_intent_understood", + "environment_binding_understood", + "generated_artifacts_understood", + "signed_product_inputs_understood", + "operator_trust_understood", + "runtime_state_understood", + ) + ) + and human["country_owner_usability_acceptance"] == "accepted" + and human["maintainability_acceptance"] == "accepted" + ) + human_passed = human["outcome"] == "passed" and human_success_facts + if human["outcome"] == "passed" and not human_success_facts: + raise AcceptanceError( + "passed human acceptance lacks independent usability evidence" + ) + if human["outcome"] == "failed" and human_success_facts: + raise AcceptanceError( + "failed human acceptance contradicts its success attestations" + ) + if human["outcome"] == "not_executed" and ( + human["published_candidate_artifacts_only"] + or human["private_maintainer_instructions_used"] + or any( + human[field] + for field in ( + "authored_intent_understood", + "environment_binding_understood", + "generated_artifacts_understood", + "signed_product_inputs_understood", + "operator_trust_understood", + "runtime_state_understood", + ) + ) + or human["country_owner_usability_acceptance"] != "not_reviewed" + or human["maintainability_acceptance"] != "not_reviewed" + ): + raise AcceptanceError( + "unexecuted human acceptance must not contain outcome attestations" + ) + + teardown = record["teardown"] + teardown_case = record["cases"][-1] + if teardown["attempted"] is not True or teardown["finally_path"] is not True: + raise AcceptanceError( + "candidate evidence must record a teardown attempt from a finally path" + ) + if teardown["outcome"] == "completed": + if ( + teardown_case["outcome"] != "passed" + or teardown_case["result_class"] != "teardown-completed" + or teardown["within_approved_bound"] is not True + ): + raise AcceptanceError( + "completed teardown contradicts the closed teardown case" + ) + elif teardown["outcome"] == "failed": + if ( + teardown_case["outcome"] != "failed" + or teardown_case["result_class"] != "execution-failed" + ): + raise AcceptanceError("failed teardown contradicts its closed case") + else: + raise AcceptanceError( + "candidate evidence must record completed or failed teardown" + ) + teardown_passed = ( + teardown["outcome"] == "completed" + and teardown["within_approved_bound"] is True + and teardown["source_call_classification"] + == "no-data-operation-operational" + ) + complete = all_cases_passed and human_passed and teardown_passed + claims = record["scope_claims"] + nonproduction_claims_safe = ( + claims["production_authorized"] is False + and claims["broad_interoperability"] is False + and claims["upstream_product_certification"] is False + ) + if not nonproduction_claims_safe: + raise AcceptanceError("record contains an unsafe scope claim") + + if record["evidence_state"] == "passed_non_production": + if record["overall_outcome"] != "passed" or not complete: + raise AcceptanceError( + "passing state requires every case, human acceptance, and " + "teardown to pass" + ) + if any( + claims[field] is not True + for field in ( + "platform_complete", + "country_ready", + "first_country_success", + ) + ): + raise AcceptanceError( + "passing acceptance evidence must explicitly close the three " + "bounded states" + ) + return "passed" + + if record["overall_outcome"] != "failed" or complete: + raise AcceptanceError( + "failed state requires a failed or unexecuted case, human gate, or teardown" + ) + if any( + claims[field] is not False + for field in ( + "platform_complete", + "country_ready", + "first_country_success", + ) + ): + raise AcceptanceError("failed evidence must remain non-closing") + return "failed" + + +def check_packet() -> None: + schema = load_schema() + template = validate_shape(load_json(TEMPLATE_PATH), schema) + validate_template(template) + + +def parser() -> argparse.ArgumentParser: + root = argparse.ArgumentParser(description=__doc__) + commands = root.add_subparsers(dest="command", required=True) + commands.add_parser( + "check-packet", + help="validate the checked-in closed schema and non-evidence template", + ) + validate = commands.add_parser( + "validate", + help="validate one sanitized candidate acceptance evidence record", + ) + validate.add_argument("record", type=Path) + return root + + +def main(argv: list[str] | None = None) -> int: + args = parser().parse_args(argv) + try: + schema = load_schema() + template = validate_shape(load_json(TEMPLATE_PATH), schema) + validate_template(template) + if args.command == "check-packet": + print("first-country acceptance source packet validation passed") + else: + record = validate_shape(load_json(args.record), schema) + outcome = validate_evidence(record) + if outcome == "passed": + print( + "first-country acceptance validation passed " + "(bounded non-production only)" + ) + else: + print( + "first-country failed-run record is valid non-closing evidence" + ) + except (AcceptanceError, KeyError, OSError, TypeError, ValueError) as exc: + print(f"error: {exc}", file=sys.stderr) + return 1 + return 0 + + +if __name__ == "__main__": + raise SystemExit(main()) diff --git a/release/scripts/validate-product-input-lifecycle.py b/release/scripts/validate-product-input-lifecycle.py new file mode 100644 index 000000000..4200db372 --- /dev/null +++ b/release/scripts/validate-product-input-lifecycle.py @@ -0,0 +1,1384 @@ +#!/usr/bin/env python3 +"""Validate a closed, redaction-safe product-input lifecycle evidence record.""" + +from __future__ import annotations + +import argparse +import hashlib +import json +import re +import stat +import subprocess +import sys +from datetime import datetime, timezone +from functools import lru_cache +from pathlib import Path +from typing import Any, Callable + +import yaml + + +ROOT = Path(__file__).resolve().parents[2] +SCRIPT_DIR = Path(__file__).resolve().parent +if str(SCRIPT_DIR) not in sys.path: + sys.path.insert(0, str(SCRIPT_DIR)) + +from conformance_candidate import ( # noqa: E402 + CandidateError as CandidateAssetError, + load_candidate, + read_regular_file_no_follow, +) +from closed_json_schema import ( # noqa: E402 + SchemaValidationError, + validate_against_schema, +) +from release_candidate import ( # noqa: E402 + CandidateError as CandidateReceiptError, + parse_tag_binding, + validate_receipt, +) + + +SCHEMA_VERSION = "registry-stack.product-input-lifecycle.v1" +STACK_REPOSITORY = "registrystack/registry-stack" +RECORD_KINDS = {"template", "candidate_evidence"} +LIFECYCLE_DIRECTORY = "product-input-lifecycle" +SCHEMA_FILENAME = "product-input-lifecycle-v1.schema.json" +TEMPLATE_FILENAME = "product-input-lifecycle-v1.template.json" +MAX_RECORD_BYTES = 4 * 1024 * 1024 +MAX_CANDIDATE_RECEIPT_BYTES = 64 * 1024 * 1024 +MAX_RELEASE_MANIFEST_BYTES = 1024 * 1024 + +SEMVER_NUMBER = r"(?:0|[1-9][0-9]*)" +SEMVER_PRERELEASE_IDENTIFIER = ( + rf"(?:{SEMVER_NUMBER}|[0-9A-Za-z-]*[A-Za-z-][0-9A-Za-z-]*)" +) +VERSION = re.compile( + rf"^v{SEMVER_NUMBER}\.{SEMVER_NUMBER}\.{SEMVER_NUMBER}" + rf"(?:-{SEMVER_PRERELEASE_IDENTIFIER}" + rf"(?:\.{SEMVER_PRERELEASE_IDENTIFIER})*)?$" +) +SLUG = re.compile(r"^[a-z0-9][a-z0-9._-]{0,127}$") +COMMIT = re.compile(r"^[0-9a-f]{40}$") +SHA256 = re.compile(r"^sha256:[0-9a-f]{64}$") +TIMESTAMP = re.compile(r"^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$") +PLACEHOLDER = re.compile(r"^<[A-Z0-9_]+>$") +EXERCISE_ID = re.compile(r"^product-input-lifecycle-[0-9a-f]{16,64}$") +EVIDENCE_LABEL = re.compile(r"^evidence-[0-9a-f]{16,64}$") +REVIEWER_LABEL = re.compile(r"^reviewer-[0-9a-f]{16,64}$") +ABSOLUTE_WINDOWS_PATH = re.compile(r"^[A-Za-z]:[\\/]") +AWS_ACCESS_KEY = re.compile(r"\bAKIA[0-9A-Z]{16}\b") +JWT_LIKE = re.compile(r"\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b") +CANDIDATE_RECORD_FILENAME = re.compile( + r"^product-input-lifecycle-[a-z0-9][a-z0-9._-]{0,127}\.json$" +) + +AUTHORING_AND_BUILD_CHECKS = ( + "authored_revision_closed", + "fixture_coverage_closed", + "preflight_closed", + "capabilities_closed", + "promotion_closed", + "deterministic_artifact_manifest_built", + "relay_unsigned_input_built", + "notary_unsigned_input_built", +) +PRODUCT_LIFECYCLE_CHECKS = ( + "relay_bundle_signed", + "notary_bundle_signed", + "relay_trust_generation_verified", + "notary_trust_generation_verified", + "relay_anti_rollback_lineage_verified", + "notary_anti_rollback_lineage_verified", + "relay_bundle_verified", + "notary_bundle_verified", + "cross_product_compatibility_verified", + "relay_staged_activation", + "notary_staged_activation", + "consultation_contract_mismatch_zero_source_calls", + "redacted_runtime_posture_inspected", + "traffic_admission_after_compatible_activation", +) +ADVANCED_OPERATION_CHECKS = ( + "upgrade_exercised", + "recovery_exercised", + "rollback_exercised", +) +REVIEW_CLASSES = ( + "correctness", + "security", + "maintainability", + "operator", +) +EVIDENCE_GROUPS = { + "authoring_and_build": AUTHORING_AND_BUILD_CHECKS, + "product_lifecycle": PRODUCT_LIFECYCLE_CHECKS, + "advanced_operations": ADVANCED_OPERATION_CHECKS, +} +ALL_CHECKS = ( + *AUTHORING_AND_BUILD_CHECKS, + *PRODUCT_LIFECYCLE_CHECKS, + *ADVANCED_OPERATION_CHECKS, +) +LIMITATIONS = { + "evidence_grade": "candidate_non_production", + "retained_evidence_content_authenticated_by_validator": False, + "live_country_interoperability_proven": False, + "country_owner_acceptance_recorded": False, + "legal_approval_recorded": False, + "production_authorization_recorded": False, + "production_signing_keys_used": False, + "country_credentials_used": False, + "country_personal_data_used": False, +} + + +class LifecycleError(ValueError): + """A product-input lifecycle record is invalid.""" + + +def require_object(value: Any, label: str, keys: set[str]) -> dict[str, Any]: + if not isinstance(value, dict): + raise LifecycleError(f"{label} must be an object") + unknown = set(value) - keys + missing = keys - set(value) + if unknown or missing: + details: list[str] = [] + if missing: + details.append("missing " + ", ".join(sorted(missing))) + if unknown: + details.append(f"{len(unknown)} unknown field(s)") + raise LifecycleError(f"{label} has invalid fields: {'; '.join(details)}") + return value + + +def closed_object(pairs: list[tuple[str, Any]]) -> dict[str, Any]: + value: dict[str, Any] = {} + for key, item in pairs: + if key in value: + raise LifecycleError("JSON objects must not contain duplicate fields") + value[key] = item + return value + + +def load_closed_json_bytes(value: bytes) -> Any: + try: + return json.loads(value, object_pairs_hook=closed_object) + except UnicodeDecodeError as error: + raise LifecycleError("record is not valid UTF-8 JSON") from error + except json.JSONDecodeError as error: + raise LifecycleError("record is not valid JSON") from error + + +def load_closed_json_file(path: Path) -> Any: + try: + value = read_regular_file_no_follow(path, max_bytes=MAX_RECORD_BYTES) + except (CandidateAssetError, OSError): + raise LifecycleError( + "record must be a bounded regular non-symlink JSON file" + ) from None + return load_closed_json_bytes(value) + + +@lru_cache(maxsize=1) +def lifecycle_schema() -> dict[str, Any]: + value = load_closed_json_file( + ROOT / "release" / "exercises" / LIFECYCLE_DIRECTORY / SCHEMA_FILENAME + ) + if not isinstance(value, dict): + raise LifecycleError("product-input lifecycle schema must be an object") + return value + + +def validate_schema_document(value: Any) -> None: + try: + validate_against_schema(value, lifecycle_schema(), lifecycle_schema()) + except SchemaValidationError: + raise LifecycleError( + "record does not satisfy the closed product-input lifecycle schema" + ) from None + + +def bounded_string( + value: Any, + label: str, + pattern: re.Pattern[str], + *, + template: bool, +) -> str: + if not isinstance(value, str): + raise LifecycleError(f"{label} must be a string") + if template and PLACEHOLDER.fullmatch(value): + return value + if pattern.fullmatch(value) is None: + raise LifecycleError(f"{label} has an invalid or unsafe value") + return value + + +def sha256_bytes(value: bytes) -> str: + return "sha256:" + hashlib.sha256(value).hexdigest() + + +def canonical_sha256(value: Any) -> str: + encoded = json.dumps(value, sort_keys=True, separators=(",", ":")).encode() + return sha256_bytes(encoded) + + +def git_bytes(root: Path, commit: str, path: Path) -> bytes: + result = subprocess.run( + ["git", "show", f"{commit}:{path.as_posix()}"], + cwd=root, + capture_output=True, + check=False, + ) + if result.returncode != 0: + raise LifecycleError( + "candidate release manifest is unavailable at the exact commit" + ) + return result.stdout + + +def parse_timestamp(value: str, label: str) -> datetime: + if TIMESTAMP.fullmatch(value) is None: + raise LifecycleError(f"{label} has an invalid or unsafe value") + try: + parsed = datetime.fromisoformat(value.removesuffix("Z") + "+00:00") + except ValueError as error: + raise LifecycleError(f"{label} is not a valid UTC timestamp") from error + if parsed.tzinfo != timezone.utc: + raise LifecycleError(f"{label} must use UTC") + return parsed + + +def reject_sensitive_sentinels(value: Any, label: str = "record") -> None: + if isinstance(value, dict): + for index, item in enumerate(value.values()): + reject_sensitive_sentinels(item, f"{label}.value[{index}]") + return + if isinstance(value, list): + for index, item in enumerate(value): + reject_sensitive_sentinels(item, f"{label}[{index}]") + return + if not isinstance(value, str) or PLACEHOLDER.fullmatch(value): + return + lowered = value.casefold() + unsafe = ( + value.startswith(("/", "~/", "\\\\")) + or ABSOLUTE_WINDOWS_PATH.search(value) is not None + or "://" in value + or "-----begin " in lowered + or "bearer " in lowered + or "password=" in lowered + or "passwd=" in lowered + or "token=" in lowered + or "secret=" in lowered + or "private_key" in lowered + or "private-key" in lowered + or AWS_ACCESS_KEY.search(value) is not None + or JWT_LIKE.search(value) is not None + or "\n" in value + or "\r" in value + ) + if unsafe: + raise LifecycleError(f"{label} contains forbidden sensitive or location data") + + +def validate_candidate(value: Any, *, template: bool, root: Path) -> dict[str, Any]: + candidate = require_object( + value, + "candidate", + { + "repository", + "release_id", + "version", + "source_ref", + "source_commit", + "release_manifest_sha256", + "image_lock_sha256", + "release_capsule_sha256", + "candidate_receipt_sha256", + "relay_image_digest", + "notary_image_digest", + }, + ) + if candidate["repository"] != STACK_REPOSITORY: + raise LifecycleError(f"candidate.repository must be {STACK_REPOSITORY}") + bounded_string( + candidate["release_id"], + "candidate.release_id", + SLUG, + template=template, + ) + bounded_string( + candidate["version"], + "candidate.version", + VERSION, + template=template, + ) + for field in ("source_ref", "source_commit"): + bounded_string( + candidate[field], + f"candidate.{field}", + COMMIT, + template=template, + ) + for field in ( + "release_manifest_sha256", + "image_lock_sha256", + "release_capsule_sha256", + "candidate_receipt_sha256", + "relay_image_digest", + "notary_image_digest", + ): + bounded_string( + candidate[field], + f"candidate.{field}", + SHA256, + template=template, + ) + if template: + return candidate + validate_candidate_git_binding(candidate, root) + return candidate + + +def validate_candidate_git_binding(candidate: dict[str, Any], root: Path) -> None: + source_ref = candidate["source_ref"] + source_commit = candidate["source_commit"] + for value, label in ( + (source_ref, "source_ref"), + (source_commit, "source_commit"), + ): + resolved = subprocess.run( + ["git", "rev-parse", "--verify", f"{value}^{{commit}}"], + cwd=root, + capture_output=True, + text=True, + check=False, + ) + if resolved.returncode != 0 or resolved.stdout.strip() != value: + raise LifecycleError(f"candidate.{label} does not resolve exactly") + ancestor = subprocess.run( + ["git", "merge-base", "--is-ancestor", source_ref, source_commit], + cwd=root, + capture_output=True, + check=False, + ) + if ancestor.returncode != 0: + raise LifecycleError("candidate.source_ref is not an ancestor of source_commit") + + manifest_path = Path( + "release/manifests", + f"registry-stack-{candidate['release_id']}.yaml", + ) + manifest_bytes = git_bytes(root, source_commit, manifest_path) + if sha256_bytes(manifest_bytes) != candidate["release_manifest_sha256"]: + raise LifecycleError( + "candidate.release_manifest_sha256 does not match the exact candidate" + ) + try: + manifest = yaml.safe_load(manifest_bytes) + except yaml.YAMLError as error: + raise LifecycleError("candidate release manifest is invalid YAML") from error + stack = manifest.get("stack") if isinstance(manifest, dict) else None + expected = { + "release": candidate["release_id"], + "version": candidate["version"].removeprefix("v"), + "source_repo": candidate["repository"], + "source_ref": source_ref, + "source_tag": candidate["version"], + } + if not isinstance(stack, dict) or any( + str(stack.get(key)) != expected_value + for key, expected_value in expected.items() + ): + raise LifecycleError( + "candidate release manifest identity does not match the candidate coordinate" + ) + artifacts = manifest.get("artifacts") if isinstance(manifest, dict) else None + if ( + not isinstance(artifacts, dict) + or not artifacts + or any(str(version) != expected["version"] for version in artifacts.values()) + ): + raise LifecycleError( + "candidate release manifest artifacts do not match the candidate version" + ) + + +def load_candidate_tag_binding(root: Path, version: str) -> dict[str, Any]: + result = subprocess.run( + [ + "git", + "for-each-ref", + "--format=%(contents)", + "--count=1", + f"refs/tags/{version}", + ], + cwd=root, + capture_output=True, + text=True, + check=False, + ) + if result.returncode != 0 or not result.stdout: + raise LifecycleError("candidate annotated tag binding is unavailable") + try: + # for-each-ref appends one record separator newline after the tag + # contents. Remove only that separator and preserve the message bytes. + return parse_tag_binding(result.stdout[:-1]) + except CandidateReceiptError as error: + raise LifecycleError("candidate annotated tag binding is invalid") from error + + +def validate_candidate_assets( + candidate: dict[str, Any], + *, + recorded_at: datetime, + root: Path, + candidate_asset_root: Path | None, + candidate_loader: Callable[..., dict[str, Any]], + receipt_validator: Callable[..., dict[str, Any]], +) -> None: + if candidate_asset_root is None: + raise LifecycleError( + "candidate evidence requires --candidate-asset-root for authentication" + ) + version = candidate["version"] + candidate_asset_directory = candidate_asset_root.expanduser() / version + manifest_path = ( + root + / "release" + / "manifests" + / f"registry-stack-{candidate['release_id']}.yaml" + ) + image_lock_path = ( + candidate_asset_directory / f"registryctl-{version}-image-lock.json" + ) + receipt_path = candidate_asset_directory / "release-candidate-receipt.json" + + try: + current_manifest_bytes = read_regular_file_no_follow( + manifest_path, + max_bytes=MAX_RELEASE_MANIFEST_BYTES, + ) + authenticated = candidate_loader(manifest_path, image_lock_path) + except (CandidateAssetError, OSError): + raise LifecycleError( + "candidate release assets could not be authenticated" + ) from None + expected_authenticated = { + "release_id": candidate["release_id"], + "version": version.removeprefix("v"), + "source_repo": candidate["repository"], + "source_ref": candidate["source_ref"], + "source_tag": version, + "tag_target": candidate["source_commit"], + # The authenticated current manifest may contain the one permitted + # release-candidate to released closeout transition. The candidate + # manifest at source_commit is bound separately by the record. + "manifest_sha256": sha256_bytes(current_manifest_bytes), + "image_lock_sha256": candidate["image_lock_sha256"], + "release_capsule_sha256": candidate["release_capsule_sha256"], + "relay_image": ( + "ghcr.io/registrystack/registry-relay@" + candidate["relay_image_digest"] + ), + "notary_image": ( + "ghcr.io/registrystack/registry-notary@" + candidate["notary_image_digest"] + ), + } + if not isinstance(authenticated, dict) or any( + authenticated.get(field) != expected + for field, expected in expected_authenticated.items() + ): + raise LifecycleError( + "authenticated release assets do not match the candidate coordinate" + ) + + try: + receipt_bytes = read_regular_file_no_follow( + receipt_path, + max_bytes=MAX_CANDIDATE_RECEIPT_BYTES, + ) + except (CandidateAssetError, OSError): + raise LifecycleError("candidate receipt could not be read safely") from None + if sha256_bytes(receipt_bytes) != candidate["candidate_receipt_sha256"]: + raise LifecycleError( + "candidate_receipt_sha256 does not match the retained receipt bytes" + ) + receipt_document = load_closed_json_bytes(receipt_bytes) + try: + receipt = receipt_validator( + receipt_document, + expected_source_sha=candidate["source_ref"], + expected_version=version.removeprefix("v"), + expected_release_id=candidate["release_id"], + now=recorded_at, + ) + except CandidateReceiptError: + raise LifecycleError("candidate receipt contract is invalid") from None + if not isinstance(receipt, dict): + raise LifecycleError("candidate receipt contract is invalid") + + validity = receipt.get("validity") + expires_at = validity.get("expires_at") if isinstance(validity, dict) else None + if ( + not isinstance(expires_at, str) + or parse_timestamp(expires_at, "candidate receipt expiry") <= recorded_at + ): + raise LifecycleError("candidate receipt expired before lifecycle evidence") + + images = receipt.get("images") + if not isinstance(images, list): + raise LifecycleError("candidate receipt image inventory is invalid") + image_digests = { + item.get("name"): item.get("index_digest") + for item in images + if isinstance(item, dict) + } + expected_receipt_images = { + "registry-relay": candidate["relay_image_digest"], + "registry-notary": candidate["notary_image_digest"], + } + if image_digests != expected_receipt_images: + raise LifecycleError( + "candidate receipt images do not match the authenticated release assets" + ) + + workflow = receipt.get("workflow") + if not isinstance(workflow, dict): + raise LifecycleError("candidate receipt workflow identity is invalid") + binding = load_candidate_tag_binding(root, version) + expected_binding = { + "run_id": workflow.get("run_id"), + "run_attempt": workflow.get("run_attempt"), + "receipt_sha256": candidate["candidate_receipt_sha256"].removeprefix("sha256:"), + } + if binding != expected_binding: + raise LifecycleError( + "candidate annotated tag does not bind the retained receipt" + ) + + +def validate_attestations(value: Any, *, template: bool) -> None: + attestations = require_object( + value, + "attestations", + {"candidate_frozen", "candidate_independently_verified"}, + ) + for field in ("candidate_frozen", "candidate_independently_verified"): + if not isinstance(attestations[field], bool): + raise LifecycleError(f"attestations.{field} must be boolean") + if template and attestations[field]: + raise LifecycleError(f"attestations.{field} must be false in a template") + if not template and not attestations[field]: + raise LifecycleError( + f"candidate evidence requires attestations.{field} to be true" + ) + + +def validate_product(value: Any, label: str, *, template: bool) -> dict[str, Any]: + product = require_object( + value, + label, + { + "unsigned_input_sha256", + "signed_bundle_sha256", + "trust_generation", + "trust_set_sha256", + "anti_rollback_lineage_sha256", + }, + ) + for field in ( + "unsigned_input_sha256", + "signed_bundle_sha256", + "trust_set_sha256", + "anti_rollback_lineage_sha256", + ): + bounded_string( + product[field], + f"{label}.{field}", + SHA256, + template=template, + ) + generation = product["trust_generation"] + if isinstance(generation, bool) or not isinstance(generation, int): + raise LifecycleError(f"{label}.trust_generation must be an integer") + if (template and generation != 0) or (not template and generation <= 0): + expected = ( + "zero in a template" if template else "positive in candidate evidence" + ) + raise LifecycleError(f"{label}.trust_generation must be {expected}") + if ( + not template + and product["unsigned_input_sha256"] == product["signed_bundle_sha256"] + ): + raise LifecycleError( + f"{label} unsigned input and signed bundle must be distinct" + ) + return product + + +def validate_product_inputs( + value: Any, + product_input_set_sha256: Any, + *, + template: bool, +) -> dict[str, Any]: + product_inputs = require_object( + value, + "product_inputs", + {"artifact_manifest_sha256", "relay", "notary"}, + ) + bounded_string( + product_inputs["artifact_manifest_sha256"], + "product_inputs.artifact_manifest_sha256", + SHA256, + template=template, + ) + relay = validate_product( + product_inputs["relay"], + "product_inputs.relay", + template=template, + ) + notary = validate_product( + product_inputs["notary"], + "product_inputs.notary", + template=template, + ) + bounded_string( + product_input_set_sha256, + "product_input_set_sha256", + SHA256, + template=template, + ) + if template: + return product_inputs + if product_input_set_sha256 != canonical_sha256(product_inputs): + raise LifecycleError( + "product_input_set_sha256 does not match the exact product inputs" + ) + distinct_product_artifacts = { + relay["unsigned_input_sha256"], + relay["signed_bundle_sha256"], + notary["unsigned_input_sha256"], + notary["signed_bundle_sha256"], + } + if len(distinct_product_artifacts) != 4: + raise LifecycleError( + "Relay and Notary unsigned inputs and signed bundles must remain separate" + ) + if relay["trust_set_sha256"] == notary["trust_set_sha256"]: + raise LifecycleError( + "Relay and Notary operator trust sets must remain separate" + ) + if relay["anti_rollback_lineage_sha256"] == notary["anti_rollback_lineage_sha256"]: + raise LifecycleError( + "Relay and Notary anti-rollback lineages must remain separate" + ) + return product_inputs + + +def validate_activation(value: Any, *, template: bool) -> dict[str, Any]: + activation = require_object( + value, + "activation", + { + "stack_generation", + "compatibility_report_sha256", + "runtime_posture_sha256", + "consultation_contract_mismatch", + }, + ) + generation = activation["stack_generation"] + if isinstance(generation, bool) or not isinstance(generation, int): + raise LifecycleError("activation.stack_generation must be an integer") + if (template and generation != 0) or (not template and generation <= 0): + expected = ( + "zero in a template" if template else "positive in candidate evidence" + ) + raise LifecycleError(f"activation.stack_generation must be {expected}") + for field in ("compatibility_report_sha256", "runtime_posture_sha256"): + bounded_string( + activation[field], + f"activation.{field}", + SHA256, + template=template, + ) + mismatch = require_object( + activation["consultation_contract_mismatch"], + "activation.consultation_contract_mismatch", + {"failure_class", "observed_source_calls", "report_sha256"}, + ) + if mismatch["failure_class"] != "consultation_contract_mismatch": + raise LifecycleError( + "activation.consultation_contract_mismatch.failure_class is invalid" + ) + calls = mismatch["observed_source_calls"] + if isinstance(calls, bool) or not isinstance(calls, int) or calls < 0: + raise LifecycleError( + "activation.consultation_contract_mismatch.observed_source_calls " + "must be a non-negative integer" + ) + bounded_string( + mismatch["report_sha256"], + "activation.consultation_contract_mismatch.report_sha256", + SHA256, + template=template, + ) + return activation + + +def result_subject_bindings( + product_inputs: dict[str, Any], + activation: dict[str, Any], + *, + candidate_binding_sha256: str, + product_input_set_sha256: str, +) -> dict[str, str]: + relay = product_inputs["relay"] + notary = product_inputs["notary"] + authoring_binding = canonical_sha256( + { + "candidate_binding_sha256": candidate_binding_sha256, + "product_input_set_sha256": product_input_set_sha256, + "artifact_manifest_sha256": product_inputs["artifact_manifest_sha256"], + } + ) + activation_binding = canonical_sha256( + { + "candidate_binding_sha256": candidate_binding_sha256, + "product_input_set_sha256": product_input_set_sha256, + "activation_sha256": canonical_sha256(activation), + } + ) + relay_trust_binding = canonical_sha256( + { + "trust_generation": relay["trust_generation"], + "trust_set_sha256": relay["trust_set_sha256"], + } + ) + notary_trust_binding = canonical_sha256( + { + "trust_generation": notary["trust_generation"], + "trust_set_sha256": notary["trust_set_sha256"], + } + ) + relay_lineage_binding = canonical_sha256( + { + "trust_generation": relay["trust_generation"], + "trust_set_sha256": relay["trust_set_sha256"], + "anti_rollback_lineage_sha256": relay["anti_rollback_lineage_sha256"], + } + ) + notary_lineage_binding = canonical_sha256( + { + "trust_generation": notary["trust_generation"], + "trust_set_sha256": notary["trust_set_sha256"], + "anti_rollback_lineage_sha256": notary["anti_rollback_lineage_sha256"], + } + ) + relay_verification_binding = canonical_sha256( + { + "candidate_binding_sha256": candidate_binding_sha256, + "product_input_set_sha256": product_input_set_sha256, + "product": "relay", + "signed_bundle_sha256": relay["signed_bundle_sha256"], + "trust_generation": relay["trust_generation"], + "trust_set_sha256": relay["trust_set_sha256"], + "anti_rollback_lineage_sha256": relay["anti_rollback_lineage_sha256"], + } + ) + notary_verification_binding = canonical_sha256( + { + "candidate_binding_sha256": candidate_binding_sha256, + "product_input_set_sha256": product_input_set_sha256, + "product": "notary", + "signed_bundle_sha256": notary["signed_bundle_sha256"], + "trust_generation": notary["trust_generation"], + "trust_set_sha256": notary["trust_set_sha256"], + "anti_rollback_lineage_sha256": notary["anti_rollback_lineage_sha256"], + } + ) + return { + "authored_revision_closed": authoring_binding, + "fixture_coverage_closed": authoring_binding, + "preflight_closed": authoring_binding, + "capabilities_closed": authoring_binding, + "promotion_closed": authoring_binding, + "deterministic_artifact_manifest_built": product_inputs[ + "artifact_manifest_sha256" + ], + "relay_unsigned_input_built": relay["unsigned_input_sha256"], + "notary_unsigned_input_built": notary["unsigned_input_sha256"], + "relay_bundle_signed": relay["signed_bundle_sha256"], + "notary_bundle_signed": notary["signed_bundle_sha256"], + "relay_trust_generation_verified": relay_trust_binding, + "notary_trust_generation_verified": notary_trust_binding, + "relay_anti_rollback_lineage_verified": relay_lineage_binding, + "notary_anti_rollback_lineage_verified": notary_lineage_binding, + "relay_bundle_verified": relay_verification_binding, + "notary_bundle_verified": notary_verification_binding, + "cross_product_compatibility_verified": activation_binding, + "relay_staged_activation": canonical_sha256( + { + "activation_binding_sha256": activation_binding, + "product": "relay", + "signed_bundle_sha256": relay["signed_bundle_sha256"], + } + ), + "notary_staged_activation": canonical_sha256( + { + "activation_binding_sha256": activation_binding, + "product": "notary", + "signed_bundle_sha256": notary["signed_bundle_sha256"], + } + ), + "consultation_contract_mismatch_zero_source_calls": canonical_sha256( + { + "activation_binding_sha256": activation_binding, + "mismatch_report_sha256": activation["consultation_contract_mismatch"][ + "report_sha256" + ], + } + ), + "redacted_runtime_posture_inspected": canonical_sha256( + { + "activation_binding_sha256": activation_binding, + "runtime_posture_sha256": activation["runtime_posture_sha256"], + } + ), + "traffic_admission_after_compatible_activation": activation_binding, + "upgrade_exercised": activation_binding, + "recovery_exercised": activation_binding, + "rollback_exercised": activation_binding, + } + + +def validate_result( + value: Any, + label: str, + check_id: str, + *, + template: bool, + subject_binding: str | None, +) -> tuple[datetime | None, str | None]: + result = require_object( + value, + label, + { + "check_id", + "outcome", + "subject_sha256", + "observed_at", + "evidence_label", + "evidence_sha256", + }, + ) + if result["check_id"] != check_id: + raise LifecycleError(f"{label}.check_id must be {check_id}") + outcome = result["outcome"] + if template: + if outcome != "not_run": + raise LifecycleError(f"{label}.outcome must be not_run in a template") + for field in ( + "subject_sha256", + "observed_at", + "evidence_label", + "evidence_sha256", + ): + if result[field] is not None: + raise LifecycleError( + f"{label}.{field} must be null in a non-evidence template" + ) + return None, None + if outcome not in {"passed", "failed"}: + raise LifecycleError(f"{label}.outcome must be passed or failed") + subject = bounded_string( + result["subject_sha256"], + f"{label}.subject_sha256", + SHA256, + template=False, + ) + observed = bounded_string( + result["observed_at"], + f"{label}.observed_at", + TIMESTAMP, + template=False, + ) + evidence_label = bounded_string( + result["evidence_label"], + f"{label}.evidence_label", + EVIDENCE_LABEL, + template=False, + ) + bounded_string( + result["evidence_sha256"], + f"{label}.evidence_sha256", + SHA256, + template=False, + ) + if subject_binding is not None and subject != subject_binding: + raise LifecycleError( + f"{label}.subject_sha256 does not match its lifecycle object" + ) + return parse_timestamp(observed, f"{label}.observed_at"), evidence_label + + +def validate_evidence( + value: Any, + *, + template: bool, + subject_bindings: dict[str, str], +) -> tuple[list[dict[str, Any]], set[str], datetime | None]: + evidence = require_object(value, "evidence", set(EVIDENCE_GROUPS)) + all_results: list[dict[str, Any]] = [] + labels: set[str] = set() + previous: datetime | None = None + for group_name, required_checks in EVIDENCE_GROUPS.items(): + group = evidence[group_name] + if not isinstance(group, list): + raise LifecycleError(f"evidence.{group_name} must be an array") + if len(group) != len(required_checks): + raise LifecycleError( + f"evidence.{group_name} must contain every required check exactly once" + ) + for index, (result, check_id) in enumerate(zip(group, required_checks)): + label = f"evidence.{group_name}[{index}]" + observed, evidence_label = validate_result( + result, + label, + check_id, + template=template, + subject_binding=subject_bindings.get(check_id), + ) + if observed is not None and previous is not None and observed < previous: + raise LifecycleError( + "candidate evidence timestamps must follow lifecycle order" + ) + if observed is not None: + previous = observed + if evidence_label is not None: + if evidence_label in labels: + raise LifecycleError("candidate evidence labels must be unique") + labels.add(evidence_label) + all_results.append(result) + if [result["check_id"] for result in all_results] != list(ALL_CHECKS): + raise LifecycleError("evidence check order is not the closed lifecycle order") + return all_results, labels, previous + + +def validate_reviews( + value: Any, + *, + template: bool, + evidence_labels: set[str], + not_before: datetime | None, +) -> tuple[list[dict[str, Any]], datetime | None]: + if not isinstance(value, list) or len(value) != len(REVIEW_CLASSES): + raise LifecycleError("reviews must contain every required review exactly once") + reviewers: set[str] = set() + reviews: list[dict[str, Any]] = [] + latest_review = not_before + for index, (review_value, review_class) in enumerate(zip(value, REVIEW_CLASSES)): + label = f"reviews[{index}]" + review = require_object( + review_value, + label, + { + "review_class", + "outcome", + "independence_attested", + "reviewer_label", + "observed_at", + "evidence_label", + "evidence_sha256", + }, + ) + if review["review_class"] != review_class: + raise LifecycleError(f"{label}.review_class must be {review_class}") + if not isinstance(review["independence_attested"], bool): + raise LifecycleError(f"{label}.independence_attested must be boolean") + if template: + if review["outcome"] != "not_run" or review["independence_attested"]: + raise LifecycleError( + f"{label} must be not_run and unattested in a template" + ) + for field in ( + "reviewer_label", + "observed_at", + "evidence_label", + "evidence_sha256", + ): + if review[field] is not None: + raise LifecycleError( + f"{label}.{field} must be null in a non-evidence template" + ) + else: + if review["outcome"] not in {"passed", "failed"}: + raise LifecycleError(f"{label}.outcome must be passed or failed") + if not review["independence_attested"]: + raise LifecycleError(f"{label} must attest reviewer independence") + reviewer = bounded_string( + review["reviewer_label"], + f"{label}.reviewer_label", + REVIEWER_LABEL, + template=False, + ) + observed = bounded_string( + review["observed_at"], + f"{label}.observed_at", + TIMESTAMP, + template=False, + ) + evidence_label = bounded_string( + review["evidence_label"], + f"{label}.evidence_label", + EVIDENCE_LABEL, + template=False, + ) + bounded_string( + review["evidence_sha256"], + f"{label}.evidence_sha256", + SHA256, + template=False, + ) + reviewed_at = parse_timestamp(observed, f"{label}.observed_at") + if not_before is not None and reviewed_at < not_before: + raise LifecycleError( + "independent reviews must follow lifecycle evidence" + ) + if latest_review is None or reviewed_at > latest_review: + latest_review = reviewed_at + if reviewer in reviewers: + raise LifecycleError( + "correctness, security, maintainability, and operator " + "reviews require distinct independent reviewer labels" + ) + reviewers.add(reviewer) + if evidence_label in evidence_labels: + raise LifecycleError( + "review and lifecycle evidence labels must be unique" + ) + evidence_labels.add(evidence_label) + reviews.append(review) + return reviews, latest_review + + +def validate_limitations(value: Any) -> None: + limitations = require_object(value, "evidence_limitations", set(LIMITATIONS)) + if limitations != LIMITATIONS: + raise LifecycleError( + "evidence_limitations must preserve the non-production external boundary" + ) + + +def require_pass( + record: dict[str, Any], + results: list[dict[str, Any]], + reviews: list[dict[str, Any]], +) -> None: + if record["record_kind"] != "candidate_evidence": + raise LifecycleError("a template is preparation and never passing evidence") + if any(result["outcome"] != "passed" for result in results): + raise LifecycleError("--require-pass requires every lifecycle check to pass") + if any(review["outcome"] != "passed" for review in reviews): + raise LifecycleError("--require-pass requires every independent review to pass") + source_calls = record["activation"]["consultation_contract_mismatch"][ + "observed_source_calls" + ] + if source_calls != 0: + raise LifecycleError( + "--require-pass requires exactly zero source calls on contract mismatch" + ) + + +def validate_record( + data: Any, + *, + allow_template: bool, + require_all_passed: bool = False, + root: Path = ROOT, + candidate_asset_root: Path | None = None, + candidate_loader: Callable[..., dict[str, Any]] = load_candidate, + receipt_validator: Callable[..., dict[str, Any]] = validate_receipt, +) -> None: + record = require_object( + data, + "record", + { + "schema_version", + "record_kind", + "exercise_id", + "recorded_at", + "candidate", + "candidate_binding_sha256", + "attestations", + "product_inputs", + "product_input_set_sha256", + "activation", + "evidence", + "reviews", + "evidence_limitations", + }, + ) + reject_sensitive_sentinels(record) + validate_schema_document(record) + if record["schema_version"] != SCHEMA_VERSION: + raise LifecycleError(f"schema_version must be {SCHEMA_VERSION}") + kind = record["record_kind"] + if kind not in RECORD_KINDS: + raise LifecycleError("record_kind must be template or candidate_evidence") + template = kind == "template" + if template and not allow_template: + raise LifecycleError( + "template is preparation, not candidate evidence; pass --template to validate it" + ) + if not template and allow_template: + raise LifecycleError("--template accepts only a template record") + bounded_string( + record["exercise_id"], + "exercise_id", + EXERCISE_ID, + template=template, + ) + recorded_at_value = bounded_string( + record["recorded_at"], + "recorded_at", + TIMESTAMP, + template=template, + ) + recorded_at = ( + None if template else parse_timestamp(recorded_at_value, "recorded_at") + ) + candidate = validate_candidate(record["candidate"], template=template, root=root) + bounded_string( + record["candidate_binding_sha256"], + "candidate_binding_sha256", + SHA256, + template=template, + ) + if not template and record["candidate_binding_sha256"] != canonical_sha256( + candidate + ): + raise LifecycleError( + "candidate_binding_sha256 does not match the one exact candidate coordinate" + ) + if not template: + assert recorded_at is not None + validate_candidate_assets( + candidate, + recorded_at=recorded_at, + root=root, + candidate_asset_root=candidate_asset_root, + candidate_loader=candidate_loader, + receipt_validator=receipt_validator, + ) + validate_attestations(record["attestations"], template=template) + product_inputs = validate_product_inputs( + record["product_inputs"], + record["product_input_set_sha256"], + template=template, + ) + activation = validate_activation(record["activation"], template=template) + bindings = ( + {} + if template + else result_subject_bindings( + product_inputs, + activation, + candidate_binding_sha256=record["candidate_binding_sha256"], + product_input_set_sha256=record["product_input_set_sha256"], + ) + ) + results, evidence_labels, last_evidence_at = validate_evidence( + record["evidence"], + template=template, + subject_bindings=bindings, + ) + mismatch_result = next( + result + for result in results + if result["check_id"] == "consultation_contract_mismatch_zero_source_calls" + ) + source_calls = activation["consultation_contract_mismatch"]["observed_source_calls"] + if not template and mismatch_result["outcome"] == "passed" and source_calls != 0: + raise LifecycleError( + "a passed contract-mismatch check requires exactly zero source calls" + ) + reviews, last_review_at = validate_reviews( + record["reviews"], + template=template, + evidence_labels=evidence_labels, + not_before=last_evidence_at, + ) + if ( + recorded_at is not None + and last_review_at is not None + and recorded_at < last_review_at + ): + raise LifecycleError( + "recorded_at must not precede lifecycle evidence or independent reviews" + ) + validate_limitations(record["evidence_limitations"]) + if require_all_passed: + require_pass(record, results, reviews) + + +def discover_records( + directory: Path, + *, + root: Path = ROOT, + candidate_asset_root: Path | None = None, + candidate_loader: Callable[..., dict[str, Any]] = load_candidate, + receipt_validator: Callable[..., dict[str, Any]] = validate_receipt, +) -> tuple[int, int]: + records_directory = directory / LIFECYCLE_DIRECTORY + try: + records_directory_info = records_directory.lstat() + except OSError as error: + raise LifecycleError( + "product-input lifecycle discovery directory is unavailable" + ) from error + if stat.S_ISLNK(records_directory_info.st_mode) or not stat.S_ISDIR( + records_directory_info.st_mode + ): + raise LifecycleError( + "product-input lifecycle discovery directory must be a real directory" + ) + discovered_schema = load_closed_json_file(records_directory / SCHEMA_FILENAME) + if discovered_schema != lifecycle_schema(): + raise LifecycleError( + "discovered product-input lifecycle schema does not match the canonical schema" + ) + json_files = sorted(records_directory.glob("*.json")) + records: list[Path] = [] + for path in json_files: + if path.name == SCHEMA_FILENAME: + continue + if CANDIDATE_RECORD_FILENAME.fullmatch(path.name) is None: + raise LifecycleError( + "product-input lifecycle discovery found an unrecognized JSON filename" + ) + records.append(path) + if not records: + raise LifecycleError( + f"--discover found no product-input lifecycle records in {LIFECYCLE_DIRECTORY}" + ) + template_count = 0 + candidate_count = 0 + for path in records: + data = load_closed_json_file(path) + kind = data.get("record_kind") if isinstance(data, dict) else None + if kind == "template": + if path.name != TEMPLATE_FILENAME: + raise LifecycleError( + "product-input lifecycle templates must use the canonical filename" + ) + validate_record(data, allow_template=True, root=root) + template_count += 1 + else: + if path.name == TEMPLATE_FILENAME: + raise LifecycleError( + "the canonical template filename cannot contain candidate evidence" + ) + validate_record( + data, + allow_template=False, + require_all_passed=True, + root=root, + candidate_asset_root=candidate_asset_root, + candidate_loader=candidate_loader, + receipt_validator=receipt_validator, + ) + candidate_count += 1 + return template_count, candidate_count + + +def main() -> int: + parser = argparse.ArgumentParser(description=__doc__) + parser.add_argument("record", nargs="?", type=Path) + parser.add_argument( + "--template", + action="store_true", + help="validate a preparation template; templates never count as evidence", + ) + parser.add_argument( + "--require-pass", + action="store_true", + help="require every lifecycle check and independent review to pass", + ) + parser.add_argument( + "--discover", + type=Path, + help=( + "validate the product-input-lifecycle subdirectory; templates are " + "non-evidence and candidate records must pass completely" + ), + ) + parser.add_argument( + "--candidate-asset-root", + type=Path, + help=( + "root containing authenticated release assets and the retained " + "candidate receipt under the exact candidate version" + ), + ) + args = parser.parse_args() + try: + if args.discover is not None: + if args.record is not None or args.template or args.require_pass: + raise LifecycleError( + "--discover cannot be combined with a record, --template, or --require-pass" + ) + templates, candidates = discover_records( + args.discover, + candidate_asset_root=args.candidate_asset_root, + ) + if candidates: + print( + "product-input lifecycle discovery passed with authenticated " + f"candidate assets: {templates} template(s), {candidates} " + "candidate evidence record(s); retained evidence content " + "remains externally reviewed" + ) + else: + print( + "product-input lifecycle discovery passed: " + f"{templates} non-evidence template(s), 0 candidate evidence record(s)" + ) + return 0 + if args.record is None: + raise LifecycleError("a record path is required") + if args.template and args.candidate_asset_root is not None: + raise LifecycleError( + "--candidate-asset-root is not used when validating a template" + ) + data = load_closed_json_file(args.record) + validate_record( + data, + allow_template=args.template, + require_all_passed=args.require_pass, + candidate_asset_root=args.candidate_asset_root, + ) + except LifecycleError as error: + print(f"product-input lifecycle validation failed: {error}", file=sys.stderr) + return 1 + except OSError: + print( + "product-input lifecycle validation failed: operation could not be completed safely", + file=sys.stderr, + ) + return 1 + if args.template: + print("product-input lifecycle template preparation validation passed") + else: + print( + "product-input lifecycle candidate evidence validation passed with " + "authenticated candidate assets; retained evidence content remains " + "externally reviewed" + ) + return 0 + + +if __name__ == "__main__": + raise SystemExit(main()) diff --git a/release/scripts/validate-upgrade-exercise.py b/release/scripts/validate-upgrade-exercise.py index b0a8397bf..d7fa10445 100644 --- a/release/scripts/validate-upgrade-exercise.py +++ b/release/scripts/validate-upgrade-exercise.py @@ -72,8 +72,15 @@ "complete_restore", "restored_products_ready", "anti_rollback_rejects_older_bundle", + "materialization_exact_restart_zero_source_calls", + "materialization_missing_cache_fail_closed", + "materialization_mismatched_cache_fail_closed", + "materialization_pointer_mutation_rejected", + "materialization_stale_or_live_fallback_rejected", ) REQUIRED_RECOVERY_ITEMS = ( + "relay_source_inputs", + "relay_ingest_cache", "relay_database", "notary_database", "config_and_bundle", @@ -147,6 +154,18 @@ def canonical_sha256(value: Any) -> str: return sha256_bytes(json.dumps(value, sort_keys=True, separators=(",", ":")).encode()) +def materialization_recovery_binding_sha256(value: dict[str, Any]) -> str: + return canonical_sha256( + {key: item for key, item in value.items() if key != "binding_sha256"} + ) + + +def record_binding_sha256(value: dict[str, Any]) -> str: + return canonical_sha256( + {key: item for key, item in value.items() if key != "record_binding_sha256"} + ) + + def git_bytes(root: Path, commit: str, path: Path) -> bytes: result = subprocess.run( ["git", "show", f"{commit}:{path.as_posix()}"], @@ -367,6 +386,74 @@ def validate_recovery_set(value: Any, *, template: bool) -> None: ) +def validate_materialization_recovery( + value: Any, + record: dict[str, Any], + *, + template: bool, +) -> None: + fields = { + "source_inputs_sha256", + "ingest_cache_sha256", + "relay_database_sha256", + "coordinated_recovery_point_sha256", + "active_publication_tuple_sha256", + "target_release_sha256", + "relay_config_schema_sha256", + "relay_role_bootstrap_identity_sha256", + "recovery_metadata_sha256", + "audit_watermark_sha256", + "binding_sha256", + } + recovery = require_object(value, "materialization_recovery", fields) + for field in fields: + bounded_string( + recovery[field], + f"materialization_recovery.{field}", + SHA256, + template=template, + ) + if template: + return + + items = { + item["item"]: item["artifact_sha256"] for item in record["recovery_set"] + } + expected_artifacts = { + "source_inputs_sha256": items["relay_source_inputs"], + "ingest_cache_sha256": items["relay_ingest_cache"], + "relay_database_sha256": items["relay_database"], + } + for field, expected in expected_artifacts.items(): + if sha256_hex(recovery[field]) != sha256_hex(expected): + raise ExerciseError( + f"materialization_recovery.{field} does not match recovery_set" + ) + + expected_release = canonical_sha256(record["target_release"]) + if sha256_hex(recovery["target_release_sha256"]) != sha256_hex( + expected_release + ): + raise ExerciseError( + "materialization_recovery.target_release_sha256 does not " + "match the exact target release" + ) + expected_schema = record["config_schemas"]["registry-relay"]["sha256"] + if sha256_hex(recovery["relay_config_schema_sha256"]) != sha256_hex( + expected_schema + ): + raise ExerciseError( + "materialization_recovery.relay_config_schema_sha256 does not " + "match the exact target schema" + ) + expected_binding = materialization_recovery_binding_sha256(recovery) + if sha256_hex(recovery["binding_sha256"]) != sha256_hex(expected_binding): + raise ExerciseError( + "materialization_recovery.binding_sha256 does not bind the closed " + "recovery coordinate" + ) + + def validate_results(value: Any, *, template: bool) -> None: if not isinstance(value, list): raise ExerciseError("results must be a list") @@ -385,7 +472,7 @@ def validate_results(value: Any, *, template: bool) -> None: outcome = result["outcome"] if outcome not in {"passed", "failed", "not_run"} or template and outcome != "not_run": raise ExerciseError(f"results[{index}].outcome is invalid for this record kind") - if not template and outcome == "not_run": + if outcome == "not_run": if any(result[field] is not None for field in ( "observed_at", "evidence_label", "evidence_sha256" )): @@ -630,7 +717,9 @@ def validate_record( "candidate_artifact_set", "topology", "recovery_set", + "materialization_recovery", "results", + "record_binding_sha256", }, ) if record["schema"] != SCHEMA: @@ -671,10 +760,27 @@ def validate_record( validate_artifact_set(record["candidate_artifact_set"], record, template=template) validate_topology(record["topology"], template=template) validate_recovery_set(record["recovery_set"], template=template) + validate_materialization_recovery( + record["materialization_recovery"], + record, + template=template, + ) validate_results(record["results"], template=template) + bounded_string( + record["record_binding_sha256"], + "record_binding_sha256", + SHA256, + template=template, + ) if not template: validate_target_binding(record, root) validate_release_asset_bindings(record, root, candidate_asset_root) + if sha256_hex(record["record_binding_sha256"]) != sha256_hex( + record_binding_sha256(record) + ): + raise ExerciseError( + "record_binding_sha256 does not bind the exact upgrade exercise record" + ) if require_all_passed: require_pass(record)